diff --git a/.claude/agents/BOOT.md b/.claude/agents/BOOT.md
index 3e352e67b..4773cc0fa 100644
--- a/.claude/agents/BOOT.md
+++ b/.claude/agents/BOOT.md
@@ -207,6 +207,7 @@ documents listed in its trigger row BEFORE producing output.
 | **Quality lifecycle — DURING-IMPL: "two crates need to talk" / "DTO field shape change" / "renamed in PR #X" / lib.rs/mod.rs touch / new REST endpoint / sprint↔sprint handover / cross-repo dep** | **baton-handoff-auditor** (PP-15, boundary mismatch hunter) | baton-handoff-anti-patterns.md, iron-rules-doctrine.md, lab-vs-canonical-surface.md |
 | **Quality lifecycle — POST-IMPL: "ready for codex review" / "pre-merge sanity check" / clippy/audit/deny/kani/loom gate / unsafe without `// SAFETY:` / v1-API-under-v2-feature alias** | **brutally-honest-tester** (PP-13, codex-class within-crate bug hunter) | codex-p1-anti-patterns.md, iron-rules-doctrine.md |
 | **Quality lifecycle — CROSS-CUTTING (PRE-SPAWN + DURING-IMPL + PRE-MERGE): "_mm*" or "vld1q_*" or "is_x86_feature_detected" in a consumer crate / arch-specific cfg outside `ndarray/src/simd_*` / hand-rolled SIMD-feature dispatch / SIMD primitive missing from polyfill / duplicated SIMD wrapper / SIMD-induced UB or OOB** | **simd-savant** (5th-slot, ndarray::simd polyfill keeper — all SIMD via `simd.rs` + `simd_ops.rs` > `simd_{type}.rs`) | autoattended-multiagent-pattern.md §14 |
+| **Dependency architecture — ndarray coordinate / `[patch]` / `[workspace.dependencies]` / relative cross-repo `path = "../../../ndarray"` / `optional = true` on a compute crate / "multiple ndarray identities" / a domain-local and/or/xor algebra beside the substrate / "one binary" reasoning applied to crate count** | **cargo-substrate-architect** (dependency graph ONLY — never carriers, never reasoning code, never deletes a duplicate algebra before differential parity) | CARGO-COMPUTE-SUBSTRATE.md |
 
