graph/cycle_sink: the concrete Lance-backed WalSink — storage-proven cognitive-cycle sink (§I.6)

.claude/board/EPIPHANIES.md

@@ -868,6 +868,15 @@ A valid sign assignment exists — so the fixture is **consistent**, and the "co
 **The second corollary: bijectivity is a CONSTRUCTOR obligation, not a test obligation.** `IdentityCodebook::try_new` rejects a non-injective key list, so the many-to-one mapping cannot be built and therefore cannot be found later at a call site. The whole-book `verify_bijective()` sweep exists anyway, because "the constructor guarantees it" is an argument and a bake wants a measurement. Both halves shipped; the negative case (a duplicate is refused, a non-duplicate is not) is its own test.
 
 **Method note worth keeping.** Two guards were **mutation-tested in-session** rather than trusted: replacing the duplicate check with `dedup()` failed the injectivity test; dropping the absent sentinel failed four tests. This is the cheap form of the falsifiability rule — write the guard, then break it on purpose and watch the suite notice. One test in the first draft (`over_capacity_codebook_is_refused`) was caught **vacuous by this discipline** — it asserted a value equalled itself — and was rewritten as a boundary assertion against an extracted `check_capacity`, because a guard whose failure path cannot be reached by any input is the defect one level up (`E-VACUOUS-ASSERTION-IS-THE-HOUSE-STYLE-1`).
+## 2026-08-02 — E-TWO-MEDCARE-LINEAGES-THE-LIVE-ONE-PULLS-THE-DEAD-ONE-HOSTS-1 — MedCare is integrated through consumer-pull; the host-side actor/manifest scaffold froze on its birth day
+
+**Status:** FINDING (six-agent read-only investigation + unshallowed git history, HEAD `71d1db1`). **Confidence:** High — every claim carries a commit sha or file:line; contradicting prose ledgers were checked against code. Plan: `.claude/plans/medcare-consumer-pull-thinking-proof-v1.md`.
+
+**The finding.** lance-graph does NOT contain "one incomplete MedCare runtime" — it contains **two lineages**. The LIVE one is consumer-pull: MedCare-rs `medcare-bridge` → vendored `lance-graph-ogar` → `MedcareBridge = UnifiedBridge<HealthcarePort>` (collapse commit `ddb6c840`, 2026-06-21; deprecated alias since `10e717d4`) → OGAR canonical Health codebook (`0x0901–0x090C`; the contract mirror verified in sync slot-for-slot; the 7-alias-vs-12-slot gap is INTENTIONAL per OGAR `ports.rs:598-606`). The DEAD one is the host-side scaffold born in the sprint-7 wave (2026-05-13, `927788e9`/`3f67aed6`) and **never functionally touched again**: `modules/medcare/manifest.yaml` is compile-time parsed (`contract/build.rs`) into `MANIFEST_METADATA` whose ONLY caller is a test; its richest fields (entity codes 100–105, all five `action_capabilities`, `actor.message_type`) are parsed then DISCARDED pre-codegen; `rbac_policy: medcare_policy` names a nonexistent symbol; `CallcenterSupervisor::spawn_consumer_actor` unconditionally spawns `StubConsumerActor` (`supervisor.rs:369`); `DispatchToG` returns `DispatchNotImplemented` before any child actor for every non-Health envelope; `MedcareConsumerActor` has ZERO constructors repo-wide; and the manifest's declared `MedCareActor`/`MedCareMessage` exist in NEITHER repository (verified against the MedCare-rs sibling directly).
+
+**Load-bearing distinctions this pins:** (a) TWO same-named `UnifiedBridge` types — ogar's `<P: PortSpec>` resolver (NO authorize method) vs callcenter's `<B: NamespaceBridge>` authorize/audit wrapper — never composed, and currently UNCOMPOSABLE (callcenter has zero dep on lance-graph-ogar); classify composition as later hardening, never as a shipped edge. (b) `lance-graph-ogar` is workspace-EXCLUDED — a green parent-workspace build compiles none of it (`--manifest-path` required; 83 tests green there). (c) The audit default is `NoopAuditSink` + `SuperDomain::Unknown`/salt 0 with swallowed emit errors, and `MEDCARE_AUDIT_SALT` is read fail-open then discarded — for a HIPAA-regime domain, "configured" vs "recording" is indistinguishable (P0 candidate). (d) Retention 2190d (`StepDomain::Medcare`, tested) vs 3650d (manifest, dead) is the DOCUMENTED open question OQ-2 (HIPAA vs BMV-Ä §57), not an accident. (e) `Anamnese`/`Ueberweisung` are first-class consumer concepts (97/81 refs) with no port alias / no canonical id at all — a real canon gap, not naming noise. (f) A third, unreconciled `.grok/` lineage (Zone-3 via spear, 2026-05-08) contradicts both.
+
+**The lesson (generalizes):** when a repo hosts a consumer-shaped scaffold AND the consumer separately pulls the repo's libraries, the scaffold can freeze at birth while every ledger keeps narrating it as "the integration" — dormancy is invisible in prose because infra work *around* the frozen files (branch names, "first-thought loop" commits) keeps the term alive. The falsifier that cut through: per-file `git log` dormancy (81 days = age of the file) + constructor-count (zero) + the two-repo actor-name check. Also: the clone was SHALLOW (5 grafted roots, 11-day window) — `git fetch --unshallow` converted a "between 06-23 and 06-26 per prose" estimate into the exact commit `ddb6c840` two days earlier. **Archaeology on a shallow clone is prose archaeology; unshallow first.**
 
