council: metta-datalog-assimilation W1–W3 spec ratified (D-ASM-1..4)

.claude/board/AGENT_LOG.md

@@ -1,3 +1,13 @@
+## 2026-10-16 — /5plus3 council: metta-datalog-assimilation W1–W3 spec (D-ASM-1..4)
+
+- Phase 0: spec v1 by the orchestrator; premise-auditor (Opus) → PREMISE-SPLIT (stamp sub-premise PREMISE-WRONG); six of its code claims re-read and confirmed; spec re-asked as v1.1 before any savant was cast.
+- Phase 1 (one parallel spawn): prior-art-savant (Opus), iron-rule-savant, code-truth (general-purpose, runtime-archaeologist charter), cascade-impact-savant, creative-explorer-savant (Sonnet). 49 findings: CONFIRMS 17 · PRIOR-ART-AT 7 · GAP 11 · RISK 12 · VIOLATES 3. Orchestrator re-read every load-bearing claim it applied (`GroupAddr::Pair`, `Agg::GroupReduce` lowering, `BindingsSet::count`, b4 fixture shape, lockfile ignore, no CI line); S4's "Cargo.lock tracked" was wrong (gitignored), all else held.
+- Phase 2: draft v2 + ledger (raw savant output banked in the session scratchpad, not forwarded).
+- Phase 3 (one parallel spawn, on v2 only): overclaim-auditor, dilution-collapse-sentinel, firewall-warden (Sonnet). 0 BLOCK, 2 FIX-P1 (`NO_PROVENANCE = 3` not 0; two-category answer), 16 FIX-P2, 1 P3.
+- Phase 4/5: v3 ratified and landed as `.claude/plans/metta-datalog-assimilation-v1-council-v3.md`; plan ⊘ notes on A–E, G, §6; `metta-polyfill-v1.md` §5 amended; STATUS_BOARD D-ASM-1..5, D-MTP-2, D-RA-3 reworded (all still Queued, not authorized); 3 TECH_DEBT rows; entry `entries/2026-10-16-metta-datalog-assimilation-council-v3.md`.
+- v1→v2→v3 deltas: struck relalg `Atom::Via`/`Rel::Semijoin`, `Keep+CountKeyRunsU32` as bag carrier, "refused at add", `Rule` value in W1–W3, "existing label codebook", blanket multi-var refusal, b4 as multiplicity gate, "golden 32/33", u32 label ids, one version per add; added `materialize_bindings` as the named exit, reserved evidence lane, G2b/G4b/G8b, POLICY-PIN labelling.
+- Written by the orchestrating main thread only. About 0.37–0.44 M subagent tokens per agent, nine agents.
+
 ## 2026-10-15 — D-HOLO H14c: one Haiku census run
 
 - General-purpose on Haiku, read-only census of `Program::new` constructions in mask-risc tests and `lance-graph-quack` (D-HOLO-H14c-6): 169 occurrences, 61 literal, 108 dynamic; distinct lanes per literal program 0:26, 1:31, 2:4.

.claude/board/STATUS_BOARD.md

@@ -15,15 +15,16 @@ Plan: `.claude/plans/wal-shootout-v1.md`. Feeds D-LNC-7; decides nothing.
 ## D-ASM — MeTTa/PeTTa atoms assimilated into the Datalog-AST · NAL · R2IL · ONA-shaped substrate (2026-10-15)
 
 Plan: `.claude/plans/metta-datalog-assimilation-v1.md`. Umbrella over D-MTP-2/3/5/6, D-RA-3/4, D-NALP-4/5/7 (cited, not copied).
+Council 2026-10-16: `metta-datalog-assimilation-v1-council-v3.md` is the ratified spec for D-ASM-1..4 (gates G1–G9 there).
 
