W2 arc: real-owner KanbanActor probe, W2a LAYOUT-GATED ruling, R-2 edges proof, semantic-OS capstone on the board

.claude/board/CROSS_SESSION_BROADCAST.md

@@ -175,3 +175,30 @@ can synthesize via existing `unpack_lo/hi_epi8` + I32 ops.
   `.claude/handovers/2026-07-02-cross-session-wishlist-intake.md`.
 - **Citation rule adopted:** cross-session references carry board
   `E-<NAME>` keys or file paths, never per-session ordinals.
+
+## 2026-07-02 — E-SEMANTIC-OS-CONVERGENCE-1: the operator's capstone framing is on the board — cite it, don't re-derive it
+
+**For:** every parallel session. The operator synthesized the fleet-wide
+convergence: the center is a verified semantic substrate, the recurring
+epiphany is MEMBRANES, and the one law is **"Do not copy meaning.
+Reference it, mask it, materialize it, trace it."** Full canonical text +
+the [G] grounding table (every semantic-OS analogy row mapped to its
+shipped artifact) + two sharpenings (the third membrane failure mode is
+DUPLICATION; a membrane without a build-failing tripwire is prose):
+`.claude/board/EPIPHANIES.md` E-SEMANTIC-OS-CONVERGENCE-1. New design
+docs should cite this entry as the frame instead of restating fragments.
+
+## 2026-07-02 — W2 arc: W2b real-owner probe + W3b KanbanSessionStorage (M25) SHIPPED; W2a ruled LAYOUT-GATED
+
+**For:** all sessions. On the shared branch: (1) **W2b** — KanbanActor
+spawned over the REAL `MailboxSoA` for the first time (3 probes green;
+dev-dep only). (2) **W3b/M25** — `graph-flow` gains a `kanban` feature:
+`KanbanSessionStorage` (snapshot + append-only real-KanbanMove log, V1
+Rubicon mapping) with the kill-mid-graph replay gate GREEN — every
+graph-flow execution is now replayable from the board (rs-graph-llm
+branch). (3) **W2a** envelope-audit: LAYOUT-GATED — BoardAggregates =
+NEW append-only 10th ValueTenant @152; T1–T6 mandatory; the board
+classid MUST come through the next batched mint (queue yours);
+`nan_projection` + symbiont fixed-offset readers are the two EXPOSED
+sweepers to gate. (4) R-2 residual closed (edges-only strided read
+proof). Capstone frame for all of it: E-SEMANTIC-OS-CONVERGENCE-1.