 ## 2026-08-02 — E-D-MBX-SPINE-IS-STRAIGHT-TRACK-VERSION-IS-NOT-A-FLEET-STEP-SIGNAL-1 — the D-MBX production ownership map is ratified, and P4's fleet-wide fan-step is corrected to sparse sealed-transition application
 

.claude/board/INTEGRATION_PLANS.md

@@ -105,6 +105,30 @@ answers — ownership cost, layout cost, WAL amortisation knee (descriptive,
 never PASS/KILL), and what genuine parallel thought execution adds before
 the deterministic seal.
 
+## 2026-08-02 — medcare-consumer-pull-thinking-proof v1 — ACTIVE (the single active MedCare plan after the two-lineage investigation) — main thread
+
+**Plan:** `.claude/plans/medcare-consumer-pull-thinking-proof-v1.md`
+Consolidation of the 2026-08-02 six-agent read-only MedCare/Healthcare
+investigation (HEAD `71d1db1`, git unshallowed to 4162 commits). Verdict:
+**two lineages, not one incomplete runtime.** LIVE = consumer-pull (MedCare-rs
+`medcare-bridge` → vendored `lance-graph-ogar` → `UnifiedBridge<HealthcarePort>`
+→ OGAR canon `0x0901–0x090C`; bridge migration COMPLETED at `ddb6c840`
+2026-06-21, `MedcareBridge` deprecated alias only). DEAD = host-side
+manifest/supervisor/actor scaffold (frozen since birth 2026-05-13; manifest
+compile-time-parsed but runtime-orphaned; `MedcareConsumerActor` never
+constructed; supervisor hard-codes `StubConsumerActor`; Dispatch rejected
+pre-child; `MedCareActor`/`MedCareMessage` exist in NEITHER repo;
+`medcare_policy` symbol nonexistent). Two same-named, never-composed
+`UnifiedBridge` types (ogar resolver — no authorize; callcenter authorize/audit
+— no ogar dep) classified as LATER hardening, not a proof prerequisite.
+**Active proof target:** one real medical thought over the live consumer-pull
+path — HealthcarePort classids → cognitive-shader-driver + REAL MailboxSoA
+(closing the qualia-extractor honesty gap) → owner_adapter cast → PR #879
+sparse cycle loop; falsifiers F1–F4 incl. the currently-ABSENT fail-closed
+unknown-actor test. `ogar-obo` (MONDO/HPO/Uberon/PATO — verified real, zero
+consumer edges) = optional slice only. Older MedCare plans classified in the
+plan's §8 ledger (completed / dormant-decision-required / stale-but-unmarked).
+
 ## 2026-08-02 — kanban-64k-inverted-awareness v1 — PLANNED / CONJECTURE (parallel thinking + the inverted-awareness witness) — main thread
 