 **The insight update cycle:**
 
diff --git a/.claude/agents/cargo-substrate-architect.md b/.claude/agents/cargo-substrate-architect.md
new file mode 100644
index 000000000..8c9d2b8ec
--- /dev/null
+++ b/.claude/agents/cargo-substrate-architect.md
@@ -0,0 +1,197 @@
+---
+name: cargo-substrate-architect
+description: >
+  Dependency architecture only. Holds the CARGO COMPUTE SUBSTRATE LAW —
+  one ndarray, one package identity, one binary, no parallel compute
+  substrate. Use BEFORE adding/moving/pinning/feature-gating any
+  `ndarray` dependency in ANY fleet repo, before writing a `[patch]`,
+  a `[workspace.dependencies]` entry, or a relative cross-repo path
+  dep, and to run the fleet unification wave. It does NOT design
+  carriers, does NOT touch reasoning code, and does NOT delete a
+  duplicate algebra before differential parity.
+tools: Read, Glob, Grep, Bash
+model: sonnet
+---
+
+You are the CARGO_SUBSTRATE_ARCHITECT. Your mission is **boring
+infrastructure** and is stated in one line:
+
+> one ndarray, one package identity, one binary, no parallel compute substrate.
+
+You are not here to discover architecture. You are here to make the dependency
+graph say what the architecture already decided.
+
+## MANDATORY FIRST READ
+
+`.claude/knowledge/CARGO-COMPUTE-SUBSTRATE.md` — the ten-rule law, the
+measured 2026-09-20 fleet inventory, the `[patch]` limit, and the anti-pattern
+table. Do not restate it; apply it. If your finding contradicts a measurement
+in §2 of that doc, **re-run the command** before writing anything: its numbers
+carry the command that produced them precisely so you can falsify them.
+
+## HARD SCOPE FENCE — read this before the wave
+
+You change **dependency coordinates, features, workspace tables and patches**.
+You do not change:
+
+- what `CallMask`, `CE64`, `Moore128`, `AlphaMask`, or any R2IL/OGAR type MEANS;
+- any reasoning, masking, fold, or semantic implementation;
+- any carrier's layout, width, or field set;
+- toolchain pins (see the MSRV trap below).
+
+A session that unifies `ndarray` AND redesigns a carrier has produced a diff
+nobody can review. If a dependency change appears to require a semantic
+change, **STOP and report it** — that is a finding for the operator, not work
+for you.
+
+## The wave, in order
+
+### 1. Inventory — measure, never read by eye
+
+```bash
+for r in <fleet repos>; do
+  grep -rhnE '^[[:space:]]*ndarray[[:space:]]*=' --include=Cargo.toml "$r"
+done
+```
+
+Record for every site: `path` / `git` / `registry` / `workspace = true`, the
+rev or branch, `optional`, and the feature list. Group by coordinate SHAPE, and
+count distinct PATH DEPTHS separately — depth variety is what makes the
+sibling-directory assumption fragile.
+
+### 2. Establish whether a duplicate identity exists TODAY
+
+Per-binary, not per-repo:
+
+```bash
+cargo metadata --format-version 1 | \
+  python3 -c "import json,sys;p=[x['id'] for x in json.load(sys.stdin)['packages'] if x['name']=='ndarray'];print(len(p),p)"
+cargo tree -d | grep -A3 ndarray
+```
+
+**A single identity may be an accident of exclusion.** In lance-graph today the
+two git-coordinate crates are workspace-EXCLUDED; promote either to a member
+and the graph carries two. Report the accident as an accident.
+
+### 3. Pick the canonical coordinate and declare it once
+
+Per workspace root:
+
+```toml
+[workspace.dependencies]
+ndarray = { git = "<canonical>", rev = "<pinned>", default-features = false, features = ["std"] }
+```
+
+Members become `ndarray = { workspace = true, features = [...] }`.
+
+### 4. Retire relative cross-repo paths
+
+`ndarray = { path = "../../../ndarray" }` is forbidden as a DURABLE contract
+(rule 5), for one mechanical reason you must be able to state: **a `[patch]`
+rewrites a source, not a dependency declaration**, so a literal `path =` is the
+one form nothing can centrally redirect.
+
+Local crate paths INSIDE a single workspace stay. They are not cross-repo.
+
+### 5. Enable local development
+
+At the top-level consumer only:
+
+```toml
+[patch."<canonical ndarray source>"]
+ndarray = { path = "../ndarray" }
+```
+
+Note the section name matters: `[patch.crates-io]` redirects the upstream
+registry crate and **cannot** redirect an AdaWorldAPI git URL. lance-graph
+already has the crates-io form for exactly the upstream-fork case; do not
+mistake it for git unification.
+
+### 6. Remove `optional = true` where the contract is compute
+
+Rule 6. A crate whose contract is compute execution has no meaningful
+substrate-less build. Build the compute-contract list explicitly and put each
+crate on it with a reason; do not infer membership from the crate's name.
+
+### 7. Inventory duplicate Boolean/SIMD algebras — DO NOT DELETE
+
+Record every domain-local `and`/`or`/`xor`/`not`/`count`/`popcount` or raw
+intrinsic implementation. For each, the order is fixed:
+
+```text
+differential parity FIRST  ->  then ownership  ->  then migration
+```
+
+A duplicate not yet proven bit-identical is a FINDING, never a deletion. The
+worked precedent is `crates/r2il-mask-abi-probe` (CallMask vs mask-risc, 6/6,
+every test disable-verified, ownership deliberately left open).
+
+### 8. Prove one identity per final binary
+
+`cargo metadata` + `cargo tree -d` on each representative consumer, and state
+the number. "Should be one" is not a measurement.
+
+### 9. Link the representative final binaries
+
+Quack, R2IL/OGAR, the Java ABI, the Odoo PoC — a full `cargo build --release`,
+not a `cargo check`. A resolve proves the graph; only a link proves rule 8.
+
+### 10. Leave a CI guard behind, then stop
+
+This is the step that makes you unnecessary. Ship a script that FAILS on:
+
+```text
+multiple ndarray package identities in one resolve
+ndarray optional in a mandatory-compute crate
+a forbidden direct SIMD implementation
+a forbidden cross-repo ../../../ndarray dependency
+```
+
+**Every check needs a disable run** — introduce the violation, watch it go red,
+restore — before you claim it guards anything. A guard that cannot fail is
+decoration, and this workspace has shipped that mistake before.
+
+## Traps, each measured
+
+**The MSRV coupling.** ndarray master requires Rust 1.98. Measured
+2026-09-20: `tesseract-rs` pins 1.97.1, `odoo-rs` 1.95, `ladybug-rs` 1.94.0,
+and two of those path-dep ndarray directly. **One canonical source means one
+MSRV floor for every consumer.** Do not bump three toolchains as a side effect
+of a dependency pass — that is
+`ISS-NDARRAY-CANONICAL-COORDINATE-COUPLES-FLEET-MSRV` and it is the operator's
+call.
+
+**A documented reason can be stale.** lance-graph's `[patch.crates-io]` comment
+blamed a `burn` SUBMODULE with an unfetchable gitlink. Measured: no gitlink, no
+`.gitmodules`; `burn` is an in-tree member whose OWN git deps are out of scope,
+and a git coordinate for `ndarray` resolves clean anyway (exit 0, 10 packages,
+no 403). **Before you accept a recorded blocker, run the command that would
+falsify it.**
+
+**The `.git` suffix is not a second identity.** Cargo canonicalizes git URLs
+and strips a trailing `.git`. Do not count it, do not "fix" it.
+
+**One binary is not one crate.** If your conclusion is "merge these crates",
+you have confused a link property with a module boundary. Report and stop.
+
+## Verdicts
+
+Return one per site, never prose:
+
+- **CANONICAL** — uses the one coordinate, correct features, not optional
+  where the contract forbids it.
+- **REDIRECTABLE** — wrong coordinate but on a patchable source; name the
+  one-line change.
+- **PATH-LOCKED** — a literal relative cross-repo `path =`; no `[patch]` can
+  reach it, so it needs the one-time move onto a patchable coordinate.
+- **DUPLICATE-IDENTITY** — two ndarray package ids reach one binary; name both
+  ids and the crate that introduces the second.
+- **PARALLEL-ALGEBRA** — a domain-local compute algebra beside the substrate;
+  name it, name whether a differential exists, and **do not touch it**.
+- **OUT-OF-SCOPE** — a semantic change is required; stop and report.
+
+## Closing rule
+
+After you run, nobody should have to remember the law. If the answer to
+"what stops this regressing?" is "an agent notices", you have not finished
+step 10.
diff --git a/.claude/board/FINDINGS-BASELINE-2026-09-20.md b/.claude/board/FINDINGS-BASELINE-2026-09-20.md
new file mode 100644
index 000000000..fe5a4a3cc
--- /dev/null
+++ b/.claude/board/FINDINGS-BASELINE-2026-09-20.md
@@ -0,0 +1,471 @@
+# Findings baseline — 181bb2c28005 (`EPIPHANIES.md`, post-2026-08-06 entries)
+
+> **What this is.** The ONE historical catch-up over the findings that went
+> into the `EPIPHANIES.md` monolith after the 2026-08-06 split watermark.
+> It is a consolidated current-state checkpoint — a **k-frame**. After it,
+> routine closeout is DELTA ONLY and never censuses the monolith again.
+> Like `PLAN-INVENTORY-2026-09-07.md` it mints **no D-ids**, so
+> `supersession_index.py` and `plan_dids.py` do not see it — by design.
+> A FROZEN snapshot, not a live artifact: the classifier that produced it
+> was the instrument for this one historical pass and is retired. Git holds
+> it at `2374b1d` if the measurement ever needs reproducing.
+>
+> **The historical prose is FROZEN, not reconciled away.** `EPIPHANIES.md`
+> is untouched: nothing was migrated, re-split, deleted or rewritten, and
+> no entry files were created for these findings. Frozen means *not reread
+> by routine closeout*; it does NOT mean adjudicated — 228 of 306 were not.
+>
+> **PROCESSED_THROUGH_SHA = `181bb2c28005c185a967edd61367008c6722eb5c`** — every eligible finding visible
+> through that source revision is consumed into this baseline. The marker
+> names the CONSUMED INPUT, never this file's own commit: a commit cannot
+> contain its own hash. Machine-readable: `.claude/board/PROCESSED_THROUGH`.
+
+---
+
+## 0. The numbers
+
+| | count |
+|---|---|
+| population (level-2 post-watermark entries with an E-id) | **306** |
+| OPEN | 39 |
+| CLOSED | 34 |
+| SUPERSEDED | 5 |
+| AMBIGUOUS | 228 |
+
+Excluded and counted so the exclusion is visible, not asserted: **3**
+level-2 bare date-group headers (no E-id) and **3** level-3
+sub-headings (sections *inside* an entry). 306 + 3 + 3 =
+312 dated headings at or after the watermark.
+
+### Mechanical reachability — the union of join keys
+
+A first estimate put the ceiling at 198 by taking `306 − 108 without a D-id
+or PR`. That was wrong: the E-id → board joins are **independent keys** and
+most of them land inside that 108.
+
+| join key | entries | answers |
+|---|---|---|
+| `eid_board` | 192 | named on a board surface — provenance |
+| `did_statusboard` | 101 | a referenced D-id has a STATUS_BOARD row — deliverable status |
+| `pr` | 128 | a PR is referenced — landing evidence ONLY |
+| `cite_live` | 48 | a cited path still exists — implementation reality |
+| `did_unknown` | 12 | referenced D-id has NO status-bearing board row — dangling |
+| `cite_dead` | 8 | cited path is GONE — stale citation |
+
+**278** entries carry ≥ 1 usable key; **27** carry none and are
+therefore automatically AMBIGUOUS. The other 201 ambiguous rows are
+ambiguous for a different and more interesting reason — §1.
+
+## 1. Why AMBIGUOUS is the largest bucket
+
+**303 of the 306 entries carry their own `Status:` line, and 295 of those lead
+with an EPISTEMIC GRADE rather than a work status:**
+
+| leading token | entries |
+|---|---|
+| `FINDING` | 204 |
+| `RULING` | 31 |
+| `OPERATOR` | 15 |
+| `CORRECTION` | 11 |
+| `MEASURED` | 6 |
+| `OPERATOR-RULED` | 5 |
+| `⊘` | 5 |
+| `SHIPPED` | 4 |
+| `PROPOSAL` | 4 |
+| `FENCE` | 2 |
+
+`FINDING`, `RULING`, `CORRECTION`, `MEASURED` answer *how well established
+is this claim*. They do not answer *is the work done*. Only **8** entries
+lead with a work-shaped token.
+
+That is the substantive result: **post-watermark `EPIPHANIES.md` was being
+used as a findings log, not a deliverable tracker.** For most rows
+OPEN/CLOSED is the wrong axis — the live question is *is this still true?*,
+which no join answers mechanically. Reading their prose to manufacture a
+status is what this pass was told not to do, so they stay AMBIGUOUS with
+their grade recorded.
+
+Not a comparable number: `PLAN-INVENTORY-2026-09-07.md` reached 40/211
+ambiguous **with a human read of every status line in context**, and records
+that naive substring matching produced ≥ 6 false positives in its corpus.
+This pass is mechanical-only by instruction; the larger residue is the price
+of that, not a worse measurement.
+
+## 2. How to read a verdict
+
+Vocabulary reused from `PLAN-INVENTORY`; nothing new minted. Each join
+answers only the question it can answer:
+
+| evidence | role | may decide status? |
+|---|---|---|
+| STATUS_BOARD D-id row | deliverable status | **yes** |
+| ISSUES section | unresolved / resolved | **yes** |
+| TECH_DEBT section | implementation debt | **yes** (OPEN) |
+| the entry's own status line | only if its leading token is work-shaped | **yes** |
+| INTEGRATION_PLANS | integration ownership | no — context |
+| PR state | landing evidence | **no — MERGED ≠ CLOSED** |
+| live code citation | implementation reality | no |
+| `entries/`, `LATEST_STATE` mention | provenance | no |
+
+Conflicting decisive evidence ⇒ **AMBIGUOUS** (23 rows), never averaged
+into certainty. Absent decisive evidence ⇒ **AMBIGUOUS** (178 joined rows +
+27 unjoinable). The *implementation* column carries landing and
+code-liveness facts precisely so they cannot be mistaken for closure.
+
+Three traps the tool encodes, each measured: STATUS_BOARD's status column
+is **per-table** (28 schemas, index 1..6, absent in two); a `Status:` line's
+**leading token only** is read; and cross-supersession needs **directional**
+phrasing, because a bare `⊘`-proximity rule read `caveat (⊘ in E-FOO-1)` —
+a sibling citing this entry's caveat — as the sibling superseding it.
+
+## 3. The rows
+
+### OPEN (39)
+
+| source id | status | implementation | outcome/open point |
+|---|---|---|---|
+| `E-THE-GOLDEN-STEP-IS-THE-WRONG-STEP-AT-SMALL-Q-1` | OPEN | PR #932 merged | live ISSUES entry |
+| `E-A-TOTAL-FUNCTION-THAT-CANNOT-REFUSE-IS-A-CORRUPTION-PATH-1` | OPEN | PR #948 merged | STATUS_BOARD row not done |
+| `E-CONTRACT-INFERENCETYPE-INVERTS-THE-COUNTERFACTUAL-1` | OPEN | no implementation evidence | STATUS_BOARD row not done |
+| `E-CAPABILITY-IS-NOT-REACHABILITY-1` | OPEN | PR #971 merged | live TECH_DEBT entry |
+| `E-THE-FILTER-WAS-FILTERING-ON-THE-WRONG-PREDICATE-1` | OPEN | PR #971 merged | live TECH_DEBT entry |
+| `E-THE-RECIPE-SURFACE-IS-CAUSALLY-BLIND-1` | OPEN | no implementation evidence | live TECH_DEBT entry |
+| `E-A-DOC-COMMENT-CAN-GIVE-THE-WRONG-REASON-FOR-A-CORRECT-GUARD-1` | OPEN | no implementation evidence | live TECH_DEBT entry |
+| `E-A-CORRECTION-CAN-SUBSTITUTE-ONE-WRONG-NOUN-FOR-ANOTHER-1` | OPEN | PR #1112 merged | STATUS_BOARD row not done |
+| `E-ONLY-TWO-OF-FOUR-STANCES-MAY-CUT-A-CANDIDATE-SET-1` | OPEN | no implementation evidence | STATUS_BOARD row not done |
+| `E-BLW5-FIRST-MEASUREMENT-1` | OPEN | 1 cited path(s) live | STATUS_BOARD row not done |
+| `E-EVERYTHING-WIRES-TO-SOA-V3-CE64-IS-ALU-LEGACY-1` | OPEN | no implementation evidence | STATUS_BOARD row not done |
+| `E-NXG-10` | OPEN | no implementation evidence | STATUS_BOARD row not done |
+| `E-NXG-11` | OPEN | PR #1160 merged | STATUS_BOARD row not done |
+| `E-NXG-16` | OPEN | no implementation evidence | STATUS_BOARD row not done; live TECH_DEBT entry |
+| `E-NXG-5` | OPEN | no implementation evidence | STATUS_BOARD row not done; own status line: PROPOSAL |
+| `E-NXG-6` | OPEN | no implementation evidence | STATUS_BOARD row not done; own status line: PROPOSAL |
+| `E-NXG-9` | OPEN | PR #1153, #1154 merged | own status line: PROPOSAL |
+| `E-AN-EXCLUDED-CRATE-ON-AN-X86-ONLY-FLEET-IS-CODE-NO-CI-HAS-EVER-COMPILED-1` | OPEN | PR #146, #844, #1194 +2 merged; 1 cited path(s) live | live ISSUES entry |
+| `E-A-CONSUMER-THAT-OPENS-A-DATASET-HAS-ALREADY-LOST-1` | OPEN | PR #879, #911, #912 merged | STATUS_BOARD row not done |
+| `E-A-DYNAMIC-DOMAIN-MASK-IS-A-SECOND-WITNESS-AND-ITS-ALIGNMENT-IS-CALIBRATION-1` | OPEN | no implementation evidence | STATUS_BOARD row not done |
+| `E-LANCE-GRAPH-OWNS-THE-AGNOSTIC-THINKING-CONSUMERS-BIND-DOMAIN-1` | OPEN | PR #1220 merged | STATUS_BOARD row not done |
+| `E-SPOG-IS-FOUNDRY-WITH-AN-ABI-SHAPED-SUBSTRATE-1` | OPEN | 1 PR ref(s), state not cached | STATUS_BOARD row not done |
+| `E-T1-HAS-TWO-SIBLING-ALGEBRAS-THE-AXIS-IS-SYNTAX-VS-EXECUTION-1` | OPEN | no implementation evidence | STATUS_BOARD row not done |
+| `E-TOPOLOGY-MASKS-MAGNITUDE-COMPOSE-NEVER-COLLAPSE-1` | OPEN | PR #1220 merged | STATUS_BOARD row not done |
+| `E-A-CHECK-THAT-CANNOT-RUN-IS-INDISTINGUISHABLE-FROM-A-CHECK-THAT-PASSES-1` | OPEN | PR #1190, #1235 merged | live ISSUES entry |
+| `E-POPCOUNT-FINDS-ELEPHANT-WHALE-BECAUSE-IT-IS-POSITION-BLIND-THE-TREES-METRIC-IS-LZCNT-AND-THE-BOARD-ALREADY-FILED-IT-1` | OPEN | no implementation evidence | STATUS_BOARD row not done; live ISSUES entry |
+| `E-POPCOUNTS-UPPER-RANGE-SIMILARITY-IS-THE-HEXAGONS-RAUMGEWINN-AND-BOARD-GAMES-MAKE-IT-FALSIFIABLE-1` | OPEN | no implementation evidence | STATUS_BOARD row not done |
+| `E-RAUMGEWINN-NEEDS-A-HORIZON-SMALLER-THAN-THE-BOARD-TIC-TAC-TOE-HAS-NONE-SO-ARM-1-IS-F0-DEGENERATE-NOT-A-KILL-1` | OPEN | 3 cited path(s) live | STATUS_BOARD row not done |
+| `E-THE-ACCUMULATOR-GATE-OUTRANKED-THE-PLANE-AND-SILENTLY-DROPPED-IT-1` | OPEN | PR #1235 merged | live ISSUES entry |
+| `E-THE-NET-ARM-RANKED-ON-A-PARTIAL-SUM-AND-ITS-ONLY-APPARENT-SIGNAL-WAS-THAT-BUG-1` | OPEN | 2 cited path(s) live | STATUS_BOARD row not done |
+| `E-THREE-CARRIERS-THREE-FOLDS-1` | OPEN | PR #1244 merged; 1 cited path(s) live | live ISSUES entry |
+| `E-A-MASK-EXPRESSION-DOES-NOT-IMPLY-A-BITMAP-1` | OPEN | no implementation evidence | STATUS_BOARD row not done |
+| `E-A-VARNODE-IS-NOT-A-BUFFER-R2IL-IS-MICROCODE-FOR-MASKED-THINKING-1` | OPEN | no implementation evidence | live ISSUES entry |
+| `E-DO-NOT-BACK-DATE-A-NEW-LAW-ONTO-AN-OLD-DOCTRINE-1` | OPEN | no implementation evidence | live ISSUES entry |
+| `E-FOLD-AND-MASK-ARE-SIBLING-PHYSICAL-PLANS-1` | OPEN | no implementation evidence | STATUS_BOARD row not done |
+| `E-LAYER-0-IS-T1-AND-MASK-RISC-IS-ALREADY-ITS-ISA-1` | OPEN | no implementation evidence | STATUS_BOARD row not done |
+| `E-THE-CENTER-IS-SPOG-PLUS-FC-EVERYTHING-ELSE-IS-CAST-1` | OPEN | no implementation evidence | STATUS_BOARD row not done |
+| `E-THREE-CONVERGENCES-TARSKI-SHANNON-JC-AND-THE-BAND-IS-A-SANDBOX-1` | OPEN | 1 referenced PR(s) closed unmerged; 1 cited path(s) live | STATUS_BOARD row not done |
+| `E-WE-THINK-WITH-OGAR-GRAPHS-OGAR-DOES-NOT-DO-THE-THINKING-1` | OPEN | no implementation evidence | live ISSUES entry |
+
+### CLOSED (34)
+
+| source id | status | implementation | outcome/open point |
+|---|---|---|---|
+| `E-A-HORSE-RACE-IS-NOT-A-CROSS-SWAP-1` | CLOSED | PR #927, #928, #930 +2 merged | STATUS_BOARD row done |
+| `E-THE-HYPOTHESIS-REFUTED-CLEANLY-AND-REVERSED-1` | CLOSED | no implementation evidence | STATUS_BOARD row done |
+| `E-THE-METRIC-THAT-SEPARATES-ONE-COMPARISON-IS-BLIND-TO-ANOTHER-1` | CLOSED | PR #926 merged | STATUS_BOARD row done |
+| `E-PIN-LANCE9-LANCEDB033-DF541-ARROW58-NO-DF53-1` | CLOSED | PR #879, #911, #912 +1 merged | ISSUES entry resolved |
+| `E-ATTENTION-MASK-IS-A-RENAME-REGISTER-FILE-NOT-A-RESIDUE-CARRIER-1` | CLOSED | no implementation evidence | STATUS_BOARD row done |
+| `E-FROM-V1-DROPS-PROVENANCE-AND-THE-COUNCIL-CAUGHT-THE-CONTRACT-ABOUT-TO-TRUST-IT-1` | CLOSED | no implementation evidence | STATUS_BOARD row done |
+| `E-THE-ATTENTION-ATOM-WAS-ALREADY-SHIPPED-WHAT-WAS-MISSING-WAS-A-COMPOSITION-THAT-IS-NOT-OR-1` | CLOSED | no implementation evidence | STATUS_BOARD row done |
+| `E-A-DOC-PRECEDENCE-CLAIM-CAN-PASS-EIGHT-GREEN-TESTS-1` | CLOSED | no implementation evidence | STATUS_BOARD row done |
+| `E-TWO-KEY-ELEVATION-WINDOW-IS-NARROW-AND-THE-CORPUS-STRADDLES-IT-1` | CLOSED | PR #997, #998 merged | STATUS_BOARD row done |
+| `E-THE-FUSED-PAYLOAD-IS-INERT-AT-EVERY-EXECUTION-GATE-THAT-CONSUMES-IT-1` | CLOSED | PR #1045 merged | STATUS_BOARD row done |
+| `E-BELIEF-ARENA-DEDUP-IS-PAYABLE-AND-W0-MUST-CITE-IT-1` | CLOSED | PR #1078 merged; 1 referenced PR(s) closed unmerged | STATUS_BOARD row done |
+| `E-THE-ORACLE-WAS-CITED-AS-A-PHILOSOPHY-AND-NEVER-AS-A-METHOD-1` | CLOSED | no implementation evidence | STATUS_BOARD row done |
+| `E-A-DETERMINISM-GATE-IS-TRIVIALLY-SATISFIED-BY-A-KERNEL-THAT-DOES-NOTHING-1` | CLOSED | no implementation evidence | STATUS_BOARD row done |
+| `E-A-WITNESS-THAT-DROPS-THE-RELATION-IS-NOT-A-WITNESS-1` | CLOSED | PR #1120 merged | STATUS_BOARD row done |
+| `E-EVERY-DEFECT-IN-A-MEASUREMENT-WAS-IN-ITS-FIXTURE-NOT-ITS-CODE-1` | CLOSED | PR #1118 merged | STATUS_BOARD row done |
+| `E-PILLAR-11-GREEN-FOR-LATTICE-WALKS-LENGTH-PARAMETERIZED-1` | CLOSED | PR #1129, #1133 merged | own status line: SHIPPED |
+| `E-QUALIA-IS-RANK-INERT-AT-THE-FRONTIER-AND-POPULATION-LOSES-TO-COUNTING-1` | CLOSED | no implementation evidence | STATUS_BOARD row done |
+| `E-THE-CALIBRATION-GATE-REVERSED-THE-DECLARED-FLOOR-1` | CLOSED | 1 cited path(s) live | STATUS_BOARD row done |
+| `E-A-DOCUMENTED-MODULE-THAT-WAS-NEVER` | CLOSED | 3 cited path(s) live | own status line: SHIPPED |
+| `E-A-PRODUCER-IS-A-PURE-FUNCTION-OF-THE-CONTENT-LOCI-1` | CLOSED | no implementation evidence | STATUS_BOARD row done; own status line: SHIPPED |
+| `E-THE-VACANCY-RULE-IS-NOT-ABOUT-ENTROPY-1` | CLOSED | no implementation evidence | STATUS_BOARD row done |
+| `E-TWO-FATE-PROBES-KILL-DIFFERENT-WAYS-1` | CLOSED | PR #1144 merged | STATUS_BOARD row done |
+| `E-A-SWEEP-IS-COMPLETE-ONLY-WITHIN-THE-TARGET-KINDS-ITS-GATE-COMPILES-1` | CLOSED | PR #1194 merged | TECH_DEBT entry resolved |
+| `E-NXG-18` | CLOSED | no implementation evidence | STATUS_BOARD row done |
+| `E-NXG-2` | CLOSED | no implementation evidence | STATUS_BOARD row done |
+| `E-NXG-21` | CLOSED | 1 cited path(s) live | STATUS_BOARD row done; own status line: SHIPPED |
+| `E-NXG-22` | CLOSED | no implementation evidence | STATUS_BOARD row done |
+| `E-SEVEN-HARVEST-SOURCES-ONE-OBJECT-THE-VERSION-KEYED-MASK-SET-1` | CLOSED | PR #1218 merged; 1 referenced PR(s) closed unmerged; 1 cited path(s) live | STATUS_BOARD row done |
+| `E-A-FLOOR-PASSED-AT-ITS-BOUND-IS-A-DEAD-FIXTURE-1` | CLOSED | no implementation evidence | STATUS_BOARD row done |
+| `E-THE-VOCABULARY-IS-THE-RECOGNITION-ORGAN-THE-LAW-IS-THE-TRANSFER-ORGAN-1` | CLOSED | no implementation evidence | STATUS_BOARD row done |
+| `E-256-BY-256-IS-EXACTLY-64K-THE-RAILS-SKIP-UNIT-IS-ITS-HI-BYTE-AND-A-QUARTER-BLOCK-IS-A-REMAINDER-1` | CLOSED | 1 cited path(s) live | STATUS_BOARD row done |
+| `E-A-SPREAD-WITHOUT-A-SURROUND-IS-A-BLUR-INHIBITION-IS-THE-FREE-HALF-1` | CLOSED | no implementation evidence | STATUS_BOARD row done |
+| `E-I-GRAFTED-HELIX-ONTO-HEXAGON-AND-THEN-DEPRECATED-THE-OPERATORS-TENANTS-ON-MY-OWN-AUTHORITY-1` | CLOSED | PR #1233 merged; 5 cited path(s) live | STATUS_BOARD row done |
+| `E-THE-TWO-FAMILY-NAMINGS-INVERT-AND-FROM-BE-BYTES-IS-THE-PLAUSIBLE-WRONG-JOIN-1` | CLOSED | no implementation evidence | ISSUES entry resolved |
+
+### SUPERSEDED (5)
+
+| source id | status | implementation | outcome/open point |
+|---|---|---|---|
+| `E-A7A-IS-THE-NAME-NOT-LITERALLY-DUMB-1` | SUPERSEDED | no implementation evidence | own heading/status ⊘ note |
+| `E-A-WATCHER-THAT-CANNOT-DISSENT-IS-NOT-A-WATCHER-1` | SUPERSEDED | no implementation evidence | own heading/status ⊘ note |
+| `E-THE-COVERAGE-FIX-IS-REAL-AND-ASYMMETRIC-1` | SUPERSEDED | no implementation evidence | own heading/status ⊘ note |
+| `E-A-CRATE-WITH-ZERO-CONSUMERS-IS-BUILT-BY-NOTHING-AND-CAN-BE-MERGED-BROKEN-1` | SUPERSEDED | PR #957, #981 merged | own heading/status ⊘ note |
+| `E-THE-RUNG-LADDER-HAS-A-STORAGE-DESIGN-AND-NO-WRITER-1` | SUPERSEDED | no implementation evidence | own heading/status ⊘ note |
+
+### AMBIGUOUS (228)
+
+| source id | status | implementation | outcome/open point |
+|---|---|---|---|
+| `E-THREE-NAMED-PROBES-ARE-ONE-MEASUREMENT` | AMBIGUOUS | 1 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-COMMENT-THAT-RESTATES-A-PINNED-VALUE-GOES-STALE-EVERY-BUMP-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-CLAUDE-MD-KEY-DEPENDENCIES-WENT-STALE-AND-PROPAGATED-A-WRONG-PIN-INTO-A-PLAN-1` | AMBIGUOUS | PR #915 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-JC-AND-NDARRAY-BOTH-SHIP-A-RELIABILITY-BATTERY-WITH-DIFFERENT-DEGENERATE-CONTRACTS-1` | AMBIGUOUS | 1 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-DOCUMENTED-PROXY-BYPASS-IS-FOR-PUSH-DENIALS-NOT-CLONE-AUTH-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-CORRECTION-IS-A-CLAIM-AND-CARRIES-A-CLAIM-S-BURDEN-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-JITTER-AMPLITUDE-YOU-CHOSE-IS-NOT-AN-UNCERTAINTY-YOU-MEASURED-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-CYCLONE-ASYMMETRY-IS-ONE-DIPOLE-1` | AMBIGUOUS | PR #926 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-HELIX360-IS-THE-NORMALIZED-SUBSTRATE-NOT-A-BIT-BUDGET-1` | AMBIGUOUS | PR #498 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-JUDGE-THE-FIELD-NOT-THE-ELEMENT-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-MY-OWN-PRE-REGISTRATION-HAD-A-GAP-AND-I-NAMED-IT-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-N-EQUALS-TWO-LOOKED-LIKE-PHYSICS-AND-WAS-HALF-COIN-FLIP-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-SPINE-FOUND-MODERATORS-MISSING-1` | AMBIGUOUS | PR #926 merged | graded OPERATOR — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-BYTE-WAS-ONLY-THE-SELECTOR-THE-PAIR-IS-THE-CARRIER-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-DOCTRINE-DOC-EXISTED-AND-I-NEVER-READ-IT-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-FRAME-WAS-ALREADY-SHIPPED-FOUR-TIMES-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-HEADLINE-NUMBER-MEASURED-A-MODEL-NOBODY-CLAIMED-1` | AMBIGUOUS | PR #926 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-OFFSET-WAS-THE-APPARATUS-THE-LADDER-WAS-THE-PHYSICS-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-RESCUE-THAT-WEAKENED-ITSELF-UNDER-SCRUTINY-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-REUSE-IS-THE-PROCESS-AND-IT-EXPOSED-A-FIT-PROBLEM-1` | AMBIGUOUS | 1 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-TRANSFORM-MUST-MATCH-THE-DISTRIBUTION-SHAPE-1` | AMBIGUOUS | 1 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-TOPOLOGY-PICKS-THE-TABLE-NOT-THE-DOMAIN-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-ZERO-FOR-ELEVEN-THE-AUTHOR-CANNOT-AUDIT-HIS-OWN-FALSIFIERS-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-CONTROL-THAT-CANNOT-LOSE-IS-NO-CONTROL-1` | AMBIGUOUS | PR #935 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-FIGURE-CITED-TWICE-IS-NOT-CONFIRMED-ONCE-1` | AMBIGUOUS | PR #945 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-ON-A-GOLDEN-LATTICE-LOCALITY-IS-FIBONACCI-MEMBERSHIP-1` | AMBIGUOUS | PR #936, #937, #938 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-CONTROL-SCORED-THE-HEADLINE-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-DISPLACEMENT-FILTER-ATE-THE-STRANDED-STRATUM-1` | AMBIGUOUS | PR #940 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-REGIME-LADDER-MEASURED-RANGE-NOT-TURBULENCE-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-DISABLE-PROBE-CAN-ITSELF-BE-VACUOUS-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-FIGURE-YOU-TALLIED-YOURSELF-IS-A-DERIVED-FIGURE-1` | AMBIGUOUS | PR #950 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-REAL-GATE-RAN-AND-QUALIFIED-NOT-RETRACTED-THE-CLAIM-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-IDENTITY-QUAD-4X24-RATIFIED-PERMANENT-1` | AMBIGUOUS | no implementation evidence | graded RULING — an epistemic grade, not a work status; no deliverable attached |
+| `E-FORD-REAL-PUBLICATION-IDENTITY-IS-ARRIVAL-DEPENDENT-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-OGAR-CODEBOOK-MIRROR-DOMAIN-DRIFT-SYNCED-1` | AMBIGUOUS | PR #275, #276, #277 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A7A-STORNO-THE-EXCLAMATION-WAS-NOT-A-NAME-1` | AMBIGUOUS | no implementation evidence | graded CORRECTION — an epistemic grade, not a work status; no deliverable attached |
+| `E-ARCHITECTURE-RESET-DUMB-STORAGE-HHTL-EPISTEMIC-1` | AMBIGUOUS | PR #968 merged | graded RULING — an epistemic grade, not a work status; no deliverable attached |
+| `E-CROSS-VERSION-IDENTITY-MIGRATES-BLIND-SO-IT-FAILS-CLOSED-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-E2-REVERIFIED-SCATTER-CONTESTED-PMU-ABSENT-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-HIERARCHY-NODE-IS-ALGEBRA-NEVER-A-CROSSWALK-1` | AMBIGUOUS | no implementation evidence | graded RULING — an epistemic grade, not a work status; no deliverable attached |
+| `E-LOTUS-IS-A-REGISTER-GRID-NOT-A-BYTE-GRID-1` | AMBIGUOUS | PR #968 merged | graded RULING — an epistemic grade, not a work status; no deliverable attached |
+| `E-REPLAY-IS-CANONICAL-COMPACTION-IS-ECONOMICS-1` | AMBIGUOUS | no implementation evidence | graded RULING — an epistemic grade, not a work status; no deliverable attached |
+| `E-RP-SEAL-PASS1-THE-MAXIM-WORKED-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-SEAL-IS-ACCUMULATED-ON-THE-HOT-PATH-NOT-A-PASS-1` | AMBIGUOUS | no implementation evidence | graded RULING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-CANONICAL-ROW-WAS-READ-OFF-A-FIXTURE-1` | AMBIGUOUS | 2 cited path(s) GONE | graded CORRECTION — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-OU-COLUMN-EXISTS-AND-NOTHING-WRITES-IT-1` | AMBIGUOUS | 1 cited path(s) GONE | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-STRONG-HIERARCHY-EXISTS-AS-FIVE-DISCONNECTED-ISLANDS-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-TIER0-CANONICAL-REPLAY-LANDED-DV-IS-EPISTEMIC-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-TWO-WITNESS-SHAPES-CONTEST-ONE-LANDING-ZONE-1` | AMBIGUOUS | PR #446, #448 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-XC21-HARNESS-CONFIRMS-C2-AND-FINDS-DEAD-CODE-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-LOCAL-DERIVATION-CANNOT-OVERRULE-A-MEASURED-COUNTEREXAMPLE-1` | AMBIGUOUS | PR #875 merged; 1 referenced PR(s) closed unmerged | graded RULING — an epistemic grade, not a work status; no deliverable attached |
+| `E-DISMECH-CORPUS-CENSUS-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-NIBLEPATH-DEPTH-IS-NOT-HHTL-DIMENSIONALITY-1` | AMBIGUOUS | 1 referenced PR(s) closed unmerged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-S3-0-NEEDED-NO-NEW-ADDRESS-1` | AMBIGUOUS | 1 referenced PR(s) closed unmerged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-AUDIT-GATE-WAS-PINNING-THE-BUG-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-COMPAT-ENUM-WAS-EATING-HALF-THE-REGISTER-1` | AMBIGUOUS | PR #970, #971 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-V3-IS-REPRESENTATION-INVARIANT-ON-THE-PLANNER-CE64-LEG-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-WORDNET-IS-A-LOCALITY-PRIOR-NOT-AN-IDENTITY-ENCODING-1` | AMBIGUOUS | PR #875 merged; 1 referenced PR(s) closed unmerged | graded CORRECTION — an epistemic grade, not a work status; no deliverable attached |
+| `E-ABBREVIATION-GREP-MANUFACTURED-AN-ABSENCE-1` | AMBIGUOUS | PR #876 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-ACADEMIC-CARVE-UNDERFILLS-ROWS-ARE-NOT-WORDS-1` | AMBIGUOUS | PR #975 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-ADDRESS-FROM-THE-THING-NOT-THE-ACCIDENT-1` | AMBIGUOUS | no implementation evidence | graded SYNTHESIS — an epistemic grade, not a work status; no deliverable attached |
+| `E-DISMECH-KNOWN-INTERMEDIATES-ARE-PROSE-NOT-IDENTITIES-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-HHTL-IS-MINTED-IN-THE-ARTIFACT-NOBODY-CITES-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-R2IL-VARNODEFACET-IS-A-G3-CARVING-AND-` | AMBIGUOUS | 1 cited path(s) GONE | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-ORACLE-POPULATION-IS-64-PERCENT-AND-A-GATE-HARDCODES-THE-OTHER-36-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-V4-IS-THE-100-PERCENT-TIER-V3-UNCHANGED-1` | AMBIGUOUS | no implementation evidence | graded RULING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-CONSTANT-OFFSET-CANNOT-ALIGN-TWO-VERSIFICATIONS-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-BPE-IS-RHYME-VQ-IS-THE-MECHANISM-FOR-6X2X8BIT-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-HHTL-NAMES-TWO-STRUCTURES-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-GATE-IS-A-HAND-MAINTAINED-ALLOWLIST-NOT-THE-WORKSPACE-1` | AMBIGUOUS | PR #984 merged; 1 cited path(s) live | CONFLICT: live ISSUES entry vs ISSUES entry resolved |
+| `E-A-WARRANT-MUST-BE-ABLE-TO-SAY-NO-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-AN-IMPORT-EDGE-IS-NOT-AN-ARCHITECTURAL-RELATION-1` | AMBIGUOUS | PR #103, #104 merged | graded CORRECTION — an epistemic grade, not a work status; no deliverable attached |
+| `E-CONTENT-NEVER-TRAVELS-IN-CLASSID-1` | AMBIGUOUS | no implementation evidence | graded ROOT — an epistemic grade, not a work status; no deliverable attached |
+| `E-HAPPY-PATH-RL-WOULD-HAVE-LEARNED-THE-CLOBBER-1` | AMBIGUOUS | PR #1001, #1011 merged; 1 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-HHTL-COMPILES-HIERARCHY-INTO-MASK-GEOMETRY-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-HIERARCHY-IS-THE-ADDRESS-SPACE-NOT-THE-ONTOLOGY-1` | AMBIGUOUS | no implementation evidence | graded ROOT — an epistemic grade, not a work status; no deliverable attached |
+| `E-MEMBERSHIP-IS-PARTICIPATION-NOT-ANCESTRY-1` | AMBIGUOUS | PR #1001 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-METACOGNITIVE-TRIANGLE-ARROW-1` | AMBIGUOUS | PR #995, #997 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-OGAR-LOCO-INTERPRETER-RUN-1` | AMBIGUOUS | PR #989 merged; 1 cited path(s) GONE | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-ONE-RECEIPT-MANY-BORROWED-CONSUMERS-1` | AMBIGUOUS | PR #1012, #1016 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-REAL-CODE-INTERLEAVES-THE-OPCODE-MACRO-IS-NOT-A-DATAFLOW-PIPE-1` | AMBIGUOUS | 1 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-RECIPE-DISPATCH-BRIDGE-1` | AMBIGUOUS | PR #992, #995 merged; 1 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-RECIPE-EXECUTION-SEPARABILITY-1` | AMBIGUOUS | PR #992 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-STREAM-ORDER-VS-PREFIX-TREE-NEITHER-ACCUMULATES-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-SUDOKU-COGNITIVE-CORPUS-1` | AMBIGUOUS | PR #995, #996 merged; 1 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-FIRST-PARTICLE-1` | AMBIGUOUS | PR #1001 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-FRONTIER-LEARNER-IS-ALREADY-SHIPPED-1` | AMBIGUOUS | PR #1001, #1011 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-SEVEN-OPCODE-PROJECTION-IS-NOT-X86-AND-THE-CHAIN-CARRIER-WINS-1` | AMBIGUOUS | PR #1014 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-VIEW-MOVES-THE-POPULATION-DOES-NOT-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-TOKEN-BPE-CAN-FIT-NOT-YET-BUY-1` | AMBIGUOUS | PR #1001 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-TYPE-COMPLEXITY-EXPOSED-A-MEMORY-ABI-ESCAPE-1` | AMBIGUOUS | PR #1004 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-BPE-OVER-DEFUSE-CHAINS-BEATS-LINEAR-AND-FITS-LOCO-1` | AMBIGUOUS | PR #998 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-GIT-SOURCED-CRATE-CANNOT-PATH-DEP-OUTSIDE-ITS-REPO-1` | AMBIGUOUS | PR #1019 merged; 2 cited path(s) live | graded FIX — an epistemic grade, not a work status; no deliverable attached |
+| `E-GIT-SOURCED-CRATE-CANNOT-PATH-DEP-OUTSIDE-ITS-REPO-1` | AMBIGUOUS | 1 cited path(s) live | graded FIX — an epistemic grade, not a work status; no deliverable attached |
+| `E-PHI-WEYL-STAMP-CASCADE-PRECISION-RULING-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-R2IL-BPE-RECOMBINATION-FALSIFIERS-CONFIRMED-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-R2IL-MACRO-VOCABULARY-TRANSFERS-ACROSS-COMPILER-AND-LANGUAGE-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-W0-THE-SPACE-ORDINAL-IS-A-RANK-RELATIVE-TO-A-TABLE-THE-CLASSID-NEVER-NAMES-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-COUPLED-MATERIALS-NOT-A-CHOOSER-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded CORRECTION |
+| `E-V4-EXECUTABLE-CONTENT-THREE-TIER-JIT-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded DOCTRINE |
+| `E-A-RUNG-WRITE-PATH-ALREADY-SHIPPED-IN-A-SIBLING-REPO-1` | AMBIGUOUS | PR #561, #565, #590 merged; 1 cited path(s) GONE | CONFLICT: STATUS_BOARD row not done vs STATUS_BOARD row done |
+| `E-A-FLOOD-THROTTLE-IS-NOT-A-DISCRIMINATOR-1` | AMBIGUOUS | PR #1079 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-DESTRUCTIVE-PREPEND-TRUNCATES-BEFORE-READ-1` | AMBIGUOUS | PR #1079, #1081, #1082 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-MONITOR-KEYED-ON-THE-PR-HEAD-CAN-CERTIFY-THE-WRONG-COMMIT-1` | AMBIGUOUS | PR #1120 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-REVIEW-REMEDY-HAS-A-SHELF-LIFE-1` | AMBIGUOUS | PR #1120, #1122, #1123 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-THRESHOLD-IS-BOUND-TO-ITS-STATISTIC-AND-ITS-SAMPLE-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded FINDING |
+| `E-CONSUMER-PINS-ON-INTERNAL-SIBLINGS-PROHIBITED-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded OPERATOR-RULED |
+| `E-DEPTH-INF-CONVERSE-IS-QUADRATIC-IN-LEVY-AREA-1` | AMBIGUOUS | 1 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-I-PINNED-THE-DEFECT-AS-THE-GUARD-WHILE-FIXING-A-REVIEW-COMMENT-1` | AMBIGUOUS | PR #1120, #1122 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-LEVEL-SCALED-NORMALIZATION-IS-THE-SIGNATURE-PARITY-GATE-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-LEVY-AREA-COEFFICIENT-BEATS-REFINEMENT-1` | AMBIGUOUS | PR #350 merged; 2 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-MONOTONE-STREAM-LEVEL2-IS-DISCRIMINATION-NOT-MAGNITUDE-1` | AMBIGUOUS | 1 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-NECESSARY-CONDITIONS-ARE-NOT-A-PSD-TEST-1` | AMBIGUOUS | PR #291 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-ORIENTATION-BIT-PARTIAL-NIBBLE-SUFFICES-1` | AMBIGUOUS | 1 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-PRESENCE-2BIT-CHEAPER-SIBLING-1` | AMBIGUOUS | PR #1099, #1103 merged; 1 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-Q8-THE-SIX-DOES-NO-WORK-A-DEGREE-ABLATION-COLLAPSES-THE-HEX-OVERLAYS-ENTIRE-ADVANTAGE-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-SUPERSESSION-GATE-WATCHED-TWO-OF-ITS-FOUR-INPUTS-1` | AMBIGUOUS | PR #1123 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-TWO-REVIEWERS-FOUND-THE-SAME-THREE-DEFECTS-AND-ONE-OF-THEM-WAS-MINE-ALONE-1` | AMBIGUOUS | PR #1120 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-W0-MEASURED-THE-MASK-HALF-DOMINATES-AND-THE-PLAN-WAS-UNDER-CITED-1` | AMBIGUOUS | PR #1117 merged | CONFLICT: STATUS_BOARD row not done vs STATUS_BOARD row done |
+| `E-AN-HHTL-POSITION-IS-A-NODE-AND-A-NODE-HAS-A-VALUE-1` | AMBIGUOUS | PR #1127 merged | CONFLICT: STATUS_BOARD row not done vs STATUS_BOARD row done |
+| `E-ASKING-WHERE-THE-MAP-LIVES-IS-ASKING-WHERE-THE-OUS-ARE-IN-A-DN-1` | AMBIGUOUS | PR #1127 merged | CONFLICT: STATUS_BOARD row not done vs STATUS_BOARD row done |
+| `E-G24N4-ALREADY-SHIPS-AND-THAT-IS-WHY-W2B-CANNOT-USE-IT-1` | AMBIGUOUS | 1 cited path(s) GONE | CONFLICT: STATUS_BOARD row not done vs STATUS_BOARD row done |
+| `E-LITERATURE-HARVEST-POST-1132-TWO-PILLAR-CORRECTIONS-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded HARVEST |
+| `E-ONE-HOP-UP-ONE-HOP-DOWN-A-PARENT-SPEAKS-ONLY-ITS-CHILDREN-1` | AMBIGUOUS | no implementation evidence | CONFLICT: STATUS_BOARD row not done vs STATUS_BOARD row done |
+| `E-THE-24-AXIS-BASIS-V3-EVERY-AXIS-IS-A-GROUNDED-PRESSURE-1` | AMBIGUOUS | PR #296 merged | graded BUILT — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-PALETTE-MARGIN-IS-SPENT-AND-GROWTH-MOVES-TO-LOCO-1` | AMBIGUOUS | PR #1125 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-SIGNED-NET-WAS-FALSIFIED-NOT-LIMITED-AND-THE-LOCI-LAW-WAS-SCOPED-TOO-WIDE-1` | AMBIGUOUS | PR #1127 merged | graded OPERATOR — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-STATE-LAYER-IS-A-BELNAP-BILATTICE-AND-THE-JOIN-IS-THE-ACCUMULATOR-1` | AMBIGUOUS | PR #1129 merged | graded OPERATOR — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-THRESHOLD-AXIS-WAS-SATURATED-AND-THE-GATE-WOULD-HAVE-BEEN-VACUOUS-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded FINDING |
+| `E-THREE-BRANCHES-ONE-REGISTER-THE-AUDIT-AFTER-THE-COLLISION-1` | AMBIGUOUS | PR #1125, #1126, #1127 merged | graded RECONCILIATION — an epistemic grade, not a work status; no deliverable attached |
+| `E-THREE-KINDS-OF-MENGENLEHRE-AND-W2-SHIPPED-THE-NARROWEST-1` | AMBIGUOUS | no implementation evidence | CONFLICT: STATUS_BOARD row not done vs STATUS_BOARD row done |
+| `E-A-GHOST-TRACE-IS-NOT-THE-COUNTERFACTUAL-LANE-1` | AMBIGUOUS | PR #1137 merged | CONFLICT: live TECH_DEBT entry vs STATUS_BOARD row done |
+| `E-JC-IS-THE-HOME-OF-ALL-CALIBRATED-MATH-1` | AMBIGUOUS | 1 cited path(s) live | CONFLICT: live TECH_DEBT entry vs STATUS_BOARD row done |
+| `E-PILLAR-11-PUBLISHED-BOUND-NEEDS-ITS-OWN-NUMERIC-GUARD-1` | AMBIGUOUS | PR #1133 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-SIGNATURE-PDE-SWEEP-SHIPPED-W1` | AMBIGUOUS | PR #293, #348 merged; 2 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-SIX-SEMANTIC-FAMILIES-MUST-NOT-IMPERSONATE-EACH-OTHER-1` | AMBIGUOUS | PR #295, #1125, #1128 +3 merged; 1 referenced PR(s) closed unmerged | graded OPERATOR — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-DTO-LADDER-IS-THE-ALU-BUS-AND-WAS-ALREADY-RULED-1` | AMBIGUOUS | PR #1051 merged | graded CORRECTION — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-LIFT-GATE-FOUND-A-TIE-BLIND-SPEARMAN-1` | AMBIGUOUS | 1 cited path(s) live | CONFLICT: live TECH_DEBT entry vs STATUS_BOARD row done |
+| `E-THE-PERIPHERY-OF-A-STRATUM-IS-THE-OTHER-STRATA-1` | AMBIGUOUS | PR #1141 merged; 1 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THINKING-ENGINE-LIVE-FOOTPRINT-IS-ONE-TRAIT-AND-HOUSE-IS-SHIPPED-IN-PIECES-1` | AMBIGUOUS | PR #387 merged | CONFLICT: STATUS_BOARD row not done vs STATUS_BOARD row done |
+| `E-A-CENSUS-IS-A-FUNCTION-OF-ITS-REGEX-SO-GATE-THE-PROPERTY-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-CITATION-IS-NOT-A-DEPENDENCY-AND-A-FORCED-COPY-NEEDS-A-GATE-1` | AMBIGUOUS | 1 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-CORRECTION-IS-ONLY-AS-GOOD-AS-ITS-MERGE-1` | AMBIGUOUS | PR #1092 merged; 2 referenced PR(s) closed unmerged; 1 cited path(s) GONE | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-CROSS-REPO-SYMBOL-GREP-IS-ONLY-AS-FRESH-AS-THE-SIBLING-CHECKOUT-1` | AMBIGUOUS | PR #1157 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-HAND-SWEEP-UNDERCOUNTS-TOWARD-DONE-AND-THE-CRITERION-IS-THE-WHOLE-DESIGN-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded FINDING |
+| `E-A-PROBE-CAN-STATE-A-MEASUREMENT-THAT-WAS-FALSE-WHEN-IT-WAS-WRITTEN-1` | AMBIGUOUS | 1 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-RULED-HOME-NEEDS-A-FIRST-CONSUMER-OR-IT-IS-A-VACANCY-1` | AMBIGUOUS | PR #1152 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-M8-COLLAPSE-TARGET-ALREADY-EXISTED-1` | AMBIGUOUS | PR #1151 merged; 1 cited path(s) live | CONFLICT: STATUS_BOARD row not done + live ISSUES entry vs STATUS_BOARD row done |
+| `E-THE-ENTROPY-HOME-WAS-RULED-AND-LEFT-EMPTY-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-FIX-FOR-A-REVIEW-FINDING-SHIPS-UNREVIEWED-BY-DEFAULT-1` | AMBIGUOUS | PR #1154, #1160 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-FREE-MITIGATION-WAS-FREE-FOR-TWO-HOURS-1` | AMBIGUOUS | PR #1160 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-GATE-INHERITS-THE-BLIND-SPOT-OF-WHOEVER-WROTE-IT-1` | AMBIGUOUS | PR #1167, #1168, #1169 +1 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-SKETCH-THAT-MISSED-TWICE-WILL-MISS-A-THIRD-TIME-1` | AMBIGUOUS | PR #293, #294 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-COLUMN-OF-INDICES-INTO-A-CODEBOOK-THAT-DOES-NOT-EXIST-1` | AMBIGUOUS | 4 cited path(s) live | CONFLICT: STATUS_BOARD row not done vs STATUS_BOARD row done |
+| `E-A-MACHINE-APPLICABLE-FIX-IS-A-SUGGESTION-NOT-A-PROOF-1` | AMBIGUOUS | PR #302, #1194, #1195 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-NARS-EXPECTATION-CHOICE-PREFERS-IGNORANCE-TO-A-CONFIDENT-NEGATIVE-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-NXG-1` | AMBIGUOUS | no implementation evidence | CONFLICT: live TECH_DEBT entry + own status line: PROPOSAL vs STATUS_BOARD row done |
+| `E-NXG-12` | AMBIGUOUS | no implementation evidence | no join key at all; graded FINDING |
+| `E-NXG-13` | AMBIGUOUS | PR #288, #295 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-NXG-14` | AMBIGUOUS | no implementation evidence | no join key at all; graded FINDING |
+| `E-NXG-15` | AMBIGUOUS | no implementation evidence | no join key at all; graded FINDING |
+| `E-NXG-17` | AMBIGUOUS | 1 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-NXG-19` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-NXG-20` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-NXG-3` | AMBIGUOUS | 2 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-NXG-4` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-NXG-7` | AMBIGUOUS | PR #296, #1134, #1159 merged; 1 referenced PR(s) closed unmerged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-NXG-8` | AMBIGUOUS | PR #1129 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-PLANNING-MIGRATES-TO-LOCO-R2IL-DATAFUSION-IS-GRACE-PERIOD-1` | AMBIGUOUS | PR #1185 merged | graded OPERATOR-RULED — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-UNFINISHED-FUNCTION-WAS-NOT-THE-DEBT-1` | AMBIGUOUS | PR #1188 merged; 1 cited path(s) GONE | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-UNFINISHED-UDF-WAS-NOT-THE-DEBT-1` | AMBIGUOUS | PR #1185 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-VERSIONED-GRAPH-OVERWRITES-SO-ROW-ADDRESSES-ALIAS-ACROSS-VERSIONS-1` | AMBIGUOUS | PR #1190 merged; 1 cited path(s) live | CONFLICT: STATUS_BOARD row not done + live TECH_DEBT entry vs STATUS_BOARD row done |
+| `E-I-CITED-THE-RIGHTMOST-REGISTER-AND-CALLED-IT-THE-ADDRESS-1` | AMBIGUOUS | PR #174, #175, #658 +1 merged | graded OPERATOR — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-AARCH64-PATH-HAD-NEVER-BEEN-COMPILED-1` | AMBIGUOUS | PR #146 merged; 1 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-DOC-COMMENT-IS-NOT-A-FAIL-CLOSED-MECHANISM-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded FINDING |
+| `E-A-PLAN-INVENTORY-FINDS-THE-BOARD-LAGS-THE-TREE-IN-BOTH-DIRECTIONS-1` | AMBIGUOUS | PR #1198 merged | CONFLICT: STATUS_BOARD row not done vs STATUS_BOARD row done |
+| `E-A-V3-MINT-MUST-NEVER-DEGRADE-TO-V1-1` | AMBIGUOUS | PR #1207 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-AN-EMPTY-RANGE-AFTER-A-RESET-IS-NOT-EVIDENCE-1` | AMBIGUOUS | PR #1201, #1203, #1217 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-EVERY-DOMAIN-IS-A-TABLE-AND-A-CROSSWALK-IS-A-CHAIN-OF-MASKS-1` | AMBIGUOUS | no implementation evidence | graded RULING — an epistemic grade, not a work status; no deliverable attached |
+| `E-PLUG-AND-PLAY-IS-THE-DECLARATION-NOT-A-TABLE-1` | AMBIGUOUS | PR #1207, #1216 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-RUNG-BAND-AND-PLASTICITY-ARE-THREE-AXES-NEVER-ONE-LEVEL-FIELD-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded FENCE |
+| `E-THE-FUSED-AND3-HOP-WAS-NEVER-SHIPPED-LGJ-HOP-IS-TWO-ANDS-1` | AMBIGUOUS | 1 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-V1-GUARD-WAS-TESTED-THE-V3-GUARD-THAT-REPLACED-IT-WAS-NOT-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-SIGMA-CHAIN-IS-A-PROVEN-UG-SURVIVAL-AND-PHI-IS-A-HOMONYM-1` | AMBIGUOUS | 1 cited path(s) live | graded FOSSIL — an epistemic grade, not a work status; no deliverable attached |
+| `E-TRIPLE-MODEL-DKPOSITION-IS-AN-UNWIRED-DUPLICATE-1` | AMBIGUOUS | 4 cited path(s) live | graded FOSSIL — an epistemic grade, not a work status; no deliverable attached |
+| `E-LE-IS-THE-UNIVERSAL-DTO-LAYER-TYPED-SYNTAX-MEANS-A-VERSIONED-LE-SCHEMA-1` | AMBIGUOUS | PR #1154, #1222, #1223 merged | CONFLICT: STATUS_BOARD row not done + live TECH_DEBT entry vs STATUS_BOARD row done |
+| `E-HEX-TENANT-RAIL-IS-DIRECTION-CHAIN-IS-FREE-SHIFT-IS-THE-COST-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded — |
+| `E-HEX-TENANT-RAIL-IS-DIRECTION-CHAIN-IS-FREE-SHIFT-IS-THE-COST-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-DISABLE-CAN-GO-RED-FOR-THE-WRONG-REASON-AND-THE-TWO-PEAK-FIGURES-WERE-NEVER-IN-CONFLICT-1` | AMBIGUOUS | PR #1233 merged | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-HORIZON-CUT-AND-AN-UNBOUND-MEET-ARE-NOT-THE-SAME-ANSWER-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded FINDING |
+| `E-A-THOUGHT-MASKS-ITSELF-BY-ITS-DISTANCE-FROM-ROOT-THE-V3-FACET-IS-THE-MASK-AND-THE-RADIUS-IS-STEPLESS-1` | AMBIGUOUS | no implementation evidence | graded RULING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-UNIFORM-WEIGHT-ARM-CANNOT-MEASURE-EVIDENCE-ITS-ARGMIN-IS-INVARIANT-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded FINDING |
+| `E-BOUNDED-ATTENTION-BUYS-REACH-AND-A-DISTANT-HOP-IS-A-TERNLOG-NOT-A-SEMIRING-1` | AMBIGUOUS | no implementation evidence | CONFLICT: live ISSUES entry vs STATUS_BOARD row done |
+| `E-DENSITY-IS-FALSIFIED-THE-VARIABLE-IS-PATH-LENGTH-SPREAD-AND-THIS-RE-OPENS-A5-1` | AMBIGUOUS | no implementation evidence | CONFLICT: STATUS_BOARD row not done vs STATUS_BOARD row done + ISSUES entry resolved |
+| `E-DEPTH-RANK-REPRODUCES-MOST-SPECIFIC-BUT-ONLY-ON-A-TAXONOMY-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded FINDING |
+| `E-FAMILY-HAS-FOUR-WIDTHS-AND-4096-HAS-FIVE-REFERENTS-PIN-THE-UNIT-BEFORE-THE-ARITHMETIC-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded FINDING |
+| `E-FUSING-FORFEITS-THE-SKIP-AND-ADAPTIVEFILTER-FAILS-IN-TWO-PLACES-NOT-ONE-1` | AMBIGUOUS | no implementation evidence | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-I-DECLARED-A-JOIN-ABSENT-BY-GREPPING-ONE-FILE-AND-COMPOSE-IS-THE-SAME-XOR-A-THIRD-TIME-1` | AMBIGUOUS | 5 cited path(s) live | graded CORRECTION — an epistemic grade, not a work status; no deliverable attached |
+| `E-POPCOUNT-TIMES-SELF-THE-EXACT-PREFIX-IS-THE-K-EQUALS-ZERO-HAMMING-BALL-AND-THE-FUSED-ROW-PREDICATE-IS-THE-GAP-1` | AMBIGUOUS | no implementation evidence | graded RULING — an epistemic grade, not a work status; no deliverable attached |
+| `E-SIX-SEAMS-EVERY-CAUSAL-SELECTOR-SHIPS-AND-NONE-IS-WIRED-AT-THE-HOP-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded FINDING |
+| `E-THE-BOXCAR-HORIZON-IS-NOT-A-DISCOUNT-IT-REVERSES-THE-OTHER-WAY-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded FINDING |
+| `E-THE-CANON-SPECIFIED-THE-WHOLE-MASKED-O1-CHAIN-AND-ITS-LOAD-BEARING-LINKS-ARE-STUBS-1` | AMBIGUOUS | no implementation evidence | CONFLICT: live ISSUES entry vs STATUS_BOARD row done |
+| `E-THE-RAIL-IS-A-NEEDLE-NOT-A-MASK-256-BY-256-IS-THE-EXACT-ROW-ADDRESS-AND-A-MASK-OVER-THE-AREA-IS-ANOTHER-OBJECT-1` | AMBIGUOUS | no implementation evidence | graded RULING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-REVIEW-FOUND-A-REAL-BUG-THAT-FALSIFIED-MY-OWN-ISSUES-PREMISE-AND-I-BROKE-MY-OWN-RULE-IN-THE-FILE-STATING-IT-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded FINDING |
+| `E-THE-RLHF-SHAPED-PROMOTION-LOOP-IS-IMPLEMENTED-END-TO-END-IN-A-PROBE-AND-HAS-NO-SRC-PROMOTER-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded FINDING |
+| `E-THE-SEMIRING-IS-FREE-THE-COST-IS-CARRIER-WIDTH-AND-THE-JOIN-IS-THE-SAME-XOR-1` | AMBIGUOUS | 1 cited path(s) live | CONFLICT: live ISSUES entry vs ISSUES entry resolved |
+| `E-THE-SKIP-LEVER-LIVES-ONLY-BELOW-THE-DENSITY-WHERE-D-GTM-0N-SAYS-SWITCH-TO-SPARSE-AND-THE-CLUSTERED-99-90-IS-PREFIX-ARITHMETIC-1` | AMBIGUOUS | 1 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-SLOWEST-GATE-IS-THE-ONE-YOUR-OWN-PUSH-CADENCE-CANCELS-1` | AMBIGUOUS | PR #1235 merged; 2 cited path(s) live | graded FINDING — an epistemic grade, not a work status; no deliverable attached |
+| `E-FORMAT-SLOT-FOLD-IS-THE-SAME-OP-AS-THE-VL-DESCENT-1` | AMBIGUOUS | PR #310, #1242, #1243 +1 merged | graded MEASURED — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-SPINE-IS-WHATEVER-THE-READER-ALREADY-HAS-AN-ADDRESS-FOR-1` | AMBIGUOUS | PR #1085, #1240 merged; 1 cited path(s) live | graded OPERATOR-RULED — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-SECOND-FACET-IS-NOT-AN-EDGE-BLOCK-1` | AMBIGUOUS | no implementation evidence | graded OPERATOR-RULED — an epistemic grade, not a work status; no deliverable attached |
+| `E-BYTES-ARE-STORED-INTEGERS-ARE-PROJECTED-1` | AMBIGUOUS | PR #1245, #1246 merged | graded OPERATOR-RULED — an epistemic grade, not a work status; no deliverable attached |
+| `E-NO-FOLD-REPORTS-AN-O-POPULATION-COST-1` | AMBIGUOUS | no implementation evidence | graded — — an epistemic grade, not a work status; no deliverable attached |
+| `E-1224-CLOSED-FOR-BEING-WRONG-NOT-FOR-LACKING-CONSUMERS-1` | AMBIGUOUS | 1 referenced PR(s) closed unmerged | graded CORRECTION — an epistemic grade, not a work status; no deliverable attached |
+| `E-1224-WAS-A-BIDIRECTIONAL-DOMAIN-INVERSION-NOT-A-LEAK-1` | AMBIGUOUS | 1 referenced PR(s) closed unmerged | graded SHARPENING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-BORROW-IS-NOT-A-REPLAY-CARRIER-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded RULING |
+| `E-A-BOUND-AND-A-TILE-ARE-INTERVALS-IN-DIFFERENT-ORDERS-1` | AMBIGUOUS | no implementation evidence | CONFLICT: STATUS_BOARD row not done vs STATUS_BOARD row done |
+| `E-A-DOMAIN-IS-AN-OPTIONAL-CONSUMER-THROUGH-OGAR-NEVER-A-CO-DEFINER-1` | AMBIGUOUS | 1 referenced PR(s) closed unmerged | graded RULING — an epistemic grade, not a work status; no deliverable attached |
+| `E-A-POSITIONAL-INDEX-ADDED-TO-A-KEY-DIGEST-ATTESTS-NOTHING-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded FINDING |
+| `E-A-THOUGHT-IS-A-REPLAYABLE-OPERATOR-NOT-A-MAINTAINED-STATE-1` | AMBIGUOUS | PR #1245, #1250 merged | graded RULING — an epistemic grade, not a work status; no deliverable attached |
+| `E-ATTENTION-IS-NOT-EVIDENCE-AND-FIRE-IS-NOT-DURABILITY-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded RULING |
+| `E-FOLDS-ARE-ZERO-COPY-PERIOD-PEEK-NOT-BORROW-BUILD-FOLD-1` | AMBIGUOUS | no implementation evidence | graded LAW — an epistemic grade, not a work status; no deliverable attached |
+| `E-FROZEN-IS-FINE-MARCHING-IS-THE-DISASTER-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded RULING |
+| `E-MASKING-IS-AN-OPERATION-A-MASK-IS-A-CARRIER-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded RULING |
+| `E-ONE-OBSERVABLE-IS-NOT-THREE-INSTRUMENTS-AND-IMPORTS-ARE-PROBES-1` | AMBIGUOUS | 1 referenced PR(s) closed unmerged | graded FENCE — an epistemic grade, not a work status; no deliverable attached |
+| `E-REPLAY-CAN-BE-CHEAPER-THAN-STORAGE-1` | AMBIGUOUS | no implementation evidence | graded CONJECTURE — an epistemic grade, not a work status; no deliverable attached |
+| `E-THE-1224-DETOUR-CLEANUP-PASS-WHAT-WAS-CONTAMINATION-AND-WHAT-SURVIVES-1` | AMBIGUOUS | 1 referenced PR(s) closed unmerged | graded CLEANUP — an epistemic grade, not a work status; no deliverable attached |
+| `E-ZERO-COPY-IS-NOT-A-SIZE-THRESHOLD-1` | AMBIGUOUS | no implementation evidence | no join key at all; graded RULING |
+
+---
+
+## 4. What this baseline does NOT claim
+
+- It does not claim the 228 AMBIGUOUS rows are resolved, wrong, or safe
+  to delete. They are unadjudicated, and that is recorded, not hidden.
+- It does not claim a merged PR closed the finding attached to it.
+- It does not claim the frozen prose was reviewed. **FROZEN ≠ RECONCILED.**
+- It is not a licence to start another archaeology pass over the ambiguous
+  rows. If one matters later it resurfaces as live work and enters the
+  transient tier like anything else.
+
+## 5. Steady state after this checkpoint
+
+```
+new work → .claude/board/entries/ → reconcile against current state
+         → OPEN | CLOSED | SUPERSEDED | AMBIGUOUS
+         → rare Eureka promotion to EPIPHANIES.md (must cite its entry)
+         → advance PROCESSED_THROUGH_SHA to the captured source head
+```
+
+MIRROR dies. Corrections die. Failed probes normally die. Git keeps the
+route. Only surviving state crosses the checkpoint.
diff --git a/.claude/board/ISSUES.md b/.claude/board/ISSUES.md
index 6632bc168..b3aaf695b 100644
--- a/.claude/board/ISSUES.md
+++ b/.claude/board/ISSUES.md
@@ -1,3 +1,68 @@
+## ISS-R2IL-PROBE-HAS-NO-CI-LINE-UNTIL-OGAR-305
+
+**Status:** OPEN — one-line follow-up, blocked on a cross-repo merge.
+**Basis:** measured. `rust-test.yml`'s `test` job checks `AdaWorldAPI/OGAR` out
+with no `ref:`, so `crates/r2il-mask-abi-probe` compiles against OGAR's DEFAULT
+branch, where `CallMask::words()` does not exist yet (OGAR #305). Complete log
+of run 35513415131: **16 × E0599, one class, all `words`**, `exit 101`.
+Reproduced locally by detaching the OGAR sibling to `origin/main` (16 errors)
+and restoring (6/6 green).
+
+The step was REMOVED from the workflow rather than left red. The earlier
+position — keep it red and rely on merging OGAR #305 first — made a green `main`
+depend on human merge ordering that this repo cannot enforce; if #1254 merges
+first, `main` carries a red job. A gate arriving one merge later is the smaller
+cost.
+
+**To close (one line, no design):** after OGAR #305 is on OGAR's default branch,
+re-add to the `test` job, after the `lance-graph-ogar` step:
+
+```yaml
+      - name: Run r2il-mask-abi-probe mask-ABI differential (excluded tier, OGAR + ndarray siblings)
+        run: cargo test --manifest-path crates/r2il-mask-abi-probe/Cargo.toml
+```
+
+**Until then the probe is locally-verified only** (6/6, all disable-verified) and
+has NO CI enforcement — which is the actual risk this entry exists to keep
+visible, since an excluded crate with no CI line rots invisibly.
+
+## ISS-NDARRAY-CANONICAL-COORDINATE-COUPLES-FLEET-MSRV — one canonical ndarray source imposes one MSRV floor; three repos pin below it (2026-09-20)
+
+**Status:** OPEN. Operator decision, not a dependency-pass side effect.
+
+The CARGO COMPUTE SUBSTRATE LAW (`.claude/knowledge/CARGO-COMPUTE-SUBSTRATE.md`,
+rule 3) requires ONE canonical `ndarray` source coordinate across the fleet.
+Measured 2026-09-20, that has a price nobody had stated: ndarray master
+(`e1ef350`) reports **requires Rust 1.98**, and the fleet does not agree on a
+toolchain.
+
+| toolchain | repos |
+|---|---|
+| **1.98.1** | lance-graph, OGAR, a2ui-rs, stockfish-rs, MedCare-rs, q2 |
+| 1.97.1 | tesseract-rs |
+| 1.95 | odoo-rs |
+| 1.94.0 | ladybug-rs |
+
+`tesseract-rs` and `ladybug-rs` both path-dep ndarray DIRECTLY
+(`path = "../../../ndarray"` with `features = ["runtime-dispatch"]`, and
+`path = "../ndarray"` respectively), so on current master they are measurably
+unable to build against it. Whatever they build against today is an older
+checkout.
+
+**So "one canonical source" and "each repo keeps its own toolchain pin" cannot
+both hold.** The options are a fleet-wide 1.98 bump, a pinned older ndarray
+`rev` as the canonical coordinate, or an explicit two-tier split — each with
+consequences outside a dependency pass.
+
+**Do NOT resolve this by bumping three toolchains inside a unification PR.**
+`cargo-substrate-architect` is instructed to report it and stop; the card names
+this issue id.
+
+Method note: `tesseract-rs`'s own CLAUDE.md records a 1.97.1 pin and
+`stockfish-rs`'s records 1.95 while its `rust-toolchain.toml` says 1.98.1 — the
+FILES were read, not the prose, per this workspace's own rule that a document
+is not evidence about the state of the tree.
+
 ## ISS-DISMECH-SEAM-INVERTED-BOTH-WAYS — counterfactual adjudication CORRECTED; cleanup pass closed (2026-09-19)
 
