D-MBX-A6-P4: cycle loop-closure driver — sparse seal/apply + MUL-gate thought seam (control-loop contract)

.claude/board/EPIPHANIES.md

@@ -1,3 +1,33 @@
+## 2026-08-02 — E-D-MBX-SPINE-IS-STRAIGHT-TRACK-VERSION-IS-NOT-A-FLEET-STEP-SIGNAL-1 — the D-MBX production ownership map is ratified, and P4's fleet-wide fan-step is corrected to sparse sealed-transition application
+
+**Status:** RATIFIED (operator ruling, 2026-08-02) + CORRECTION of a same-session drift. **Confidence:** High for the ownership map (verified against `Cargo.toml` deps) and the sparse correction (it removes a direct contradiction with `E-COMPLETE-CYCLE-IS-PHYSICALLY-SPARSE-NOT-A-FULL-REWRITE-1`). Documentation-only — no Rust/tests changed. Recorded in `.claude/plans/cycle-loop-closure-driver-v1.md` §3, §9–§11.
+
+**The production spine (straight railway track).** contract **defines** · planner **proposes and seals** · supervisor **owns and applies** · shader **thinks** · Lance **persists**. Ownership map (verified deps): `lance-graph-contract` = canonical types (KanbanColumn/KanbanMove, DatasetVersion, VersionScheduler traits, MailboxSoaView/Owner, legal Rubicon transitions; zero-dep; no fleet ownership, no persistence impl, no thought body). `cognitive-shader-driver` = **MailboxSoA type/layout home** + native cognition/shader/thinking (defines the anatomy; NOT the runtime fleet lifecycle). `lance-graph-planner` = **decides** (StyleStrategy/StrategyOutcome, intended KanbanMove, owner_adapter, BatchWriter, cycle collection+coalescing, persist_cycle/WalSink contract, recovery/temporal contracts; **never mutates a supervisor-owned MailboxSoA**). `lance-graph-supervisor` = **exclusive runtime owner** (KanbanActor state IS the owner; authoritative phase mutation; the P4 cycle-loop; applies only sealed sparse transitions; fires CognitiveWork; returns Outcomes; **owns D-MBX-A6-P4**). `lance-graph` = Lance dataset + DatasetVersion substrate + external-reader subscription + future concrete LanceShardSink (storage, NOT cognitive fleet owner). The three-way split that must stay explicit: **MailboxSoA type = shader; runtime ownership = supervisor; decision + persistence-contract = planner.**
+
+**Dependency direction (verified 2026-08-02).** `supervisor → contract` (+callcenter) and `planner → contract` exist; `planner` does NOT dep supervisor/symbiont/rs-graph-llm; `contract` is zero-dep; `cognitive-shader-driver` has an OPTIONAL feature-gated planner dep (debug/serve DTOs, not fleet ownership). The `supervisor → planner` edge is the **planned P4 wiring** and is acyclic (planner's closure never reaches supervisor). **No dependency cycles found.**
+
+**The correction — a version is NOT a fleet-step signal.** The earlier same-session draft of the P4 loop had the supervisor **fan `NextPhaseScheduler::on_version` across the whole fleet → advance every non-absorbing mailbox** on each sealed version. That is WRONG: it makes almost the entire fleet dirty every cycle, directly violating the sparse-cycle ruling. **Corrected model:** mailboxes think over the sealed `Vn`; owners that produce material updates emit sparse fire-and-forget intents (a `SweepSlot` with a `paired_move`); planner collects/coalesces/seals (one WAL → `Vn+1`) and exposes the **sealed paired-transition set**; the supervisor iterates **ONLY those sealed transitions**, resolves each owner, applies one legal `try_advance_phase`, and leaves **all unrepresented owners byte-identical**. `NextPhaseScheduler::on_version` is the **intent-time lowering policy**, never an apply-time fan. `SymbiontBoard.step`-advances-every-board is the SLICE shape-prover, not the production rule. **Canonical distinction: `DatasetVersion` is global knowledge; Kanban mutation is sparse and owner-specific; a new version is never, by itself, permission to advance every mailbox.** P4b's falsifier is now the sparse shape: 64k mailboxes / 17 sealed transitions → exactly 17 advance, rest byte-identical, no second dataset read, one version. **Interim conservative rule:** ≤1 durable Kanban phase transition per owner per sealed cycle (data updates coalesce; extra state-dependent transitions wait for the next sealed horizon). The writer applies the sealed set INLINE (no dataset re-read; NOT 64k async `drive_once`).
+
+**Adjacent-crates doctrine (basements, not owners).** `symbiont` = golden-image + bystander research lab (compile/link golden image, integration/scale probes, AST-arm + arm-discovery experiments) — FORBIDDEN as authoritative MailboxSoA owner / production scheduler / Kanban lifecycle / WAL owner / version authority / required dep of the core crates. `rs-graph-llm` = optional capability basement (agentic demos, Rig, tool-use adapters, HITL façades, optional CognitiveWork capability providers) — FORBIDDEN as authoritative SoA/Kanban/WAL/version state or a required dep; it is a client/capability provider that returns Outcomes/evidence, never owns the standing wave. `ogar-*` = AST/declaration/adapter basement — describes behaviour, never owns the living cycle. Subagent guardrail (STOP+report triggers) recorded in the plan §11. Extends `E-KANBANMOVE-IS-THE-PARCEL-ADDRESS-STEP-IS-THE-DELIVERY-SCAN-1`, `E-SUBSTRATE-IS-THE-SCHEDULER`, `E-COMPLETE-CYCLE-IS-PHYSICALLY-SPARSE-NOT-A-FULL-REWRITE-1`.