.claude/board/EPIPHANIES.md

@@ -1,3 +1,16 @@
+## 2026-07-02 — E-1BRC-ADDRESSING-1: addressing-is-aggregation measured — route-and-write is 3× the classic map; the Morton dress costs ~10%
+**Status:** FINDING (measured, onebrc-probe t0–t3, recipe corpus rows=10000000 seed=42 sha256=f1853caa…5691, 4-core container; tables in `crates/onebrc-probe/README.md` §5–5.3)
+
+The 1BRC probe (operator-requested, Addendum-13) closed all six lanes. The ladder, medians at 4 workers: BTreeMap map (C) 28.3 Mrows/s → ractor actor-per-worker (D) 22.4 (the "helper, not a messaging path" ruling measured: ~20% actor tax, dominated by the forced Arc corpus copy) → kanban-carded (E) ≈ D (journaling floor WITHIN NOISE; ~66 µs/card at 256-card granularity = ~0.01% of the W2d 550 ms Libet budget — the board is not a scheduling threat) → **flat SoA route-and-write: radix control (R) 86.3, Morton tile address (F) 77.4**. Three load-bearing numbers: (1) group-by-as-address-route into SoA accumulators with gated indexed writes beats look-up-and-compare by **3×** — the substrate's aggregation shape is right; (2) the semantic (Morton tile) address costs **~10% over plain radix** at ~400-group cardinality — directionally validating addressing-is-aggregation while honestly pricing the address layer (the canon's prefix-local-tile payoff is a HIGH-cardinality claim this corpus cannot test); (3) SIMD delimiter-scan alone (B, 1.06×) is not where the win lives — the accumulator is. Fence kept: every number travels with its regenerable corpus recipe.
+## 2026-07-02 — E-SEMANTIC-OS-CONVERGENCE-1: the operator's capstone — "code is no longer the center; the center is a verified semantic substrate"
+**Status:** FINDING (operator synthesis across 7+ parallel sessions, recorded verbatim below; grounding table + two sharpenings appended by this session)
+
+**Operator's text (canonical, preserved):** The fleet keeps rediscovering ONE shape — `semantic facts → classid/codebook → mask/ClassView → deterministic materialization → adapter → execution → trace/falsifier/replay` — and the repeated epiphany is MEMBRANES (classid opacity; public/private evidence; data/behaviour; source/materialization; task/state/WAL; frontend/backend; human-session/claim-board). Every failure came from a membrane missing or leaky (proprietary leak, classid bit math, stale toolchain assumptions, duplicate session work, unacked graph steps, hand-census drift, template/accessor drift, floating pins, green CI that didn't test the real fuse); every success from making the membrane explicit (opaque facet_classid → the flip was free; FieldMask → UI/RBAC/render convergence; predicate registry → reassemble inverse mint; WAL ack CastId↔LanceVersion → replayable task graph; claim files/board entries → fewer collisions; generated scans → no census rot). The convergence: **business logic becomes addressable semantic topology; execution becomes a reversible, audited projection; coordination becomes the same substrate applied to humans and agents.** The one law: **"Do not copy meaning. Reference it, mask it, materialize it, trace it."** Sharper: ISA compresses meaning · ClassView projects meaning · adapters incarnate meaning · falsifiers protect meaning · boards coordinate meaning. The meta-result: not "Odoo in Rust" or "graph-flow orchestration" — a **semantic operating system**: ontology = filesystem · classid = inode · ClassView = permissioned view · adapter = device driver · kanban/WAL = process journal · falsifier = fsck · **LLM = oracle interrupt**.
+
+**Grounding table (every analogy row has a shipped artifact — this is [G], not aspiration):** classid=inode → OGAR-CONSUMER-BEST-PRACTICES' literal one-liner "the classid is pure address; the magic is what it resolves to" + the opacity accessors (`concept_of`/`app_of`, bit math banned); ClassView=permissioned view → FieldMask + the RBAC keystone + `value_schema`/`edge_codec_flavor` lens selection; adapter=device driver → `ogar-adapter-{surrealql,ttl,clickhouse-ddl}` emitting from the Core, never carrying state; kanban/WAL=process journal → M24 board-as-WAL + the CastId↔LanceVersion ack join + temporal deinterlace (replay = a read at a pinned QueryReference); falsifier=fsck → the probe queues, the flip fuse + COUNT_FUSE (which demonstrably FIRED in the #148/#632 merge window and cleared — fsck catching a real inconsistency on day one), the scan family (classid_scan/emission_scan); LLM=oracle interrupt → MEASURED, not metaphor: 1–2 ms framework vs 8.4–8.7 s oracle round trip (E-V3-ORACLE-LIVE-1) — the oracle is invoked on FailureTicket exactly like a page-fault handler, never polled. "Do not copy meaning" is the one law the whole ENTROPY ledger already enforces case-by-case: every M1–M25 row is a "meaning was copied N times → reference it once" collapse, and wire-don't-invent / the consumer preflight (never copy the codebook) / zero-copy-to-tombstone / REUSE-AS-REFERENCE verdicts are its instances.
+
+**Two sharpenings (this session's additions):** (1) the failure list has a THIRD membrane failure mode beyond missing/leaky — **duplicated**: two membranes for one boundary (two GateDecisions, two ResonanceDtos, three coordination-channel proposals) — and the entropy ledger is the fsck FOR membranes themselves; (2) a membrane is only real when crossing it wrongly **fails a build** — "membrane" without a tripwire is prose; the per-consumer-ownership + fuses ruling is the enforcement half of the law, so the doctrine's operational test is: *name the fuse or it isn't a membrane yet*.
+
 ## 2026-07-02 — E-V3-XSESSION-INTAKE-1-RULINGS: operator closed the intake's escalations — R-1 was a PHANTOM, R-2 is an edges-projection requirement, L3 schema design is KILLED
 **Status:** CORRECTION + FINDING (three operator rulings on E-V3-XSESSION-INTAKE-1; full text in the intake handover appendices)
 

.claude/board/LATEST_STATE.md

@@ -100,6 +100,7 @@ Membrane consumers can now pull BOTH halves of a render `classid` BBB-safely fro
 
