Lotus Phase 0/1: frontier audit + F-ORD-REAL pre-registered falsifier - #961
Merged
AdaWorldAPI merged 3 commits intoAug 18, 2026
Merged
Conversation
…, and the C-band The contract's mirror of OGAR's ConceptDomain ended at Geo (0x0F) while OGAR carries Ontology (0x03, populated by the DisMech 0x0333 mints), Blocks (0x17), and the C-band JavaRuntime/Analytics/BinaryLifting (0xC0/0xC1/0xC4 -- the altitude ruling, OGAR #276+#277; 0xC0 is Panama FFM alone, Valhalla being a property of the C0 vocabulary rather than an addressable concept). Both sides' docs demand they update together; this is the catch-up, found by the lance-graph-java session and verified independently by the ruff/R2IL session at db488f5, with ownership of the sync explicitly handed here so the ruff arc's PR3 rebases trivially. The real finding is WHY the drift guard never fired: domains_agree + assert_codebook_parity only walk ids that carry concept rows, so a reserved-EMPTY domain added to one enum but not the other is invisible to a content walk. Proven live -- the first disable-run (dropping the new BinaryLifting pair from domains_agree) stayed GREEN. Repaired with reserved_empty_domains_agree_across_the_mirror: one id per new domain, the populated 0x0333, the deliberate 0xC2-0xC3 gap pinned like OGAR's own 0x10-0x16, the band edges, and the 0x0C/0xC0 digit-swap two-sided. Both disable-runs (bridge pair dropped; contract arm dropped) now go red on exactly that test; the contract's own domain_routes_on_high_byte independently catches the arm removal. Gates: lance-graph-contract 1162/1162 + doctests, clippy --all-targets clean; lance-graph-ogar (workspace-excluded, tested via manifest-path) 64/64 incl. assert_codebook_parity green -- content parity holds, this was domain-level drift only. The crate's 11 pre-existing clippy warnings are measured identical with this diff stashed and left untouched. Board: EPIPHANIES E-OGAR-CODEBOOK-MIRROR-DOMAIN-DRIFT-SYNCED-1 prepended in the same commit, per the board-hygiene rule.
Research charter deliverables 1-2 (no fix included, by design): - docs/lotus/LOTUS-FRONTIER-AUDIT.md — Phase 0 archaeology across the write path, persistence capability, placement/comma prior art, and frontier visibility, every statement graded VERIFIED / INFERENCE / HYPOTHESIS / BLOCKER. Headline findings: content_hash folds arrival-minted stream_position values into batch_hash (persist_sink.rs:414), contradicting DetachedCycleBatch's own order-independence doc; the seal is O(batch bytes) x3 passes with the batch resident up to 3x at seal; SweepSlot's caller-supplied semantic order-key contract vs collect_casts' arrival mint; the lance crate source is absent from this sandbox (prepared-artifact capability audit BLOCKED). Section 6 answers the permeability question: the cycle does not become permeable, it becomes thin — trailing-publication pipelining (Regime A) needs no epistemic weakening; rung-qualified frontier visibility (temporal.rs EpistemicMode ladder) stratifies rather than reopens the retired race; texts stay linear, tiles get derived placement, resolved per class. - docs/lotus/F-ORD-REAL-FALSIFIER.md — the defect mechanism in four verified steps + the test design (perturb the process that creates the key: permute cast() call order, never post-mint slots). - cycle_driver.rs tests: f_ord_real_defect_pin_... (GREEN, two-sided — anti-vacuity proves the perturbation reaches the key mint; semantic set + image pinned arrival-independent; batch_hash pinned arrival-DEPENDENT; fails loudly when a fix lands) and f_ord_real_publication_identity_... (#[ignore]d RED falsifier — the desired property, red under --ignored on the real chain). Gates: cargo test -p lance-graph-supervisor --features cycle-driver 28 passed / 1 ignored (+ suites green); RED verified red under --ignored; fmt clean; clippy adds zero new warnings (8 pre-existing recover_fleet lints only visible under this non-default feature). Board: EPIPHANIES E-FORD-REAL-PUBLICATION-IDENTITY-IS-ARRIVAL-DEPENDENT-1; STATUS_BOARD lotus-seal-fractal-commit-frontier section (D-LOTUS-1..9). Co-Authored-By: Claude <noreply@anthropic.com>
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_c9c4310a-1feb-4359-90c5-0dd64813682f) |
|
Important Review available on request
Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
AdaWorldAPI
marked this pull request as ready for review
August 18, 2026 17:37
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
AdaWorldAPI
pushed a commit
that referenced
this pull request
Aug 18, 2026
AdaWorldAPI
pushed a commit
that referenced
this pull request
Aug 18, 2026
Co-Authored-By: Claude <noreply@anthropic.com>
AdaWorldAPI
added a commit
that referenced
this pull request
Aug 18, 2026
…e.dev debug=0 (#962) * ogar_codebook: sync the ConceptDomain wire-mirror -- Ontology, Blocks, and the C-band The contract's mirror of OGAR's ConceptDomain ended at Geo (0x0F) while OGAR carries Ontology (0x03, populated by the DisMech 0x0333 mints), Blocks (0x17), and the C-band JavaRuntime/Analytics/BinaryLifting (0xC0/0xC1/0xC4 -- the altitude ruling, OGAR #276+#277; 0xC0 is Panama FFM alone, Valhalla being a property of the C0 vocabulary rather than an addressable concept). Both sides' docs demand they update together; this is the catch-up, found by the lance-graph-java session and verified independently by the ruff/R2IL session at db488f5, with ownership of the sync explicitly handed here so the ruff arc's PR3 rebases trivially. The real finding is WHY the drift guard never fired: domains_agree + assert_codebook_parity only walk ids that carry concept rows, so a reserved-EMPTY domain added to one enum but not the other is invisible to a content walk. Proven live -- the first disable-run (dropping the new BinaryLifting pair from domains_agree) stayed GREEN. Repaired with reserved_empty_domains_agree_across_the_mirror: one id per new domain, the populated 0x0333, the deliberate 0xC2-0xC3 gap pinned like OGAR's own 0x10-0x16, the band edges, and the 0x0C/0xC0 digit-swap two-sided. Both disable-runs (bridge pair dropped; contract arm dropped) now go red on exactly that test; the contract's own domain_routes_on_high_byte independently catches the arm removal. Gates: lance-graph-contract 1162/1162 + doctests, clippy --all-targets clean; lance-graph-ogar (workspace-excluded, tested via manifest-path) 64/64 incl. assert_codebook_parity green -- content parity holds, this was domain-level drift only. The crate's 11 pre-existing clippy warnings are measured identical with this diff stashed and left untouched. Board: EPIPHANIES E-OGAR-CODEBOOK-MIRROR-DOMAIN-DRIFT-SYNCED-1 prepended in the same commit, per the board-hygiene rule. * lotus Phase 0/1: frontier audit + F-ORD-REAL pre-registered falsifier Research charter deliverables 1-2 (no fix included, by design): - docs/lotus/LOTUS-FRONTIER-AUDIT.md — Phase 0 archaeology across the write path, persistence capability, placement/comma prior art, and frontier visibility, every statement graded VERIFIED / INFERENCE / HYPOTHESIS / BLOCKER. Headline findings: content_hash folds arrival-minted stream_position values into batch_hash (persist_sink.rs:414), contradicting DetachedCycleBatch's own order-independence doc; the seal is O(batch bytes) x3 passes with the batch resident up to 3x at seal; SweepSlot's caller-supplied semantic order-key contract vs collect_casts' arrival mint; the lance crate source is absent from this sandbox (prepared-artifact capability audit BLOCKED). Section 6 answers the permeability question: the cycle does not become permeable, it becomes thin — trailing-publication pipelining (Regime A) needs no epistemic weakening; rung-qualified frontier visibility (temporal.rs EpistemicMode ladder) stratifies rather than reopens the retired race; texts stay linear, tiles get derived placement, resolved per class. - docs/lotus/F-ORD-REAL-FALSIFIER.md — the defect mechanism in four verified steps + the test design (perturb the process that creates the key: permute cast() call order, never post-mint slots). - cycle_driver.rs tests: f_ord_real_defect_pin_... (GREEN, two-sided — anti-vacuity proves the perturbation reaches the key mint; semantic set + image pinned arrival-independent; batch_hash pinned arrival-DEPENDENT; fails loudly when a fix lands) and f_ord_real_publication_identity_... (#[ignore]d RED falsifier — the desired property, red under --ignored on the real chain). Gates: cargo test -p lance-graph-supervisor --features cycle-driver 28 passed / 1 ignored (+ suites green); RED verified red under --ignored; fmt clean; clippy adds zero new warnings (8 pre-existing recover_fleet lints only visible under this non-default feature). Board: EPIPHANIES E-FORD-REAL-PUBLICATION-IDENTITY-IS-ARRIVAL-DEPENDENT-1; STATUS_BOARD lotus-seal-fractal-commit-frontier section (D-LOTUS-1..9). Co-Authored-By: Claude <noreply@anthropic.com> * board: #961 arc entry + LATEST_STATE + D-LOTUS-1/2 Shipped flips Co-Authored-By: Claude <noreply@anthropic.com> * operator pin ruling: DF 54.1 only — remove broken delta feature; RP-SEAL charter + boards Ruling (E-PIN-LANCE9-LANCEDB033-DF541-ARROW58-NO-DF53-1): lance 9 / lancedb 0.33 / datafusion 54.1 (no DF 53) / arrow 58, always, across AdaWorldAPI forks, usually via [patch -> upstream repository git]. Measured before acting: the only DF-53 source was deltalake 0.32.4 (^53.1.0) behind the already-non-default, already-broken delta feature; registry check shows no DF-54 deltalake exists. Removed: delta feature, deltalake + url optional deps, DeltaTableReader (module docs + Cargo.toml carry dated removal notes; DataSourceFormat::Delta stays as a catalog tag). Post-removal Cargo.lock: exactly ONE datafusion = 54.1.0, zero deltalake entries. cargo check -p lance-graph green; fmt clean; full suite running as the PR gate. Docker pins surveyed: root + avx512 = Rust 1.97.1 + protobuf-compiler, no delta references — removal is docker-safe (stale flag noted: crates/symbiont/Dockerfile rust:1.95). Also: RP-SEAL research charter committed as .claude/plans/erasure-seals-compaction-research-v1.md (15-researcher program, independent pass dispatched as background workflow wf_ca974718-1b4; adversaries strongest-tier, builders/scouts grindwork tier); INTEGRATION_PLANS + STATUS_BOARD entries; D-LOTUS-6 BLOCKER lifted (operator-sanctioned upstream-git source consult; exact v9.0.0 tag on disk matching the lock checksum) with the audit carrying the dated lift note; CLAUDE.md 'BOTH MAJORS ARE REQUIRED' note superseded in place. Co-Authored-By: Claude <noreply@anthropic.com> * scope pivot (operator): rustynum struck — everything ndarray; symbiont deprecated (#879/#911/#912/#913) Recorded in the RP-SEAL plan header + the pin-ruling EPIPHANIES entry; the workflow script was corrected in place (source map + the two cell briefs naming rustynum); the in-flight independent pass could not be force-stopped in this harness build, so the ruling binds consolidation as a hard filter. Deltalake removal ratified same exchange. Co-Authored-By: Claude <noreply@anthropic.com> * correct the delta-removal notes: delta-rs MAIN is already DF 54 + arrow 58 Operator-pointed, verified from delta-io/delta-rs main Cargo.toml (datafusion = 54.0.0, arrow = 58): only the crates.io releases top out at DF 53. Restoration is available now via a git-pin on upstream + a reader refactor to the current builder API — as its own deliberate PR if a consumer needs Delta. The removal itself stands on the need ruling ('we don't need deltalake'), not on availability; notes in Cargo.toml, CLAUDE.md, and the EPIPHANIES entry corrected accordingly. Co-Authored-By: Claude <noreply@anthropic.com> * profile.dev debug=0 — smaller/faster builds (operator ruling) Full-debuginfo test binaries grew target/ to 17 GB and SIGBUS'd the linker on a full disk this session; debug=0 shrinks the lance/datafusion-stack test binaries ~an order of magnitude. Matches the gate already running with CARGO_PROFILE_DEV_DEBUG=0 (same resolved profile, cache reuse). line-tables-only noted as the fallback if line-numbered backtraces are ever needed. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
AdaWorldAPI
added a commit
that referenced
this pull request
Aug 18, 2026
