D-TGL: F-LAND / F-DISCARD lab, Thought-Git lifecycle contract, post-merge record for #1923

.claude/board/INTEGRATION_PLANS.md

@@ -1,3 +1,13 @@
+## 2026-11-02 — D-TGL-PUB: G10 × G11 atomic publication lab spec → `.claude/plans/g10-g11-atomic-publication-lab-v1.md`
+
+**Status:** SPEC, lab only; nothing implemented. **Board:** [STATUS_BOARD](STATUS_BOARD.md) D-TGL-PUB; [entry](entries/2026-11-02-d-tgl-release-fence-and-g10-g11-boundaries.md).
+**Confidence:** boundaries read in code (dt64 `route`/`RouteLog`, `persist_sink.rs`); the release-profile fence result was measured.
+
+## 2026-11-02 — D-TGL: the GitHub-analogue Thought-Git lifecycle as a shared contract → `.claude/plans/thought-git-lifecycle-contract-v1.md`
+
+**Status:** CONTRACT, docs only; Codegraph lab F-LAND / F-DISCARD shipped (crate-private). **Board:** [STATUS_BOARD](STATUS_BOARD.md) D-TGL-0 … D-TGL-G12, D-TGL-EXO148; [decisions + lab](entries/2026-11-02-p4-operator-decisions-lifecycle-lab.md); [P4 review](entries/2026-11-02-p4-thought-git-codegraph-dt64-review.md).
+**Confidence:** lab measured (tests + 2 disables); production gates G9–G12 and EXO-148 open.
+
 ## 2026-11-02 — D-DT64-AUTH: DT64 as the one method authority, census + ratchet → `.claude/plans/d-dt64-method-authority-census-v1.md`
 
 **Status:** PROPOSED, plan only (operator decision P3 of the architecture review). **Board:** [STATUS_BOARD](STATUS_BOARD.md) D-DT64-AUTH; [review](entries/2026-11-02-codegraph-dr3-dt64-ruff-architecture-review.md); [decisions](entries/2026-11-02-codegraph-review-operator-decisions.md). Same day: `d-codegraph-0-binary-lanes-v1.md` gained Amendment A (P2: provenance header, `(artifact, FunDeclId)`, `INVOKES_WORD`).

.claude/board/LATEST_STATE.md

@@ -1,3 +1,13 @@
+## 2026-11-02 — main after #1922 and #1923 (merged `2e19a5adc`)
+
+- `lance-graph-codegraph` opens stores of any size on a multi-tile xlog cube.
+  - `refresh_crate` is atomic: a refused refresh changes nothing.
+  - The codegraph suites run in `rust-test.yml`.
+- xlog: wide closure, multiset delta log with merge on read, `Cube::stage` / `commit`; binds survive an extending rebase.
+- dt64 `dr`: a versioned append-only tile index; a frame reads its own layout; `map_at(RouteVersion)`.
+- egglog pinned to one commit in `egglog-r2il-probe`, `dr-math-binding-probe`, `xlog-relcomp-probe`.
+- Board: architecture review and decisions, P4 review, plans for binary lanes (amended) and the DT64 authority census.
+
 ## 2026-11-02 — main after #1920 and #1921 (merged `4ab93bf3e`), ruff #130–#132
 
 - New workspace-excluded crate `lance-graph-codegraph` (#1921, D-CODEGRAPH-0 slice C): reads the `ruff_charon` rows v2 artifacts by column name and answers callers, callees, references and impact as confirmed / possible / unknown masks over one xlog cube; diagnostics dead function, unresolved call, dangling call, unused import (NOT_RUN). Limits surfaced as typed refusals: closure > 64 positions, tile > 256 symbols.