 | PR | Merged | Title | What it added |
 |---|---|---|---|
+| **#632** | 2026-07-02 | Cross-session intake: RouteBucketTyped (C6) + emission_scan + OCR codebook mirror + GraphRAG-rs inventory + operator rulings | Three sibling wishlists dispositioned; C6 merged verbatim (nexgen retires vendor diff); emission_scan = 2nd scan-family instance (pattern NAMED); OCR 0x08XX mirror of OGAR #148 (fuses arc: flip fuse + two-sided COUNT_FUSE — fuse FIRED 65v68 in the merge window, cleared by lock bump, 68==68); rulings: ownership+tripwires, R-1 naming phantom (domain:appid:classview), R-2 closed (512B row frozen, strided edges), L3 schema design killed; codex P2 x2 resolved (precedence global; collision documented). Contract 792/792. Merge `df367471`. |
 | **#631** | 2026-07-02 | W1b LIVE: WAL batch writer (4 probes green) + M15 rename + temporal synthesis + live oracle numbers | batch_writer implemented: BTreeMap WAL board, ack(cast, LanceVersion) join, delegation cache, never-refuses stacking (probe 4); M15 MulGateDecision rename (W2 unblocked; collapse_gate confirmed 3rd distinct type); operator rulings pinned (zero-copy descriptor casts + eager drain + mutual masking; melden macht frei — freeze retracted; temporal.rs = the read side, replay = QueryReference::at + deinterlace, M24=M25=time-travel ONE mechanism). Measured live: W3c oracle 1-2 ms framework overhead vs 8.4-8.7 s LLM round trip (rig->xAI grok-4 via FlowRunner); JITSON serve.rs = local CI oracle delta. Planner lib 204 + probes 4/4. Merge `c7149eab`. |
 | **#630** | 2026-07-02 | V3 W1 START: preflight deltas + WAL writer probes + adoption scan + D-PERT-1 + temporal synthesis | Fable-5 ten-point preflight (M24 board=WAL, W6a baseline inversion, W3 oracle ratchet, W2 probe-first reorder) + operator rulings folded live: zero-copy sink (cast = descriptor never bytes, flush via NodeRowPacket::as_le_bytes), "melden macht frei" (stacked casts never refused — 4 ignored probes define W1b green), temporal.rs deinterlace = the READ side (replay = QueryReference::at + deinterlace; M24/M25/time-travel are ONE mechanism; ack carries LanceVersion). Landed code: batch_writer skeleton + 4 probes; contract::classid_scan (771 green); D-PERT-1 rename (462 green). Audits: planner-SoA type-real/wiring-dormant (M15 GateDecision rename BLOCKING before W2); M7 corrected (NodeRowPacket IS production SoaEnvelope, codex P2); graph-flow benched ~0.4-0.5us/step (two-speed confirmed); M25 KanbanSessionStorage design (graph-flow-kanban envelope exists — wire don't invent). Merge `9a6df2a1`. |
 | **#629** | 2026-07-02 | V3 SUBSTRATE consolidated entry point (`.claude/v3/`) + ractor ownership attestation | `.claude/v3/` tree shipped: README (orientation), INTEGRATION-PLAN (W0–W6), COMPONENT-MAP (reuse/repurpose/retire), ENTROPY-MILESTONES (N→1 ledger), MODULE-TABLE (per-file census core/contract/planner), soa_layout/ (LE contract, tenant lanes, consumer map, routing), knowledge/ (substrate primer, mailbox-kanban model, sonnet-worker-guardrails), agents/BOOT.md (4 V3 cards); `/v3` skill + `/v3-audit` command; CLAUDE.md/BOOT.md ★ entrypoint. Review sharpenings folded: LE byte-order range-scan caveat, 3-shape legacy corpus scanner (incl. `0xAAAA_DDCC`), ractor helper-scope ruling (NOT messaging — slow; helper only: spawn/supervision/occasional control RPC). Ownership compile attestation: `KanbanActor<O: MailboxSoaOwner>` `type State = O`, owner MOVES in at pre_start; 22 supervisor tests green on the AdaWorldAPI ractor fork. Merge `28f17cd7`. |

