lance-graph-xlog: XLOG's admitted chain over Quack → mask-risc (D-XLOG-NATIVE-4)

.claude/board/STATUS_BOARD.md

@@ -15,7 +15,7 @@ Plan: `.claude/plans/d-dt64-7-behaviour-addressing-registration-v1.md`. Docs onl
 | D-DT64-7-L1 | full-classid basis for behaviour lenses (contract `ClassView` accessor) | Queued | after L4 |
 | D-DT64-7-L5 | consumer `ClassView` + immutable basis witness at registration | Queued | after L1 |
 | D-DT64-7-L2 | host composition of DT64 and OGAR authorities + views, with activation checks (L3) | Queued | after L5 |
-| D-DT64-7-5 | the versioned global → local selection table, a BindStore plan item (Litho is a mental model, folded into the bind store plan as D-DT64-6 Amendment A) | Queued | O5 (taken by this session) |
+| D-DT64-7-5 | the versioned global → local table, a BindStore plan item (plan §1e; Litho is a mental model, folded into the bind store plan as D-DT64-6 Amendment A) | Core in PR: `dr::MapTable`; stored selections (D7') wait on O4 | O4 for the selection half |
 
 ## D-MIST-NATIVE — Mistaber's Kripke holdings over the DR64 relation register (2026-10-30)
 
@@ -37,7 +37,7 @@ Plan: `.claude/plans/d-dynbag-holographic-bags-v1.md`. Plan only.
 
 | D-id | Deliverable | Status | Gate |
 |---|---|---|---|
-| D-DYNBAG-0 | PR #1884 layering fix: XLOG intake as lanes, support + bag count via Quack → mask-risc, fold oracles, cost columns | Queued | operator go-ahead |
+| D-DYNBAG-0 | PR #1884 layering fix: XLOG intake as lanes, support + bag count via Quack → mask-risc, fold oracles, cost columns | In PR: gates 1–7 (plan §17.7); cost columns not done | operator go-ahead (given 2026-11-01) |
 | D-DYNBAG-1 | ℕ-compose probe: `matmul_i8_to_i32` over two DR64² tiles for `p(X, Z)`; B projection = `relcomp::compose` | Queued | D-DYNBAG-0 |
 | D-DYNBAG-2 | semiring parameter K (B, ℕ) in relalg `Rel` + Quack surface; typed refusal per (op, K) | Queued | D-DYNBAG-1 |
 | D-DYNBAG-3 | missing ℕ words backend-first (i64 masked select, min, truncated minus, compare-to-mask, masked sum; maybe bit-packed product) | Queued | D-DYNBAG-2 |
@@ -68,7 +68,7 @@ Plan: `.claude/plans/d-soc-fence-v1.md`. Plan only; nothing runs yet.
 | D-XLOG-NATIVE-1 | test the selection rows (eq/ne_u32_to_mask, i32 comparisons, mask_and/or/andnot) against the probe's two oracles, signatures checked | Queued | N2 |
 | D-XLOG-NATIVE-2 | test masked_group_count_u32 keyed by one table's column against the RIR walk, with the out-of-universe refusal | Queued | N2, N3 |
 | D-XLOG-NATIVE-3 | ask the ndarray / mask-risc owners for a native home for the many-to-many join (fixture: Gate B) | Queued | owner decision |
-| D-XLOG-NATIVE-4 | create `crates/lance-graph-xlog` (ndarray only, no `xlog-*` dep, no plan type) once plan §4 holds | Queued | N1–N5 |
+| D-XLOG-NATIVE-4 | create `crates/lance-graph-xlog` (shape per Amendment C/D: Quack + mask-risc + DT64, no `xlog-*` or arrow dep, no plan type) | In PR (stacked on D-DYNBAG-0) | N1, N4, N5 met; N2 scalar oracle in-crate + both oracles in the probe; N3 typed refusals |
 | D-XLOG-NATIVE-6 | probe executes on `ndarray::simd` (`src/native.rs`): support via `eq_u32_to_mask` / `mask_scatter_or_u32` / `mask_and`, bag count via `masked_group_count_u32` ×2 + `checked_binary_i64`; DR `LocalMap` up to 256; register path kept as differential (plan Amendment B) | Shipped (#1884) | lab probe; layering fix is D-DYNBAG-0 |
 | D-XLOG-NATIVE-5 | bag count bound through the production bind store (`lance-graph-dt64` + `dt64::dr`), polyfill words by position; Epi5 reading of XLOG results pinned (plan Amendment A) | Shipped (#1884) | lab execution only |
 