 **Plan:** `.claude/plans/kanban-64k-inverted-awareness-v1.md`
@@ -144,7 +168,6 @@ each probe-first with both falsifier halves. Blocked-on external: the consumer
 physical bake (private repo), validity criterion, `LanceShardSink`. Built on the R1–R15
 review list (session 2026-08-02); §0 ground state carries receipts so nothing
 is re-derived.
-
 ## 2026-08-02 — cycle-loop-closure-driver v1 — PLANNED / CONJECTURE (the seam that makes persist_sink load-bearing at 64k) — main thread
 
 **Plan:** `.claude/plans/cycle-loop-closure-driver-v1.md`

.claude/board/LATEST_STATE.md

@@ -1,3 +1,16 @@
+## 2026-08-09 — branch `claude/medcare-rs-continue-ufsazd` — `lance_graph::graph::cycle_sink`: the CONCRETE cognitive-cycle Lance sink (the storage-proven `WalSink`)
+
+### Current Contract Inventory — new module (lance-graph core, `planner` feature)
+
+- `lance_graph::graph::cycle_sink` — **the gap `persist_sink` deliberately left is now closed**: a concrete implementation of `lance_graph_planner::persist_sink::WalSink` over the official Lance 9 insert path (`Dataset::write` / `Dataset::append` — the same `InsertBuilder` transaction machinery every Lance writer uses). No bespoke ledger, no acknowledgement protocol, no parallel replay system: Lance's own manifest/version chain IS the WAL. Gated on the default-on `planner` feature (the trait lives in the optional planner dep).
+  - `LanceCycleSink::new(path)` — holds only the dataset path; opens the dataset per operation, so restart-survival is exercised on EVERY call, not just in tests.
+  - `cycle_store_schema()` — one dataset, two row kinds: a per-cycle **frame row** (`kind=0`, the cycle ↔ version mapping sealed INSIDE the same atomic commit — zero sidecar state) and **landing rows** (`kind=1`: `stream_position`, `owner`, `row`, nullable `move_*` Rubicon-edge columns, `payload` witness-node bytes).
+  - **The §I.6 fence, both halves.** Pre-commit: the store's current version must equal the cycle's sealed predecessor `base` (empty store ⇒ head `DatasetVersion(0)`), else refused with NOTHING written. Post-commit: the published version must be exactly `base + 1` (`sealed_version = base_version + 1` is an identity the commit path VERIFIES, never assumes). Lance has NO expected-version conditional append (the rebase runs even on a single-attempt Append commit; strict mode exists only for Overwrite — measured in `lance-9.0.0/src/io/commit.rs`), so a foreign interleaved writer can land the batch at `base + 2`; the review round (#911 Codex P1 + CodeRabbit) made the fence EFFECTIVE retroactively there: the just-published cycle rows are removed again with an official `Dataset::delete` scoped to exactly this cycle (the cycle id is an unsealed identity — the predicate is exact), and only then is the retryable `WriteFailed` returned, so "write failed" is TRUE at the visible head and the driver's regenerate-from-`Vn` contract stays sound. The one manual-reconciliation corner (compensating delete itself fails) names the orphaned version explicitly — reachable only when the one-writer doctrine was already violated by a foreign writer.
+  - **The coalesced image is DURABLE** (review round): `kind = 2` image rows (`row → final 512-byte payload` after the per-row fold) persist in the same atomic commit as the landings; `LanceCycleSink::scan_image(cycle)` reads a sealed cycle's coherent end-state (projected `row`+`payload` under the kind+cycle predicate) while the per-cast history stays intact via `scan_sealed`. Every landing/image payload is gated to exactly `EPISODIC_WITNESS_BYTES = 512` (the canonical `key(16)|edges(16)|value(480)` node stride) BEFORE anything durable happens; `versions()` projects only `cycle`+`base_version` under `kind = 0` so the coarse-timeline lookup never materializes a witness payload.
+  - **Order is a write-side property**: landings are stored in the already-deinterlaced `DetachedCycleBatch` order and scanned back with `scan_in_order(true)`; the sink never sorts on read.
+  - **Domain-0x09 witness contract (module doc, operator-ruled):** the patient SoA at classid domain `0x09` is the ONLY place patient reasoning is written to Lance, so the store is witness-focused and maximally rich — `payload` carries the 512-byte canonical EpisodicWitness node (visited ontology addresses, executed crosswalk mappings, exact RO/ontology edge ids, supporting/contradicting/missing observations, NARS truth+confidence, differential branches), whose edges point INTO the immutable domain-0x03 ontology address space. The cycle takes ontology immutability for granted for its representation window (`base_version` names the sealed predecessor it read) and therefore never restates ontology content — the sealed versioning is a reflection of the thinking; downstream (the Gotham display, differential views) reads the sealed version, never a live recomputation.
+- **Gates:** 6 tokio tests, every guarantee proven against a REOPENED dataset (fresh sink instance + fresh `Dataset::open`, never an in-memory echo): seal survives restart; stale base fenced with nothing written (store version chain, landings, timeline all untouched — checked, not assumed); sequential cycles chain V1→V2→V3 with strictly-after filtering; a zero-landing cycle advances the timeline only; an empty store reads empty (a state, not an error — `DatasetNotFound` distinguished from real I/O failure); move-nullability + 512-byte payload byte-exact round-trip. Real Lance version chain cross-checked against the returned `DatasetVersion` in-test.
+
 ## 2026-08-06 — branch `claude/vocab-tenant-bake` — `lance_graph_contract::identity_quad`: four external identifier spaces joined at BAKE time into one 96-bit facet payload
 