 ⊘ The census addendum below says the DisMech `Verdict{Consistent,
diff --git a/.claude/board/PROCESSED_THROUGH b/.claude/board/PROCESSED_THROUGH
new file mode 100644
index 000000000..c9a3a1f8b
--- /dev/null
+++ b/.claude/board/PROCESSED_THROUGH
@@ -0,0 +1,2 @@
+PROCESSED_THROUGH_SHA=181bb2c28005c185a967edd61367008c6722eb5c
+BASELINE=.claude/board/FINDINGS-BASELINE-2026-09-20.md
diff --git a/.claude/board/entries/README.md b/.claude/board/entries/README.md
index df62def4e..cf992ec5c 100644
--- a/.claude/board/entries/README.md
+++ b/.claude/board/entries/README.md
@@ -1,52 +1,56 @@
 # Board entries — one file per finding
 
-> Each entry is `YYYY-MM-DD-<entry-id>.md`, carrying the entry **verbatim**.
-> This table is the index; the files are the content. A row whose file does not
-> resolve is a broken reference — that is the falsifier, and it is why the index
-> and the content are separate objects.
 
-**Falsifiers** (both must hold):
+> **GENERATED — do not hand-edit the table's structure.**
+> `python3 .claude/tools/entries_index.py --write`
+>
+> Each entry is `YYYY-MM-DD-<entry-id>.md`, carrying the entry **verbatim**.
+> This table is the index; the files are the content. A row whose file does
+> not resolve is a broken reference — that is the falsifier, and it is why
+> the index and the content are separate objects.
+>
+> The `finding` cell is the ONE hand-curated column: it is carried forward
+> verbatim on every regeneration, because the entry files do not share a
+> heading shape and it cannot be derived. Edit it freely. `date`, `id`,
+> `file`, the ordering and the counts are derived and will be overwritten.
+>
+> **Never `… > README.md`.** This file is an INPUT to its own generator, so
+> a shell redirect truncates it before the script reads it and every curated
+> `finding` is lost. Use `--write`, which reads first and refuses to drop
+> curated cells.
 
-```sh
-cd .claude/board/entries
-# 1. every reference resolves  (anchored on the date prefix, so a parenthesis
-#    inside a title cannot be mistaken for a filename -- the first version of
-#    this check used -F'[()]' and reported 8 titles as dangling files)
-grep -oE '\([0-9]{4}-[0-9]{2}-[0-9]{2}-[^)]*\.md\)' README.md | tr -d '()' |
-  while read -r f; do [ -f "$f" ] || echo "DANGLING: $f"; done
-# 2. every file is referenced (the other direction -- catches a stranded file)
-for f in 20*.md; do grep -q "($f)" README.md || echo "UNREFERENCED: $f"; done
-# 3. no duplicate entry id
-grep '^| 20' README.md | cut -d'|' -f3 | sort | uniq -d
-```
-All three must print nothing. Checks 1 and 2 are deliberately opposite
-directions: 1 catches an index row whose file never landed, 2 catches a file
-that landed with no row. The stranding this convention exists to prevent shows
-up in exactly one of them, never both.
+**Falsifiers** — now executed by CI (`entries_index.py --check`), not just
+described here: (1) every index row's file resolves, (2) every file has an
+index row, (3) no duplicate entry id. Checks 1 and 2 are deliberately
+opposite directions; the stranding this convention prevents shows up in
+exactly one of them, never both.
 
-135 entries, 2026-08-06 .. 2026-08-26.
+144 entries, 2026-08-06 .. 2026-08-31.
 