.claude/board/entries/2026-11-01-dynbag-0-xlog-through-quack-mask-risc.md

@@ -0,0 +1,26 @@
+# D-DYNBAG-0: the XLOG probe runs through Quack → mask-risc, gated by the bind store
+
+**Date 2026-11-01 · ID D-DYNBAG-0 · Status IN PR · Plan `.claude/plans/d-dynbag-holographic-bags-v1.md` §17.7 · Crate `crates/xlog-relcomp-probe`**
+
+- `native.rs` describes each side as a Quack `Query` and runs it with mask-risc `execute_into`:
+  - support: `ScatterOrU32`, then `mask_and`;
+  - bag count: `GroupReduce { Local(y), Count }`, then a checked product.
+- No `ndarray::simd` fold word is called from the probe. Two direct calls remain, and neither is a fold: `mask_and`, an elementwise alias, and `checked_binary_i64`, TRACKED as MISSING-3.
+- `native::Intake` looks Y up once under a `dr::MapTable` frame (#1905). Each query re-checks that frame and performs no further lookup (MISSING-5).
+- `bag_count_admitted` runs only from an admitted `Population::Bag` `MethodBinding`, with each word read by the caller (MISSING-1, probe-local).
+- Refused:
+  - a retracted route (it produces no binding);
+  - a stale frame;
+  - a word the caller gave no reading for;
+  - a `Distinct` method;
+  - `p(X, Z)` (MISSING-6).
+- Disable runs, all red:
+  - Count swapped for Max;
+  - backward dropped;
+  - population check removed;
+  - frame check removed;
+  - unread word accepted;
+  - intake frame not re-checked;
+  - one lookup per query.
+
+**OPEN:** the cost columns, MISSING-1/2/3/4 in their owner crates, and `crates/lance-graph-xlog` (D-XLOG-NATIVE-4), whose dependencies Amendment C now sets as Quack + mask-risc rather than ndarray only.

.claude/board/entries/2026-11-01-lance-graph-xlog-crate.md

@@ -0,0 +1,15 @@
+# D-XLOG-NATIVE-4: `crates/lance-graph-xlog`
+
+**Date 2026-11-01 · ID D-XLOG-NATIVE-4 · Status IN PR (stacked on D-DYNBAG-0) · Plan `.claude/plans/d-xlog-native-v1.md` Amendment D**
+
+A workspace crate holds XLOG's admitted two-atom chain over the substrate:
+- Quack describes it, mask-risc evaluates it, DT64/DR address it, and it runs from an admitted bind-store method.
+- XLOG admission stays in `xlog-relcomp-probe`, which now calls the crate.
+
+**Gates:**
+- N4: `cargo tree -p lance-graph-xlog -e normal` shows no `xlog-*` and no arrow (19 lines).
+- N1 and N5: `and` is `ndarray::simd::mask_and` and `lance_graph_onnx::and`, by `fn_addr_eq`.
+- Scalar oracle: support and bag count match enumeration under four bound combinations, on a fixture that repeats a tuple.
+- Disable run: ignoring the bound turns 2 tests red.
+
+**OPEN:** `p(X, Z)` and longer chains (still NATIVE, refused at admission); MISSING-1/2/3/4 in their owner crates; the cost columns of D-DYNBAG-0.

.claude/board/entries/2026-11-01-maptable-versioned-local-map.md

@@ -0,0 +1,15 @@
+# D-DT64-7-5: `dr::MapTable`, the versioned global → local table
+
+**Date 2026-11-01 · ID D-DT64-7-5 · Status IN PR · Plan `.claude/plans/d-dt64-7-behaviour-addressing-registration-v1.md` §1e**
+
+`LocalMap` and `FrameStore` existed, and `LocalMap::digest` was documented as the frame's `coordinates` revision, but nothing tied a map to its frame. `MapTable` holds every tile's `LocalMap` under one `FrameStore`:
+
+- `advance` derives `coordinates` from the held `(tile id, map digest)` pairs.
+- `map(&Frame, tile)` refuses a stale or foreign frame (`MapRead::Stale`), and a missing tile (`NoSuchTile`).
+- Existing `LocalMap` and `FrameStore` callers are unchanged: `tests/dr.rs` and `xlog-relcomp-probe` stay green.
+
+**Disable runs:**
+- Dropping the frame check turns 3 tests red.
+- Dropping the tile id from the digest turns `tile renamed` red. The first version of the test used only a swap case, which stayed green without the tile id because order alone changes the digest.
+
+**OPEN:** stored selections (D7'), which need O4: does one `0xF###` value name one stored selection, or a position in a wider basis?