 ### Current Contract Inventory — new module (lance-graph-contract)
@@ -133,6 +146,16 @@ Production path: `plan evaluation → KanbanMove intent → BatchWriter → spar
 **Open, named:** the `ConsumerActor<P: PortSpec>` generalization (would re-derive the stub actor as a one-line alias — the actor-half of the bridge collapse onto `UnifiedBridge<P>`; #570 did that for OpenProject/Redmine and explicitly deferred Healthcare until the codebook promotion, which landed in a later, unnamed PR); the ownership question for `soa_bake`'s scaffolded half now that OGAR ships complete bakes emitting `NodeRow` bytes; A3 `LanceShardSink` still deferred behind its own crash falsifiers.
 
 **Process, recorded not buried:** an operator-ruled public/private separation-of-concerns violation occurred mid-arc and was remediated the same session (files scrubbed, three unmerged commits rewritten into one and force-pushed with lease — PR branch only, `main` untouched — PR body rewritten, bot comments patched). Residue stated honestly at the time: orphaned SHAs may persist until GC, edit histories remain in the UI, and pre-existing occurrences on merged `main` were surfaced for an operator decision rather than rewritten unilaterally. **Also found:** the PR arc's memory practice has broken again — **no `PR_ARC_INVENTORY` entry exists for #862, #875, #876, or #879**. The gap is now recorded at the top of that file; reconstruction is queued, not done.
+## 2026-08-02 — branch `claude/medcare-rs-continue-ufsazd` (restarted on main post-#879-merge) — pre-commit failure contract corrected to deterministic regeneration + proof re-homed to the live consumer
+
+- **#879 MERGED** (2026-08-02T12:25Z); branch restarted from `origin/main` per protocol, unmerged docs commit rebased on top. Two operator-ruled realignments applied (grain-of-salt round 2):
+- **1) Pre-commit failure contract corrected** in `cycle_driver.rs` docs + tests. The authoritative rule: **sealed `Vn` + unchanged Kanban task + deterministic computation = the same provisional intent on the next sweep** — commit fails before `Vn+1` → publish nothing · mutate no owner · advance no watermark · discard provisional slots/held moves/planning results · rerun from `Vn`. `SealFailure{casts}` RECLASSIFIED from "the retry-safety mechanism" to **optional retry cache / implementation convenience** (never a provisional-planning ledger; dropping it is always sound). `recover_fleet` doc-pinned as **committed-history recovery ONLY** (`Vn+1` exists, application interrupted) — the two mechanisms share no state. `HeldIntent` doc-pinned as within-success scheduling convenience, discarded on failure. NEW authoritative falsifier `pre_commit_failure_discards_everything_and_regenerates_from_vn` (derives cycle C from Vn → injects failure → DROPS the SealFailure → asserts no version/phase/watermark change → reruns the unchanged deterministic task → asserts the SAME semantic sparse cycle regenerates → one `Vn+1`, owners advance once; object identity deliberately NOT asserted). The old byte-identical-retry test demoted to "optional-cache probe". **20 cycle_driver tests green**, clippy+fmt clean. Latency figures in review prose = operator-provided measurements, not workspace-reproduced.