+
+## 2026-08-02 — E-COMPLETE-CYCLE-IS-PHYSICALLY-SPARSE-NOT-A-FULL-REWRITE-1 — a globally-complete cycle persists only its coalesced dirty-row delta, never a full 64k-row snapshot
+
+**Status:** RATIFIED as architecture; UNIMPLEMENTED in a concrete Lance sink (operator ruling, 2026-08-02). **Confidence:** High for the ruling (a storage-density invariant); the concrete sink that must honor it is deferred and unbuilt. Documentation-only — no Rust/tests changed. Recorded in `.claude/plans/persistence-cycle-wal-bootstrap-v1.md` §2.
+
+**The ruling.** "One complete cycle image" must NEVER be read as serializing every row because every participant belonged to the cycle. **Complete logical cycle ≠ full physical dataset rewrite.** A cycle is *logically complete* when all required participants reached the boundary, all updates were collected + temporally ordered/coalesced, all required lifecycle transitions were included, the change set was frozen, and it committed atomically. The *physical payload stays sparse*: 64k participants → N dirty rows (N may be ≪ 64k) → one frozen sparse delta batch → one WAL transaction → one `DatasetVersion`. Unchanged rows are **inherited from the sealed predecessor version** and MUST NOT be serialized merely because they participated.
+
+**The invariant (verbatim).** «A cycle is globally complete but physically sparse. `commit_cycle` persists only the coalesced dirty-row set and the required durable transition metadata. Unchanged rows remain inherited from the sealed base version and do not become new row payloads merely because they were members of the cycle.» "One WAL write per cycle" = one atomic durability boundary for the sparse change set, NOT one full 64k-row (~32 MiB) snapshot.
+
+**Participation ≠ mutation.** Cycle completion evidence (cycle identity, sealed base version, participation digest, dirty-row count, transition count, batch digest) is a small footer, compact + separate from row payloads. A participant that produced no state mutation MUST NOT require a 512-byte row payload merely to prove participation. (Cohort internals — participant-count encoding, bitmap layout, ownership — are out of scope; separate cohort architecture session.)
+
+**Honest bootstrap limitation.** The #878 contract-probe duplicates bytes in memory (`SweepSlot` owns payload + `DetachedCycleBatch` retains landings + `freeze` clones the final image). Acceptable for the fake; the concrete sink must NOT persist both the per-landing bytes AND the coalesced image. Future concrete shape: landing metadata / durable transitions + ONE detached coalesced dirty-row image + a small cycle footer. (Structs NOT redesigned here — a concrete-sink upgrade requirement.)
+
+**Capacity is an explicit event.** Normal cycle = sparse delta; worst case (every row genuinely dirty) ≈ one full row slab — VALID but an explicit capacity event, not the default shape. The concrete sink must define (numbers not chosen here): max frozen cycles in flight, max bytes in flight, WAL/storage backpressure, checkpoint/compaction, version-retention, disk-monitoring + refusal threshold.
+
+**Five concrete-sink falsifiers (deferred, probe-first).** (1) sparse-cycle: 64k participants / 17 dirty → exactly 17 coalesced payloads + one version, rest inherited from Vn; (2) no-op-cycle: zero dirty + zero transitions → ONE documented policy (no new version OR metadata-only version; never a full empty slab); (3) coalescing: many updates one row → one final payload written, no duplicate intermediate row state, transition history separate; (4) dense-cycle capacity: all dirty → one bounded batch, backpressure bounds the queue, no silent disk exhaustion; (5) retention: many versions → documented cleanup bounds disk growth, hindsight-horizon versions stay readable.
+
+**Preserves the split (unchanged):** horizontal coherence = `temporal.rs`; vertical durable succession = `DatasetVersion`; correction = `revision.rs` into a later version; execution/cohort internals = separate work. This ruling concerns physical persistence density ONLY — it does not pull cohort topology, temporal partial ordering, or revision semantics into the concrete-sink design. Extends `E-THE-DURABLE-UNIT-IS-THE-CYCLE-NOT-THE-CAST-ONE-WAL-WRITE-PER-SWEEP-1`.
+
 ## 2026-08-02 — E-THE-DURABLE-UNIT-IS-THE-CYCLE-NOT-THE-CAST-ONE-WAL-WRITE-PER-SWEEP-1 — the persistence seam is reshaped to the WAL-amortized generation; per-cast durability retired
 