.claude/board/entries/README.md

@@ -25,10 +25,13 @@ index row, (3) no duplicate entry id. Checks 1 and 2 are deliberately
 opposite directions; the stranding this convention prevents shows up in
 exactly one of them, never both.
 
-536 entries, 2026-08-06 .. 2026-10-31.
+539 entries, 2026-08-06 .. 2026-11-01.
 
 | date | entry id | finding | file |
 |---|---|---|---|
+| 2026-11-01 | `D-DT64-7-5` |  | [2026-11-01-maptable-versioned-local-map.md](2026-11-01-maptable-versioned-local-map.md) |
+| 2026-11-01 | `D-XLOG-NATIVE-4` |  | [2026-11-01-lance-graph-xlog-crate.md](2026-11-01-lance-graph-xlog-crate.md) |
+| 2026-11-01 | `D-DYNBAG-0` |  | [2026-11-01-dynbag-0-xlog-through-quack-mask-risc.md](2026-11-01-dynbag-0-xlog-through-quack-mask-risc.md) |
 | 2026-10-31 | `x2-dt64-admission-policy` |  | [2026-10-31-x2-dt64-admission-policy.md](2026-10-31-x2-dt64-admission-policy.md) |
 | 2026-10-31 | `r1-r2il-binding-reading` |  | [2026-10-31-r1-r2il-binding-reading.md](2026-10-31-r1-r2il-binding-reading.md) |
 | 2026-10-31 | `r1-native-prepared-successor` |  | [2026-10-31-r1-native-prepared-successor.md](2026-10-31-r1-native-prepared-successor.md) |

.claude/plans/d-dt64-7-behaviour-addressing-registration-v1.md

@@ -116,6 +116,43 @@ Preserved throughout: the `0xC401` name-bound reading, the `FnIndex` opcode cont
 