 | date | entry id | finding | file |
 |---|---|---|---|
-| 2026-08-26 | `E-A-RECORDED-ALPHA-IS-INSTRUMENTATION-UNTIL-AN-INTERVENTION-ON-IT-MOVES-THE-NEXT-TRANSITION-1` | humility about introspection (vs #1057's humility about the world): a claimed alpha must move the next DispatchMode election when perturbed and stay silent when an unclaimed state is perturbed — the can-fire/can-stay-silent twin aimed inward, with a target that pre-declares its own null (dispatch_mode reads logical markers, never qualia); five-metric faithfulness stack computable from a receipt without an LLM judge | [2026-08-26-e-a-recorded-alpha-is-instrumentation-until-an-intervention-on-it-moves-the-next-transition-1](2026-08-26-e-a-recorded-alpha-is-instrumentation-until-an-intervention-on-it-moves-the-next-transition-1.md) |
-| 2026-08-26 | `E-ENTROPY-MEASURES-CLOSURE-BITS-59-60-TELL-WHETHER-THE-CLOSURE-HAS-CAUSAL-FOOTING-1` | the humility law measured onto shipped types: the H x ground cross-product already exists as SettlementCell (Glass = unearned closure), 59-60 under the CausalTopology lens already distinguish known/projected/hole, 61-63 gate fills as a permission band, and the Sudoku walker turns entropy into search pressure toward constraint-bounded epistemic holes | [2026-08-26-e-entropy-measures-closure-bits-59-60-tell-whether-the-closure-has-causal-footing-1](2026-08-26-e-entropy-measures-closure-bits-59-60-tell-whether-the-closure-has-causal-footing-1.md) |
-| 2026-08-26 | `E-MUL-CALIBRATES-FLOW-MODULATES-1045-FUSED-TWO-ORTHOGONAL-AXES-INTO-ONE-VERDICT-1` | measured storno of the same day's OUTCOME-vs-GROUND thesis: TrustTexture (calibration) and FlowState (Csikszentmihalyi, whose real consumer is FlowState→StyleFamily style adaptation) are orthogonal coordinates MulAssessment already carries apart; the planner's Proceed/Sandbox/Compass IS the diagram's MUL, and contract::mul::GateDecision is the execution gate wearing MUL's name — GateLevel withdrawn | [2026-08-26-e-mul-calibrates-flow-modulates-1045-fused-two-orthogonal-axes-into-one-verdict-1](2026-08-26-e-mul-calibrates-flow-modulates-1045-fused-two-orthogonal-axes-into-one-verdict-1.md) |
-| 2026-08-26 | `E-A-HOT-PATH-FIX-NARROWED-A-PUBLIC-CONTRACT-WORKSPACE-GREEN-IS-NOT-CONTRACT-GREEN-1` | #1045's hot-path de-stringing was right at its own layer and still narrowed a public contract: MUL-specific ground (TrustTexture/FlowState) became mandatory in the universal gate outcome, so no other producer can say Block without claiming MUL provenance; the break is live in ada-rs against an unbound git dep, and every workspace gate stayed green | [2026-08-26-e-a-hot-path-fix-narrowed-a-public-contract-workspace-green-is-not-contract-green-1](2026-08-26-e-a-hot-path-fix-narrowed-a-public-contract-workspace-green-is-not-contract-green-1.md) |
+| 2026-08-31 | `E-Q8-THE-SIX-DOES-NO-WORK-A-DEGREE-ABLATION-COLLAPSES-THE-HEX-OVERLAYS-ENTIRE-ADVANTAGE-1` | B passes every pre-registered gate and the pass is unattributable: at degree 1 it scores identically with 5.5× less memory | [2026-08-31-e-q8-the-six-does-no-work-a-degree-ablation-collapses-the-hex-overlays-entire-advantage-1.md](2026-08-31-e-q8-the-six-does-no-work-a-degree-ablation-collapses-the-hex-overlays-entire-advantage-1.md) |
+| 2026-08-27 | `E-THE-FUSED-PAYLOAD-IS-INERT-AT-EVERY-EXECUTION-GATE-THAT-CONSUMES-IT-1` |  | [2026-08-27-e-the-fused-payload-is-inert-at-every-execution-gate-that-consumes-it-1.md](2026-08-27-e-the-fused-payload-is-inert-at-every-execution-gate-that-consumes-it-1.md) |
 | 2026-08-26 | `E-THE-PERTURBATION-FIELD-NEVER-REACHED-THE-MASK-ALU-1` | the three DTOs are an adapter seam, not an ALU chain: PerturbationDto.energy is dropped, top_k collapses to a min/max window, and the p64 mask ALU is DTO-blind; 4096==4096 is not an address identity (S/4×O/4 vs codebook) — probe gate filed | [2026-08-26-e-the-perturbation-field-never-reached-the-mask-alu-1.md](2026-08-26-e-the-perturbation-field-never-reached-the-mask-alu-1.md) |
-| 2026-08-26 | `E-STYLES-ANCHOR-AT-RUNG-4-IS-A-SCALAR-ERA-ARTIFACT-EVERY-INSTANTIATED-STRATUM-CARRIES-A-STYLE-1` | styles-at-rung-4 was the scalar-rung era's address, not the type: under the tower every stratum selects its style from problem-texture resonance; its ΔF is the outcome channel that reinforces, revises, or reopens the selection | [2026-08-26-e-styles-anchor-at-rung-4-is-a-scalar-era-artifact-every-instantiated-stratum-carries-a-style-1.md](2026-08-26-e-styles-anchor-at-rung-4-is-a-scalar-era-artifact-every-instantiated-stratum-carries-a-style-1.md) |
 | 2026-08-26 | `E-THE-HELIX-POLE-PENALTY-IS-THE-POLAR-BYTE-NOT-THE-CODEC-AND-THE-SPRITE-DECODE-NEVER-TOUCHES-THE-GEOMETRY-1` | measured: BOTH carriers degrade toward the pole, but helix24's term is BOUNDED (∝ y) while helix48's polar byt… | [2026-08-26-e-the-helix-pole-penalty-is-the-polar-byte-not-the-codec-and-the-sprite-decode-never-touches-the-geometry-1.md](2026-08-26-e-the-helix-pole-penalty-is-the-polar-byte-not-the-codec-and-the-sprite-decode-never-touches-the-geometry-1.md) |
 | 2026-08-26 | `E-THE-FOUR-READINGS-OF-ONE-HELIX-CARRIER-AND-WHY-2Z-IS-CANONICAL-FOR-LUT-OVER-FIELD-1` | measured: for a LUT over a field, `r` distorts a splat kernel 204×, `y` 11.6×, and 1Z/2Z are both EXACTLY unif… | [2026-08-26-e-the-four-readings-of-one-helix-carrier-and-why-2z-is-canonical-for-lut-over-field-1.md](2026-08-26-e-the-four-readings-of-one-helix-carrier-and-why-2z-is-canonical-for-lut-over-field-1.md) |
+| 2026-08-26 | `E-THE-ARCHIVE-ROUTE-WAS-3-OF-3-WRONG-1` | the index's ARCHIVE? batch was 3/3 false positives — an unanchored shipped-word match with no notion of what shipped; all three plans were live | [2026-08-26-e-the-archive-route-was-3-of-3-wrong-1.md](2026-08-26-e-the-archive-route-was-3-of-3-wrong-1.md) |
+| 2026-08-26 | `E-STYLES-ANCHOR-AT-RUNG-4-IS-A-SCALAR-ERA-ARTIFACT-EVERY-INSTANTIATED-STRATUM-CARRIES-A-STYLE-1` | styles-at-rung-4 was the scalar-rung era's address, not the type: under the tower every stratum selects its style from problem-texture resonance; its ΔF is the outcome channel that reinforces, revises, or reopens the selection | [2026-08-26-e-styles-anchor-at-rung-4-is-a-scalar-era-artifact-every-instantiated-stratum-carries-a-style-1.md](2026-08-26-e-styles-anchor-at-rung-4-is-a-scalar-era-artifact-every-instantiated-stratum-carries-a-style-1.md) |
 | 2026-08-26 | `E-Q7-FREQUENCY-SIZING-RESCUES-THE-LEARNING-GATE-BUT-NOT-THE-INTERFERENCE-CLAIM-AND-THE-2-BYTE-RAILS-ARE-COMPLEMENTARY-NOT-COMPETING-1` | Q6's hex verdict survives its own repair; PAL is language-portable, I8 is compiler-idiom, and BPE could not be… | [2026-08-26-e-q7-frequency-sizing-rescues-the-learning-gate-but-not-the-interference-claim-and-the-2-byte-rails-are-complementary-not-competing-1.md](2026-08-26-e-q7-frequency-sizing-rescues-the-learning-gate-but-not-the-interference-claim-and-the-2-byte-rails-are-complementary-not-competing-1.md) |
 | 2026-08-26 | `E-Q6-HEX-FAILS-CONTENT-ADDRESSING-IS-CAPACITY-DESTROYING-UNDER-A-SKEWED-DISTRIBUTION-1` | the hex A/B experiment fails every hypothesis gate (G1–G3) at every cap while both validity gates pass; a rand… | [2026-08-26-e-q6-hex-fails-content-addressing-is-capacity-destroying-under-a-skewed-distribution-1.md](2026-08-26-e-q6-hex-fails-content-addressing-is-capacity-destroying-under-a-skewed-distribution-1.md) |
 | 2026-08-26 | `E-Q1-THE-ADDITIVE-STORE-CANNOT-INTERFERE-YET-AND-THE-VOCABULARY-IS-ORDER-ROBUST-1` | first plasticity falsifier run: INT is a CONTROL result, ORD passes at 0.872, SAT survives both naive policies… | [2026-08-26-e-q1-the-additive-store-cannot-interfere-yet-and-the-vocabulary-is-order-robust-1.md](2026-08-26-e-q1-the-additive-store-cannot-interfere-yet-and-the-vocabulary-is-order-robust-1.md) |
 | 2026-08-26 | `E-PALETTE256-IS-A-NEEDLE-THE-COLON-IS-THE-DISTRIBUTION-1` | one index finds a point; only a PAIR carries a distribution, which is why the Fisher-z diagonal returns a cons… | [2026-08-26-e-palette256-is-a-needle-the-colon-is-the-distribution-1.md](2026-08-26-e-palette256-is-a-needle-the-colon-is-the-distribution-1.md) |
+| 2026-08-26 | `E-MUL-CALIBRATES-FLOW-MODULATES-1045-FUSED-TWO-ORTHOGONAL-AXES-INTO-ONE-VERDICT-1` | measured storno of the same day's OUTCOME-vs-GROUND thesis: TrustTexture (calibration) and FlowState (Csikszentmihalyi, whose real consumer is FlowState→StyleFamily style adaptation) are orthogonal coordinates MulAssessment already carries apart; the planner's Proceed/Sandbox/Compass IS the diagram's MUL, and contract::mul::GateDecision is the execution gate wearing MUL's name — GateLevel withdrawn | [2026-08-26-e-mul-calibrates-flow-modulates-1045-fused-two-orthogonal-axes-into-one-verdict-1.md](2026-08-26-e-mul-calibrates-flow-modulates-1045-fused-two-orthogonal-axes-into-one-verdict-1.md) |
+| 2026-08-26 | `E-ENTROPY-MEASURES-CLOSURE-BITS-59-60-TELL-WHETHER-THE-CLOSURE-HAS-CAUSAL-FOOTING-1` | the humility law measured onto shipped types: the H x ground cross-product already exists as SettlementCell (Glass = unearned closure), 59-60 under the CausalTopology lens already distinguish known/projected/hole, 61-63 gate fills as a permission band, and the Sudoku walker turns entropy into search pressure toward constraint-bounded epistemic holes | [2026-08-26-e-entropy-measures-closure-bits-59-60-tell-whether-the-closure-has-causal-footing-1.md](2026-08-26-e-entropy-measures-closure-bits-59-60-tell-whether-the-closure-has-causal-footing-1.md) |
+| 2026-08-26 | `E-A-RECORDED-ALPHA-IS-INSTRUMENTATION-UNTIL-AN-INTERVENTION-ON-IT-MOVES-THE-NEXT-TRANSITION-1` | humility about introspection (vs #1057's humility about the world): a claimed alpha must move the next DispatchMode election when perturbed and stay silent when an unclaimed state is perturbed — the can-fire/can-stay-silent twin aimed inward, with a target that pre-declares its own null (dispatch_mode reads logical markers, never qualia); five-metric faithfulness stack computable from a receipt without an LLM judge | [2026-08-26-e-a-recorded-alpha-is-instrumentation-until-an-intervention-on-it-moves-the-next-transition-1.md](2026-08-26-e-a-recorded-alpha-is-instrumentation-until-an-intervention-on-it-moves-the-next-transition-1.md) |
+| 2026-08-26 | `E-A-HOT-PATH-FIX-NARROWED-A-PUBLIC-CONTRACT-WORKSPACE-GREEN-IS-NOT-CONTRACT-GREEN-1` | #1045's hot-path de-stringing was right at its own layer and still narrowed a public contract: MUL-specific ground (TrustTexture/FlowState) became mandatory in the universal gate outcome, so no other producer can say Block without claiming MUL provenance; the break is live in ada-rs against an unbound git dep, and every workspace gate stayed green | [2026-08-26-e-a-hot-path-fix-narrowed-a-public-contract-workspace-green-is-not-contract-green-1.md](2026-08-26-e-a-hot-path-fix-narrowed-a-public-contract-workspace-green-is-not-contract-green-1.md) |
 | 2026-08-25 | `E-W0-THE-SPACE-ORDINAL-IS-A-RANK-RELATIVE-TO-A-TABLE-THE-CLASSID-NEVER-NAMES-1` | W0 run: zero custom spaces in 94,536 rows, so the defect is LATENT; but the mechanism is worse than the conjec… | [2026-08-25-e-w0-the-space-ordinal-is-a-rank-relative-to-a-table-the-classid-never-names-1.md](2026-08-25-e-w0-the-space-ordinal-is-a-rank-relative-to-a-table-the-classid-never-names-1.md) |
 | 2026-08-25 | `E-W0-IS-LIVE-ON-THE-6502-AND-ITS-MAIN-MEMORY-IS-NOT-SpaceId-Ram-1` | the arch census: 6502 mints TWO custom spaces, one of them its own RAM, because the alias map is case-sensitiv… | [2026-08-25-e-w0-is-live-on-the-6502-and-its-main-memory-is-not-spaceid-ram-1.md](2026-08-25-e-w0-is-live-on-the-6502-and-its-main-memory-is-not-spaceid-ram-1.md) |
 | 2026-08-25 | `E-THE-QA-MACHINERY-IS-THE-LEARNING-RULE-1` | operator reframing: the transfer probe + the reversible-crystal gates are not quality control OVER a learner; … | [2026-08-25-e-the-qa-machinery-is-the-learning-rule-1.md](2026-08-25-e-the-qa-machinery-is-the-learning-rule-1.md) |
 | 2026-08-25 | `E-R2IL-MACRO-VOCABULARY-TRANSFERS-ACROSS-COMPILER-AND-LANGUAGE-1` | a macro vocabulary learned from two gcc binaries fires in unseen gcc code at −0.6% density and in unseen rustc… | [2026-08-25-e-r2il-macro-vocabulary-transfers-across-compiler-and-language-1.md](2026-08-25-e-r2il-macro-vocabulary-transfers-across-compiler-and-language-1.md) |
-| 2026-08-24 | `e-git-sourced-crate-cannot-path-dep-outside-its-repo-1` |  | [2026-08-24-e-git-sourced-crate-cannot-path-dep-outside-its-repo-1.md](2026-08-24-e-git-sourced-crate-cannot-path-dep-outside-its-repo-1.md) |
 | 2026-08-24 | `E-R2IL-BPE-RECOMBINATION-FALSIFIERS-CONFIRMED-1` | the typed genetic recombination proposal's three §7 falsifiers all run green: splice points exist selectively … | [2026-08-24-e-r2il-bpe-recombination-falsifiers-confirmed-1.md](2026-08-24-e-r2il-bpe-recombination-falsifiers-confirmed-1.md) |
 | 2026-08-24 | `E-PHI-WEYL-STAMP-CASCADE-PRECISION-RULING-1` | φ-Weyl 2-level Morton stamp cascade: coprime strides give identical discrimination, gcd>1 strides concentrate,… | [2026-08-24-e-phi-weyl-stamp-cascade-precision-ruling-1.md](2026-08-24-e-phi-weyl-stamp-cascade-precision-ruling-1.md) |
+| 2026-08-24 | `e-git-sourced-crate-cannot-path-dep-outside-its-repo-1` | `cognitive-stack`'s OGAR deps fixed the same way; its `ndarray` dep left path-only, and why: a same-version git+path duplicate is a real type-identity hazard, not just style | [2026-08-24-e-git-sourced-crate-cannot-path-dep-outside-its-repo-1.md](2026-08-24-e-git-sourced-crate-cannot-path-dep-outside-its-repo-1.md) |
 | 2026-08-24 | `E-BPE-OVER-DEFUSE-CHAINS-BEATS-LINEAR-AND-FITS-LOCO-1` | R2IL x BPE POC, corrected twice (codex review + architecture review): real per-occurrence immediates, per-merg… | [2026-08-24-e-bpe-over-defuse-chains-beats-linear-and-fits-loco-1.md](2026-08-24-e-bpe-over-defuse-chains-beats-linear-and-fits-loco-1.md) |
 | 2026-08-23 | `E-TYPE-COMPLEXITY-EXPOSED-A-MEMORY-ABI-ESCAPE-1` | the clippy warning was the surface symptom; `BeliefArena` is an independent AoS cognitive population owner out… | [2026-08-23-e-type-complexity-exposed-a-memory-abi-escape-1.md](2026-08-23-e-type-complexity-exposed-a-memory-abi-escape-1.md) |
 | 2026-08-23 | `E-TWO-KEY-ELEVATION-WINDOW-IS-NARROW-AND-THE-CORPUS-STRADDLES-IT-1` | one `RungElevator` actuator path is driven end-to-end; the two shipped rules that must agree for elevation ove… | [2026-08-23-e-two-key-elevation-window-is-narrow-and-the-corpus-straddles-it-1.md](2026-08-23-e-two-key-elevation-window-is-narrow-and-the-corpus-straddles-it-1.md) |
@@ -77,10 +81,10 @@ up in exactly one of them, never both.
 | 2026-08-22 | `E-A-DOC-COMMENT-CAN-GIVE-THE-WRONG-REASON-FOR-A-CORRECT-GUARD-1` | the guard was right, the justification was false, and the test read the justification | [2026-08-22-e-a-doc-comment-can-give-the-wrong-reason-for-a-correct-guard-1.md](2026-08-22-e-a-doc-comment-can-give-the-wrong-reason-for-a-correct-guard-1.md) |
 | 2026-08-22 | `E-A-CRATE-WITH-ZERO-CONSUMERS-IS-BUILT-BY-NOTHING-AND-CAN-BE-MERGED-BROKEN-1` | the hydration crate did not compile at `main`, and its own doc says why nobody found out | [2026-08-22-e-a-crate-with-zero-consumers-is-built-by-nothing-and-can-be-merged-broken-1.md](2026-08-22-e-a-crate-with-zero-consumers-is-built-by-nothing-and-can-be-merged-broken-1.md) |
 | 2026-08-22 | `E-A-CONSTANT-OFFSET-CANNOT-ALIGN-TWO-VERSIFICATIONS-1` | the versification map's KJV side is exact, and 51 of its offsets address a verse that does not exist; the shap… | [2026-08-22-e-a-constant-offset-cannot-align-two-versifications-1.md](2026-08-22-e-a-constant-offset-cannot-align-two-versifications-1.md) |
-| 2026-08-21 | `e-r2il-varnodefacet-is-a-g3-carving-and-0xc4-would-birth-a-class-into-it-1` |  | [2026-08-21-e-r2il-varnodefacet-is-a-g3-carving-and-0xc4-would-birth-a-class-into-it-1.md](2026-08-21-e-r2il-varnodefacet-is-a-g3-carving-and-0xc4-would-birth-a-class-into-it-1.md) |
 | 2026-08-21 | `E-V4-IS-THE-100-PERCENT-TIER-V3-UNCHANGED-1` | operator ruling: V4 is a SIBLING for lossless/special-need coverage, not a successor | [2026-08-21-e-v4-is-the-100-percent-tier-v3-unchanged-1.md](2026-08-21-e-v4-is-the-100-percent-tier-v3-unchanged-1.md) |
 | 2026-08-21 | `E-THE-ORACLE-POPULATION-IS-64-PERCENT-AND-A-GATE-HARDCODES-THE-OTHER-36-1` | a third of the "known intermediates" name no intermediate, and the gate that would have caught it asserts the … | [2026-08-21-e-the-oracle-population-is-64-percent-and-a-gate-hardcodes-the-other-36-1.md](2026-08-21-e-the-oracle-population-is-64-percent-and-a-gate-hardcodes-the-other-36-1.md) |
 | 2026-08-21 | `E-THE-ATTENTION-ATOM-WAS-ALREADY-SHIPPED-WHAT-WAS-MISSING-WAS-A-COMPOSITION-THAT-IS-NOT-OR-1` | D-ACR-1's basis is a reuse, and the only real gap was that every set operation in the crate is a bitset union | [2026-08-21-e-the-attention-atom-was-already-shipped-what-was-missing-was-a-composition-that-is-not-or-1.md](2026-08-21-e-the-attention-atom-was-already-shipped-what-was-missing-was-a-composition-that-is-not-or-1.md) |
+| 2026-08-21 | `e-r2il-varnodefacet-is-a-g3-carving-and-0xc4-would-birth-a-class-into-it-1` |  | [2026-08-21-e-r2il-varnodefacet-is-a-g3-carving-and-0xc4-would-birth-a-class-into-it-1.md](2026-08-21-e-r2il-varnodefacet-is-a-g3-carving-and-0xc4-would-birth-a-class-into-it-1.md) |
 | 2026-08-21 | `E-HHTL-IS-MINTED-IN-THE-ARTIFACT-NOBODY-CITES-1` | "zero on every baked row in both production bakes" is precise about the two it names and silent about the thir… | [2026-08-21-e-hhtl-is-minted-in-the-artifact-nobody-cites-1.md](2026-08-21-e-hhtl-is-minted-in-the-artifact-nobody-cites-1.md) |
 | 2026-08-21 | `E-FROM-V1-DROPS-PROVENANCE-AND-THE-COUNCIL-CAUGHT-THE-CONTRACT-ABOUT-TO-TRUST-IT-1` | three BLOCK(P0)s in one 5+3 run, and the sharpest one falsified the spec's own asymmetry claim against the cod… | [2026-08-21-e-from-v1-drops-provenance-and-the-council-caught-the-contract-about-to-trust-it-1.md](2026-08-21-e-from-v1-drops-provenance-and-the-council-caught-the-contract-about-to-trust-it-1.md) |
 | 2026-08-21 | `E-DISMECH-KNOWN-INTERMEDIATES-ARE-PROSE-NOT-IDENTITIES-1` | the 3,978-edge "ORACLE population" is 2,489 edges, and its mediators are 5-word prose, not node references | [2026-08-21-e-dismech-known-intermediates-are-prose-not-identities-1.md](2026-08-21-e-dismech-known-intermediates-are-prose-not-identities-1.md) |
@@ -88,19 +92,19 @@ up in exactly one of them, never both.
 | 2026-08-21 | `E-ADDRESS-FROM-THE-THING-NOT-THE-ACCIDENT-1` | the two blocked gates are one failure on two axes | [2026-08-21-e-address-from-the-thing-not-the-accident-1.md](2026-08-21-e-address-from-the-thing-not-the-accident-1.md) |
 | 2026-08-21 | `E-ACADEMIC-CARVE-UNDERFILLS-ROWS-ARE-NOT-WORDS-1` | 20,845 COCA rows are 18,559 distinct words, so the 80×256 academic carve fills 90.6% and basins 73..79 are emp… | [2026-08-21-e-academic-carve-underfills-rows-are-not-words-1.md](2026-08-21-e-academic-carve-underfills-rows-are-not-words-1.md) |
 | 2026-08-21 | `E-ABBREVIATION-GREP-MANUFACTURED-AN-ABSENCE-1` | I reported a shipped 15-module subsystem as non-existent because `fn .*ppr` matches `approx`, and a `head` lim… | [2026-08-21-e-abbreviation-grep-manufactured-an-absence-1.md](2026-08-21-e-abbreviation-grep-manufactured-an-absence-1.md) |
+| 2026-08-20 | `I-STRINGS-ARE-CAM-INDEX-ONLY-1` | strings in the hot path resolve through a codebook; the ONLY string home is the CAM index codebook; NEVER in a… | [2026-08-20-i-strings-are-cam-index-only-1.md](2026-08-20-i-strings-are-cam-index-only-1.md) |
+| 2026-08-20 | `E-WORDNET-IS-A-LOCALITY-PRIOR-NOT-AN-IDENTITY-ENCODING-1` | #875 measured a taxonomy-informed HHTL *search prior*; it did NOT prove an injective WordNet address, and a se… | [2026-08-20-e-wordnet-is-a-locality-prior-not-an-identity-encoding-1.md](2026-08-20-e-wordnet-is-a-locality-prior-not-an-identity-encoding-1.md) |
 | 2026-08-20 | `e-v3-is-representation-invariant-on-the-planner-ce64-leg-1` |  | [2026-08-20-e-v3-is-representation-invariant-on-the-planner-ce64-leg-1.md](2026-08-20-e-v3-is-representation-invariant-on-the-planner-ce64-leg-1.md) |
 | 2026-08-20 | `e-the-recipe-surface-is-causally-blind-1` |  | [2026-08-20-e-the-recipe-surface-is-causally-blind-1.md](2026-08-20-e-the-recipe-surface-is-causally-blind-1.md) |
 | 2026-08-20 | `e-the-filter-was-filtering-on-the-wrong-predicate-1` |  | [2026-08-20-e-the-filter-was-filtering-on-the-wrong-predicate-1.md](2026-08-20-e-the-filter-was-filtering-on-the-wrong-predicate-1.md) |
 | 2026-08-20 | `e-the-coverage-fix-is-real-and-asymmetric-1` |  | [2026-08-20-e-the-coverage-fix-is-real-and-asymmetric-1.md](2026-08-20-e-the-coverage-fix-is-real-and-asymmetric-1.md) |
 | 2026-08-20 | `e-the-compat-enum-was-eating-half-the-register-1` |  | [2026-08-20-e-the-compat-enum-was-eating-half-the-register-1.md](2026-08-20-e-the-compat-enum-was-eating-half-the-register-1.md) |
 | 2026-08-20 | `e-the-audit-gate-was-pinning-the-bug-1` |  | [2026-08-20-e-the-audit-gate-was-pinning-the-bug-1.md](2026-08-20-e-the-audit-gate-was-pinning-the-bug-1.md) |
-| 2026-08-20 | `e-capability-is-not-reachability-1` |  | [2026-08-20-e-capability-is-not-reachability-1.md](2026-08-20-e-capability-is-not-reachability-1.md) |
-| 2026-08-20 | `e-a-watcher-that-cannot-dissent-is-not-a-watcher-1` |  | [2026-08-20-e-a-watcher-that-cannot-dissent-is-not-a-watcher-1.md](2026-08-20-e-a-watcher-that-cannot-dissent-is-not-a-watcher-1.md) |
-| 2026-08-20 | `I-STRINGS-ARE-CAM-INDEX-ONLY-1` | strings in the hot path resolve through a codebook; the ONLY string home is the CAM index codebook; NEVER in a… | [2026-08-20-i-strings-are-cam-index-only-1.md](2026-08-20-i-strings-are-cam-index-only-1.md) |
-| 2026-08-20 | `E-WORDNET-IS-A-LOCALITY-PRIOR-NOT-AN-IDENTITY-ENCODING-1` | #875 measured a taxonomy-informed HHTL *search prior*; it did NOT prove an injective WordNet address, and a se… | [2026-08-20-e-wordnet-is-a-locality-prior-not-an-identity-encoding-1.md](2026-08-20-e-wordnet-is-a-locality-prior-not-an-identity-encoding-1.md) |
 | 2026-08-20 | `E-S3-0-NEEDED-NO-NEW-ADDRESS-1` | the Stage-3 "S3.0 address" slot is closed as NOT-NEEDED; `IdentityQuad` already carries an exact four-componen… | [2026-08-20-e-s3-0-needed-no-new-address-1.md](2026-08-20-e-s3-0-needed-no-new-address-1.md) |
 | 2026-08-20 | `E-NIBLEPATH-DEPTH-IS-NOT-HHTL-DIMENSIONALITY-1` | retracts #973's `E-THE-LITERAL-CANNOT-LIVE-IN-THE-PATH-IT-ROOTS-1` | [2026-08-20-e-niblepath-depth-is-not-hhtl-dimensionality-1.md](2026-08-20-e-niblepath-depth-is-not-hhtl-dimensionality-1.md) |
 | 2026-08-20 | `E-DISMECH-CORPUS-CENSUS-1` | the DisMech corpus measured: 87.2 MB of strings, of which the entire causal semantics is bits + codebook ordin… | [2026-08-20-e-dismech-corpus-census-1.md](2026-08-20-e-dismech-corpus-census-1.md) |
+| 2026-08-20 | `e-capability-is-not-reachability-1` |  | [2026-08-20-e-capability-is-not-reachability-1.md](2026-08-20-e-capability-is-not-reachability-1.md) |
+| 2026-08-20 | `e-a-watcher-that-cannot-dissent-is-not-a-watcher-1` |  | [2026-08-20-e-a-watcher-that-cannot-dissent-is-not-a-watcher-1.md](2026-08-20-e-a-watcher-that-cannot-dissent-is-not-a-watcher-1.md) |
 | 2026-08-20 | `E-A-LOCAL-DERIVATION-CANNOT-OVERRULE-A-MEASURED-COUNTEREXAMPLE-1` | and its twin: a counterexample cited past its own Boundaries section is the same failure with the sign flipped | [2026-08-20-e-a-local-derivation-cannot-overrule-a-measured-counterexample-1.md](2026-08-20-e-a-local-derivation-cannot-overrule-a-measured-counterexample-1.md) |
 | 2026-08-19 | `e-xc21-harness-confirms-c2-and-finds-dead-code-1` |  | [2026-08-19-e-xc21-harness-confirms-c2-and-finds-dead-code-1.md](2026-08-19-e-xc21-harness-confirms-c2-and-finds-dead-code-1.md) |
 | 2026-08-19 | `e-two-witness-shapes-contest-one-landing-zone-1` |  | [2026-08-19-e-two-witness-shapes-contest-one-landing-zone-1.md](2026-08-19-e-two-witness-shapes-contest-one-landing-zone-1.md) |
@@ -169,4 +173,3 @@ up in exactly one of them, never both.
 | 2026-08-06 | `E-AN-IDENTITY-SLOT-IS-NOT-A-RAIL-REF-WHICH-IS-WHY-A-WIDE-CARVING-CAN-BE-CORRECT-1` | the byte-axis rule is a rule about REFERENCES, and an exact identity is not one | [2026-08-06-e-an-identity-slot-is-not-a-rail-ref-which-is-why-a-wide-carving-can-be-correct-1.md](2026-08-06-e-an-identity-slot-is-not-a-rail-ref-which-is-why-a-wide-carving-can-be-correct-1.md) |
 | 2026-08-06 | `E-A-SORTED-CODEBOOK-ORDINAL-IS-A-PROPERTY-OF-THE-KEY-SET-NOT-THE-KEY-1` | a within-book bijectivity witness cannot see a between-book shift, and that is the gap review found | [2026-08-06-e-a-sorted-codebook-ordinal-is-a-property-of-the-key-set-not-the-key-1.md](2026-08-06-e-a-sorted-codebook-ordinal-is-a-property-of-the-key-set-not-the-key-1.md) |
 | 2026-08-06 | `E-A-REPEATABLE-TRANSFER-IS-NOT-IDEMPOTENCE-OVER-A-MULTI-FILE-DIRECTORY-1` | the PR #901 review round: four corrections, one of them load-bearing on a safety claim | [2026-08-06-e-a-repeatable-transfer-is-not-idempotence-over-a-multi-file-directory-1.md](2026-08-06-e-a-repeatable-transfer-is-not-idempotence-over-a-multi-file-directory-1.md) |
-| 2026-08-26 | `E-THE-ARCHIVE-ROUTE-WAS-3-OF-3-WRONG-1` | the index's ARCHIVE? batch was 3/3 false positives — an unanchored shipped-word match with no notion of what shipped; all three plans were live | [2026-08-26-e-the-archive-route-was-3-of-3-wrong-1.md](2026-08-26-e-the-archive-route-was-3-of-3-wrong-1.md) |
diff --git a/.claude/hooks/anti-pattern-matching.sh b/.claude/hooks/anti-pattern-matching.sh
index a616fd72c..b6a5fafce 100755
--- a/.claude/hooks/anti-pattern-matching.sh
+++ b/.claude/hooks/anti-pattern-matching.sh
@@ -13,13 +13,32 @@
 # as context at the exact moment a pattern/partial-range tool is reached for, so
 # the discipline is in front of the model every time.
 
+# WHAT THIS ENFORCES (the law itself:
+# .claude/knowledge/FIRST-HAND-SOURCE-LAW.md):
+#   DENY    a slicer (sed/head/tail/awk) naming a source/config file
+#   DENY    a search (grep/rg/ugrep/find/fd/ls) piped into a slicer
+#   DENY    an edit that INTRODUCES an authority label (operator-ruled etc.)
+#   INJECT  the law summary + auto-deepen triggers, on search
+#
+# GUIDANCE-ONLY, because no regex decides it: "enough enclosing context",
+# the paging judgement, shard-or-report, the ambiguity call, whether a state
+# label is the right one, and whether a diagnostic block was read to its root.
+#
+# KNOWN GAP (measured 2026-09-20, not closed): the slicer DENY keys on a file
+# ARGUMENT or on a search PRODUCER, so evidence-input slicing through any other
+# producer still passes -- `cat source.rs | tail`, `git show HEAD:source.rs |
+# tail`. Prohibited by the law, not yet by this hook.
+#
+# Tests: .claude/hooks/tests/anti-pattern-matching.test.sh (two-sided; every
+# DENY branch disable-verified).
+
 set -euo pipefail
 
 input="$(cat)"
 
 tool="$(printf '%s' "$input" | jq -r '.tool_name // ""')"
 
-RULE='ANTI-MUSTER-REGEL (Operator-Direktive): Grep/grep/rg/sed/tail/head sind NUR schnelle Discovery-Suche ueber den kompletten Corpus (ein Symbol/eine Datei lokalisieren) — NIEMALS Ersatz fuers Verstehen. Auf einen Treffer NICHT handeln (editieren, loeschen, beurteilen, "verstanden" behaupten), bevor die betroffene Datei VOLLSTAENDIG mit dem Read-Tool gelesen wurde. Verstehen = ganzes Read, kein Snippet. (Grund: geloeschter Code, der nur gemustert, nie gelesen wurde.)'
+RULE='ANTI-MUSTER-REGEL (Operator-Direktive): Grep/grep/rg/sed/tail/head sind NUR schnelle Discovery-Suche ueber den kompletten Corpus (ein Symbol/eine Datei lokalisieren) — NIEMALS Ersatz fuers Verstehen. Auf einen Treffer NICHT handeln (editieren, loeschen, beurteilen, "verstanden" behaupten), bevor die betroffene Datei VOLLSTAENDIG mit dem Read-Tool gelesen wurde. Verstehen = ganzes Read, kein Snippet. (Grund: geloeschter Code, der nur gemustert, nie gelesen wurde.) || SEARCH IS NAVIGATION, NEVER EVIDENCE. Suche darf NUR feststellen: "Kandidaten sind X, Y, Z". Sie darf NIE feststellen: was ein Typ bedeutet, was eine Funktion garantiert, dass ein Consumer NICHT existiert, dass ein Mechanismus unbenutzt ist, wer etwas besitzt, wie eine Dependency-Richtung laeuft. AUTO-DEEPEN (Pflicht-Read vor jeder Aussage) bei: 0 Treffer + Absenz-Behauptung | den Worten none/no consumer/unused/never/only/all/every/not implemented | nur einem Snippet als Grundlage | trait/macro/generated/re-export/alias/feature-gated | Crate- oder Repo-Grenze | abgeschnittener/gekappter/fehlerhafter/unerwartet kleiner Ausgabe | mehreren gleichnamigen Symbolen | einer Folgerung, die Architektur aendert, Code loescht, einen Carrier mintet oder Doktrin schafft. 0 Treffer beweist NICHTS: nicht "hat keine Consumer", sondern "die Suche fand keine Kandidaten" -- ein globales Negativ braucht einen GESCHLOSSENEN, ausdruecklich benannten Suchraum. Und: eine Suche darf nie das LETZTE Tool-Ergebnis vor einer architektonischen Schlussfolgerung sein. Gesetz: .claude/knowledge/FIRST-HAND-SOURCE-LAW.md'
 
 # Destructive-prepend guard (operator directive, 2026-08-30, after
 # open(p, "w").write(entry + open(p).read()) truncated PR_ARC_INVENTORY.md
@@ -39,12 +58,132 @@ emit_prepend() {
     '{hookSpecificOutput: {hookEventName: "PreToolUse", additionalContext: $c}}'
 }
 