.claude/board/PR_ARC_INVENTORY.md

@@ -1,3 +1,37 @@
+## 2026-11-02 — lance-graph PR #1923 (merged `2e19a5adc`, branch `claude/clone-repositories-71a5sw`) — D-CODEGRAPH-0 wide closure, atomic refresh, versioned DR index (D-DYNBAG-4)
+
+- **Added:**
+  - dt64 `dr`: `MapTable::locate`, `LocalMap::extends` / `view`, `Axis::for_survivors`, versioned append-only tile index (`map(frame)`, `map_at(RouteVersion)`, shared `VersionClock`).
+  - xlog:
+    - `closure_wide` (multi-word rows, block presence);
+    - `Cube::new_tiled`;
+    - multiset delta log with merge on read;
+    - `refresh_closure`, `refold`, `rebase`;
+    - `Cube::stage` / `stage_closure` / `commit`;
+    - `Node::Bind` keeps its global id.
+  - codegraph: multi-tile stores, interned lanes, digest skip, atomic `refresh_crate` (staged interner, positions, tile map, batch, closures).
+  - CI line for the codegraph suites; egglog pinned to one commit in three crates.
+- **Locked:**
+  - positions never renumber;
+  - a refused refresh changes nothing;
+  - an old frame replays its own layout;
+  - a bind to an unmapped id is placed by an extending rebase or commit.
+- **Deferred:**
+  - binary lanes (D-CODEGRAPH-0-BIN, amended with PROV / `(artifact, FunDeclId)` / `INVOKES_WORD`);
+  - Quack counting;
+  - prefetch;
+  - cross-tile ℕ-compose;
+  - the DT64 authority census (D-DT64-AUTH, plan only).
+- **Docs:**
+  - architecture review (Codegraph × DR³ × DT64 × Ruff) and operator decisions;
+  - P4 review (Thought-Git × Codegraph × DT64);
+  - plans `d-codegraph-0-wide-closure-v1`, `d-dynbag-4-dr-versioned-mapping-v1`, `d-codegraph-0-binary-lanes-v1`, `d-dt64-method-authority-census-v1`.
+- **Confidence:**
+  - suites and clippy green; atomic-refresh and bind falsifiers with 7 disable runs red; full CI green on the merged head.
+  - mask-risc: impact 286 ns, callers 29 µs, references 45 µs.
+  - An unchanged refresh takes 1.5–1.7 ms (failed gate, TSV read).
+- **Stranded:** two commits made after the merge point (prepare/commit split with F-LAND / F-DISCARD; the D-TGL lifecycle contract). They are re-offered in a follow-up PR from the same branch, with `main` merged in (no history rewrite).
+
 ## 2026-11-02 — lance-graph PR #1921 (merged `4ab93bf3e`, branch `claude/clone-repositories-71a5sw`) — D-CODEGRAPH-0 slice C: `lance-graph-codegraph`
 
 - **Added:** `crates/lance-graph-codegraph` (workspace-excluded): rows v2 reader keyed by schema names; one xlog cube (CALLS, NODE, MAY, IMPL, RCONF, RPOSS) and position masks; `callers` / `callees` / `references` / `impact` graded confirmed / possible / unknown; diagnostics dead function, unresolved call, dangling call, unused import NOT_RUN; store fixtures rev1, rev2, mixed, fnref; `examples/timing.rs`.