.claude/board/PR_ARC_INVENTORY.md

@@ -35,6 +35,20 @@
 
 ---
 
+## #632 lance-graph: Cross-session intake — RouteBucketTyped (C6) merged, emission_scan minted, OCR codebook mirror, GraphRAG-rs inventory + operator rulings
+
+**Status:** MERGED 2026-07-02 (merge commit `df367471`), branch `claude/v3-substrate-migration-review-o0yoxv`. Companion: OGAR #148 (merge `75d955b`) — the cross-repo fuses + serialized allocation batch; merged FIRST per the lockstep note; this post-merge commit carries the ogar-vocab lock bumps that cleared COUNT_FUSE (fired 65 vs 68 in the in-between state — first live demonstration of the fuse mechanism, then green 68 == 68, lance-graph-ogar 81 tests).
+
+**Added:** `codegen_spine::RouteBucketTyped` (kind-generic sibling + `?Sized` blanket bridge, merged verbatim from op-nexgen's vendored C6 diff); `contract::emission_scan` (TypedForm + classify_ddl_type + EmissionCounts; the scan family named as a contract pattern); `ogar_codebook` 0x08XX OCR rows (unicharset/recoder/charset — mirror of OGAR #148's mint; CODEBOOK 68); `.claude/knowledge/graphrag-rs-inventory.md`; the cross-session intake handover + appendices.
+
+**Locked:** per-consumer classid ownership + tripwires (operator ruling — fuses ARE the coordination mechanism; flip fuse + two-sided COUNT_FUSE are the pattern instances); R-1 naming CLOSED as phantom (`domain:appid:classview`; "concept" names the whole hi u16; the "app" homonym across halves caused the thread; both ledgers carry the line); R-2 CLOSED (512-byte SoA row frozen — kv-lance + batch-writer tested; edges read via the NODE_ROW_COLUMNS strided 16-of-512 view; no storage change); L3 new-Arrow-schema design KILLED ("we already have a working SoA schema" — extraction lands as SoA rows via the W1b cast path; survivors: minter@sha provenance + ndjson-as-golden); scan-family pattern (third counter mirrors, never a bespoke grep); emission_scan precedence global-not-first-token (codex P2 fix); RouteBucketTyped name collision deliberate + UFCS rule (codex P2 documented).
+
+**Deferred:** L4 DAG-materialization flag (M19/W5); OGAR fields_for(u32) ClassView routing; F17 body triage (most-agreed fleet next move); corpus proof vs a real bake (no classid-keyed corpora in-container); R-3 per-entry board files + R-4 probe-ledger Wave A (operator council queue); q2 APP_PREFIX row (mint when q2 renders classviews — not blocked).
+
+**Docs:** intake handover (5 appendices incl. rulings + vart mirror recipe), Addendum-10/11, E-V3-XSESSION-INTAKE-1(+RULINGS), E-V3-GRAPHRAG-INV-1, CROSS_SESSION_BROADCAST merge-event entry, OGAR D-CLASSID-HI-U16-SPELLING + D-TRUNCATION-DISALLOWED-SOC-REROUTE.
+
+**Confidence (2026-07-02):** HIGH — contract 792/792 at merge; lance-graph-ogar 81 green post lock-bump; OGAR vocab 96/96 + class-view 12/12 (flip fuse vs live main).
+
 ## #631 lance-graph: W1b LIVE — WAL batch writer implemented, M15 rename, temporal synthesis, live oracle measurements
 
 **Status:** MERGED 2026-07-02 (merge commit `c7149eab`), branch `claude/v3-substrate-migration-review-o0yoxv`.

.claude/v3/ENTROPY-MILESTONES.md

@@ -47,7 +47,7 @@
 | M22 | 2 divergent q2 OSINT V3 bakes (crates/osint-bake canon-high 0x0700_0000 vs data/osint-v3 STALE pre-flip 0x1000_0700 dual-GUID scheme) | one canon-high bake against osint_classview.rs's 0x0700/0x0701 reservation | re-bake; grep pre-flip forms in q2 data/ = zero (or dual-alias-read only) | QUEUED (W5; latent until a reader assumes canon-high) |
 | M23 | 2 write-path doctrines coexisting (owner-stamped V3 writes vs smb-office-rs `LanceConnector::upsert` — the ONE live online consumer write, no stamp/classid/envelope) | all online consumer writes routed through the batch-writer cast | consumer-map §2 table shows zero ORPHAN-WRITE rows; warden green fleet-wide | QUEUED (W5 first live migration; medcare-soa writer BORN stamped as the prevention half) |
 | M24 | 2 write-intent bookkeepers (batch-writer internal state vs kanban board AHEAD update) | ONE: the kanban board IS the write-ahead log — cast = move = intent record; ack = confirmation | kill-after-cast-before-ack replay test green; grep writer-internal intent queues = zero; cast carries descriptor never bytes (zero-copy sink through NodeRowPacket); stacked-casts-never-refused test (melden macht frei — Addendum-7; sink coalesces naturally via live-store reads) | QUEUED (shapes W1b from first line; operator ruling Addendum-6: eager drain + mutual masking via phase machine) |
-| M25 | 2 persistence surfaces for orchestration state (graph-flow SessionStorage backend vs mailbox kanban board) | ONE: KanbanSessionStorage — Session transitions ARE KanbanMoves via the W1b writer; replay = rebuild from board | kill-mid-graph replay test: session resumes identically from board-recorded moves; grep non-kanban SessionStorage impls in lance-graph = zero | QUEUED (W3b; feeds off M24) |
+| M25 | 2 persistence surfaces for orchestration state (graph-flow SessionStorage backend vs mailbox kanban board) | ONE: KanbanSessionStorage — Session transitions ARE KanbanMoves via the W1b writer; replay = rebuild from board | kill-mid-graph replay test: session resumes identically from board-recorded moves; grep non-kanban SessionStorage impls in lance-graph = zero | SHIPPED v1 2026-07-02 (rs-graph-llm graph-flow `kanban` feature: KanbanSessionStorage, snapshot+move-log; kill-mid-graph replay test GREEN — no repeats/gaps, pinned Rubicon column sequence; grep gate holds: no non-kanban SessionStorage impl in lance-graph) |
 
 ## The meta-rule (why this ledger exists)