* ogar_codebook: sync the ConceptDomain wire-mirror -- Ontology, Blocks, and the C-band The contract's mirror of OGAR's ConceptDomain ended at Geo (0x0F) while OGAR carries Ontology (0x03, populated by the DisMech 0x0333 mints), Blocks (0x17), and the C-band JavaRuntime/Analytics/BinaryLifting (0xC0/0xC1/0xC4 -- the altitude ruling, OGAR #276+#277; 0xC0 is Panama FFM alone, Valhalla being a property of the C0 vocabulary rather than an addressable concept). Both sides' docs demand they update together; this is the catch-up, found by the lance-graph-java session and verified independently by the ruff/R2IL session at db488f5, with ownership of the sync explicitly handed here so the ruff arc's PR3 rebases trivially. The real finding is WHY the drift guard never fired: domains_agree + assert_codebook_parity only walk ids that carry concept rows, so a reserved-EMPTY domain added to one enum but not the other is invisible to a content walk. Proven live -- the first disable-run (dropping the new BinaryLifting pair from domains_agree) stayed GREEN. Repaired with reserved_empty_domains_agree_across_the_mirror: one id per new domain, the populated 0x0333, the deliberate 0xC2-0xC3 gap pinned like OGAR's own 0x10-0x16, the band edges, and the 0x0C/0xC0 digit-swap two-sided. Both disable-runs (bridge pair dropped; contract arm dropped) now go red on exactly that test; the contract's own domain_routes_on_high_byte independently catches the arm removal. Gates: lance-graph-contract 1162/1162 + doctests, clippy --all-targets clean; lance-graph-ogar (workspace-excluded, tested via manifest-path) 64/64 incl. assert_codebook_parity green -- content parity holds, this was domain-level drift only. The crate's 11 pre-existing clippy warnings are measured identical with this diff stashed and left untouched. Board: EPIPHANIES E-OGAR-CODEBOOK-MIRROR-DOMAIN-DRIFT-SYNCED-1 prepended in the same commit, per the board-hygiene rule. * lotus Phase 0/1: frontier audit + F-ORD-REAL pre-registered falsifier Research charter deliverables 1-2 (no fix included, by design): - docs/lotus/LOTUS-FRONTIER-AUDIT.md — Phase 0 archaeology across the write path, persistence capability, placement/comma prior art, and frontier visibility, every statement graded VERIFIED / INFERENCE / HYPOTHESIS / BLOCKER. Headline findings: content_hash folds arrival-minted stream_position values into batch_hash (persist_sink.rs:414), contradicting DetachedCycleBatch's own order-independence doc; the seal is O(batch bytes) x3 passes with the batch resident up to 3x at seal; SweepSlot's caller-supplied semantic order-key contract vs collect_casts' arrival mint; the lance crate source is absent from this sandbox (prepared-artifact capability audit BLOCKED). Section 6 answers the permeability question: the cycle does not become permeable, it becomes thin — trailing-publication pipelining (Regime A) needs no epistemic weakening; rung-qualified frontier visibility (temporal.rs EpistemicMode ladder) stratifies rather than reopens the retired race; texts stay linear, tiles get derived placement, resolved per class. - docs/lotus/F-ORD-REAL-FALSIFIER.md — the defect mechanism in four verified steps + the test design (perturb the process that creates the key: permute cast() call order, never post-mint slots). - cycle_driver.rs tests: f_ord_real_defect_pin_... (GREEN, two-sided — anti-vacuity proves the perturbation reaches the key mint; semantic set + image pinned arrival-independent; batch_hash pinned arrival-DEPENDENT; fails loudly when a fix lands) and f_ord_real_publication_identity_... (#[ignore]d RED falsifier — the desired property, red under --ignored on the real chain). Gates: cargo test -p lance-graph-supervisor --features cycle-driver 28 passed / 1 ignored (+ suites green); RED verified red under --ignored; fmt clean; clippy adds zero new warnings (8 pre-existing recover_fleet lints only visible under this non-default feature). Board: EPIPHANIES E-FORD-REAL-PUBLICATION-IDENTITY-IS-ARRIVAL-DEPENDENT-1; STATUS_BOARD lotus-seal-fractal-commit-frontier section (D-LOTUS-1..9). Co-Authored-By: Claude <noreply@anthropic.com> * board: #961 arc entry + LATEST_STATE + D-LOTUS-1/2 Shipped flips Co-Authored-By: Claude <noreply@anthropic.com> * operator pin ruling: DF 54.1 only — remove broken delta feature; RP-SEAL charter + boards Ruling (E-PIN-LANCE9-LANCEDB033-DF541-ARROW58-NO-DF53-1): lance 9 / lancedb 0.33 / datafusion 54.1 (no DF 53) / arrow 58, always, across AdaWorldAPI forks, usually via [patch -> upstream repository git]. Measured before acting: the only DF-53 source was deltalake 0.32.4 (^53.1.0) behind the already-non-default, already-broken delta feature; registry check shows no DF-54 deltalake exists. Removed: delta feature, deltalake + url optional deps, DeltaTableReader (module docs + Cargo.toml carry dated removal notes; DataSourceFormat::Delta stays as a catalog tag). Post-removal Cargo.lock: exactly ONE datafusion = 54.1.0, zero deltalake entries. cargo check -p lance-graph green; fmt clean; full suite running as the PR gate. Docker pins surveyed: root + avx512 = Rust 1.97.1 + protobuf-compiler, no delta references — removal is docker-safe (stale flag noted: crates/symbiont/Dockerfile rust:1.95). Also: RP-SEAL research charter committed as .claude/plans/erasure-seals-compaction-research-v1.md (15-researcher program, independent pass dispatched as background workflow wf_ca974718-1b4; adversaries strongest-tier, builders/scouts grindwork tier); INTEGRATION_PLANS + STATUS_BOARD entries; D-LOTUS-6 BLOCKER lifted (operator-sanctioned upstream-git source consult; exact v9.0.0 tag on disk matching the lock checksum) with the audit carrying the dated lift note; CLAUDE.md 'BOTH MAJORS ARE REQUIRED' note superseded in place. Co-Authored-By: Claude <noreply@anthropic.com> * scope pivot (operator): rustynum struck — everything ndarray; symbiont deprecated (#879/#911/#912/#913) Recorded in the RP-SEAL plan header + the pin-ruling EPIPHANIES entry; the workflow script was corrected in place (source map + the two cell briefs naming rustynum); the in-flight independent pass could not be force-stopped in this harness build, so the ruling binds consolidation as a hard filter. Deltalake removal ratified same exchange. Co-Authored-By: Claude <noreply@anthropic.com> * correct the delta-removal notes: delta-rs MAIN is already DF 54 + arrow 58 Operator-pointed, verified from delta-io/delta-rs main Cargo.toml (datafusion = 54.0.0, arrow = 58): only the crates.io releases top out at DF 53. Restoration is available now via a git-pin on upstream + a reader refactor to the current builder API — as its own deliberate PR if a consumer needs Delta. The removal itself stands on the need ruling ('we don't need deltalake'), not on availability; notes in Cargo.toml, CLAUDE.md, and the EPIPHANIES entry corrected accordingly. Co-Authored-By: Claude <noreply@anthropic.com> * profile.dev debug=0 — smaller/faster builds (operator ruling) Full-debuginfo test binaries grew target/ to 17 GB and SIGBUS'd the linker on a full disk this session; debug=0 shrinks the lance/datafusion-stack test binaries ~an order of magnitude. Matches the gate already running with CARGO_PROFILE_DEV_DEBUG=0 (same resolved profile, cache reuse). line-tables-only noted as the fallback if line-numbered backtraces are ever needed. Co-Authored-By: Claude <noreply@anthropic.com> * drift cleanup: rustynum/symbiont no-go applied to live surfaces - lance-graph-cognitive: rustynum_accel was a name-only shim (zero rustynum dependency); renamed simd_accel (module + file + 11 call sites), rerouted through the sanctioned ndarray::simd re-export instead of ndarray::hpc::bitwise. Default compile green; the wip feature's pre-existing not-yet-compiling state has zero errors naming the rename. - docs/lotus audit: symbiont::domino::morton4 candidate row struck (census history only). - CLAUDE.md: symbiont removed from the binding-consumer lists via dated annotations. - EPIPHANIES: cleanup recorded in the pin-ruling entry. Audit also confirmed NO redo needed: A1's research report is clean (0 citations), the Java/Panama arc never touched either (ndarray::simd enforced), board history stays append-only. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
AdaWorldAPI
added a commit
that referenced
this pull request
Aug 19, 2026
… core, compaction = optional economics (#964) * ogar_codebook: sync the ConceptDomain wire-mirror -- Ontology, Blocks, and the C-band The contract's mirror of OGAR's ConceptDomain ended at Geo (0x0F) while OGAR carries Ontology (0x03, populated by the DisMech 0x0333 mints), Blocks (0x17), and the C-band JavaRuntime/Analytics/BinaryLifting (0xC0/0xC1/0xC4 -- the altitude ruling, OGAR #276+#277; 0xC0 is Panama FFM alone, Valhalla being a property of the C0 vocabulary rather than an addressable concept). Both sides' docs demand they update together; this is the catch-up, found by the lance-graph-java session and verified independently by the ruff/R2IL session at db488f5, with ownership of the sync explicitly handed here so the