.claude/board/STATUS_BOARD.md

@@ -41,7 +41,7 @@ Plan: `.claude/plans/d-dynbag-holographic-bags-v1.md`. Plan only.
 | D-DYNBAG-1 | ℕ-compose probe: `matmul_i8_to_i32` over two DR64² tiles for `p(X, Z)`; B projection = `relcomp::compose` | In PR: exact vs both oracles (300 cases), projection = compose; MEASURED ~21 µs/tile on the AVX-512 VNNI tier (no AMX) vs 50 ns–2.4 µs for B (plan §7.6) | D-DYNBAG-0 |
 | D-DYNBAG-2 | semiring parameter K (B, ℕ) in relalg `Rel` + Quack surface; typed refusal per (op, K) | Queued | D-DYNBAG-1 |
 | D-DYNBAG-3 | missing ℕ words backend-first (i64 masked select, min, truncated minus, compare-to-mask, masked sum; maybe bit-packed product) | Queued | D-DYNBAG-2 |
-| D-DYNBAG-4 | DR{dynamic}: width from survivor count, multi-tile map, cross-tile fold/compose | In PR (partial): `Axis::for_survivors` (width rule), `MapTable::locate` (global → (tile, local)), versioned append-only index (`map(frame)` replays the frame's layout, `map_at(RouteVersion)`, shared `VersionClock`), xlog `Cube::new_tiled` + `closure_wide` (cross-tile closure). Plans `d-codegraph-0-wide-closure-v1.md`, `d-dynbag-4-dr-versioned-mapping-v1.md`. Open: cross-tile ℕ-compose (§7.4) | DT64 `dr` owner |
+| D-DYNBAG-4 | DR{dynamic}: width from survivor count, multi-tile map, cross-tile fold/compose | Shipped (partial, #1923 merged `2e19a5adc`): `Axis::for_survivors` (width rule), `MapTable::locate` (global → (tile, local)), versioned append-only index (`map(frame)` replays the frame's layout, `map_at(RouteVersion)`, shared `VersionClock`), xlog `Cube::new_tiled` + `closure_wide` (cross-tile closure). Plans `d-codegraph-0-wide-closure-v1.md`, `d-dynbag-4-dr-versioned-mapping-v1.md`. Open: cross-tile ℕ-compose (§7.4) | DT64 `dr` owner |
 | D-DYNBAG-5 | `sql-quack-probe` modelled on `lance-graph-cypher-quack` | Queued | parser decision |
 | D-DYNBAG-6 | scoreboard vs DuckDB / PostgreSQL, ns units, losses reported | Queued | D-DYNBAG-5 |
 | D-DYNBAG-7 | second Datalog frontend (Scallop) through the same path | Queued | D-DYNBAG-2 |
@@ -240,8 +240,17 @@ Plan: [d-codegraph-0-resident-codegraph-v1.md](../plans/d-codegraph-0-resident-c
 | **D-CODEGRAPH-0-A** | ruff `ruff_charon`: LLBC → Kythe facts with a witness status per call, for one real crate | SHIPPED: ruff #129 (merged `9913e90946`), lance-graph #1918 (merged `c11e4262e`): calls byte-identical to `llbc_calls.py` on the fixture and `mask-risc`; receipt conserved (16,149); Kythe `/xrefs` 3/3 call pins | rust-analyzer oracle (`sag-ra-probe GRAPH=1`) and rustc on `fixtures/codegraph`; `POSSIBLE` never counted as a confirmed caller |
 | **D-CODEGRAPH-0-B** | resident rows via the ruff sink; per-file digests; incremental invalidation | LANDED (offline form): ruff #130 (merged `95be2e480b`; offline store in `ruff_charon`; `RefinedTruthSink` not reused, typed to R2IL). Incremental == clean on the fixture, byte-identical; skipped dependent leaves exactly one dangling edge. Follow-up fixes in ruff #131 (open). Lance-graph SoA residency still open | clean import == incremental import |
 | **D-CODEGRAPH-0-C** | callers / callees / impact / diagnostics; tiled closure; body → R2IL design check | SHIPPED (fixture scale): ruff #132 (merged `ed8fd4194f`, rows v2) + lance-graph #1921 (merged `4ab93bf3e`), `crates/lance-graph-codegraph` (queries as confirmed / possible / unknown masks over the xlog cube; dead function, unresolved call, dangling call; unused import NOT_RUN). 27 tests, 12 disable runs red. Tiled closure deferred: refusals `ClosureWidth` (> 64) and `TooMany` (> 256) are surfaced as typed UNKNOWN | each guard disable-verified; unused import proven only without macros, traits, globs, re-exports |
-| **D-CODEGRAPH-0-C2** | wide closure (multi-word rows, block presence), multi-tile cube, merge-on-read refresh, interned lanes | IN PR: lance-graph branch `claude/clone-repositories-71a5sw`. Impact over any size; mask-risc store (695 symbols, 3 tiles): impact 286 ns, callers 29 µs, references 45 µs; refresh of an unchanged crate 1.5–1.7 ms = FAILED gate (reading the 2.5 MB text file), fixed by D-CODEGRAPH-0-BIN. `refresh_crate` atomic (prepare → validate → commit: staged interner, positions, tile map, `Cube::stage`, closure; commit has no error path); codegraph suites now in `rust-test.yml` | narrow vs wide bit-identical ≤ 64; BFS reference on 694 positions; refresh == clean open; a refused refresh changes nothing (NeedsReopen, injected stage and closure refusals; no version issued); retry == the refresh that never failed, call-site multiplicity included; 7 disable runs red |