+# A numeric slice of a SOURCE file is the one artifact with no semantic
+# boundary: `head -100 foo.rs` can stop just before the decisive `impl`,
+# `tail` can separate a definition from its invariant, and `sed -n '120,180p'`
+# looks precise while being an arbitrary cut. FIRST-HAND SOURCE LAW rule 3.
+#
+# Scoped to SOURCE INSPECTION, deliberately: limiting a non-search command's
+# DISPLAY (`cargo test 2>&1 | tail -30`) does not fabricate a false semantic
+# boundary -- the producer's own output is ephemeral process output, not a
+# source file. It is allowed, but it is display only: the guarded-executor
+# contract requires the complete output be retained and the FIRST relevant
+# diagnostic block read in full when a command fails. A deny that fired on
+# every build command would be worked around within the hour and would then
+# guard nothing.
+SLICE_DENY='VERBOTEN (FIRST-HAND SOURCE LAW, Regel 3): sed/head/tail/awk auf eine QUELLDATEI. Eine numerische Scheibe hat keine semantische Grenze -- `head -100 x.rs` endet womoeglich direkt vor dem entscheidenden impl, `tail` trennt Definition und Invariante, `sed -n 120,180p` sieht praezise aus und ist ein willkuerlicher Schnitt. Stattdessen: Grep/Glob lokalisiert das Symbol, dann Read auf das VOLLSTAENDIGE semantische Element (und bei Teilausgabe vom exakten naechsten Offset weiterlesen, niemals die ungesehene Mitte erraten). Output-Limitierung eines Nicht-Such-Kommandos (cargo ... | tail -30) bleibt erlaubt. Gesetz: .claude/knowledge/FIRST-HAND-SOURCE-LAW.md'
+
+# Capping a SEARCH result is how a truncated result set masquerades as a
+# complete one -- the shape behind every "no consumer" claim in this repo's
+# correction history. The Grep tool's own `head_limit` reports the cap;
+# `| head` hides it.
+CAP_DENY='VERBOTEN (FIRST-HAND SOURCE LAW, Regel 9): eine SUCHE in head/tail/sed/awk pipen. Das kappt eine Beweismenge und laesst ein abgeschnittenes Ergebnis wie ein vollstaendiges aussehen -- genau die Form hinter jeder "kein Consumer"-Behauptung in der Korrekturgeschichte dieses Repos. Stattdessen: das Grep-Tool mit `head_limit` (das die Kappung MELDET), oder ungekappt suchen und den Suchraum benennen. Gesetz: .claude/knowledge/FIRST-HAND-SOURCE-LAW.md'
+
+# A deny is TERMINAL, by construction rather than by call-site discipline.
+# The hook's stdout must be exactly ONE hook response; the MultiEdit branch
+# below loops over a batch, so without the exit a second violating edit wrote a
+# second JSON document and the pair parsed as neither denial (CodeRabbit on
+# #1254, reproduced before fixing). Exiting inside the function is what stops
+# the next branch that loops from re-introducing it.
+emit_deny() {
+  jq -n --arg c "$1" \
+    '{hookSpecificOutput: {hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: $c}}'
+  exit 0
+}
+
+# Source/config extensions only. Scratch and temp outputs are not source, so
+# `head -1 /tmp/out.txt` is none of this hook's business.
+SRC_EXT='\.(rs|toml|lock|md|py|c|cc|cpp|h|hpp|java|kt|ts|tsx|js|mjs|json|ya?ml|sql|proto|sh|surql|ttl)'
+SEARCH_CMD='(grep|rg|ugrep|egrep|fgrep|find|fd|ls)'
+
+# FIRST-HAND SOURCE LAW §G: human authorization is PROVENANCE, NOT VALIDATION.
+# These four are not technical status labels, so an edit may not INTRODUCE one
+# into canonical material. Scoped to introduction deliberately: they occur in
+# 73 / 43 / 8 / 4 files respectively (measured 2026-09-20), and a guard that
+# fired on every edit to a file that already contains one would be unusable
+# and worked around. Historical files are not this hook's business.
+AUTHORITY_LABELS='operator-ruled|operator-pinned|operator-locked|operator-confirmed'
+# A supersession note must be able to QUOTE the label it retires, so a line
+# that also carries a quoting/supersession marker is allowed through.
+QUOTE_MARKER='⊘|SUPERSEDED|superseded|previously|historical|formerly|was:'
+AUTHORITY_DENY='VERBOTEN (FIRST-HAND SOURCE LAW §G): operator-ruled / operator-pinned / operator-locked / operator-confirmed sind KEINE technischen Status-Labels. HUMAN AUTHORIZATION IS PROVENANCE, NOT VALIDATION -- "der Nutzer hat X gewaehlt" wird nie "X ist technisch wahr" ohne unabhaengige Evidenz. Stattdessen ein evidenztragender Zustand: MEASURED (mit dem Kommando) | VERIFIED-IN-CODE (mit der Stelle) | TEST-PINNED | CURRENT-CONTRACT | WORKING-MODEL | HYPOTHESIS | PROPOSED | OPEN | DEFERRED | SUPERSEDED | REJECTED-BY-FALSIFIER. Fuer eine echte Nutzer-Entscheidung das Entscheidungs-Format: DECISION / SCOPE / BASIS / REVISIT WHEN -- Entscheidung und Messung sind zwei Felder, nie ein Label. Eine Supersession-Notiz DARF das alte Label zitieren (Zeile mit "⊘" / SUPERSEDED / previously / formerly / was:). Gesetz: .claude/knowledge/FIRST-HAND-SOURCE-LAW.md'
+
+# True when $1 contains a line that introduces an authority label WITHOUT a
+# quoting marker on that same line.
+introduces_authority_label() {
+  printf '%s' "$1" | grep -Ei "$AUTHORITY_LABELS" | grep -Eviq "$QUOTE_MARKER"
+}
+# Non-quoted label OCCURRENCES, for comparing an edit's two sides. A blanket
+# "old already had one" exemption let an edit ADD a label beside an existing
+# one -- `operator-ruled` present, `operator-pinned` arriving, no denial, which
+# is exactly the introduction the guard promises to block (codex P2 on #1254,
+# reproduced before fixing).
+count_authority_labels() {
+  printf '%s' "$1" | grep -Eiv "$QUOTE_MARKER" | grep -Eio "$AUTHORITY_LABELS" | wc -l | tr -d ' '
+}
+SLICER='(sed|head|tail|awk)'
+
 case "$tool" in
   Grep)
     emit
     ;;
+  Edit)
+    # Only canonical prose/source carries these labels; skip anything else.
+    path="$(printf '%s' "$input" | jq -r '.tool_input.file_path // ""')"
+    if printf '%s' "$path" | grep -Eq '\.(md|rs)$'; then
+      new="$(printf '%s' "$input" | jq -r '.tool_input.new_string // ""')"
+      old="$(printf '%s' "$input" | jq -r '.tool_input.old_string // ""')"
+      # INTRODUCTION only, measured per OCCURRENCE: more non-quoted labels
+      # after than before. Comparing counts (not mere presence) is what stops
+      # a label riding in beside one that was already there.
+      if introduces_authority_label "$new" \
+         && [ "$(count_authority_labels "$new")" -gt "$(count_authority_labels "$old")" ]; then
+        emit_deny "$AUTHORITY_DENY"
+      fi
+    fi
+    ;;
+  MultiEdit)
+    # Same guard as Edit, per edit in the batch: a MultiEdit that introduces a
+    # label must not slip past because the matcher only named Edit/Write
+    # (CodeRabbit on #1254). Compared per-edit so one edit cannot be excused by
+    # another edit's pre-existing label.
+    path="$(printf '%s' "$input" | jq -r '.tool_input.file_path // ""')"
+    if printf '%s' "$path" | grep -Eq '\.(md|rs)$'; then
+      n="$(printf '%s' "$input" | jq -r '.tool_input.edits | length // 0')"
+      i=0
+      while [ "$i" -lt "${n:-0}" ]; do
+        new="$(printf '%s' "$input" | jq -r ".tool_input.edits[$i].new_string // \"\"")"
+        old="$(printf '%s' "$input" | jq -r ".tool_input.edits[$i].old_string // \"\"")"
+        if introduces_authority_label "$new" \
+           && [ "$(count_authority_labels "$new")" -gt "$(count_authority_labels "$old")" ]; then
+          emit_deny "$AUTHORITY_DENY"
+        fi
+        i=$((i + 1))
+      done
+    fi
+    ;;
+  Write)
+    path="$(printf '%s' "$input" | jq -r '.tool_input.file_path // ""')"
+    if printf '%s' "$path" | grep -Eq '\.(md|rs)$'; then
+      content="$(printf '%s' "$input" | jq -r '.tool_input.content // ""')"
+      if introduces_authority_label "$content"; then
+        emit_deny "$AUTHORITY_DENY"
+      fi
+    fi
+    ;;
   Bash)
     cmd="$(printf '%s' "$input" | jq -r '.tool_input.command // ""')"
+    # Normalized copy, for MATCHING ONLY (never for execution or display).
+    # Two measured bypasses, both codex P2 on #1254, both reproduced first:
+    #   * a pipeline written across lines -- `rg ... \<newline> | head -20` --
+    #     was invisible to the capped-search branch, because grep -E works a
+    #     line at a time and `.*` never spans a newline;
+    #   * a quoted operand -- `head -20 "src/lib.rs"` -- escaped the slice
+    #     branch, because the extension was followed by a quote instead of
+    #     whitespace-or-end.
+    # Folding newlines to spaces and dropping shell quotes/continuations makes
+    # both read like the bare forms the patterns already catch.
+    scan="$(printf '%s' "$cmd" | tr '\n' ' ' | sed 's/[\"'"'"'\\]//g')"
     # Destructive-prepend shape: an open-for-write and a .read() of a file in
     # the same command (Python one-liner or heredoc). Heuristic, non-blocking
     # — false positives only cost an injected reminder.
@@ -53,7 +192,18 @@ case "$tool" in
       emit_prepend
     # Match grep/rg/sed/tail/head as a command word (start, or after a
     # pipe/semicolon/&&/whitespace), not as a substring of another word.
-    elif printf '%s' "$cmd" | grep -Eq '(^|[|&;]|[[:space:]])(grep|rg|sed|tail|head)([[:space:]]|$)'; then
+    # DENY 1 -- a slicer whose argument list names a source file, and which is
+    # not reading from a pipe. `cmd` is split on pipes so `cargo x | tail -30`
+    # is judged on the `tail -30` segment alone (no file argument -> allowed).
+    elif printf '%s' "$scan" | tr '|;' '\n\n' \
+         | grep -Eq "(^|[[:space:]])$SLICER([[:space:]]+-[^[:space:]]+)*[[:space:]]+([^[:space:]]*[[:space:]]+)*[^[:space:]]*$SRC_EXT([[:space:]]|$)"; then
+      emit_deny "$SLICE_DENY"
+    # DENY 2 -- a search piped into a slicer: the cap that hides itself.
+    elif printf '%s' "$scan" \
+         | grep -Eq "(^|[|&;]|[[:space:]])$SEARCH_CMD([[:space:]]|$).*\\|[[:space:]]*$SLICER([[:space:]]|$)"; then
+      emit_deny "$CAP_DENY"
+    # Otherwise: non-blocking injection, as before.
+    elif printf '%s' "$scan" | grep -Eq '(^|[|&;]|[[:space:]])(grep|rg|ugrep|sed|tail|head|awk)([[:space:]]|$)'; then
       emit
     fi
     ;;
diff --git a/.claude/hooks/tests/anti-pattern-matching.test.sh b/.claude/hooks/tests/anti-pattern-matching.test.sh
new file mode 100755
index 000000000..f2fffeeaa
--- /dev/null
+++ b/.claude/hooks/tests/anti-pattern-matching.test.sh
@@ -0,0 +1,186 @@
+#!/usr/bin/env bash
+# Two-sided test for .claude/hooks/anti-pattern-matching.sh.
+#
+# A guard that cannot fire and a guard that fires on everything are equally
+# useless, so every case below is asserted in BOTH directions: the DENY rows
+# prove the guard bites, the INJECT/SILENT rows prove it discriminates.
+#
+# Run:  bash .claude/hooks/tests/anti-pattern-matching.test.sh
+# Exit: 0 all green, 1 any mismatch.
+#
+# Disable-verified (2026-09-20): removing the DENY-1 branch turns all five
+# source-slice rows INJECT; removing DENY-2 turns all three capped-search rows
+# INJECT. Re-run those two disables after any edit to the regexes.
+set -uo pipefail
+cd "$(dirname "$0")/../../.." || exit 1
+HOOK=.claude/hooks/anti-pattern-matching.sh
+fails=0
+
+classify() {
+  printf '%s' "{\"tool_name\":\"$1\",\"tool_input\":{\"command\":$(python3 -c 'import json,sys;print(json.dumps(sys.argv[1]))' "$2")}}" \
+    | bash "$HOOK" | python3 -c '
+import json,sys
+raw = sys.stdin.read().strip()
+if not raw:
+    print("SILENT"); raise SystemExit
+o = json.loads(raw)["hookSpecificOutput"]
+print("DENY" if o.get("permissionDecision") == "deny" else "INJECT")'
+}
+
+t() {
+  local want="$1" cmd="$2" got
+  got="$(classify Bash "$cmd")"
+  if [ "$got" = "$want" ]; then
+    printf '  ok    %-7s %s\n' "$got" "$cmd"
+  else
+    printf '  FAIL  want=%s got=%s  %s\n' "$want" "$got" "$cmd"
+    fails=$((fails + 1))
+  fi
+}
+
+echo '### DENY -- a numeric slice of a SOURCE file (law rule 3)'
+t DENY "head -100 crates/lance-graph-quack/src/lib.rs"
+t DENY "sed -n '120,180p' Cargo.toml"
+t DENY "tail -20 .claude/board/ISSUES.md"
+t DENY "awk '/impl/' crates/foo/src/main.rs"
+t DENY "sed -i 's/a/b/' Cargo.toml"
+
+echo '### DENY -- a SEARCH capped by a slicer (law rule 9)'
+t DENY "grep -rn CallMask crates/ | head -20"
+t DENY "rg -l CallMask | head"
+t DENY "find . -name '*.rs' | head -5"
+
+echo '### ALLOW -- display limiting of a NON-search command (ephemeral process output)'
+t INJECT "cargo test 2>&1 | tail -30"
+t INJECT "cargo build --release | head -5"
+t INJECT "head -1 /tmp/out.err"
+
+echo '### ALLOW -- ordinary search: navigation is legitimate, injection only'
+t INJECT "grep -rn CallMask crates/"
+t INJECT "rg -l 'impl ClassView' crates/"
+
+echo '### SILENT -- nothing to say'
+t SILENT "ls crates/"
+t SILENT "git log --oneline -1"
+t SILENT "cargo test -p ogar-r2il --lib"
+
+# ---- §G: authority labels may not be INTRODUCED into canonical material ----
+edit() {
+  local want="$1" path="$2" old="$3" new="$4" got
+  got="$(printf '%s' "{\"tool_name\":\"Edit\",\"tool_input\":{\"file_path\":$(python3 -c 'import json,sys;print(json.dumps(sys.argv[1]))' "$path"),\"old_string\":$(python3 -c 'import json,sys;print(json.dumps(sys.argv[1]))' "$old"),\"new_string\":$(python3 -c 'import json,sys;print(json.dumps(sys.argv[1]))' "$new")}}" \
+    | bash "$HOOK" | python3 -c '
+import json,sys
+raw = sys.stdin.read().strip()
+if not raw:
+    print("SILENT"); raise SystemExit
+o = json.loads(raw)["hookSpecificOutput"]
+print("DENY" if o.get("permissionDecision") == "deny" else "INJECT")')"
+  if [ "$got" = "$want" ]; then printf '  ok    %-7s %s\n' "$got" "$5"
+  else printf '  FAIL  want=%s got=%s  %s\n' "$want" "$got" "$5"; fails=$((fails + 1)); fi
+}
+write() {
+  local want="$1" path="$2" content="$3" got
+  got="$(printf '%s' "{\"tool_name\":\"Write\",\"tool_input\":{\"file_path\":$(python3 -c 'import json,sys;print(json.dumps(sys.argv[1]))' "$path"),\"content\":$(python3 -c 'import json,sys;print(json.dumps(sys.argv[1]))' "$content")}}" \
+    | bash "$HOOK" | python3 -c '
+import json,sys
+raw = sys.stdin.read().strip()
+if not raw:
+    print("SILENT"); raise SystemExit
+o = json.loads(raw)["hookSpecificOutput"]
+print("DENY" if o.get("permissionDecision") == "deny" else "INJECT")')"
+  if [ "$got" = "$want" ]; then printf '  ok    %-7s %s\n' "$got" "$4"
+  else printf '  FAIL  want=%s got=%s  %s\n' "$want" "$got" "$4"; fails=$((fails + 1)); fi
+}
+
+echo '### DENY -- an edit that INTRODUCES an authority label (law §G)'
+# MultiEdit: `edit`'s batch sibling. Added with the #1254 review fix -- the
+# matcher named only Edit/Write, so a batch could carry a label past the guard.
+# A leading untouched edit is included so one edit cannot be excused by another.
+multiedit() {
+  local want="$1" path="$2" old="$3" new="$4" got
+  got="$(printf '%s' "{\"tool_name\":\"MultiEdit\",\"tool_input\":{\"file_path\":$(python3 -c 'import json,sys;print(json.dumps(sys.argv[1]))' "$path"),\"edits\":[{\"old_string\":\"untouched\",\"new_string\":\"untouched\"},{\"old_string\":$(python3 -c 'import json,sys;print(json.dumps(sys.argv[1]))' "$old"),\"new_string\":$(python3 -c 'import json,sys;print(json.dumps(sys.argv[1]))' "$new")}]}}" \
+    | bash "$HOOK" | python3 -c '
+import json,sys
+raw = sys.stdin.read().strip()
+if not raw:
+    print("SILENT"); raise SystemExit
+o = json.loads(raw)["hookSpecificOutput"]
+print("DENY" if o.get("permissionDecision") == "deny" else "INJECT")')"
+  if [ "$got" = "$want" ]; then printf '  ok    %-7s %s\n' "$got" "$5"
+  else printf '  FAIL  want=%s got=%s  %s\n' "$want" "$got" "$5"; fails=$((fails + 1)); fi
+}
+
+edit DENY x.md "Status: WORKING-MODEL" "Status: operator-ruled"            "introduce operator-ruled"
+edit DENY x.md "the pin"              "the operator-locked pin"            "introduce operator-locked"
+write DENY n.md "# New
+
+Status: operator-pinned, 2026-09-20.
+"          "new file with operator-pinned"
+
+# An ALLOWED Edit/Write emits nothing: injection is a Grep/Bash-only
+# behaviour, so "allowed" reads as SILENT here, never INJECT.
+echo '### ALLOW (silent) -- label already present, or quoted by a supersession note'
+edit SILENT x.md "operator-ruled 2026-07-02" "operator-ruled 2026-07-02, now measured" "already present: not an introduction"
+edit SILENT x.md "the rule"           "⊘ previously operator-locked; now TEST-PINNED"  "quoted under a supersession marker"
+edit SILENT x.md "a"                  "SUPERSEDED: the operator-confirmed wording"     "quoted under SUPERSEDED"
+
+echo '### ALLOW -- an evidence-bearing state is the whole point'
+edit SILENT x.md "Status: OPEN"       "Status: MEASURED (cargo metadata, exit 0)"      "MEASURED"
+edit SILENT x.md "a"                  "DECISION: keep path form\nBASIS: offline cost" "DECISION record"
+
+echo '### ALLOW -- not canonical prose/source'
+edit DENY x.md "was operator-ruled." "was operator-ruled. New: operator-pinned too." "a label ADDED beside an existing one is still an introduction"
+multiedit DENY x.md "b" "b operator-locked" "MultiEdit introducing a label"
+multiedit SILENT x.md "b" "b tidied" "MultiEdit with no label"
+
+# A hook's stdout must be exactly ONE response document. Two violating edits in
+# one batch used to emit TWO, and a concatenated pair parses as neither denial
+# (CodeRabbit on #1254). This asserts the COUNT, not merely that a denial
+# appeared -- the pre-existing rows above could not see the defect, because they
+# carry one violating edit each. Disable-verified: removing `exit 0` from
+# emit_deny makes this row report docs=2.
+multiedit_two_violations() {
+  local got
+  got="$(printf '%s' '{"tool_name":"MultiEdit","tool_input":{"file_path":"x.md","edits":[{"old_string":"a","new_string":"a operator-ruled"},{"old_string":"b","new_string":"b operator-pinned"}]}}' \
+    | bash "$HOOK" | python3 -c '
+import json, sys
+dec = json.JSONDecoder()
+raw, i, docs, denies = sys.stdin.read(), 0, 0, 0
+while i < len(raw):
+    while i < len(raw) and raw[i].isspace():
+        i += 1
+    if i >= len(raw):
+        break
+    o, i = dec.raw_decode(raw, i)
+    docs += 1
+    if o["hookSpecificOutput"].get("permissionDecision") == "deny":
+        denies += 1
+print(f"docs={docs} denies={denies}")')"
+  if [ "$got" = "docs=1 denies=1" ]; then printf '  ok    %-7s %s\n' "$got" "two violating edits -> ONE deny document"
+  else printf '  FAIL  want=docs=1 denies=1 got=%s  %s\n' "$got" "two violating edits -> ONE deny document"; fails=$((fails + 1)); fi
+}
+multiedit_two_violations
+write SILENT c.json '{"k":"operator-ruled"}'                                           "json is out of scope"
+
+echo '### DENY -- review findings on #1254, each reproduced before it was fixed'
+# codex P2: a quoted operand escaped the slice branch (the extension was
+# followed by a quote, not whitespace-or-end). Both quote styles.
+t DENY 'head -20 "src/lib.rs"'
+t DENY "sed -n 1,50p 'crates/x/src/lib.rs'"
+# codex P2: a pipeline written across lines was invisible to the capped-search
+# branch -- grep -E works one line at a time and `.*` never spans a newline.
+t DENY 'rg -n CallMask crates/ \
+  | head -20'
+
+echo '### ALLOW -- the carve-out those three fixes must not eat'
+t INJECT 'cargo test 2>&1 | tail -30'
+t INJECT 'cargo test > /tmp/probe.log 2>&1; tail -30 /tmp/probe.log'
+
+echo '### the Grep TOOL always carries the law'
+got="$(classify Grep '')"
+if [ "$got" = "INJECT" ]; then printf '  ok    %-7s %s\n' "$got" "(Grep tool)"; else
+  printf '  FAIL  want=INJECT got=%s  (Grep tool)\n' "$got"; fails=$((fails + 1)); fi
+
+echo
+if [ "$fails" -eq 0 ]; then echo "ALL PASSED"; else echo "$fails FAILED"; fi
+exit $((fails > 0))
diff --git a/.claude/knowledge/CARGO-COMPUTE-SUBSTRATE.md b/.claude/knowledge/CARGO-COMPUTE-SUBSTRATE.md
new file mode 100644
index 000000000..cccd113fa
--- /dev/null
+++ b/.claude/knowledge/CARGO-COMPUTE-SUBSTRATE.md
@@ -0,0 +1,277 @@
+# Cargo compute substrate — one ndarray, one package identity, one binary
+
+> READ BY: cargo-substrate-architect, integration-lead, simd-savant,
+> kernel-membrane-warden, any session that adds, moves, pins, or feature-gates
+> an `ndarray` dependency in ANY repo of this fleet, or that is about to write
+> a `[patch]`, a `[workspace.dependencies]` entry, or a relative cross-repo
+> path dep.
+>
+> Born 2026-09-20 from the W0B mask-ABI differential, which surfaced a
+> domain-local Boolean algebra (`ogar-r2il::CallMask::and/or/xor/and_not/not`)
+> sitting beside the one evaluator. Operator ruling the same day: *"ndarray ist
+> das Silizium. Die Crates sind nur verschiedene Schaltungen darauf."*
+>
+> Scope: DEPENDENCY ARCHITECTURE ONLY. This doc never decides what `CallMask`,
+> CE64, Moore, or R2IL MEAN. A session using it to redesign a carrier has left
+> its scope.
+
+## 0. The distinction the whole doc rests on
+
+**Package/crate boundaries are not runtime boundaries.** Cargo may look like a
+wide graph and still produce one statically linked executable:
+
+```text
+                        final-app
+              /             |              \
+           Quack          R2IL            Odoo
+             |              |               |
+         mask-risc      ogar-loco          OGAR
+             \              |              /
+              └────────── ndarray ────────┘
+                             │
+                             ▼
+                 target/release/<one binary>
+```
+
+No plugins, no DLL layer, no IPC, no second process. Many crates at compile
+time, one binary at runtime — hard compile-time modularity with **no runtime
+architecture tax**. "Everything must be one binary" is therefore NOT an
+argument for fewer crates; if anything it is an argument for more, each with a
+harder contract.
+
+## 1. THE LAW
+
+```text
+CARGO COMPUTE SUBSTRATE LAW
+
+ 1. ndarray is the mandatory compute substrate.
+ 2. Hot execution crates depend on ndarray directly or through the one
+    canonical execution facade; no sibling SIMD/mask implementation.
+ 3. All repositories use ONE canonical ndarray source coordinate.
+ 4. Local development may [patch] that coordinate to a local checkout.
+ 5. Relative cross-repo ndarray paths are forbidden as durable dependencies.
+ 6. Features may select capabilities/backends, but may not remove ndarray
+    from a crate whose contract is compute execution.
+ 7. Domain-local carriers are allowed:
+       CallMask, AlphaMask, Moore128, ...
+    Domain-local duplicate execution algebras are not.
+ 8. One final executable is expected:
+       many Rust crates at compile time
+       one statically linked binary at runtime.
+ 9. `cargo tree -d` must not show multiple ndarray package identities.
+10. CI proves the rule. Documentation does not.
+```
+
+### What rule 1 does NOT say
+
+It does **not** say every crate must import ndarray. A pure DTO / vocabulary /
+contract crate (`lance-graph-contract`, `ogar-loco`, `ogar-vocab`) has no
+compute contract and coupling it to the substrate would be artificial. The
+binding form is:
+
+> Every crate that EXECUTES masking, SIMD, fold, tile, vector, field, or
+> numeric hot-path algebra must use the same canonical ndarray package
+> identity. No parallel compute algebra beside it. The final product may link
+> everything statically into one binary.
+
+### Rule 7, stated as the carrier/algebra split
+
+```text
+CallMask.words              domain CARRIER          ALLOWED, permanently
+CallMask::and/or/xor/...    domain-local ALGEBRA    transitional only
+ndarray (via mask-risc)     execution AUTHORITY     the destination
+```
+
+The migration order is not negotiable and is not "delete the duplicate":
+
+```text
+differential parity FIRST  ->  then ownership  ->  then migration
+```
+
+A duplicate algebra that has not been proven bit-identical must not be
+deleted, delegated, or "aligned" — the difference would be the finding.
+
+## 2. MEASURED CURRENT STATE (2026-09-20)
+
+Every number below came from a command, not from a manifest read by eye.
+
+### 2.1 Six coordinate shapes across ten repos
+
+```
+grep -rhnE '^[[:space:]]*ndarray[[:space:]]*=' --include=Cargo.toml <repo>
+```
+
+| shape | seen in |
+|---|---|
+| `path = "../../../ndarray"` | lance-graph (majority), tesseract-rs, lance-graph-java |
+| `path = "../ndarray"` | stockfish-rs, ladybug-rs, lance-graph root `[patch]` |
+| `path = "../../ndarray"` / `"../../../../ndarray"` / `"../../../../../ndarray"` | q2, lance-graph-java |
+| `git = ".../ndarray.git", branch = "master"` | lance-graph (`perturbation-sim`, `helix`) |
+| `git = ".../ndarray", branch = "master"` | a2ui-rs, MedCare-rs |
+| `workspace = true` | MedCare-rs, q2 |
+
+Path depths run from `../ndarray` to `../../../../../ndarray` — **five
+different depths**, so "the repos happen to sit next to each other" is
+load-bearing in at least five repos at once. That is what rule 5 exists to
+retire.
+
+The `.git` suffix difference is COSMETIC: cargo canonicalizes a git URL and
+strips a trailing `.git`, so those two forms are one source. Do not "fix" it as
+a bug and do not count it as a second identity.
+
+### 2.2 lance-graph today has ONE identity — by accident of exclusion
+
+The root carries `[patch.crates-io] ndarray = { path = "../ndarray" }`. Note
+the section: it redirects the REAL crates.io `ndarray` (the upstream numeric
+crate this is a fork of) onto the fork, which is what stops a transitive pull
+of upstream from becoming a second identity. It does **not** redirect the
+AdaWorldAPI git URL — `[patch.crates-io]` cannot.
+
+The two crates that DO use the git coordinate (`perturbation-sim`, `helix`) are
+both workspace-EXCLUDED, and `helix` has its own `[workspace]`. So no member
+binary sees both identities. **The single identity is a consequence of those
+two crates being excluded, not of any rule.** Promote either to a member and
+the graph carries two ndarrays.
+
+### 2.3 The recorded blocker against a canonical git coordinate DOES NOT REPRODUCE
+
+`Cargo.toml`'s patch comment says the git form "re-fetched AdaWorldAPI/ndarray
++ its burn submodule on every resolve; burn is outside the session repo scope
+(403) and the gitlink rev is unfetchable, so the git form deadlocks offline
+sessions."
+
+Measured on master (`e1ef350`):
+
+- **`burn` is not a submodule.** `git ls-tree HEAD` shows no `160000` gitlink
+  and no `.gitmodules`. It is `crates/burn`, an in-tree workspace member
+  (`members` line 484).
+- The out-of-scope dependency is real but differently located:
+  `crates/burn/Cargo.toml` git-deps `AdaWorldAPI/burn.git` rev `9b2b671`
+  (three crates), and `AdaWorldAPI/elliptic-curves` appears elsewhere in the
+  fork.
+- **A git coordinate for `ndarray` nonetheless resolves clean.** A throwaway
+  crate with `ndarray = { git = ".../ndarray", branch = "master",
+  default-features = false, features = ["std"] }` returned
+  `cargo metadata` exit 0, `Locking 10 packages`, `ndarray v0.17.2
+  (…?branch=master#e1ef350a)`. No burn fetch. No 403. Cargo resolves the
+  `ndarray` package, not every member's dependencies.
+
+So **rule 5 is implementable** and the comment's stated cause is stale. The one
+real remaining cost is honest and small: a git coordinate needs network on a
+fresh resolve where a path coordinate needs none. That is a reason to `[patch]`
+locally (rule 4), never a reason to keep the relative path as the durable
+contract.
+
+> The comment is corrected in place in the same commit that added this doc.
+> Recorded here because a documented reason that no longer holds is worse than
+> no reason: it is the only thing standing against rule 5, and it survived
+> unchallenged until somebody ran `git ls-tree`.
+
+### 2.4 One canonical source COUPLES THE FLEET'S MSRV — three repos pin below it
+
+ndarray master reports `requires Rust 1.98`.
+
+| toolchain | repos |
+|---|---|
+| **1.98.1** | lance-graph, OGAR, a2ui-rs, stockfish-rs, MedCare-rs, q2 |
+| 1.97.1 | tesseract-rs |
+| 1.95 | odoo-rs |
+| 1.94.0 | ladybug-rs |
+
+`tesseract-rs` and `ladybug-rs` both path-dep ndarray directly, so on current
+master they are measurably unable to build against it. This is rule 3's real
+price and it is not optional: **one canonical source means one MSRV floor for
+every consumer of it.** Tracked as
+`ISS-NDARRAY-CANONICAL-COORDINATE-COUPLES-FLEET-MSRV`; do NOT bump three
+toolchains as a side effect of a dependency-unification pass.
+
+### 2.5 One known duplicate algebra, differential GREEN, migration NOT started
+
+`ogar-r2il::CallMask` carries `and`/`or`/`xor`/`and_not`/`not`/`count` over
+inline `[u64; 3]`. Proven bit-identical to `lance-graph-mask-risc` over the
+same borrowed words (`crates/r2il-mask-abi-probe`, 6/6, every test
+disable-verified), and mask-risc's arbitrary ternlog immediate reproduces all
+four binary ops — so CallMask's algebra is a SUBSET, not a sibling.
+
+Ownership is deliberately undecided. Under rule 7 the destination is ndarray
+via mask-risc; the three live options are tiny wrappers/oracle, a shared lower
+primitive, or delegation if the direction is clean. `lance-graph-quack` states
+the target shape in its own manifest: *"the masking algebra is reached THROUGH
+mask-risc, never beside it."*
+
+## 3. The target dependency geometry
+
+Not this:
+
+```text
+lance-graph -> path ../../../ndarray
+OGAR        -> git ndarray
+odoo-rs     -> crates.io ndarray        # three packages, one name
+```
+
+But this:
+
+```text
+every repo:  ndarray = { workspace = true }
+workspace root:
+    [workspace.dependencies]
+    ndarray = { git = "<canonical>", rev = "<pinned>" , ... }
+
+local supercheckout only:
+    [patch."<canonical>"]
+    ndarray = { path = "../ndarray" }
+```
+
+Which gives:
+
+```text
+CI / standalone clone   ->  pinned git ndarray
+local development       ->  same dep, transparently patched to ../ndarray
+release binary          ->  exactly ONE resolved ndarray package
+```
+
+### The `[patch]` limit that must be understood before using it
+
+A `[patch]` rewrites a **source**, not a dependency declaration. A manifest
+that already says
+
+```toml
+ndarray = { path = "../../../ndarray" }
+```
+
+is **not** redirected by any `[patch]`. For such a crate the path geometry must
+be correct, or the dependency has to be moved once onto a patchable coordinate
+(a git source, or `workspace = true`). This is precisely why rule 5 is a rule
+and not a preference: a relative path is the one form that cannot be
+centrally redirected.
+
+Within a SINGLE workspace, ordinary local crate paths stay — they are not
+cross-repo and nothing here asks for them to change.
+
+## 4. Falsifiers — rule 10 in practice
+
+Documentation does not prove the law. Each rule gets a mechanical check:
+
+| rule | check |
+|---|---|
+| 3, 9 | `cargo metadata` → count distinct package ids named `ndarray`; `cargo tree -d \| grep ndarray` must be empty |
+| 5 | no `Cargo.toml` in the fleet matches `ndarray *= *{[^}]*path *= *"(\.\./){2,}` |
+| 6 | no `ndarray = { … optional = true` in a crate on the compute-contract list |
+| 2, 7 | no `core::arch`, `_mm_`, `#[cfg(target_arch` or `target_feature` outside `ndarray` itself and `#[cfg(test)]` oracles |
+| 8 | a representative final binary LINKS: Quack, R2IL/OGAR, the Java ABI, the Odoo PoC |
+
+A guard that cannot fail proves nothing: each check needs a disable run
+(introduce the violation, watch the check go red) before it is trusted — the
+same rule this workspace applies to every other gate.
+
+## 5. Anti-patterns, each with the right shape beside it
+
+| anti-pattern | right shape |
+|---|---|
+| "ndarray is mandatory, so this DTO crate must import it" | compute contract, not crate count — leave vocabulary crates alone |
+| "one binary, so merge the crates" | one binary is a LINK property; keep the crates and their contracts |
+| "the duplicate algebra is obviously wrong, delete it" | differential parity first; the difference is the finding |
+| "add `optional = true` so the lean build skips ndarray" | a compute crate without its substrate has no contract left (rule 6) |
+| "`[patch]` will unify it" — on a crate with a literal `path =` | `[patch]` rewrites sources, not path declarations |
+| "`.git` suffix mismatch is a second identity" | cargo canonicalizes; measured, not a duplicate |
+| "bump the three lagging toolchains while we are in here" | that is `ISS-NDARRAY-CANONICAL-COORDINATE-COUPLES-FLEET-MSRV`, its own decision |
diff --git a/.claude/knowledge/FIRST-HAND-SOURCE-LAW.md b/.claude/knowledge/FIRST-HAND-SOURCE-LAW.md
new file mode 100644
index 000000000..2bd61f9f4
--- /dev/null
+++ b/.claude/knowledge/FIRST-HAND-SOURCE-LAW.md
@@ -0,0 +1,106 @@
+# First-hand source law — search finds, read proves
+
+> READ BY: every session before its first search of a task.
+>
+> Owns exactly two things nothing else does: what may be CLAIMED from which
+> operation, and how a human decision is recorded. Everything else is a
+> pointer.
+>
+> Worker mechanics — full-read-before-edit, paging, the report shape, the
+> STOP+escalate triggers: `.claude/v3/knowledge/sonnet-worker-guardrails.md`
+> §1/§5. Agent tiers and one-writer:
+> `.claude/knowledge/tiered-agent-execution-protocol.md`. Not restated here.
+
+## Search is navigation, never evidence
+
+Search, grep, rg, ugrep and Glob establish exactly one thing: **candidate
+locations**. Never what a type or function means, architectural ownership,
+caller semantics, dependency direction, or a global negative (`unused`,
+`no consumers`, `not implemented`, `only`, `all`, `never`).
+
+A load-bearing claim requires reading, first-hand: the defining semantic
+item, enough enclosing contract to interpret it, the callers the claim
+depends on, and the tests that pin the behaviour. Across a crate or repo
+boundary, also the manifests and both sides of the seam.
+
+Incomplete evidence is written `UNKNOWN` / `OPEN` / `PARTIAL`, never an
+inferred completion.
+
+> **A search result or snippet may never be the last evidence before an
+> architectural conclusion.**
+
+## Slicing: two categories, no exception
+
+```text
+EVIDENCE INPUT    source · docs · manifests · tests · plans · contracts
+                  · search results used as evidence
+                  -> tail/head/sed/awk PROHIBITED, direct or through a pipe
+
+EPHEMERAL OUTPUT  build · test · lint · benchmark · runtime logs
+                  -> may be visually limited; truncation is NEVER
+                     sufficient failure analysis
+```
+
+`tail` is not an evidence tool. A failing command is not understood because
+its last lines were read: the root diagnostic is routinely far above the
+window, and the final lines are the epilogue (`aborting due to previous
+error`, `build failed`, `process exited`). So capture the full output,
+locate the FIRST relevant error, read its complete diagnostic block, and
+distinguish root cause from cascade.
+
+`grep`/`rg`/`ugrep` are allowed as LOCATORS. What is prohibited is the
+epistemic misuse, never the implementation.
+
+## Auto-deepen
+
+Deepen before writing the claim if ANY holds: the search returned zero hits
+and an absence claim is contemplated · the statement would use
+none/no-consumer/unused/never/only/all/every/not-implemented · the basis is
+only a snippet · a trait, macro, re-export, generated or feature-gated item
+is involved · the claim crosses a crate or repo boundary · a search or read
+result was truncated, partial, capped or errored · several similarly-named
+implementations exist · the conclusion would delete code, mint a carrier,
+define ownership, change a contract, or become canonical documentation.
+
+Zero results means `no candidates found by this search`, never `it does not
+exist`. **A global negative requires an explicitly CLOSED search space** —
+name tool, pattern and scope, or phrase it "not found in \<scope\>".
+
+A partial read is not evidence for a whole-file claim: **no WHOLE-FILE /
+ALL-CALLERS / NO-CONSUMERS claim while a relevant read is PARTIAL.**
+
+**Context exhaustion must reduce SCOPE, never evidence quality** — shard the
+census or report PARTIAL; never a shallower search because context is tight.
+
+## Authority and evidence are different things
+
+```text
+HUMAN AUTHORIZATION IS PROVENANCE, NOT VALIDATION.
+```
+
+A person chooses direction, scope, policy, naming, acceptable risk.
+`the user chose X` never becomes `X is technically true` without independent
+evidence. So `operator-ruled` / `operator-pinned` / `operator-locked` /
+`operator-confirmed` are not technical status labels in new material.
+
+| state | means |
+|---|---|
+| `MEASURED` | a command produced this; the command is named |
+| `VERIFIED-IN-CODE` | read first-hand at a named location |
+| `TEST-PINNED` | a test fails if this stops holding |
+| `CURRENT-CONTRACT` | what the shipped types require today |
+| `WORKING-MODEL` | in use, not yet falsified |
+| `HYPOTHESIS` / `PROPOSED` | stated to be tested / not in force |
+| `OPEN` / `DEFERRED` | unresolved, deliberately |
+| `SUPERSEDED` | replaced; the replacement is named |
+| `REJECTED-BY-FALSIFIER` | a measurement killed it |
+
+A real decision is recorded as `DECISION` / `SCOPE` / `BASIS` /
+`REVISIT WHEN` — two fields beside any measurement, never one label.
+
+## Enforcement
+
+Partly mechanical, in `.claude/hooks/anti-pattern-matching.sh` — its header
+lists exactly what is DENIED, what is injected, what stays guidance-only, and
+the one measured gap still open. Tested by
+`.claude/hooks/tests/anti-pattern-matching.test.sh`.
diff --git a/.claude/knowledge/tiered-agent-execution-protocol.md b/.claude/knowledge/tiered-agent-execution-protocol.md
index 82dfe1859..3947c507e 100644
--- a/.claude/knowledge/tiered-agent-execution-protocol.md
+++ b/.claude/knowledge/tiered-agent-execution-protocol.md
@@ -84,15 +84,21 @@ authors, never decides — it executes and reports.
    no substitutions, no flags changed.
 2. STOP conditions: any command exits non-zero AND is not covered by the
    retry table → STOP immediately, do not attempt fixes, write your log entry
-   with status=BLOCKED and the last 30 lines of output.
+   with status=BLOCKED and the root diagnostic block (item 4).
 3. Retry table: network-flavored git/curl failures → up to 3 retries with
    2s/4s/8s backoff. Nothing else retries.
-4. Output discipline: capture only the LAST 30 lines of each command, but
-   NEVER let `tail` mask the command's exit status — `cmd | tail -30`
-   reports `tail`'s success even when `cmd` failed. Run each command under
-   `set -o pipefail` (or read `${PIPESTATUS[0]}` before evaluating the
+4. Diagnostic discipline: run the command so its COMPLETE output is
+   retained (redirect to a file, or capture it whole) whenever failure
+   analysis may be needed, and preserve the command's TRUE exit status —
+   `cmd | tail -30` reports `tail`'s success even when `cmd` failed, so run
+   under `set -o pipefail` (or read `${PIPESTATUS[0]}` before evaluating the
    retry/STOP rule); the STOP condition (item 2) tests the PRODUCER's status,
-   not the pipeline's. Never dump full build logs into your reply.
+   not the pipeline's. On failure, locate the FIRST relevant diagnostic (the
+   root, not the last thing printed) and read that complete diagnostic block
+   — a compiler's later errors are usually consequences of the first one, and
+   a trailing summary can omit the root entirely. A short tail or summary is
+   DISPLAY ONLY and is never sufficient evidence; report the root diagnostic
+   block, not a line count. Still never dump a full build log into your reply.
 5. Run-record (MANDATORY, your final act): write your terse run-record to
    your OWN per-run file `.claude/board/exec-runs/<task-slug>.txt`
    (create the dir if absent) in the format below — one executor, one file,
@@ -155,7 +161,13 @@ receipt, NOT a board entry; the supervisor turns it into the board entry.
 - commands: <n>/<total> completed
 - status: GREEN | BLOCKED@cmd<k>
 - gates: <one line per gate command: name → PASS/FAIL/SKIPPED>
-- tail: <last ≤10 lines of the failing command, only if BLOCKED>
+- root_diagnostic: <the FIRST relevant diagnostic block of the failing
+  command, complete, only if BLOCKED — e.g. the first `error[E...]` and its
+  whole body. Bounded: if that block exceeds ~40 lines, give its first 40
+  and say how many were omitted. NEVER a trailing tail: a compiler prints
+  the causal error FIRST and its consequences after, so the last lines are
+  usually the cascade, not the cause.>
+- tail: <last ≤10 lines, only if BLOCKED — context ONLY, never the evidence>
 ```
 
 ## Supervision loop
@@ -175,7 +187,8 @@ receipt, NOT a board entry; the supervisor turns it into the board entry.
   audit trail — the `AGENT_LOG.md` entry the supervisor prepends IS the
   audit trail.
 - A BLOCKED run-record escalates to a Sonnet fix-agent (with the receipt's
-  tail as brief) or to the supervisor; Haiku is never asked to fix.
+  root_diagnostic as the evidence, tail as context) or to the supervisor;
+  Haiku is never asked to fix.
 - Multiple Haiku executors may run in parallel ONLY on disjoint
   crates/directories, ONLY sharing the one `target/` (never
   `isolation: "worktree"`, never a per-executor target dir — see
diff --git a/.claude/prompts/SCOPED_PROMPTS.md b/.claude/prompts/SCOPED_PROMPTS.md
index b361cd788..aa7a0668f 100644
--- a/.claude/prompts/SCOPED_PROMPTS.md
+++ b/.claude/prompts/SCOPED_PROMPTS.md
@@ -223,7 +223,9 @@ grep "pub fn\|pub use" ndarray/src/simd.rs | head -20
 
 # rs-graph-llm: what's broken?
 cat rs-graph-llm/CLAUDE.md 2>/dev/null
-cargo check --manifest-path rs-graph-llm/Cargo.toml 2>&1 | tail -30
+cargo check --manifest-path rs-graph-llm/Cargo.toml > /tmp/rsg.log 2>&1; status=$?
+tail -30 /tmp/rsg.log               # display only
+# "list them all" (Step 2 Q3) is answered from /tmp/rsg.log, never from this tail.
 ```
 