 ---
 
+### 1e. O5 design: the versioned global → local table (2026-11-01)
+
+**Status:** core shipped (`dr::MapTable`, T1–T4 green, both disable runs red). Stored selections wait on O4.
+
+O5 is a BindStore plan item (D-DT64-6 Amendment A). Litho is the mental model it came from, not a component.
+
+**What exists (VERIFIED-IN-CODE, `lance-graph-dt64/src/dr.rs`):**
+
+| Piece | What it does |
+|---|---|
+| `LocalMap::prepare(width, globals)` | One tile's global → local table, at most 64 or 256 entries. Duplicates and overflow are refused. |
+| Row shape | One row per local position: `globals[local]`. `local()` reads global → local (counted), `global()` reads local → global. Ids only, never values. |
+| `LocalMap::digest` | FNV-1a over the local-order table. Its doc says a frame carries this value as its `coordinates` revision. |
+| `FrameStore` | `seal` / `advance` / `check`. A stale frame is refused and names the revision that moved (`CoordinatesChanged` for a new map). |
+
+So "versions = frame revisions" already works as a mechanism. **The gap:** nothing ties a `LocalMap` to the frame it was sealed under.
+- A caller can keep a map after `advance` and read through it with no refusal.
+- `coordinates` is whatever number the caller passes, not the digest of the maps in use.
+
+**Proposal (WORKING-MODEL), in `dr`, additive. No existing signature changes:**
+
+1. **`MapTable`.** It owns one `FrameStore` and the `LocalMap` of each tile, keyed by `TileId` (a `u32` the caller names). Insert and replace go through `MapTable::advance(changes)`. That sets `coordinates` to a digest over every tile's `(TileId, LocalMap::digest)` in tile order, and leaves `source` and `relation_map` as passed. Tiles are inserted only through `advance`, so the revision always matches the maps actually held.
+2. **Reads take the frame.** `MapTable::map(&Frame, tile) -> Result<&LocalMap, MapRead>`. `MapRead` is either `Stale(FrameRefusal)` or `NoSuchTile`. Old frames are refused, so a map cannot outlive its frame. This is `Pop`'s `Stale` rule (F7) applied to coordinates.
+3. **Where it sits.** DR owns the frame, so the table lives in `dr`, beside `FrameStore`. The BindStore keeps reading frames through `Guards`, exactly as `prepare` does now. A BindStore field holding the table is the alternative; it would make the store own DR state, which §3 assigns to DR.
+4. **Not in this item: stored selections (D7').** Storing a `WideFieldMask` over a tile's local positions, keyed to the frame, depends on O4: whether one `0xF###` value names one stored selection or one position in a wider basis. It is added once O4 is decided, as a sibling read with the same `Stale` refusal.
+
+**Falsifiers (test-first):**
+
+| Id | Falsifier |
+|---|---|
+| T1 | A map read under a frame sealed before `advance` is refused with `Stale(CoordinatesChanged)`, and read under the new seal it succeeds. Twin: an `advance` that changes nothing in a tile still re-seals, so the old frame gets `Stale(FrameResealed)`. |
+| T2 | `coordinates` is a function of the held maps. The same maps in the same tiles give the same revision. Reordering one tile's globals changes it. Swapping two tiles' maps changes it. Renaming a tile with the same map in the same position changes it; this case alone tests that the `TileId` is in the digest (a disable run showed the swap case passes without it). |
+| T3 | A frame from another `MapTable` is refused with `Stale(ForeignFrame)`, even at equal revisions. |
+| T4 | Backward compatibility: existing `LocalMap` / `FrameStore` callers (`tests/dr.rs`, `xlog-relcomp-probe` `litho.rs` and `gate_b.rs`) are unchanged and green. |
+
+Each falsifier gets a disable run: drop the frame check in `map`, and drop the `TileId` from the digest.
+
 ## 2. The classid, both sides
 
 ```text

.claude/plans/d-dynbag-holographic-bags-v1.md

@@ -537,6 +537,20 @@ XLOG compile ─► RIR ─► admit / admit_count
 
 **REVISIT WHEN:** MISSING-3 or MISSING-4 lands in its owner crate; the TRACKED call is then deleted.
 
+### 17.7 Status (2026-11-01, branch `ccr-85acaff0-oszq40-dynbag0`, on #1905)
+
+| gate | state | where |
+|---|---|---|
+| 1 compile → admit → bind → Quack → `lower` → `execute_into` → addressed result | met; a retracted route yields no `MethodBinding`, so nothing runs | `tests/dto_binding.rs` `the_admitted_method_drives_the_count`, `a_retracted_route_leaves_nothing_to_run` |
+| 2 no owned tuples after intake | met: `native::Intake` holds `u32` lanes and a live plane; queries read only those | `src/native.rs` |