+| **D-CODEGRAPH-0-C2** | wide closure (multi-word rows, block presence), multi-tile cube, merge-on-read refresh, interned lanes | SHIPPED: #1923 (merged `2e19a5adc`). Impact over any size; mask-risc store (695 symbols, 3 tiles): impact 286 ns, callers 29 µs, references 45 µs; refresh of an unchanged crate 1.5–1.7 ms = FAILED gate (reading the 2.5 MB text file), fixed by D-CODEGRAPH-0-BIN. `refresh_crate` atomic (prepare → validate → commit: staged interner, positions, tile map, `Cube::stage`, closure; commit has no error path); codegraph suites now in `rust-test.yml` | narrow vs wide bit-identical ≤ 64; BFS reference on 694 positions; refresh == clean open; a refused refresh changes nothing (NeedsReopen, injected stage and closure refusals; no version issued); retry == the refresh that never failed, call-site multiplicity included; 7 disable runs red |
 | **D-CODEGRAPH-0-BIN** | ruff_charon binary row lanes + header digest; codec9 small codebooks; Quack counting; no strings in the hot path; provenance header + per-row `(artifact, FunDeclId)`; `INVOKES_WORD` to a registered DT64 word | QUEUED: plan `d-codegraph-0-binary-lanes-v1.md` (operator: graph-wide u32 ids, TSV kept as debug `open_tsv`; Amendment A §8: PROV section, FUNDECL/ARTREF lanes, `INVOKES_WORD`, F9–F12). Ruff writer PR first, then the codegraph reader. OPEN: source of the "function realises word" association | unchanged refresh ≤ 20 µs; changed-crate open ≤ 1 ms; binary == TSV row for row |
+| **D-TGL-0** | GitHub-analogue Thought-Git lifecycle as a shared contract (branch → change → diff → PR → checks → review → rebase/squash → land → receipt/replay; rework / discard) for Codegraph, DT64, XLOG | CONTRACT (docs): plan `thought-git-lifecycle-contract-v1.md`; PR states are readings of existing records, no workflow engine | each step expressible with listed primitives |
+| **D-TGL-LAB** | Codegraph lab: F-LAND / F-DISCARD | SHIPPED (lab, crate-private): `prepare_refresh` / `commit_refresh` with a generation fence (`RefreshRefusal::Stale`); second branch recomputed against current W0 == clean open incl. call-site counts; discard leaves W0 unchanged; 2 disables red (without the fence only a `debug_assert` catches the collision) | not a production land |
+| **D-TGL-G8** | bag semantics: merge source revisions, never raw edge ADDs | DECIDED (contract §4) | 5 call sites from two sources after both land (F-LAND) |
+| **D-TGL-G9** | lifecycle gate | OPEN (production) | D-TGA-1/3/4/6, D-TGB-2/3/5 delivered against the contract table |
+| **D-TGL-G10** | atomic publication: prepare all, durable commit first, then infallible in-memory apply from the land record, replay after crash | OPEN (production); named gap: no prepare/validate route API on `BindStore` | a `Fenced` leaves no published partial state |
+| **D-TGL-G11** | branch-local routing; no branch-minted DR position as durable routing key | OPEN (production) | a branch route leaves `BindStore::current_version()` unchanged until land |
+| **D-TGL-G12** | identities apart: W-slot, generation, ThoughtCommitId, DurableRef, RouteVersion, Lance version, source SHA (provenance only) | OPEN (production) | joins only through receipt / CommitWitness / MetaKey / land record |
+| **D-TGL-PUB** | G10 × G11 lab: prepared land (Codegraph + DT64 route intent), fenced durable commit through a test `WalSink`, crash recovery from the durable record, branch-local routing | SPEC: plan `g10-g11-atomic-publication-lab-v1.md`; boundaries B1–B5 located; needs `BindStore::check_route` (read-only, missing) | L1–L6, each with a disable; L4 shows route re-application ticks `RouteVersion` without a watermark |
+| **D-TGL-EXO148** | `DurableRef` + never-reused `ThoughtCommitId` before any durable land, replay or PR record | OPEN (production, EXO-148) | reuse test (D-RST-1) |
 | **D-DT64-AUTH** | DT64 / F### as the one method authority: census of production words with a two-way exception ratchet; parallel identities (`MethodSignature`, tract `Registry`, XLOG `Word`, ogar-loco `FnIndex`) stay as listed `LAB` adapters | QUEUED: plan `d-dt64-method-authority-census-v1.md` (operator decision 2026-11-02); egglog pinned to one commit in `egglog-r2il-probe`, `dr-math-binding-probe`, `xlog-relcomp-probe` | undeclared production word → red; stale exception → red; current tree green |
 | **D-CODEGRAPH-0-D** | local stdio MCP over C | QUEUED | only after B and C gates |
 | **D-CODEGRAPH-0-E** | token measurement with and without the Codegraph | QUEUED | same revision, questions, model; nothing claimed before measured |