+- **2) Proof re-homed:** `medcare-consumer-pull-thinking-proof-v1.md` §4 now pins the proof's primary home to **MedCare-rs** (the live composition root) — lance-graph contributes only genuinely-missing GENERIC seams, never a MedCare-shaped host adapter (would reconstruct the dead lineage in miniature). Hard driver requirement added: the proof must invoke the existing **cognitive-shader-driver + MailboxSoA operational unit** — SoA-read qualia fed straight into `shade_owner` proves only the (already-proven) MUL gate; `shade_owner` participates only as the driver's existing downstream gate. Trace-and-report obligation added (every arrow file:symbol-named). F1 strengthened to require a discriminating DRIVER outcome, not gate-only.
+
+## 2026-08-02 — branch `claude/medcare-rs-continue-ufsazd` — MedCare two-lineage investigation CONSOLIDATED → one active plan (consumer-pull thinking proof)
+
+- Six-agent read-only investigation (code inventory · callcenter/policy · manifest→runtime chain · plans archaeology · git history · tests+build) + main-thread cross-repo verification (OGAR + MedCare-rs siblings) + `git fetch --unshallow` (5 grafted roots → 4162 commits). Full verdict in `EPIPHANIES.md` `E-TWO-MEDCARE-LINEAGES-THE-LIVE-ONE-PULLS-THE-DEAD-ONE-HOSTS-1`; classification + proof target in **`.claude/plans/medcare-consumer-pull-thinking-proof-v1.md`** (ACTIVE — the single active MedCare plan; INTEGRATION_PLANS prepended).
+- Headline: **bridge migration COMPLETED** (`ddb6c840` 2026-06-21, `MedcareBridge` = deprecated alias over `UnifiedBridge<HealthcarePort>`; codebook mirror verified in sync with OGAR); **host-side manifest/supervisor/actor lineage DORMANT since birth 2026-05-13** (manifest runtime-orphaned; `MedcareConsumerActor` never constructed; `StubConsumerActor` hard-coded; Dispatch rejected pre-child; `MedCareActor`/`MedCareMessage` in neither repo; `medcare_policy` nonexistent). Two same-named, uncomposable `UnifiedBridge` types = later hardening. **Active target: one real medical thought over the live consumer-pull path into the #879 cycle loop** (F1–F4 falsifiers, incl. the ABSENT Healthcare fail-closed unknown-actor test). P0 candidates surfaced: NoopAuditSink-by-default for a HIPAA-regime domain; fail-open discarded `MEDCARE_AUDIT_SALT`. Open decisions carried (§6): OQ-2 retention 2190/3650, `Ueberweisung`/`Anamnese` canon gap, dead-lineage retire/revive, `.grok/` lineage.
 
 ## 2026-08-02 — branch `claude/medcare-rs-continue-ufsazd` — PR #879 review round: recovery/data-integrity holes fixed + scope honesty (grain-of-salt audit)