 **Status:** FINDING (operator-ruled 2026-08-02 — the decision on the fork Correction 2(c) of `E-THE-PAIRED-MOVE-MUST-BE-DURABLE-CO-LOCATED-NOT-IN-MEMORY-ONLY-1` surfaced). **Confidence:** High for the **storage/race CONTRACT** (`lance-graph-planner` 344 lib tests, 13 in `persist_sink`, clippy+fmt clean); crash-durability remains contract-probed over an in-process fake, NOT storage-proven (`compile+test green ≠ storage proven`, the Ladybug lesson). Builds NO concrete sink.

.claude/board/INTEGRATION_PLANS.md

@@ -1,3 +1,38 @@
+## 2026-08-02 — cycle-loop-closure-driver v1 — PLANNED / CONJECTURE (the seam that makes persist_sink load-bearing at 64k) — main thread
+
+**Plan:** `.claude/plans/cycle-loop-closure-driver-v1.md`
+The loop-closure driver: the missing seam that turns the merged `persist_sink`
+cycle/WAL bootstrap into a running loop at 64k concurrency. Today
+`persist_sink::{persist_cycle, WalSink, versions}` has **zero production
+callers** — the loop is open. The driver closes: owners think over the sealed
+`Vn`; owners that produce material updates emit **sparse** fire-and-forget
+intents; the planner collects/coalesces/freezes one cycle (one WAL, `Vn+1`) and
+exposes the **sealed paired-transition set**; the supervisor applies **ONLY the
+sealed sparse transitions** (each represented owner advances one legal step;
+**all unrepresented owners stay byte-identical**); owners entering CognitiveWork
+run the thought and cast the next intent via `owner_adapter`. **Correctness
+pivot (corrects the earlier draft): a `DatasetVersion` is global knowledge, NOT
+permission to advance every mailbox** — the earlier "fan `on_version` across the
+whole fleet" model violated the sparse-cycle ruling and is removed. The sealed
+transitions are applied INLINE by the writer (no dataset re-read; NOT 64k async
+`LanceVersionScheduler::drive_once`, which is the reader-that-did-not-write
+variant). Interim rule: ≤1 durable phase transition per owner per sealed cycle.
+Mints NO new types — composes `KanbanMove`/`DatasetVersion`/`SweepSlot`/
+`BatchWriter`/`NextPhaseScheduler`/`KanbanActor`/`owner_adapter`/
+`recover_and_apply`. Deliverables D-MBX-A6-P4a (drain+seal) → P4b (apply sealed
+sparse set; falsifier: 64k mailboxes / 17 sealed transitions → exactly 17
+advance, rest byte-identical) → P4c (CognitiveWork+cast round-trip) → P4d
+(wait-free emit) → P4e (recovery composition) → P4f (sparse-routing scale
+16k/64k, W2a-gated), each probe-first. Home: `lance-graph-supervisor` (structural
+fleet owner; new one-way planner path-dep, verified acyclic) with a planner
+fallback. Also carries the D-MBX crate-responsibility map (§9), the
+adjacent-crates doctrine for symbiont / rs-graph-llm / ogar-* (§10), and the
+subagent anti-drift guardrail (§11). HONEST: the CONTROL loop closes; the
+durability leg stays the contract-probe fake until the concrete `LanceShardSink`
+lands. Board-as-tenant (D-V3-W2a) is a SCALE gate, not a control-loop blocker.
+Companion to `persistence-cycle-wal-bootstrap-v1.md` §2 sparse-delta ruling
+(EPIPHANIES `E-COMPLETE-CYCLE-IS-PHYSICALLY-SPARSE-NOT-A-FULL-REWRITE-1`).
+
 ## 2026-08-01 — CORRECTION to the §8 entry below: `RungLevel 0–10` → `0–9`
 
 The `2026-07-31 — SYNERGY-MAP-S00-S07 §8` entry's summary line reads