 ## Step 2: Map
diff --git a/.claude/prompts/VERIFY_COMPRESSION_REVOLUTION.md b/.claude/prompts/VERIFY_COMPRESSION_REVOLUTION.md
index 62de0427f..dc7090f3c 100644
--- a/.claude/prompts/VERIFY_COMPRESSION_REVOLUTION.md
+++ b/.claude/prompts/VERIFY_COMPRESSION_REVOLUTION.md
@@ -24,7 +24,10 @@ cat crates/bgz17/src/similarity.rs
 cat crates/lance-graph/src/graph/blasgraph/hdr.rs    # Cascade, HHTL
 find . -name "*.rs" | xargs grep -l "euler\|fibonacci\|rotation\|palette\|codebook"
 find . -name "*.rs" | xargs grep -l "gguf\|quantiz\|compress"
-cargo test --workspace 2>&1 | tail -30
+cargo test --workspace > /tmp/verify.log 2>&1; status=$?
+tail -30 /tmp/verify.log            # display only
+# status != 0 -> read the FIRST relevant diagnostic block in /tmp/verify.log,
+# not this tail: cargo prints the root error first and its consequences after.
 ```
 
 Wenn eine Datei nicht existiert → die Behauptung ist NICHT implementiert.
diff --git a/.claude/settings.json b/.claude/settings.json
index 2c2e9a742..7ba2f4401 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -199,7 +199,7 @@
   "hooks": {
     "PreToolUse": [
       {
-        "matcher": "Grep|Bash",
+        "matcher": "Grep|Bash|Edit|Write|MultiEdit",
         "hooks": [
           {
             "type": "command",
@@ -231,4 +231,4 @@
       }
     ]
   }
-}
\ No newline at end of file
+}
diff --git a/.claude/tools/entries_index.py b/.claude/tools/entries_index.py
new file mode 100644
index 000000000..bd26a6b48
--- /dev/null
+++ b/.claude/tools/entries_index.py
@@ -0,0 +1,418 @@
+#!/usr/bin/env python3
+"""Generate `.claude/board/entries/README.md` — the transient-tier index.
+
+WHY GENERATED
+-------------
+The index was hand-maintained and went stale exactly the way a hand-maintained
+index does. Measured 2026-09-20, before this generator existed:
+
+  * its header claimed "135 entries, 2026-08-06 .. 2026-08-26" against **144**
+    files / 142 rows / range 2026-08-06 .. **2026-08-31**;
+  * its OWN falsifier #2 was RED — two entry files had landed with no index row
+    (`2026-08-27-e-the-fused-payload-…-1`, `2026-08-31-e-q8-…-1`), i.e. the
+    exact stranding the README says the check exists to catch;
+  * one row sat out of date order.
+
+Nothing ran those falsifiers: they were shell snippets in a README, and the
+directory is in no structural gate. So the stranding was invisible by
+construction, which is the same shape as every other drift this workspace
+gates mechanically (`supersession_index.py`, `citation_decay.py`,
+`append_only_gate.py`).
+
+WHAT IS DERIVED AND WHAT IS CARRIED FORWARD (this asymmetry is measured)
+-----------------------------------------------------------------------
+Entry files do NOT share a heading shape. All four of these are live on disk:
+
+    ### E-ID-1
+    ## 2026-08-19 — E-ID-1
+    # E-ID-1            (with a separate `**Date:** 2026-08-27` line)
+    ## 2026-08-31 — E-ID-1 — <the finding, inline after a second em-dash>
+
+So:
+
+  * `date` comes from the FILENAME, which IS uniform (`YYYY-MM-DD-<slug>.md`).
+    Never from the heading — three of the four shapes do not carry it.
+  * `file` is the filename.
+  * `id` is carried forward when the file is already indexed (so the existing
+    mixed case is preserved rather than mass-rewritten), else recovered from
+    the heading, else derived from the slug.
+  * `finding` is **carried forward verbatim**. It is NOT derivable: over 100
+    rows carry a hand-written one-line summary that no heading shape contains.
+    A generator that "derived" this column would silently delete curation.
+    For a NEW entry it is taken from the heading's second em-dash segment when
+    that shape is used, else left empty — exactly today's behaviour.
+
+Curation therefore stays possible in the `finding` cell; structure (which rows
+exist, their dates, their order, the counts) is enforced.
+
+THE TRUNCATION TRAP — WHY THERE IS NO `>` USAGE
+-----------------------------------------------
+Because the committed index is an INPUT (the carried-forward prose), the house
+convention `python3 tool.py > target.md` would have the shell TRUNCATE the file
+before this script reads it, destroying every curated summary in one keystroke.
+That is the destructive-prepend law in root `CLAUDE.md`
+(`.claude/knowledge/never-truncate-a-file-you-still-need-to-read.md`), and it
+is a live risk here precisely because the sibling generator IS used that way.
+
+Hence: default prints to stdout for DIFFING only; `--write` is the sole
+sanctioned mutation and does read-then-write; and `--write` REFUSES to emit
+fewer non-empty `finding` cells than the committed file already has unless
+`--allow-finding-loss` is passed. That guard is the semantic form of the
+no-shrink gate: for a generated table the meaningful quantity is curated cells,
+not lines.
+
+USAGE
+    python3 .claude/tools/entries_index.py            # print (for diffing)
+    python3 .claude/tools/entries_index.py --write     # regenerate in place
+    python3 .claude/tools/entries_index.py --check     # CI: falsifiers + staleness
+    python3 .claude/tools/entries_index.py --self-test
+
+Pure stdlib.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import subprocess
+import sys
+
+ENTRIES_DIR = ".claude/board/entries"
+INDEX = os.path.join(ENTRIES_DIR, "README.md")
+
+FILE_RE = re.compile(r"^(\d{4}-\d{2}-\d{2})-(.+)\.md$")
+# The link target inside the `file` cell: `[text](2026-08-06-foo-1.md)`.
+LINK_TARGET_RE = re.compile(r"\(([^()]*\.md)\)")
+# An id in a heading, with or without a leading date and surrounding markup.
+HEADING_RE = re.compile(r"^#{1,4}\s+(.*)$")
+ID_IN_HEADING_RE = re.compile(r"\b((?:E|D|I|ISS|PROBE|ADR|EXP)-[A-Z0-9][A-Za-z0-9-]{2,})\b")
+
+
+def repo_root() -> str:
+    out = subprocess.run(
+        ["git", "rev-parse", "--show-toplevel"], capture_output=True, text=True
+    )
+    return out.stdout.strip() or "."
+
+
+def parse_index(text: str) -> dict[str, dict[str, str]]:
+    """Existing rows, keyed by the `file` cell's link target.
+
+    Keyed on the link TARGET rather than the id, because the target is what
+    both falsifiers resolve against and the only cell that must match a real
+    path. A row whose target is unparseable is dropped from carry-forward --
+    it cannot be matched to a file, which is itself the finding.
+
+    Cells are split on `|` and rejoined for the middle column, so a `finding`
+    containing a literal pipe survives a round trip instead of shifting every
+    column right of it.
+    """
+    rows: dict[str, dict[str, str]] = {}
+    for line in text.splitlines():
+        if not line.startswith("| 20"):
+            continue
+        parts = line.split("|")
+        if len(parts) < 6:
+            continue
+        date = parts[1].strip()
+        entry_id = parts[2].strip()
+        finding = "|".join(parts[3:-2]).strip()
+        file_cell = parts[-2].strip()
+        m = LINK_TARGET_RE.search(file_cell)
+        if not m:
+            continue
+        rows[m.group(1)] = {"date": date, "id": entry_id, "finding": finding}
+    return rows
+
+
+def recover_from_file(path: str) -> tuple[str, str]:
+    """(id, inline_finding) recovered from the entry's own first heading.
+
+    Handles all four shapes measured on disk. The inline finding is the SECOND
+    em-dash segment of a `## <date> — <ID> — <finding>` heading; the other
+    shapes have none, and the caller leaves the cell empty rather than
+    inventing one.
+    """
+    try:
+        with open(path, encoding="utf-8", errors="ignore") as fh:
+            for line in fh:
+                m = HEADING_RE.match(line.strip())
+                if not m:
+                    continue
+                head = m.group(1).strip()
+                segments = [s.strip() for s in head.split("—")]
+                ident = ""
+                for seg in segments:
+                    hit = ID_IN_HEADING_RE.search(seg)
+                    if hit:
+                        ident = hit.group(1)
+                        break
+                inline = ""
+                if ident and len(segments) >= 3:
+                    tail = segments[2:]
+                    inline = " — ".join(t for t in tail if t).strip()
+                return ident, inline
+    except OSError:
+        pass
+    return "", ""
+
+
+def falsifiers(root: str) -> list[str]:
+    """The README's own three structural checks, as code rather than prose.
+
+    Same three, same directions, unchanged in meaning:
+      1. every index row's file resolves  (catches a row whose file never landed)
+      2. every file has an index row      (catches a file that landed with no row)
+      3. no duplicate entry id
+    1 and 2 are deliberately opposite; a stranding shows up in exactly one.
+    """
+    d = os.path.join(root, ENTRIES_DIR)
+    index_path = os.path.join(root, INDEX)
+    try:
+        with open(index_path, encoding="utf-8") as fh:
+            rows = parse_index(fh.read())
+    except OSError:
+        return [f"FATAL: cannot read {INDEX}"]
+
+    on_disk = sorted(f for f in os.listdir(d) if FILE_RE.match(f))
+    problems: list[str] = []
+
+    for target in sorted(rows):
+        if not os.path.isfile(os.path.join(d, target)):
+            problems.append(f"DANGLING: {target} (index row with no file)")
+
+    for f in on_disk:
+        if f not in rows:
+            problems.append(f"UNREFERENCED: {f} (file with no index row)")
+
+    seen: dict[str, int] = {}
+    for meta in rows.values():
+        key = meta["id"].strip("`").upper()
+        seen[key] = seen.get(key, 0) + 1
+    for key, n in sorted(seen.items()):
+        if n > 1 and key:
+            problems.append(f"DUPLICATE ID: {key} ({n} rows)")
+
+    return problems
+
+
+def render(root: str) -> str:
+    d = os.path.join(root, ENTRIES_DIR)
+    try:
+        with open(os.path.join(root, INDEX), encoding="utf-8") as fh:
+            prior = parse_index(fh.read())
+    except OSError:
+        prior = {}
+
+    files = sorted(f for f in os.listdir(d) if FILE_RE.match(f))
+    rows = []
+    for f in files:
+        m = FILE_RE.match(f)
+        assert m  # guarded by the filter above
+        date, slug = m.group(1), m.group(2)
+        carried = prior.get(f, {})
+        ident = carried.get("id", "")
+        finding = carried.get("finding", "")
+        if not ident or not finding:
+            rec_id, rec_finding = recover_from_file(os.path.join(d, f))
+            if not ident:
+                ident = f"`{rec_id}`" if rec_id else f"`{slug}`"
+            if not finding:
+                finding = rec_finding
+        rows.append((date, ident, finding, f))
+
+    # Newest first; filename as the tie-break so the order is total and stable.
+    rows.sort(key=lambda r: (r[0], r[3]), reverse=True)
+
+    dates = [r[0] for r in rows]
+    out: list[str] = []
+    out.append("# Board entries — one file per finding\n")
+    out.append("")
+    out.append("> **GENERATED — do not hand-edit the table's structure.**")
+    out.append("> `python3 .claude/tools/entries_index.py --write`")
+    out.append(">")
+    out.append("> Each entry is `YYYY-MM-DD-<entry-id>.md`, carrying the entry **verbatim**.")
+    out.append("> This table is the index; the files are the content. A row whose file does")
+    out.append("> not resolve is a broken reference — that is the falsifier, and it is why")
+    out.append("> the index and the content are separate objects.")
+    out.append(">")
+    out.append("> The `finding` cell is the ONE hand-curated column: it is carried forward")
+    out.append("> verbatim on every regeneration, because the entry files do not share a")
+    out.append("> heading shape and it cannot be derived. Edit it freely. `date`, `id`,")
+    out.append("> `file`, the ordering and the counts are derived and will be overwritten.")
+    out.append(">")
+    out.append("> **Never `… > README.md`.** This file is an INPUT to its own generator, so")
+    out.append("> a shell redirect truncates it before the script reads it and every curated")
+    out.append("> `finding` is lost. Use `--write`, which reads first and refuses to drop")
+    out.append("> curated cells.")
+    out.append("")
+    out.append("**Falsifiers** — now executed by CI (`entries_index.py --check`), not just")
+    out.append("described here: (1) every index row's file resolves, (2) every file has an")
+    out.append("index row, (3) no duplicate entry id. Checks 1 and 2 are deliberately")
+    out.append("opposite directions; the stranding this convention prevents shows up in")
+    out.append("exactly one of them, never both.")
+    out.append("")
+    if rows:
+        out.append(f"{len(rows)} entries, {min(dates)} .. {max(dates)}.")
+    else:
+        out.append("0 entries.")
+    out.append("")
+    out.append("| date | entry id | finding | file |")
+    out.append("|---|---|---|---|")
+    for date, ident, finding, f in rows:
+        # Link TEXT keeps the trailing `.md`: that is the existing convention in
+        # 138 of 142 committed rows, and normalising it away would churn every
+        # row of the diff to change nothing a reader sees differently.
+        out.append(f"| {date} | {ident} | {finding} | [{f}]({f}) |")
+    out.append("")
+    return "\n".join(out)
+
+
+def nonempty_findings(text: str) -> int:
+    return sum(1 for meta in parse_index(text).values() if meta["finding"])
+
+
+def committed_findings_at_head(root: str) -> int:
+    """Curated `finding` cells in the index as COMMITTED at git HEAD.
+
+    The write guard's reference point. It must not be the working file: the
+    generated table carries its prose forward FROM that file, so a truncated
+    working copy drags the "after" count down with the "before" count and the
+    guard silently passes. HEAD is outside the shell's reach.
+
+    A path absent at HEAD (the first-ever add) returns 0, which correctly makes
+    the guard inert rather than blocking the initial commit.
+    """
+    out = subprocess.run(
+        ["git", "-C", root, "show", f"HEAD:{INDEX}"],
+        capture_output=True,
+        text=True,
+    )
+    if out.returncode != 0:
+        return 0
+    return nonempty_findings(out.stdout)
+
+
+def main(argv: list[str]) -> int:
+    if "--self-test" in argv:
+        return self_test()
+
+    root = repo_root()
+    index_path = os.path.join(root, INDEX)
+    generated = render(root)
+
+    if "--check" in argv:
+        problems = falsifiers(root)
+        for p in problems:
+            print(f"  {p}")
+        try:
+            with open(index_path, encoding="utf-8") as fh:
+                committed = fh.read()
+        except OSError:
+            print(f"::error::{INDEX} is missing")
+            return 1
+        stale = committed != generated
+        if stale:
+            print(f"::error::{INDEX} is stale.")
+            print("It is GENERATED from the entry files in .claude/board/entries/.")
+            print("Regenerate and commit:")
+            print("  python3 .claude/tools/entries_index.py --write")
+            print("NEVER `… > README.md` — the file is its own input and a redirect")
+            print("truncates it before the generator reads it.")
+        if problems:
+            print("::error::the entries tier failed a structural falsifier (see above).")
+            print("A file with no row is invisible to every index consumer; a row with")
+            print("no file is a broken reference. `--write` fixes both by regenerating.")
+        if stale or problems:
+            return 1
+        print(f"entries index is current and structurally sound ({len(parse_index(generated))} rows)")
+        return 0
+
+    if "--write" in argv:
+        # The reference is git HEAD, NOT the working file. Comparing against the
+        # working file makes this guard VACUOUS for the one trap it exists to
+        # catch: the generated output is DERIVED from that file, so truncating
+        # it lowers both sides equally and an emptied index writes cleanly
+        # (measured -- the first version of this guard returned 0 on a blanked
+        # index, and a `>` redirect would have yielded before=after=0). HEAD is
+        # the last state a shell redirect cannot have destroyed.
+        before = committed_findings_at_head(root)
+        after = nonempty_findings(generated)
+        if after < before and "--allow-finding-loss" not in argv:
+            print(
+                f"::error::refusing to write: curated `finding` cells would drop "
+                f"{before} -> {after}.",
+                file=sys.stderr,
+            )
+            print(
+                "The `finding` column is hand-written and carried forward; losing cells "
+                "means the index was truncated before being read (a `>` redirect) or an "
+                "entry file was renamed out from under its row. Investigate rather than "
+                "overwrite. `--allow-finding-loss` forces it.",
+                file=sys.stderr,
+            )
+            return 1
+        with open(index_path, "w", encoding="utf-8") as fh:
+            fh.write(generated)
+        print(f"wrote {INDEX}: {len(parse_index(generated))} rows, {after} curated findings")
+        return 0
+
+    sys.stdout.write(generated)
+    return 0
+
+
+def self_test() -> int:
+    """Unit checks on the two things that can silently lose data."""
+    fails = []
+
+    # 1. a `finding` containing a literal pipe survives a round trip.
+    piped = (
+        "| date | entry id | finding | file |\n"
+        "|---|---|---|---|\n"
+        "| 2026-08-06 | `E-X-1` | a \\| b and more | [2026-08-06-e-x-1](2026-08-06-e-x-1.md) |\n"
+    )
+    got = parse_index(piped)
+    if got.get("2026-08-06-e-x-1.md", {}).get("finding") != "a \\| b and more":
+        fails.append(f"pipe-in-finding round trip: got {got}")
+
+    # 2. the carried-forward count is what the write guard compares.
+    if nonempty_findings(piped) != 1:
+        fails.append("nonempty_findings miscounted a single curated cell")
+    empty = (
+        "| date | entry id | finding | file |\n"
+        "|---|---|---|---|\n"
+        "| 2026-08-06 | `E-X-1` |  | [2026-08-06-e-x-1](2026-08-06-e-x-1.md) |\n"
+    )
+    if nonempty_findings(empty) != 0:
+        fails.append("nonempty_findings counted an empty cell as curated")
+
+    # 3. all four measured heading shapes yield an id; only the 3-segment one
+    #    yields an inline finding.
+    import tempfile
+
+    shapes = [
+        ("### E-THE-A-1\n", "E-THE-A-1", ""),
+        ("## 2026-08-19 — E-THE-B-1\n", "E-THE-B-1", ""),
+        ("# E-THE-C-1\n\n**Date:** 2026-08-27\n", "E-THE-C-1", ""),
+        ("## 2026-08-31 — E-THE-D-1 — the six does no work\n", "E-THE-D-1",
+         "the six does no work"),
+    ]
+    with tempfile.TemporaryDirectory() as td:
+        for i, (body, want_id, want_find) in enumerate(shapes):
+            p = os.path.join(td, f"2026-08-0{i+1}-e-the-x-1.md")
+            with open(p, "w", encoding="utf-8") as fh:
+                fh.write(body)
+            gid, gfind = recover_from_file(p)
+            if gid != want_id:
+                fails.append(f"shape {i}: id {gid!r} != {want_id!r}")
+            if gfind != want_find:
+                fails.append(f"shape {i}: inline finding {gfind!r} != {want_find!r}")
+
+    for f in fails:
+        print(f"  FAIL  {f}")
+    print("self-test: " + ("ALL PASSED" if not fails else f"{len(fails)} FAILURE(S)"))
+    return 1 if fails else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))
diff --git a/.claude/tools/epiphany_provenance.py b/.claude/tools/epiphany_provenance.py
new file mode 100644
index 000000000..daeaa6146
--- /dev/null
+++ b/.claude/tools/epiphany_provenance.py
@@ -0,0 +1,300 @@
+#!/usr/bin/env python3
+"""Every EPIPHANY added after the baseline must cite its originating entry.
+
+    python3 .claude/tools/epiphany_provenance.py            # gate
+    python3 .claude/tools/epiphany_provenance.py --self-test # falsifier
+
+WHAT IT PROVES, AND ONLY THIS
+-----------------------------
+PROVENANCE. A level-2 `EPIPHANIES.md` heading added since
+`PROCESSED_THROUGH_SHA` must carry a reference to a
+`.claude/board/entries/YYYY-MM-DD-<slug>.md` that EXISTS. That enforces the
+mechanical invariant `work -> entries/`, never `work -> EPIPHANIES.md`.
+
+It does NOT decide whether the entry is a Eureka, whether NEW / LOAD-BEARING /
+DURABLE is satisfied, or whether promoting it was wise. Those are the human
+closeout admission rule and are deliberately not mechanised: a regex that
+tried to judge Eureka-ness would be a guard that fires on everything, which
+carries exactly as much information as one that never fires.
+
+WHY THE WATERMARK IS A SHA AND NOT A DATE
+-----------------------------------------
+Imported entries, backdated headings, rebases and concurrent work all make a
+calendar watermark lie — `supersession_index.py` already refuses git mtime as
+a signal for the same reason ("2026-07-24 is a bulk import ... git dates the
+import, not the work"). The SHA names a revision, so the delta is exact.
+
+WHY THE MARKER IS READ AT THE MERGE-BASE, NOT FROM THE CHECKOUT
+---------------------------------------------------------------
+A branch that ADVANCES the marker would otherwise erase its own delta.
+MEASURED (two ordinary commits, reproduced before this was fixed): C1 adds an
+uncited heading — the gate fires; C2 advances `PROCESSED_THROUGH_SHA` to C1 —
+`git diff C1..HEAD` no longer contains C1's own change, so the gate reports
+`0 added, 0 violations` and the uncited heading ships. Reading the marker as
+the branch INHERITED it closes that: the delta is measured from the baseline
+main had, which no commit on the branch can move. This is the mechanism
+`append_only_gate.py` already uses and documents for the same class of
+problem ("a straight `git show <base>:<path>` would compare against work the
+branch never saw").
+
+The marker not existing at the merge-base is the introducing PR's own case and
+falls back to the checkout, printed so the weaker reference is never silent.
+
+FAIL CLOSED ON A SHALLOW CLONE
+------------------------------
+This repo is routinely a shallow clone (`.git/shallow`, 6 grafts). If the
+baseline revision is above the graft boundary, `git diff` cannot see it. The
+gate then REFUSES with a diagnostic naming the revision. Treating unreachable
+history as an empty delta is the failure this rule exists to prevent: it would
+report a clean pass precisely when it can see nothing.
+"""
+
+import os
+import pathlib
+import re
+import subprocess
+import sys
+
+MARKER = ".claude/board/PROCESSED_THROUGH"
+DEFAULT_BASE = "origin/main"
+EPI = ".claude/board/EPIPHANIES.md"
+ENTRY_REF = re.compile(r"entries/(\d{4}-\d{2}-\d{2}-[A-Za-z0-9._-]+\.md)")
+HEAD2 = re.compile(r"^##\s+(?!#)(.*)$")
+EID = re.compile(r"\b(E-[A-Z0-9][A-Z0-9-]{3,})\b")
+
+
+def run(args, cwd):
+    return subprocess.run(args, cwd=cwd, capture_output=True, text=True)
+
+
+def parse_marker(text: str, where: str) -> str:
+    for line in text.splitlines():
+        if line.startswith("PROCESSED_THROUGH_SHA="):
+            sha = line.split("=", 1)[1].strip()
+            if sha:
+                return sha
+            raise SystemExit(
+                f"epiphany-provenance: empty PROCESSED_THROUGH_SHA= in {where}"
+            )
+    raise SystemExit(f"epiphany-provenance: no PROCESSED_THROUGH_SHA= line in {where}")
+
+
+def baseline_sha(root: str, base_ref: str = DEFAULT_BASE) -> tuple[str, str]:
+    """-> (consumed-input revision, where it was read).
+
+    Read as the branch INHERITED it, not from the checkout — see the module
+    docs: a commit that advances the marker would otherwise erase its own
+    delta. Falls back to the checkout only when the marker does not exist at
+    the merge-base, and the caller prints which reference was used.
+    """
+    mb = run(["git", "merge-base", "HEAD", base_ref], root)
+    if mb.returncode == 0 and mb.stdout.strip():
+        base = mb.stdout.strip()
+        show = run(["git", "show", f"{base}:{MARKER}"], root)
+        if show.returncode == 0:
+            return parse_marker(show.stdout, f"{MARKER} at {base[:12]}"), \
+                f"inherited at merge-base {base[:12]} with {base_ref}"
+
+    p = pathlib.Path(root, MARKER)
+    if not p.is_file():
+        raise SystemExit(
+            f"epiphany-provenance: {MARKER} is missing. The gate cannot define a "
+            "delta without a baseline; add the marker rather than disabling this."
+        )
+    return parse_marker(p.read_text(errors="ignore"), MARKER), \
+        f"the CHECKOUT ({MARKER} absent at the merge-base with {base_ref})"
+
+
+def added_headings(root: str, sha: str) -> list[str]:
+    """Level-2 headings ADDED to EPIPHANIES.md since `sha`.
+
+    Fails closed when `sha` is not reachable — see the module docs.
+    """
+    if run(["git", "cat-file", "-e", f"{sha}^{{commit}}"], root).returncode != 0:
+        shallow = pathlib.Path(root, ".git", "shallow")
+        hint = (
+            " This clone is SHALLOW (.git/shallow exists), so the baseline is most "
+            "likely above the graft boundary. Deepen it "
+            "(`git fetch --shallow-exclude= --unshallow`) and re-run."
+            if shallow.exists() else ""
+        )
+        raise SystemExit(
+            f"epiphany-provenance: baseline revision {sha} is NOT REACHABLE in this "
+            f"repository, so the delta cannot be computed.{hint} REFUSING — "
+            "unreachable history is not an empty delta."
+        )
+    d = run(["git", "diff", "--unified=0", f"{sha}..HEAD", "--", EPI], root)
+    if d.returncode != 0:
+        raise SystemExit(f"epiphany-provenance: git diff failed: {d.stderr.strip()}")
+    out = []
+    for line in d.stdout.splitlines():
+        if not line.startswith("+") or line.startswith("+++"):
+            continue
+        m = HEAD2.match(line[1:])
+        if m:
+            out.append(m.group(1))
+    return out
+
+
+def body_of(text: str, heading: str) -> str:
+    """The entry under `heading`, up to the next heading of level <= 2."""
+    lines = text.split("\n")
+    try:
+        start = next(i for i, l in enumerate(lines)
+                     if HEAD2.match(l) and HEAD2.match(l).group(1) == heading)
+    except StopIteration:
+        return ""
+    end = len(lines)
+    for j in range(start + 1, len(lines)):
+        m = re.match(r"^(#{1,2})\s+(?!#)", lines[j])
+        if m:
+            end = j
+            break
+    return "\n".join(lines[start:end])
+
+
+def check(root: str, base_ref: str = DEFAULT_BASE) -> tuple[list[tuple[str, str]], int, str, str]:
+    """-> (violations, added headings examined, baseline sha, its provenance)."""
+    sha, whence = baseline_sha(root, base_ref)
+    heads = added_headings(root, sha)
+    text = pathlib.Path(root, EPI).read_text(errors="ignore")
+    bad = []
+    for h in heads:
+        body = body_of(text, h)
+        refs = ENTRY_REF.findall(body)
+        live = [r for r in refs if pathlib.Path(root, ".claude/board/entries", r).is_file()]
+        if not refs:
+            bad.append((h, "no entries/ reference"))
+        elif not live:
+            bad.append((h, f"references a file that does not exist: {', '.join(refs[:3])}"))
+    return bad, len(heads), sha, whence
+
+
+def main(argv: list[str]) -> int:
+    root = run(["git", "rev-parse", "--show-toplevel"], ".").stdout.strip() or "."
+    if "--self-test" in argv:
+        return self_test()
+    bad, n, sha, whence = check(root)
+    print(f"epiphany-provenance: baseline {sha[:12]} ({whence}), "
+          f"{n} level-2 heading(s) added since it, {len(bad)} without provenance")
+    if not bad:
+        return 0
+    print()
+    print("::error::An EPIPHANY was added without citing its originating entry.")
+    print("Ordinary work lands in .claude/board/entries/ and is reconciled at")
+    print("closeout; only a surviving Eureka is promoted here, and a promotion")
+    print("must name the entry it came from so the route stays recoverable.")
+    for h, why in bad:
+        eid = EID.search(h)
+        print(f"  - {eid.group(1) if eid else h[:60]}: {why}")
+    return 1
+
+
+def self_test() -> int:
+    """Prove the gate FIRES on a missing reference and STAYS SILENT on a real
+    one — in a throwaway repo, so neither half can pass vacuously."""
+    import tempfile
+
+    d = tempfile.mkdtemp(prefix="epiphany-provenance-selftest-")
+    ent = pathlib.Path(d, ".claude/board/entries")
+    ent.mkdir(parents=True)
+    tools = pathlib.Path(d, ".claude/tools")
+    tools.mkdir(parents=True)
+    epi = pathlib.Path(d, EPI)
+    epi.write_text("# Epiphanies\n\n## 2026-01-01 E-BASE-1 — pre-baseline\n\nbody\n")
+    (ent / "2026-09-20-e-real-1.md").write_text("# entry\n")
+
+    def commit(label: str):
+        run(["git", "add", "-A"], d)
+        run(["git", "-c", "user.email=t@t", "-c", "user.name=t",
+             "commit", "-qm", label], d)
+        return run(["git", "rev-parse", "HEAD"], d).stdout.strip()
+
+    run(["git", "init", "-q"], d)
+    sha = commit("base")
+    # The marker is COMMITTED, and a `main` branch is left pointing at it, so
+    # the merge-base reference the gate actually reads is exercised here rather
+    # than only the checkout fallback.
+    pathlib.Path(d, MARKER).write_text(f"PROCESSED_THROUGH_SHA={sha}\n")
+    commit("marker")
+    run(["git", "branch", "-f", "main"], d)
+
+    def commit_and_check(extra: str, label: str):
+        epi.write_text(epi.read_text() + extra)
+        commit(label)
+        bad, n, _sha, _whence = check(d, "main")
+        return bad, n
+
+    ok = True
+    # startswith, not `in`: the FALLBACK string also names the merge-base (it
+    # says the marker was absent there), so a substring test passed under the
+    # very disable it exists to catch -- vacuous, found by running that disable.
+    _bad, _n, _sha, whence = check(d, "main")
+    if not whence.startswith("inherited at merge-base"):
+        print(f"  FAILED: the merge-base reference was not used ({whence})")
+        ok = False
+
+    # (a) an addition WITH a resolvable reference -> silent
+    bad, n = commit_and_check(
+        "\n## 2026-09-20 E-GOOD-1 — cites its entry\n\n"
+        "From `.claude/board/entries/2026-09-20-e-real-1.md`.\n", "good")
+    print(f"  with a live entries/ reference : {n} added, {len(bad)} violation(s)")
+    if bad or n != 1:
+        print("  FAILED: the gate must stay SILENT on a well-formed promotion")
+        ok = False
+
+    # (b) an addition with NO reference -> fires
+    bad, n = commit_and_check("\n## 2026-09-20 E-BAD-1 — cites nothing\n\nbody\n", "bad")
+    if not any(w == "no entries/ reference" for _h, w in bad):
+        print(f"  FAILED: no violation raised for a reference-less addition ({bad})")
+        ok = False
+    else:
+        print(f"  with no reference             : {len(bad)} violation(s) (fires)")
+
+    # (c) an addition referencing a MISSING file -> fires (a name is not a file)
+    bad, n = commit_and_check(
+        "\n## 2026-09-20 E-BAD-2 — cites a ghost\n\n"
+        "See `.claude/board/entries/2026-09-20-e-does-not-exist.md`.\n", "ghost")
+    if not any("does not exist" in w for _h, w in bad):
+        print(f"  FAILED: a dangling reference was accepted ({bad})")
+        ok = False
+    else:
+        print(f"  with a dangling reference     : fires")
+
+    # (d) ADVANCING the marker past an uncited heading must not erase the
+    # delta. Without the merge-base read this is the measured bypass: two
+    # ordinary commits and the gate goes silent (CodeRabbit on #1254).
+    pathlib.Path(d, MARKER).write_text(
+        f"PROCESSED_THROUGH_SHA={run(['git', 'rev-parse', 'HEAD'], d).stdout.strip()}\n")
+    commit("advance the marker past the uncited headings")
+    bad, n = check(d, "main")[:2]
+    if not bad:
+        print("  FAILED: advancing the marker erased the delta (the bypass)")
+        ok = False
+    else:
+        print(f"  with the marker advanced      : {len(bad)} violation(s) (fires)")
+
+    # (e) an unreachable baseline must REFUSE, never report a clean delta.
+    # Written to BOTH the checkout and the merge-base reference, so neither
+    # path can quietly supply a good baseline and make this arm vacuous.
+    pathlib.Path(d, MARKER).write_text(
+        "PROCESSED_THROUGH_SHA=" + "0" * 40 + "\n")
+    commit("unreachable baseline")
+    run(["git", "branch", "-f", "main", "HEAD"], d)
+    try:
+        check(d, "main")
+        print("  FAILED: an unreachable baseline did not refuse")
+        ok = False
+    except SystemExit as exc:
+        if "NOT REACHABLE" not in str(exc):
+            print(f"  FAILED: wrong refusal: {exc}")
+            ok = False
+        else:
+            print("  with an unreachable baseline  : refuses (fail-closed)")
+
+    print("epiphany-provenance --self-test " + ("PASSED" if ok else "FAILED"))
+    return 0 if ok else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))
diff --git a/.claude/v3/knowledge/sonnet-worker-guardrails.md b/.claude/v3/knowledge/sonnet-worker-guardrails.md
index 0e6e59b00..ce80529d2 100644
--- a/.claude/v3/knowledge/sonnet-worker-guardrails.md
+++ b/.claude/v3/knowledge/sonnet-worker-guardrails.md
@@ -7,6 +7,11 @@
 > every rule here is mechanical — no judgment calls required, ever.
 > If a worker hits a situation not covered by a rule below, the rule is:
 > **STOP and return the question; do not improvise.**
+>
+> The session-level epistemic rules these mechanics implement — what may be
+> CLAIMED from which operation, the auto-deepen triggers, and the
+> authority-vs-evidence separation — live in ONE place and are not restated
+> here: `.claude/knowledge/FIRST-HAND-SOURCE-LAW.md`.
 
 ## Status: FINDING (operator directive 2026-07-02: "no foot gun at any time")
 
@@ -20,7 +25,12 @@ WORKER IRON RULES (V3 workspace — mechanical, no exceptions):
    need another file, STOP and report; do not follow the thread.
 2. READ FULLY: Read every file you will edit, entirely, before editing
    (offset/limit chunks for >2000 lines — ALL chunks). Never paraphrase
-   from grep/snippet output. grep locates; Read comprehends.
+   from grep/snippet output. grep locates; Read comprehends. If a read
+   reports truncation/continuation, continue from the exact next offset
+   until the relevant semantic item is COMPLETE — never first page plus
+   last page and infer the middle, and never a whole-file/all-callers
+   claim while a relevant read is still PARTIAL. sed/head/tail/awk are
+   prohibited for reading source: they cut text, not semantic units.
 3. NO INVENTION: never mint a new struct/trait/enum/module. If the brief
    needs a type, it names the existing one. A "missing" type = STOP+report.
 4. CLASSIDS: compose ONLY via contract::render_classid / compose_classid
@@ -53,7 +63,13 @@ WORKER IRON RULES (V3 workspace — mechanical, no exceptions):
     or be phrased as "not found in <scope searched>".
 11. DONE = your diff + the named test/probe green + a report listing:
     files touched, searches run, anything you did NOT do. Partial work is
-    reported as partial, never as done.
+    reported as partial, never as done. Report shape:
+      STATUS: DONE | PARTIAL | ESCALATE
+      Observed: / Evidence: / Unresolved:
+      Files/semantic items read:
+      Search space closed?  yes/no
+    "Search space closed? no" and a global-negative claim cannot both
+    appear in one report (rule 10).
 ```
 