ruff arc's PR3 rebases trivially. The real finding is WHY the drift guard never fired: domains_agree + assert_codebook_parity only walk ids that carry concept rows, so a reserved-EMPTY domain added to one enum but not the other is invisible to a content walk. Proven live -- the first disable-run (dropping the new BinaryLifting pair from domains_agree) stayed GREEN. Repaired with reserved_empty_domains_agree_across_the_mirror: one id per new domain, the populated 0x0333, the deliberate 0xC2-0xC3 gap pinned like OGAR's own 0x10-0x16, the band edges, and the 0x0C/0xC0 digit-swap two-sided. Both disable-runs (bridge pair dropped; contract arm dropped) now go red on exactly that test; the contract's own domain_routes_on_high_byte independently catches the arm removal. Gates: lance-graph-contract 1162/1162 + doctests, clippy --all-targets clean; lance-graph-ogar (workspace-excluded, tested via manifest-path) 64/64 incl. assert_codebook_parity green -- content parity holds, this was domain-level drift only. The crate's 11 pre-existing clippy warnings are measured identical with this diff stashed and left untouched. Board: EPIPHANIES E-OGAR-CODEBOOK-MIRROR-DOMAIN-DRIFT-SYNCED-1 prepended in the same commit, per the board-hygiene rule. * lotus Phase 0/1: frontier audit + F-ORD-REAL pre-registered falsifier Research charter deliverables 1-2 (no fix included, by design): - docs/lotus/LOTUS-FRONTIER-AUDIT.md — Phase 0 archaeology across the write path, persistence capability, placement/comma prior art, and frontier visibility, every statement graded VERIFIED / INFERENCE / HYPOTHESIS / BLOCKER. Headline findings: content_hash folds arrival-minted stream_position values into batch_hash (persist_sink.rs:414), contradicting DetachedCycleBatch's own order-independence doc; the seal is O(batch bytes) x3 passes with the batch resident up to 3x at seal; SweepSlot's caller-supplied semantic order-key contract vs collect_casts' arrival mint; the lance crate source is absent from this sandbox (prepared-artifact capability audit BLOCKED). Section 6 answers the permeability question: the cycle does not become permeable, it becomes thin — trailing-publication pipelining (Regime A) needs no epistemic weakening; rung-qualified frontier visibility (temporal.rs EpistemicMode ladder) stratifies rather than reopens the retired race; texts stay linear, tiles get derived placement, resolved per class. - docs/lotus/F-ORD-REAL-FALSIFIER.md — the defect mechanism in four verified steps + the test design (perturb the process that creates the key: permute cast() call order, never post-mint slots). - cycle_driver.rs tests: f_ord_real_defect_pin_... (GREEN, two-sided — anti-vacuity proves the perturbation reaches the key mint; semantic set + image pinned arrival-independent; batch_hash pinned arrival-DEPENDENT; fails loudly when a fix lands) and f_ord_real_publication_identity_... (#[ignore]d RED falsifier — the desired property, red under --ignored on the real chain). Gates: cargo test -p lance-graph-supervisor --features cycle-driver 28 passed / 1 ignored (+ suites green); RED verified red under --ignored; fmt clean; clippy adds zero new warnings (8 pre-existing recover_fleet lints only visible under this non-default feature). Board: EPIPHANIES E-FORD-REAL-PUBLICATION-IDENTITY-IS-ARRIVAL-DEPENDENT-1; STATUS_BOARD lotus-seal-fractal-commit-frontier section (D-LOTUS-1..9). Co-Authored-By: Claude <noreply@anthropic.com> * board: #961 arc entry + LATEST_STATE + D-LOTUS-1/2 Shipped flips Co-Authored-By: Claude <noreply@anthropic.com> * operator pin ruling: DF 54.1 only — remove broken delta feature; RP-SEAL charter + boards Ruling (E-PIN-LANCE9-LANCEDB033-DF541-ARROW58-NO-DF53-1): lance 9 / lancedb 0.33 / datafusion 54.1 (no DF 53) / arrow 58, always, across AdaWorldAPI forks, usually via [patch -> upstream repository git]. Measured before acting: the only DF-53 source was deltalake 0.32.4 (^53.1.0) behind the already-non-default, already-broken delta feature; registry check shows no DF-54 deltalake exists. Removed: delta feature, deltalake + url optional deps, DeltaTableReader (module docs + Cargo.toml carry dated removal notes; DataSourceFormat::Delta stays as a catalog tag). Post-removal Cargo.lock: exactly ONE datafusion = 54.1.0, zero deltalake entries. cargo check -p lance-graph green; fmt clean; full suite running as the PR gate. Docker pins surveyed: root + avx512 = Rust 1.97.1 + protobuf-compiler, no delta references — removal is docker-safe (stale flag noted: crates/symbiont/Dockerfile rust:1.95). Also: RP-SEAL research charter committed as .claude/plans/erasure-seals-compaction-research-v1.md (15-researcher program, independent pass dispatched as background workflow wf_ca974718-1b4; adversaries strongest-tier, builders/scouts grindwork tier); INTEGRATION_PLANS + STATUS_BOARD entries; D-LOTUS-6 BLOCKER lifted (operator-sanctioned upstream-git source consult; exact v9.0.0 tag on disk matching the lock checksum) with the audit carrying the dated lift note; CLAUDE.md 'BOTH MAJORS ARE REQUIRED' note superseded in place. Co-Authored-By: Claude <noreply@anthropic.com> * scope pivot (operator): rustynum struck — everything ndarray; symbiont deprecated (#879/#911/#912/#913) Recorded in the RP-SEAL plan header + the pin-ruling EPIPHANIES entry; the workflow script was corrected in place (source map + the two cell briefs naming rustynum); the in-flight independent pass could not be force-stopped in this harness build, so the ruling binds consolidation as a hard filter. Deltalake removal ratified same exchange. Co-Authored-By: Claude <noreply@anthropic.com> * correct the delta-removal notes: delta-rs MAIN is already DF 54 + arrow 58 Operator-pointed, verified from delta-io/delta-rs main Cargo.toml (datafusion = 54.0.0, arrow = 58): only the crates.io releases top out at DF 53. Restoration is available now via a git-pin on upstream + a reader refactor to the current builder API — as its own deliberate PR if a consumer needs Delta. The removal itself stands on the need ruling ('we don't need deltalake'), not on availability; notes in Cargo.toml, CLAUDE.md, and the EPIPHANIES entry corrected accordingly. Co-Authored-By: Claude <noreply@anthropic.com> * profile.dev debug=0 — smaller/faster builds (operator ruling) Full-debuginfo test binaries grew target/ to 17 GB and SIGBUS'd the linker on a full disk this session; debug=0 shrinks the lance/datafusion-stack test binaries ~an order of magnitude. Matches the gate already running with CARGO_PROFILE_DEV_DEBUG=0 (same resolved profile, cache reuse). line-tables-only noted as the fallback if line-numbered backtraces are ever needed. Co-Authored-By: Claude <noreply@anthropic.com> * drift cleanup: rustynum/symbiont no-go applied to live surfaces - lance-graph-cognitive: rustynum_accel was a name-only shim (zero rustynum dependency); renamed simd_accel (module + file + 11 call sites), rerouted through the sanctioned ndarray::simd re-export instead of ndarray::hpc::bitwise. Default compile green; the wip feature's pre-existing not-yet-compiling state has zero errors naming the rename. - docs/lotus audit: symbiont::domino::morton4 candidate row struck (census history only). - CLAUDE.md: symbiont removed from the binding-consumer lists via dated annotations. - EPIPHANIES: cleanup recorded in the pin-ruling entry. Audit also confirmed NO redo needed: A1's research report is clean (0 citations), the Java/Panama arc never touched either (ndarray::simd enforced), board history stays append-only. Co-Authored-By: Claude <noreply@anthropic.com> * RP-SEAL pass 1 consolidated: evidence matrix M1-M15, tiering, Appendix H 15-researcher independent pass complete (15/15, 0 errors, no cross-talk). Consolidation per charter §12-§13: docs/lotus/RP-SEAL-CONSOLIDATION-PASS1.md - DELETED: phase/comma coefficient schedule (3 independent routes), the unconditional SFC default, 'compaction = one publication', the naive query+repair one-grouping hope - Found: b+1 coalescing amplification (65x at b=64) + non-amortizing FNV seal CPU (E2); 11 order leaks, L2 = replay order IS physical scan order (D2); five defective seal paths wearing strong names (C2/C3); Lance 9.0.0 apparatus complete and unused (5 cells concordant) - Survived: hash + row/column P+Q 64x64 seal baseline; compaction-time layout-key upstream seam; two novel candidates (joint locality question refined by the anti-synergy; STRICT/AWARE/RETRO reader-rung tiers) - Appendix H: 15 reports + orchestrator pre-pass under