.claude/board/entries/2026-11-02-d-tgl-release-fence-and-g10-g11-boundaries.md

@@ -0,0 +1,30 @@
+# D-TGL: the generation fence holds in release; G10 × G11 boundaries located (2026-11-02)
+
+**Status:** MEASURED (release run) + SPEC (G10 × G11 lab, plan [`g10-g11-atomic-publication-lab-v1.md`](../plans/g10-g11-atomic-publication-lab-v1.md), D-TGL-PUB).
+**Source:** operator review of #1924 (2026-11-02). Production Thought-Git land stays unapproved; EXO-148 stays locked.
+
+## Git hygiene
+#1923 was merged at `83ac4b3a8`. The two commits after that point (`ab9fb36f6`, `4025292ea`) are in #1924, which contains current `main` (`2e19a5adc`, merged in, no history rewrite, no force push). Nothing was lost.
+
+## Release profile (MEASURED)
+- `cargo test --release --lib` in `crates/lance-graph-codegraph`: 7 passed, including `lifecycle::f_land_*` and `f_discard_*`.
+- **Release disable (fence removed):** F-LAND fails on its own assertion: `a stale preparation must be refused, got Ok(RefreshStats { edges_added: 6, symbols_appended: 1, .. })`.
+  - With `debug_assert` compiled out, the stale preparation is **accepted silently**.
+  - The generation fence is the only guard, and it refuses correctly on its own.
+  - The debug-build catch (`artifact.rs:186`) was a second net, not the guard.
+
+## G10 × G11 boundaries (read in code)
+- **DT64 `route`:**
+  - It refuses only `UnknownClass` / `OutsideReservation`.
+  - The class registry is insert-only and the route log push-only, so a checked route intent never goes stale.
+  - **Gap:** no read-only `check_route` exists.
+  - **Re-applying `route` ticks `RouteVersion` again (not idempotent).**
+- **Codegraph:** re-applying a source revision is a no-op (digest skip). DT64 recovery therefore needs a watermark; Codegraph recovery does not.
+- **Writer (`persist_sink.rs`):**
+  - The refusals and outcomes are `Fenced` / `HashConflict` / `InvalidArtifact` / `Io` / `Ambiguous` → `Reconciled`.
+  - `scan_sealed` returns landings without payload, so land records must be read from the image.
+  - `recover_and_apply` is idempotent by watermark, not by phase.
+- **Five crash boundaries:** B1 before commit; B2 refused; B3 ambiguous; B4 committed but not published; B5 process loss. Plan §1.4.
+- **The smallest common falsifier set is L1–L6.** Each has its own disable. The decisive one is L4: without the watermark, a second recovery ticks `RouteVersion` while the Codegraph stays unchanged.
+
+OPEN: `check_route`, the lab `WalSink`, and the L1–L6 test are three separate reviewable steps (plan §4). None is implemented.