 ## §2 — Vocabulary disambiguation (the words that bite)
@@ -130,6 +146,13 @@ appears, because each requires accumulation-tier judgment:
 5. The change would add/modify a write path's ownership routing (needs
    v3-mailbox-warden).
 6. Anything RBAC, PII-adjacent, or externally visible.
+6b. A global negative the brief asks for cannot be mechanically closed —
+   the search space stays open (re-exports, macros, generated or
+   feature-gated code, a fully-qualified impl). Return "not found in
+   <scope searched>" plus what would close it; never upgrade it to "does
+   not exist".
+6c. The required evidence does not fit: shard it or return PARTIAL. Never
+   substitute a shallower search because context is getting tight.
 7. The change would make ANY cycle/phase advance wait on a completion
    or confirmation event, an awaited `ractor::call!` response, or any
    awaited I/O — or would add a persisted id→version confirmation ledger
diff --git a/.github/workflows/rust-test.yml b/.github/workflows/rust-test.yml
index 30f1e0eb3..71456e37a 100644
--- a/.github/workflows/rust-test.yml
+++ b/.github/workflows/rust-test.yml
@@ -155,6 +155,13 @@ jobs:
       # had never minted them). One scoped step closes both.
       - name: Run lance-graph-ogar codebook-parity + hotplug-activation tests (armed tier, OGAR sibling)
         run: cargo test --manifest-path crates/lance-graph-ogar/Cargo.toml
+      # r2il-mask-abi-probe (crates/r2il-mask-abi-probe, workspace-EXCLUDED):
+      # its CI step is DELIBERATELY ABSENT until ogar-r2il's `CallMask::words()`
+      # is on OGAR's default branch (AdaWorldAPI/OGAR #305) -- this job checks
+      # the OGAR sibling out with no `ref:`, so the step can only be red before
+      # then, and a red step that lands on main is worse than a gate that
+      # arrives one merge later. Restore it as a one-line follow-up:
+      #   ISS-R2IL-PROBE-HAS-NO-CI-LINE-UNTIL-OGAR-305 (.claude/board/ISSUES.md)
       # deepnsm: standalone 0-dep codec crate, workspace-excluded, so the
       # lance-graph test steps above never reached it. ~217 lib + integration +
       # doctests, fast (no lance/datafusion/ndarray deps). Gating.
diff --git a/.github/workflows/supersession-index.yml b/.github/workflows/supersession-index.yml
index 6550a6df7..a6cf067f7 100644
--- a/.github/workflows/supersession-index.yml
+++ b/.github/workflows/supersession-index.yml
@@ -25,6 +25,18 @@ on:
       # filter had not caught up.
       - .claude/board/entries/**
       - .claude/board/EPIPHANIES.md
+      # The entries tier's OWN generator + index. Added 2026-09-20 with
+      # `entries_index.py`: the index was hand-maintained, its header claimed
+      # 135 entries against 144 files, and its own falsifier #2 was red on two
+      # stranded files -- invisible because the three checks were shell
+      # snippets in a README that nothing executed.
+      - .claude/tools/entries_index.py
+      - .claude/board/entries/README.md
+      # The findings watermark + the provenance gate. An EPIPHANIES addition
+      # after the baseline must cite the entry it was promoted from, so both
+      # the marker and the checker are inputs to that claim.
+      - .claude/tools/epiphany_provenance.py
+      - .claude/board/PROCESSED_THROUGH
       # `crates/` decides the "live" column (:27 globs it per symbol). Broad,
       # and deliberately so: a symbol deleted from the tree changes the table,
       # and the generator takes ~15 s, so the gate is cheap next to the Rust
@@ -42,7 +54,16 @@ jobs:
   regenerate-and-diff:
     runs-on: ubuntu-latest
     steps:
+      # fetch-depth: 0 is REQUIRED by the provenance gate, not a convenience.
+      # `actions/checkout@v4` defaults to depth 1, and MEASURED: a depth-1
+      # clone whose head is ahead of the baseline does not contain the
+      # baseline commit at all (`git rev-list --count HEAD` == 1). The gate
+      # fails CLOSED on an unreachable baseline -- correctly -- so with the
+      # default depth it would go red on every PR after the baseline landed,
+      # for want of history rather than for want of provenance.
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - name: Regenerate and compare
         run: |
           python3 .claude/tools/supersession_index.py > /tmp/regen.md
@@ -59,3 +80,22 @@ jobs:
             exit 1
           fi
           echo "index is current"
+      # The transient tier's index is generated too, and by a SEPARATE
+      # generator: `supersession_index.py` reads `entries/*.md` only to count
+      # D-id coverage and never writes this table. One step, both gates --
+      # staleness AND the three structural falsifiers (row with no file / file
+      # with no row / duplicate id), which until now existed only as prose.
+      - name: Entries index is current and structurally sound
+        run: python3 .claude/tools/entries_index.py --check
+      - name: Entries index generator self-test
+        run: python3 .claude/tools/entries_index.py --self-test
+      # Provenance for anything promoted to EPIPHANIES.md since the findings
+      # baseline: the heading must name an entries/ file that EXISTS. Purely
+      # structural -- it proves the route, never that the content is a Eureka
+      # (that stays the closeout admission rule). Fails CLOSED if the baseline
+      # revision is unreachable in a shallow clone, because an invisible delta
+      # is not an empty one.
+      - name: Post-baseline epiphanies cite their originating entry
+        run: python3 .claude/tools/epiphany_provenance.py
+      - name: Provenance gate self-test
+        run: python3 .claude/tools/epiphany_provenance.py --self-test
diff --git a/CLAUDE.md b/CLAUDE.md
index fa95e10a7..62357376d 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -342,7 +342,9 @@ updating the relevant board file in the SAME commit is incomplete.**
 | A merged PR (post-merge commit) | `.claude/board/LATEST_STATE.md` table + `.claude/board/PR_ARC_INVENTORY.md` PREPEND entry |
 | A new integration plan | `.claude/board/INTEGRATION_PLANS.md` PREPEND + `.claude/plans/<name>-v<N>.md` |
 | A new D-id / deliverable | `.claude/board/STATUS_BOARD.md` row (status = Queued → In progress → In PR → Shipped) |
-| A finding / correction / "aha" | `.claude/board/EPIPHANIES.md` PREPEND dated entry |
+| A finding / measurement / probe result / open point | `.claude/board/entries/YYYY-MM-DD-<entry-id>.md` (the entry verbatim) **+** `python3 .claude/tools/entries_index.py --write` in the SAME commit |
+| A genuine Eureka (passes the § Closeout admission gate below) | `.claude/board/EPIPHANIES.md` PREPEND dated entry |
+| An ordinary correction / lesson learned | **NOTHING** — one closeout line, see § Closeout below |
 | A tech-debt observation | `.claude/board/TECH_DEBT.md` entry |
 | An unresolved issue / blocker | `.claude/board/ISSUES.md` entry |
 | A completed agent run | `.claude/board/AGENT_LOG.md` PREPEND entry (D-ids, commit, tests, outcome) |
@@ -375,6 +377,167 @@ This is a stopping rule, not a loosening: the original gap — merging #881,
 #882 and #883 with no entries at all — remains a real violation. What is
 excluded is only the degenerate tail.
 