docs/lotus/rp-seal-v1/ - Scope-pivot filter PASSED (zero rustynum/symbiont-sourced findings) - Board: EPIPHANIES entry, AGENT_LOG entry (one-writer), STATUS_BOARD + plan header flips Co-Authored-By: Claude <noreply@anthropic.com> * §0 operator STORNO: canonical replay coordinates are core; compaction = optional economics PHYSICAL ITERATION ORDER MUST NOT DEFINE SEMANTIC REPLAY ORDER — fixed by canonical replay coordinates/order, never by physical reordering or compaction. Permanent temporal replay additionally requires a retention/tombstone policy under which historical knowledge states stay reconstructible indefinitely. Desired model: arbitrary placement + arbitrary fragmentation + historically addressable tombstones + canonical semantic replay order + current visibility as a projection + historical visibility as a QueryReference projection. Consolidation doc gains §0 with in-place ⊘-marked corrections; Tier 1 reordered (canonical coordinates, retention/tombstone, QueryReference projection fixes); Tier 2/3 layout/compaction items reclassified as the optional storage-economics track; F-NOCOMPACT promoted to the default operating description. EPIPHANIES ruling entry + STATUS_BOARD + plan header amended. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Deliverables 1-2 of the LOTUS SEAL / FRACTAL COMMIT FRONTIER research charter (operator, 2026-08-18). No fix is included, by design — the charter's sequencing is archaeology → RED falsifier → only then design.
docs/lotus/LOTUS-FRONTIER-AUDIT.md— Phase 0 archaeology, every statement graded VERIFIED / INFERENCE / HYPOTHESIS / BLOCKER, across four lenses: the write path (cast → collect → freeze → hash), persistence capability (cycle_sink's actual Lance surface), placement/comma prior art (FacetTier::morton, NiblePath, CurveRuler, the basin-probe overclaim flag), and frontier visibility (the DurableWitness retirement, the un-composed supervisor↔core seam). §6 answers the operator's sharpened question — "can temporal.rs amortize enough that the cycles become permeable" — the cycle does not become permeable, it becomes thin: trailing-publication pipelining needs no epistemic weakening; the rung ladder (EpistemicMode::for_rung, already shipped) stratifies frontier visibility instead of reopening the retired race; texts stay linear while tiles get derived placement, resolved per class.docs/lotus/F-ORD-REAL-FALSIFIER.md— the verified defect chain and the test design.cycle_driver.rs, behind the existingcycle-driverfeature):f_ord_real_defect_pin_arrival_order_leaks_into_batch_hash— GREEN, two-sided: anti-vacuity proves the perturbation reaches the CastId mint; the semantic set and the row-keyed image are pinned arrival-INDEPENDENT (the legs that hold);batch_hashis pinned arrival-DEPENDENT (the defect). A fix makes this fail loudly, forcing a deliberate re-pin.f_ord_real_publication_identity_is_arrival_order_independent— the#[ignore]d RED falsifier (the desired property). Red under--ignoredon the real chain: hashes2604999916736672513vs4858955943411201665for the identical semantic set.The headline finding
content_hashfolds arrival-mintedstream_positionVALUES intobatch_hash(persist_sink.rs:414) — so the publication identity depends on producer completion order even afterfreeze's stable sort, contradictingDetachedCycleBatch's own doc (:359-362). Three adjacent verified tensions are recorded (SweepSlot's caller-supplied-semantic-key contract vs the arrival mint; the descriptor doctrine unrealized asBatchWriter<Vec<u8>>→ batch resident ~3× at seal; the seal's triple O(bytes) pass), plus one loud BLOCKER: the lance crate source is absent from this sandbox, so the prepared-artifact capability audit (charter Phase 6) is gated.Test plan
cargo test -p lance-graph-supervisor --features cycle-driver— 28 passed / 1 ignored (+ integration suites green)-- --ignored f_ord_realcargo fmtclean; clippy adds zero new warnings (8 pre-existingrecover_fleetlints only visible under this non-default feature, untouched)Board (same commit): EPIPHANIES
E-FORD-REAL-PUBLICATION-IDENTITY-IS-ARRIVAL-DEPENDENT-1; STATUS_BOARDlotus-seal-fractal-commit-frontiersection (D-LOTUS-1..9).🤖 Generated with Claude Code
https://claude.ai/code/session_017Pud4qpxFHwqyqDjSabQbs
Generated by Claude Code