+| 3 no global → local lookup per query (MISSING-5) | met via `dr::MapTable` (#1905): the intake looks Y up once under a sealed frame; each query re-checks the frame | `queries_after_intake_do_not_look_y_up_again`, `a_stale_map_frame_is_refused_before_anything_runs` |
+| 4 support and multiplicity distinct | met: support = `ScatterOrU32` ×2 + `mask_and`; bag = `GroupReduce Count` ×2 + checked product; a `Distinct` method is refused as a bag count | `gate_b`, `litho`, `a_distinct_method_is_not_run_as_a_bag_count` |
+| 5 disable runs | all red: Count swapped (litho 3 red), backward dropped (gate_b 5 red), population check, frame check, unread word, intake frame re-check, lookup per query (1 red each) | — |
+| 6 `q(Y)` never answers `p(X, Z)` (MISSING-6) | met: `admit` and `admit_count` both refuse a `p(X, Z)` body (behaviour that already held, now pinned) | `p_x_z_is_refused_not_answered_by_q_y` |
+| 7 no `ndarray::simd` fold word in `native.rs` | met: only `mask_and` (elementwise alias) and `checked_binary_i64` (TRACKED, MISSING-3) | `src/native.rs` module doc |
+
+MISSING-1 stays probe-local: the caller reads each `AlgebraRef` word as a `native::Word`, and any word without a reading is refused (`BoundRefusal::UnknownWord`).
+
 ---
 
 ## 18. Cross-frontend projection crosswalk (2026-10-31, before coding)

.claude/plans/d-xlog-native-v1.md

@@ -106,7 +106,7 @@ Status of every row: **name-checked, not tested.** Each native target is a funct
 - [ ] D-XLOG-NATIVE-1: in the probe, test the selection rows (`eq_u32_to_mask`, `ne_u32_to_mask`, the `i32` comparisons, `mask_and/or/andnot`) against both oracles, with each native signature checked.
 - [ ] D-XLOG-NATIVE-2: in the probe, test `masked_group_count_u32` keyed by one table's column against the RIR walk, including the out-of-universe refusal.
 - [ ] D-XLOG-NATIVE-3: ask the ndarray and mask-risc owners for a native home for the many-to-many join; the probe's Gate B is the fixture.
-- [ ] D-XLOG-NATIVE-4: create the crate once §4 holds.
+- [x] D-XLOG-NATIVE-4: create the crate once §4 holds (in PR, 2026-11-01; shape per Amendment D).
 - [x] D-XLOG-NATIVE-5: bind the bag count through the production bind store (`lance-graph-dt64` and its `dr` module), and state the Epi5 reading of XLOG results (Amendment A).
 
 ## 6. Gates
@@ -173,3 +173,16 @@ Effect on §2:
 - **No mask-risc word yet:** `checked_binary_i64` is the one direct call, TRACKED in D-SOC-FENCE until mask-risc gains an i64 combine (D-DYNBAG §17.5 MISSING-3).
 - In §2, the `ndarray::simd` column is what mask-risc calls, not what XLOG calls. The NATIVE / INLINE categories now mean "has a mask-risc program", not "has an ndarray function".
 - The work is D-DYNBAG-0 (`d-dynbag-holographic-bags-v1.md` §17).
+
+## Amendment D (2026-11-01): the crate as created
+
+**DECISION (operator, 2026-11-01: "lance-graph-xlog has priority, and dynbag").** `crates/lance-graph-xlog` is created after D-DYNBAG-0, on the shape Amendment C implies, which supersedes §4's "ndarray as its one dependency":
+
+- **Dependencies:** `lance-graph-quack`, `lance-graph-mask-risc`, `lance-graph-dt64`, `lance-graph-contract`, and `ndarray` only for the elementwise alias `and` and the TRACKED `checked_binary_i64`. No `xlog-*` dependency and no arrow (N4, checked with `cargo tree -e normal`).
+- **Contents:** the computation the probe ran (`Intake`, `support`, `bag_count`, `bag_count_admitted`, `Word`, `Support`, the refusals, `ids`, `nonzero`). Bounds arrive as plain `Bounds { left, right }`, so no XLOG type crosses.
+- **Left in the probe:** XLOG admission (`admit`, `admit_count`) and the `ChainQuery` → `Bounds` reading. The probe calls the crate and keeps both oracles.
+- **Gates:**
+  - N1 and N5: `and` is `ndarray::simd::mask_and` and `lance_graph_onnx::and`, by `fn_addr_eq`.
+  - N2: an in-crate scalar oracle under four bound combinations, plus the probe's scalar oracle and RIR walk.
+  - N3: typed refusals (`NativeRefusal`, `BoundRefusal`).
+- **§4 condition 2 holds for the projected two-atom chain only.** A join keeping both ends (`p(X, Z)`) and chains of more than two atoms remain NATIVE and are refused at admission.

Cargo.toml

@@ -16,6 +16,9 @@ members = [
     # ONNX mathematical compatibility facade over existing ndarray functions
     # (D-ONNX-NATIVE-0). Depends on ndarray only; nothing native depends on it.
     "crates/lance-graph-onnx",
+    # XLOG's admitted chain query (support, bag count) over Quack → mask-risc,
+    # addressed by DT64/DR (D-XLOG-NATIVE-4). No xlog-* or arrow dependency.
+    "crates/lance-graph-xlog",
     # DT64: the ClassId-addressed binding store (D-DRDT §1/§4, D-DT64-6 §1/§3).
     # Depends on the zero-dep contract only.
     "crates/lance-graph-dt64",