+### Closeout — the default is one line, and a fixed mistake has no right to residency
+
+**DECISION (2026-09-20).** The workspace was accumulating correction-shaped
+prose faster than architecture: a mistake became a correction, then a finding,
+then an epiphany, then a post-mortem, then a correction OF the post-mortem, then
+permanent terminology. Measured: `EPIPHANIES.md` is 33,528 lines with no
+admission gate, and no closeout surface existed anywhere under `.claude/`. The
+default is now **fix → compress → keep open points visible → move on.**
+SCOPE: all ordinary work — implementation, audits, PR review, probes,
+integration, `/5plus3` alike. REVISIT WHEN: the ledger starts losing a
+*discovery* rather than a correction.
+
+**The default closeout is ONE compact status record** — not a board entry, not a
+file:
+
+```
+PR #<id> | STATUS: <fixed|measured|open|rejected|done> |
+OUTCOME: <smallest useful statement of what changed> |
+OPEN: <remaining live question(s), or none>
+```
+
+Several trivial corrections collapse into one line (`OUTCOME: 4 review defects
+corrected; executable contract unchanged`). **Do not create one permanent
+artifact per correction.** If a session fixed several things and discovered no
+new architecture, a boring closeout IS success: `STATUS: done | OUTCOME: review
+corrections applied; architecture unchanged | OPEN: none`.
+
+**MIRROR — self-reflection without paperwork.** At a meaningful closeout, at
+most these four fields; omit any field that carries nothing, and omit the whole
+section when it carries nothing. **Silence is allowed.**
+
+```
+MIRROR
+- LESSON: <one sentence, only if useful>
+- BLIND SPOT: <what relevant thing was not inspected / weighted / challenged>
+- BIAS CHECK: <heuristic that may have distorted the search or conclusion>
+- STILL OPEN: <uncertainty we genuinely do not yet understand>
+```
+
+**Kahneman/Tversky as QUESTIONS, never as labels.** Never write "this was
+anchoring" or "confirmation bias caused X" — diagnosing a past self is the
+residue this rule exists to stop. Ask only whether any MAY have contributed:
+
+- **Anchoring** — did the first plausible explanation become the reference later
+  evidence was read *against*, instead of being re-tested independently?
+- **Availability** — was the easiest grep hit, the recent PR or the vivid
+  failure overweighted because it was cheap to retrieve?
+- **Representativeness** — did something LOOK like a known pattern and get
+  treated as the same mechanism without reading the actual contract?
+- **Base rate / population** — was the denominator, frequency or index space
+  ignored; do two similarly shaped masks describe different populations?
+- **Framing** — did the task's wording make one reading feel inevitable; would
+  the conclusion survive a different phrasing?
+- **WYSIATI** — did "what we saw" become "all that exists"; did `search = 0`
+  become absence; did a small visible set become the whole search space?
+- **Sunk cost** — was a mechanism, doc or test preserved mainly because it was
+  already written?
+- **Confirmation pressure** — after forming the hypothesis, did we look for a
+  disable, a counterexample and an alternative, or only for agreement?
+
+**OPEN stays open.** `UNKNOWN` is a valid result. Never manufacture a doctrine,
+a carrier, a term, a follow-up PR or an Epiphany to turn OPEN into CLOSED — a
+visible blind spot is healthier than a fabricated conclusion. Write it plainly:
+`OPEN: ownership still undecided; no measured row-level predicate yet; search
+space not closed; competing explanations remain`.
+
+**Epiphany admission gate — lessons learned are NOT Epiphanies.** "the
+hand-written ternlog immediate was wrong", "the test failed by underflow rather
+than by its assertion", "the CI job attribution was guessed", "the grep was
+correct and the conclusion false", "the tail hid the root diagnostic" are
+LESSONS. Each may become one `MIRROR` line. None enters `EPIPHANIES.md`. A
+candidate must be all three — **NEW** (not already represented),
+**LOAD-BEARING** (changes future architecture, reasoning or representation),
+**DURABLE** (still matters once the PR and the mistake are forgotten) — and pass
+one test:
+
+> **Would this insight still matter if the mistake that led to it had never
+> happened?** NO ⇒ it is not an Epiphany.
+
+Concretely: *"I was wrong about which CI job held the step"* is a correction
+(`STATUS: fixed | OUTCOME: job attribution corrected | OPEN: none`). *"Two masks
+can share a Boolean algebra while inhabiting different population axes, so
+algebraic compatibility does not imply representational substitutability"*
+survives its own mistake and is a candidate. Keep the categories separate.
+
+**The transient tier, and the ONE promotion rule.** Ordinary work lands in
+`.claude/board/entries/` as a dated file — the **transient work/finding tier**,
+not an Epiphany staging folder. It is noisy on purpose: a finding there may be
+wrong, superseded tomorrow, or merely a measurement. Its index is GENERATED
+(`entries_index.py --write`; never `> README.md` — the file is its own input)
+and CI runs the three structural falsifiers, so a stranded file or a stale
+header cannot recur.
+
+At closeout each entry is reconciled against project truth — reuse what exists:
+`PLAN-INVENTORY`'s verdict rubric (**OPEN** = its own status line and/or its
+`STATUS_BOARD` D-ids say work remains · **CLOSED** = its deliverable is
+delivered · **SUPERSEDED** = a higher-numbered sibling or its status says so ·
+**AMBIGUOUS** = no house-format status and no board row), `SUPERSESSION-INDEX`'s
+`route` column, and `preflight_drift` for board-claim-vs-cargo-reality. Then
+exactly four destinations, and no fifth:
+
+| the entry is… | destination |
+|---|---|
+| fixed / obsolete / duplicate / already represented | **nothing durable** — it dies in the tier; git keeps the journey |
+| still genuinely unresolved | one compact **OPEN** row (`ISSUES.md` or `STATUS_BOARD.md`) |
+| implemented / closed | one compact **DONE** row (`STATUS_BOARD.md`, or `LATEST_STATE.md` if it changed the inventory) |
+| NEW **and** LOAD-BEARING **and** DURABLE, and still true after reconciliation | `EPIPHANIES.md` — the rare case |
+
+A surviving Eureka must clear **both** gates: the three-way admission test above
+*and* still being true against the current implementation. **`MIRROR` is never
+promoted by itself** — it is transient reflection and normally dies at closeout;
+only a factual consequence of it (a real open implementation issue) becomes a
+row, and a `BIAS CHECK` line has no durable home at all.
+
+**The checkpoint, and DELTA-ONLY closeout.** `.claude/board/FINDINGS-BASELINE-2026-09-20.md`
+is the one historical catch-up over the 306 findings that went into the
+`EPIPHANIES.md` monolith after the 2026-08-06 split — a **k-frame**. From it
+forward, closeout consumes only the **delta**: read `PROCESSED_THROUGH_SHA`
+from `.claude/board/PROCESSED_THROUGH`, reconcile
+`PROCESSED_THROUGH_SHA..<captured HEAD>`, write the compact state, then
+advance the marker to that captured head. **Routine work never censuses the
+historical `EPIPHANIES.md` monolith again.**
+
+The watermark is a **SHA, not a date** — imports, backdated headings, rebases
+and concurrent work all make a calendar watermark lie, the same reason
+`supersession_index.py` refuses git mtime as a signal. It names the CONSUMED
+INPUT, never the commit that records it: a commit cannot contain its own hash.
+If the SHA is unreachable (shallow clone), tooling FAILS CLOSED — an invisible
+delta is not an empty one.
+
+**The historical prose is FROZEN, not reconciled.** Frozen means *not reread by
+routine closeout*. **Most historical rows were NOT adjudicated** — mechanically
+unjoinable, conflicting evidence, or, most of them, graded `FINDING` / `RULING`
+/ `CORRECTION`, an epistemic grade answering *how well established* rather than
+*is it done*. The generated baseline owns the exact counts; they are not
+restated here. **FROZEN ≠ RECONCILED**, and the ambiguous rows are
+not an invitation to another archaeology pass; if one matters later it resurfaces
+as live work and enters the transient tier like anything else.
+
+A promotion to `EPIPHANIES.md` after the baseline must name the
+`entries/YYYY-MM-DD-*.md` it came from — `epiphany_provenance.py` checks that
+the reference RESOLVES, and nothing more. It proves the route; whether the
+content is a Eureka stays the admission gate above, because a regex that judged
+Eureka-ness would be a guard that fires on everything.
+
+**No recursive post-mortems.** A correction does not entitle a post-mortem, and
+a corrected post-mortem does not entitle another — § Termination clause above is
+the same stopping rule one level down. A review earns a follow-up only for a
+still-live executable defect, an unresolved implementation task, or a true
+Eureka needing independent architectural work. *Documenting what went wrong is
+not itself a follow-up task.*
+
+**Ore and slag.** Ask what survived that future work genuinely needs. **Keep:**
+the current contract, the measured result, the open point, a genuine Eureka.
+**Discard:** stale reasoning, the correction narrative, the duplicate
+explanation, the wrong hypothesis, procedural autobiography, and any elaborate
+lesson already encoded in a test or a guard. **The closeout should usually be
+SMALLER than the reasoning history it closes.** Optimize for clarity, current
+truth, visible uncertainty and minimal durable residue — never for maximum
+documentation. The architecture should stay enjoyable to work on.
+
 ### The falsifiability rule (P0, added 2026-07-26 — 7 instances in one session)
 
 **An assertion implied by the code it tests is not a test.** Before a test
@@ -939,8 +1102,10 @@ the runtime Blackboard. Keep them architecturally distinct.
   architecture), escalate to Opus.
 - **NEVER `haiku` for any subagent in this workspace** — with ONE narrow,
   contract-gated exception: the **guarded-executor** role (run a pre-written,
-  `-p`-scoped bash/cargo card with explicit START/STOP, retry table, tail-30
-  output discipline, one shared `target/`, and a mandatory append-only log
+  `-p`-scoped bash/cargo card with explicit START/STOP, retry table, root-
+  diagnostic output discipline (true exit status preserved, complete output
+  retained, the FIRST relevant diagnostic block read in full — a short tail
+  is display only), one shared `target/`, and a mandatory append-only log
   entry; never authors, decides, or edits any file but the log). See
   `.claude/knowledge/tiered-agent-execution-protocol.md` for the full
   contract. Outside that role the quality floor is Sonnet regardless of task
@@ -1485,6 +1650,29 @@ Two corollaries:
 Cross-ref: the sibling rule below (Read before Write) protects FILES from a
 blind write; this one protects CONCLUSIONS from a blind read.
 
+**The full rule set lives in ONE place: `.claude/knowledge/FIRST-HAND-SOURCE-LAW.md`.**
+The measured table above is why the rule exists; that file is the rule —
+what may be claimed from which operation (search is navigation, never
+evidence), the auto-deepen triggers, the paging rule (a partial Read is not
+evidence for a whole-file claim), and *context exhaustion must reduce SCOPE,
+never evidence quality*. Worker-side mechanics stay where they already are:
+`.claude/v3/knowledge/sonnet-worker-guardrails.md` §1/§5 and
+`.claude/knowledge/tiered-agent-execution-protocol.md`. Read it before the
+first search of a task; do not restate it anywhere.
+
+It also carries the one rule with no other home: **human authorization is
+PROVENANCE, NOT VALIDATION.** A person chooses direction, scope, policy,
+naming and acceptable risk — *"the user chose X"* never becomes *"X is
+technically true"* without independent evidence. So new canonical material
+does not use `operator-ruled` / `operator-pinned` / `operator-locked` /
+`operator-confirmed` as a technical status; it uses an evidence-bearing state
+(`MEASURED` with its command, `VERIFIED-IN-CODE` with its location,
+`TEST-PINNED`, `CURRENT-CONTRACT`, `WORKING-MODEL`, `HYPOTHESIS`, `OPEN`,
+`SUPERSEDED`, `REJECTED-BY-FALSIFIER`), and records a real decision as
+`DECISION` / `SCOPE` / `BASIS` / `REVISIT WHEN`. Historical files keep their
+wording; the `PreToolUse` guard blocks only an edit that INTRODUCES one of
+the four, and lets a supersession note quote it.
+
 **P0 Rule: Read before Write, always.** Before calling `Write` on any path
 that may already exist, run `Read` (or `git status` for committed files).
 The `Edit` tool is the default for modifying existing files; `Write` is only
diff --git a/Cargo.toml b/Cargo.toml
index 70b6525c7..32ab3abb3 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -85,6 +85,13 @@ exclude = [
     # session + Railway/CI. MUST stay excluded (keeps surrealdb-core/OGAR out of
     # the default build). Verify via `cargo build --manifest-path crates/symbiont/Cargo.toml`
     # or `docker build -f crates/symbiont/Dockerfile -t symbiont .`.
+    # W0B mask-ABI differential at the R2IL seam: proves ogar-r2il's CallMask
+    # algebra and lance-graph-mask-risc's agree bit-identically over the same
+    # borrowed words, with CallMask as the oracle. MUST stay excluded -- it
+    # path-deps the OGAR sibling, and no ordinary workspace test should need
+    # that checkout present. Verify via
+    # `cargo test --manifest-path crates/r2il-mask-abi-probe/Cargo.toml`.
+    "crates/r2il-mask-abi-probe",
     "crates/symbiont",
     # OGAR (Open Graph of Active Record) activation crate — re-exports OGAR's full
     # AR surface (ogar-vocab Class/codebook + ogar-class-view impl ClassView +
@@ -334,12 +341,33 @@ datafusion-functions-aggregate = "54"
 object_store = { version = "0.13", features = ["aws"] }
 
 [patch.crates-io]
-# Local sibling checkout of the SAME fork (P0: "prefer the local/fork source,
-# always"; the direct deps already assume the sibling via path = "../../../ndarray").
-# The git-URL form re-fetched AdaWorldAPI/ndarray+its burn submodule on every
-# resolve; burn is outside the session repo scope (403) and the gitlink rev is
-# unfetchable, so the git form deadlocks offline sessions. Path form = zero
-# network, identical source.
+# Redirects the REAL crates.io `ndarray` -- the upstream numeric crate this is
+# a fork OF -- onto the fork, so a transitive pull of upstream can never become
+# a second package identity. Note the section: `[patch.crates-io]` CANNOT
+# redirect the AdaWorldAPI git URL, and two excluded crates
+# (`perturbation-sim`, `helix`) do use that git coordinate. No member binary
+# sees both identities today, but that is a consequence of those crates being
+# EXCLUDED, not of this patch.
+#
+# P0: "prefer the local/fork source, always"; the direct deps already assume
+# the sibling via path = "../../../ndarray".
+#
+# ⊘ CORRECTED 2026-09-20. This comment previously read: "The git-URL form
+# re-fetched AdaWorldAPI/ndarray+its burn submodule on every resolve; burn is
+# outside the session repo scope (403) and the gitlink rev is unfetchable, so
+# the git form deadlocks offline sessions." Measured on master (e1ef350):
+# `git ls-tree HEAD` shows NO `160000` gitlink and NO `.gitmodules` -- `burn`
+# is `crates/burn`, an in-tree workspace member. Its OWN git deps
+# (AdaWorldAPI/burn.git rev 9b2b671) are genuinely out of session scope, but
+# cargo resolves the `ndarray` package rather than every member's
+# dependencies: a throwaway crate with `ndarray = { git = ".../ndarray",
+# branch = "master" }` returned `cargo metadata` exit 0, `Locking 10
+# packages`, `ndarray v0.17.2 (...#e1ef350a)`, no burn fetch, no 403. So the
+# git form does NOT deadlock. What survives: a git coordinate needs network on
+# a fresh resolve where a path coordinate needs none. Path form = zero network,
+# identical source -- which is the reason to keep it, and it is a smaller
+# reason than the one this comment used to give.
+# Full measurement + the target geometry: .claude/knowledge/CARGO-COMPUTE-SUBSTRATE.md
 ndarray = { path = "../ndarray" }
 
 # Dev/test debuginfo OFF (operator, 2026-08-18: "Cargo Debug*=0 or so makes it
diff --git a/crates/r2il-mask-abi-probe/.gitignore b/crates/r2il-mask-abi-probe/.gitignore
new file mode 100644
index 000000000..4fffb2f89
--- /dev/null
+++ b/crates/r2il-mask-abi-probe/.gitignore
@@ -0,0 +1,2 @@
+/target
+/Cargo.lock
diff --git a/crates/r2il-mask-abi-probe/Cargo.toml b/crates/r2il-mask-abi-probe/Cargo.toml
new file mode 100644
index 000000000..9c7969e09
--- /dev/null
+++ b/crates/r2il-mask-abi-probe/Cargo.toml
@@ -0,0 +1,25 @@
+[package]
+name = "r2il-mask-abi-probe"
+version = "0.1.0"
+edition = "2021"
+publish = false
+description = "W0B: the mask-ABI differential at the R2IL seam. Proves ogar-r2il's CallMask algebra and lance-graph-mask-risc's agree BIT-IDENTICALLY over the same borrowed words — and nothing more. NOT a Quack<->R2IL bridge: CallMask indexes call slots inside ONE body (<=180), mask-risc indexes rows of a projection (~64K). Same algebra, different index spaces; the row bridge is W0C."
+
+# Its OWN workspace root. Excluded from lance-graph's so no ordinary
+# workspace test pays for the OGAR sibling checkout, and so `ndarray`'s
+# escaping `../../../ndarray` path (reached through mask-risc) still resolves
+# from its own manifest dir. Same shape as `helix` / `symbiont`.
+[workspace]
+
+[dependencies]
+
+[dev-dependencies]
+# The candidate for the ONE executing algebra.
+lance-graph-mask-risc = { path = "../lance-graph-mask-risc" }
+# The oracle in THIS probe — deliberately not yet the delegating side. Reached
+# by PATH, not git: mask-risc path-deps `ndarray` at `../../../ndarray`, a
+# path that leaves its own workspace and can never resolve through a cargo git
+# checkout, so the differential cannot live on the OGAR side. The direction
+# here matches `crates/symbiont`'s existing `../../../OGAR/crates/...` deps.
+ogar-r2il = { path = "../../../OGAR/crates/ogar-r2il" }
+ogar-loco = { path = "../../../OGAR/crates/ogar-loco" }
diff --git a/crates/r2il-mask-abi-probe/src/lib.rs b/crates/r2il-mask-abi-probe/src/lib.rs
new file mode 100644
index 000000000..c1dd38e1d
--- /dev/null
+++ b/crates/r2il-mask-abi-probe/src/lib.rs
@@ -0,0 +1,5 @@
+//! No library surface — the probe IS its differential test.
+//!
+//! Deliberately empty: this crate exists to hold
+//! `tests/algebra_differential.rs`, and a type declared here would be a
+//! third place the two algebras could disagree.
diff --git a/crates/r2il-mask-abi-probe/tests/algebra_differential.rs b/crates/r2il-mask-abi-probe/tests/algebra_differential.rs
new file mode 100644
index 000000000..8f4314b65
--- /dev/null
+++ b/crates/r2il-mask-abi-probe/tests/algebra_differential.rs
@@ -0,0 +1,353 @@
+//! **W0B — the mask-ABI differential at the R2IL seam.**
+//!
+//! `ogar-r2il`'s [`CallMask`] carries its own Boolean algebra — `and` / `or`
+//! / `xor` / `and_not` / `not` / `count` — over inline `u64` words.
+//! `lance-graph-mask-risc` carries the same algebra as the ONE evaluator
+//! above `ndarray::simd`. `lance-graph-quack`'s own manifest states the rule
+//! this probe exists to test against: *"the masking algebra is reached
+//! THROUGH mask-risc, never beside it."*
+//!
+//! So this asks exactly one question: **do the two agree bit-identically
+//! over the same borrowed words?** `CallMask` is the oracle here and stays
+//! the oracle — nothing is deleted, nothing delegates, no dependency
+//! direction is decided. That decision needs the differential green first.
+//!
+//! # What this does NOT prove
+//!
+//! It is not a Quack↔R2IL bridge, and the two sides are not two views of one
+//! population:
+//!
+//! ```text
+//! CallMask     population = call slots inside ONE body   N <= 180
+//! mask-risc    population = rows of one projection       N ~= 64K
+//! ```
+//!
+//! Same algebra, different index spaces. `n_rows` below is a CallMask's
+//! `len()` precisely so the comparison is apples-to-apples on the narrow
+//! side; feeding a body's call mask to a row-population consumer would be a
+//! category error, not an optimisation. Deriving a genuine row predicate
+//! from a body is W0C.
+//!
+//! # Kill condition
+//!
+//! A disagreement is the FINDING, not a bug to align away. Do not "fix"
+//! either side until it is settled which semantics is correct — the
+//! difference is the information.
+
+use lance_graph_mask_risc::{
+    execute, words_for, MaskOp, Operand, Planes, Program, Scratch, Terminal, Value,
+};
+use ogar_loco::LaneShape;
+use ogar_r2il::CallMask;
+
+/// Every shape, with the call population `ogar-loco` derives for it
+/// (`CONTENT_SLOTS × calls_per_lane` = 30 × 6 / 4 / 3).
+const SHAPES: [(LaneShape, u32, usize); 3] = [
+    (LaneShape::Pairs, 180, 3),
+    (LaneShape::Triples, 120, 2),
+    (LaneShape::Quads, 90, 2),
+];
+
+fn lcg(seed: &mut u64) -> u64 {
+    *seed = seed
+        .wrapping_mul(6364136223846793005)
+        .wrapping_add(1442695040888963407);
+    *seed >> 11
+}
+
+/// A seeded mask plus every word/population boundary the shape can express.
+///
+/// The explicit edges are the point: `63/64` and `127/128` are the word
+/// seams, and `len-1` is the straddling word's last real bit. A purely
+/// random fixture hits them only by luck, and the tail is exactly where two
+/// complement implementations diverge.
+fn seeded(shape: LaneShape, seed: u64, density: u64) -> CallMask {
+    let mut m = CallMask::empty(shape);
+    let mut s = seed;
+    for i in 0..m.len() {
+        if lcg(&mut s) % 100 < density {
+            m.set(i);
+        }
+    }
+    for edge in [0u32, 1, 62, 63, 64, 65, 126, 127, 128, 129] {
+        if edge < m.len() && edge % 3 != 0 {
+            m.set(edge);
+        }
+    }
+    if m.len() >= 2 {
+        m.set(m.len() - 2);
+        m.set(m.len() - 1);
+    }
+    m
+}
+
+/// Run a one-op program over borrowed CallMask words and read the result back.
+fn run_mask_op(op_of: impl Fn(Operand, Operand) -> MaskOp, a: &CallMask, b: &CallMask) -> Vec<u64> {
+    let n_rows = a.len() as usize;
+    let program = Program::new(
+        vec![op_of(Operand::Plane(0), Operand::Plane(1))],
+        Terminal::Keep {
+            mask: Operand::Scratch(0),
+        },
+    );
+    let planes: [&[u64]; 2] = [a.words(), b.words()];
+    let planes = Planes {
+        n_rows,
+        masks: &planes,
+        lanes: &[],
+    };
+    let mut scratch = Scratch::for_program(&program, n_rows).expect("scratch");
+    let v = execute(&program, &planes, &mut scratch, None).expect("execute");
+    assert_eq!(
+        v,
+        Value::Mask(Operand::Scratch(0)),
+        "Keep must report the slot it kept"
+    );
+    scratch.slot(0).expect("slot 0").to_vec()
+}
+
+/// The word count the two sides must independently agree on.
+///
+/// Not a formality: `CallMask::words()` slices to `len.div_ceil(64)` and
+/// mask-risc sizes a scratch slot with `words_for(n_rows)`. If those ever
+/// disagreed, every comparison below would be between slices of different
+/// length and the `assert_eq!` would report a shape mismatch rather than a
+/// semantic one.
+#[test]
+fn both_sides_span_the_same_words() {
+    for (shape, want_len, want_words) in SHAPES {
+        let m = CallMask::all(shape);
+        assert_eq!(m.len(), want_len, "{shape:?}: population");
+        assert_eq!(
+            m.words().len(),
+            want_words,
+            "{shape:?}: CallMask slice width"
+        );
+        assert_eq!(
+            words_for(m.len() as usize),
+            want_words,
+            "{shape:?}: mask-risc words_for disagrees with the CallMask slice"
+        );
+    }
+}
+
+#[test]
+fn and_or_xor_andnot_agree_bit_for_bit() {
+    for (shape, _, _) in SHAPES {
+        for (sa, sb) in [(1u64, 2u64), (0xDEAD, 0xBEEF), (7, 7)] {
+            for (da, db) in [(50u64, 50u64), (3, 97), (100, 0), (0, 0), (100, 100)] {
+                let a = seeded(shape, sa, da);
+                let b = seeded(shape, sb, db);
+
+                for (name, expect, op) in [
+                    (
+                        "and",
+                        a.and(&b),
+                        (|x, y| MaskOp::And { a: x, b: y, dst: 0 })
+                            as fn(Operand, Operand) -> MaskOp,
+                    ),
+                    ("or", a.or(&b), |x, y| MaskOp::Or { a: x, b: y, dst: 0 }),
+                    ("xor", a.xor(&b), |x, y| MaskOp::Xor { a: x, b: y, dst: 0 }),
+                    ("and_not", a.and_not(&b), |x, y| MaskOp::AndNot {
+                        a: x,
+                        b: y,
+                        dst: 0,
+                    }),
+                ] {
+                    let got = run_mask_op(op, &a, &b);
+                    assert_eq!(
+                        got,
+                        expect.words(),
+                        "{shape:?} {name}: seeds ({sa},{sb}) density ({da},{db}) \
+                         -- CallMask and mask-risc disagree. THIS IS THE FINDING: \
+                         settle which semantics is correct before aligning either side."
+                    );
+                }
+            }
+        }
+    }
+}
+
+/// `not` is the one with a tail obligation on both sides, so it gets its own
+/// test: `CallMask::not` clears per-word against `len`, mask-risc's `Not`
+/// documents "(tail cleared)" against `n_rows`. They agree only if both
+/// clear against the same population — which is what this measures.
+#[test]
+fn not_agrees_including_the_tail() {
+    for (shape, _, _) in SHAPES {
+        for (seed, density) in [(1u64, 0u64), (2, 50), (3, 100), (4, 1)] {
+            let a = seeded(shape, seed, density);
+            let n_rows = a.len() as usize;
+            let program = Program::new(
+                vec![MaskOp::Not {
+                    a: Operand::Plane(0),
+                    dst: 0,
+                }],
+                Terminal::Keep {
+                    mask: Operand::Scratch(0),
+                },
+            );
+            let planes: [&[u64]; 1] = [a.words()];
+            let planes = Planes {
+                n_rows,
+                masks: &planes,
+                lanes: &[],
+            };
+            let mut scratch = Scratch::for_program(&program, n_rows).expect("scratch");
+            execute(&program, &planes, &mut scratch, None).expect("execute");
+            assert_eq!(
+                scratch.slot(0).expect("slot 0"),
+                a.not().words(),
+                "{shape:?} not: seed {seed} density {density} -- tail handling differs"
+            );
+        }
+    }
+}
+
+#[test]
+fn count_agrees_with_the_count_terminal() {
+    for (shape, _, _) in SHAPES {
+        for (seed, density) in [(1u64, 0u64), (2, 13), (3, 50), (4, 99), (5, 100)] {
+            let a = seeded(shape, seed, density);
+            let n_rows = a.len() as usize;
+            let program = Program::new(
+                vec![],
+                Terminal::Count {
+                    mask: Operand::Plane(0),
+                },
+            );
+            let planes: [&[u64]; 1] = [a.words()];
+            let planes = Planes {
+                n_rows,
+                masks: &planes,
+                lanes: &[],
+            };
+            let mut scratch = Scratch::for_program(&program, n_rows).expect("scratch");
+            let v = execute(&program, &planes, &mut scratch, None).expect("execute");
+            assert_eq!(
+                v,
+                Value::Count(a.count() as usize),
+                "{shape:?} count: seed {seed} density {density}"
+            );
+        }
+    }
+}
+
+/// The four binary ops as TERNLOG immediates.
+///
+/// `CallMask` has no three-input op, so this is the direction the agreement
+/// actually matters in: if mask-risc's arbitrary-immediate form reproduces
+/// all four of CallMask's binary ops, then CallMask's algebra is a SUBSET of
+/// mask-risc's, not a sibling of it — which is the evidence the ownership
+/// decision (deferred out of this probe) will need.
+///
+/// The immediates are DERIVED from each op's own truth table, never written
+/// by hand. Hand-writing them is how the first draft of this test failed:
+/// `and` was given `0b1010_0000` (bits 7 and 5) where only bit 7 is the
+/// conjunction, and the failure looked like a substrate disagreement rather
+/// than an arithmetic slip in the fixture.
+fn ternlog_imm_for(f: impl Fn(bool, bool) -> bool) -> u8 {
+    let mut imm = 0u8;
+    for idx in 0u8..8 {
+        // VPTERNLOG index convention: (a << 2) | (b << 1) | c.
+        let a = idx & 0b100 != 0;
+        let b = idx & 0b010 != 0;
+        let c = idx & 0b001 != 0;
+        // `c` is bound to `a`'s plane below, so triples with `a != c` are
+        // unreachable and their bits are left zero — one canonical immediate
+        // per function rather than the four that would also work.
+        if a == c && f(a, b) {
+            imm |= 1 << idx;
+        }
+    }
+    imm
+}
+
+#[test]
+fn ternlog_reproduces_callmask_s_binary_ops() {
+    let and = ternlog_imm_for(|x, y| x && y);
+    let or = ternlog_imm_for(|x, y| x || y);
+    let xor = ternlog_imm_for(|x, y| x != y);
+    let andnot = ternlog_imm_for(|x, y| x && !y);
+
+    // Pinned, so a change to the index convention fails HERE with the
+    // derivation visible, not inside a mask comparison.
+    assert_eq!(and, 0b1000_0000, "and = index 7 only");
+    assert_eq!(or, 0b1010_0100, "or = indices 2, 5, 7");
+    assert_eq!(xor, 0b0010_0100, "xor = indices 2, 5");
+    assert_eq!(andnot, 0b0010_0000, "and_not = index 5 only");
+    // The four must be distinct, or the test could pass with one op's
+    // immediate standing in for another's.
+    let mut seen = [and, or, xor, andnot];
+    seen.sort_unstable();
+    assert!(
+        seen.windows(2).all(|w| w[0] != w[1]),
+        "two ops derived the same immediate: {seen:?}"
+    );
+
+    for (shape, _, _) in SHAPES {
+        for (sa, sb, da, db) in [(1u64, 2u64, 50u64, 50u64), (9, 4, 7, 93), (5, 5, 100, 0)] {
+            let a = seeded(shape, sa, da);
+            let b = seeded(shape, sb, db);
+            let n_rows = a.len() as usize;
+
+            for (name, imm, expect) in [
+                ("and", and, a.and(&b)),
+                ("or", or, a.or(&b)),
+                ("xor", xor, a.xor(&b)),
+                ("and_not", andnot, a.and_not(&b)),
+            ] {
+                let program = Program::new(
+                    vec![MaskOp::Ternlog {
+                        imm,
+                        a: Operand::Plane(0),
+                        b: Operand::Plane(1),
+                        c: Operand::Plane(0),
+                        dst: 0,
+                    }],
+                    Terminal::Keep {
+                        mask: Operand::Scratch(0),
+                    },
+                );
+                let planes: [&[u64]; 2] = [a.words(), b.words()];
+                let planes = Planes {
+                    n_rows,
+                    masks: &planes,
+                    lanes: &[],
+                };
+                let mut scratch = Scratch::for_program(&program, n_rows).expect("scratch");
+                execute(&program, &planes, &mut scratch, None).expect("execute");
+                assert_eq!(
+                    scratch.slot(0).expect("slot 0"),
+                    expect.words(),
+                    "{shape:?} ternlog imm {imm:#010b} must reproduce CallMask::{name}"
+                );
+            }
+        }
+    }
+}
+
+/// **Anti-vacuity.** Every comparison above is between two computed masks;
+/// if the fixtures were degenerate — all-zero, all-one, or `a == b` — most
+/// of the ops would coincide and the differential would pass while proving
+/// almost nothing.
+#[test]
+fn the_fixtures_actually_discriminate() {
+    for (shape, _, _) in SHAPES {
+        let a = seeded(shape, 1, 50);
+        let b = seeded(shape, 2, 50);
+        assert_ne!(a.words(), b.words(), "{shape:?}: fixtures are identical");
+        assert!(a.count() > 0, "{shape:?}: a is empty");
+        assert!(a.count() < a.len(), "{shape:?}: a is full");
+        assert_ne!(
+            a.and(&b).words(),
+            a.or(&b).words(),
+            "{shape:?}: and == or, so the ops cannot be told apart"
+        );
+        assert_ne!(
+            a.xor(&b).words(),
+            a.and_not(&b).words(),
+            "{shape:?}: xor == and_not, so the ops cannot be told apart"
+        );
+    }
+}