 | D-id | scope | status | gate / falsifier |
 |---|---|---|---|
 | **D-ASM-0** | Plan + inventory (`.claude/research/2026-10-15-nars-metta-ce64-mapping-inventory.md`) | Done 2026-10-15 | — |
-| **D-ASM-1** | Binder: `(functor, arity) → ClassView` + label codebook; atoms → addresses once; typed refusal for Grounded/nested/state | Queued (not authorized) | same address twice per fixture atom; refusals named by kind; no string survives bind |
-| **D-ASM-2** | Join as D-CMR-5 preimage in relalg (`EqU32Via` / gated `Gather` / range) | Queued (not authorized) | pairs == datafrog as a bag 10²..10⁶; join_10000 answers; `Program` byte-identical across front ends |
-| **D-ASM-3** | Bag terminal → `BindingsSet` multiplicity | Queued (not authorized) | `b4_nondeterm` multiset == Hyperon; dedup arm fails; new terminal only with insufficiency proof |
-| **D-ASM-4** | `LanceSpace` named space; Hyperon · PeTTa · LanceSpace harness | Queued (not authorized) | golden 32/33 unchanged; every answer == Hyperon multiset or a named refusal |
-| **D-ASM-5** | ONA-shaped compound-term tenant (64 × u8 heap), parity vs ONA `Term_*` | Queued (not authorized) | byte-identical hash/extraction; > 64 atoms refused; LAYOUT-CLEAN |
+| **D-ASM-1** | Binder: `(functor, arity)` class + NEW u16 label codebook (`metta::codebook`, mints at `add` only); atoms → addresses once; non-row atoms ROUTED to the inner `GroundingSpace`, counted by kind; reserved `evidence` lane | Queued (not authorized; spec ratified 2026-10-16) | council G1: same address twice; no `String` reachable from row/Program/Query; `CodebookFull` can-fire at 65,535 |
+| **D-ASM-2** | Existence half of the body as quack `Filter::{Semijoin, EqU32Via}` + range (D-MTP-1 shape); `metta::datalog` values lower to quack `Query` (not relalg) | Queued (not authorized; spec ratified 2026-10-16) | council G2/G2b/G3/G4/G4b: pairs == datafrog as a bag 10²..10⁶ incl. non-functional; 4 disable runs; `Program` byte-identical to `join_probe` on the functional fixture |
+| **D-ASM-3** | Bag = keyed count `GroupReduce{Count}` (`Local` / same-table `Pair`); one named exit `materialize_bindings`; cross-table projections refused | Queued (not authorized; spec ratified 2026-10-16) | council G5: purpose-built bag fixture multiset == Hyperon; `b4` is the ROUTING fixture (100 % inner space); dedup arm (`CountKeyRunsU32`) fails it |
+| **D-ASM-4** | `LanceSpace` (= D-MTP-2) named space with inner `GroundingSpace`, two-category answers, batch flush; Hyperon · PeTTa · LanceSpace harness | Queued (not authorized; spec ratified 2026-10-16) | council G6: 26-script baseline MEASURED first (`hyperon-probe/golden` is absent); every answer == Hyperon per category or a named refusal; sides disjoint |
+| **D-ASM-5** | Interned frame-side term table with ONA `Term_*` parity; 16-byte row reference; strided subterm match (council v3 struck the per-row 64 × u8 tenant) | Queued (not authorized) | byte-identical hash/extraction; > 64 atoms refused; LAYOUT-CLEAN |
 | **D-ASM-6** | Rule catalogue as data (ONA `R1/R2`, OpenNARS tables) with truth label + engine order tag; `Narsese.rs` front end | Queued (not authorized) | each rule re-emits its source line; order tag proven on both engines |
 | **D-ASM-7** | Mining seam (`lance-graph-cog` driver tier) — separate plan | Reserved | — |
 
@@ -36,9 +37,9 @@ Plan: `.claude/plans/metta-polyfill-v1.md`. Proposed crate `lance-graph-metta` (
 | **D-MTP-0** | Adoption map, MeTTa-as-IR verdict, PeTTa vs Hyperon measurements, trie panic ≥ 1,024 children | Done 2026-10-14 (entry `2026-10-14-metta-polyfill-map.md`) | — |
 | **D-MTP-1** | Two-hop join lowered by hand through Quack `Semijoin` (relalg has no hop), n = 10²..10⁶, v4 | Measured 2026-10-14: pairs == datafrog at every n, counts == Hyperon/PeTTa; at 10⁶ emit 4.0–5.7 ns/pair vs datafrog 59–71 (7.2–9.6× with ingest charged per emitted pair); count 1.2–1.8 ns/row, the random `Gather` read, not sub-ns as expected | == oracles; two disable runs red as pre-registered |
 | **D-MTP-1b** | The hop as a range: preimage of `valid`'s runs under a monotone `dst` vs the gather, clustered and scattered | Measured (§6d): R-declared count 0.0001–0.0004 ns/row vs gather 1.3–2.4 at 10⁶ | == datafrog; two disable runs red; costs reported |
-| **D-MTP-2** | `LanceSpace` (`Space + SpaceMut`) as a named space for the non-recursive Datalog subset; golden corpus rerun | Queued (not authorized) | 32/33 golden files still pass; refusals named; whole-conjunction vs per-conjunct calls recorded |
+| **D-MTP-2** | `LanceSpace` (`Space + SpaceMut`) as a named space for the non-recursive Datalog subset; golden corpus rerun — same deliverable as D-ASM-4, flips with it | Queued (not authorized) | the 26-script baseline built and committed FIRST (G6; `hyperon-probe/golden` is absent), then unchanged with facts in `LanceSpace`; refusals counted per kind; whole-conjunction vs per-conjunct calls recorded |
 | **D-MTP-3** | Recursive Datalog rules → relalg μ through the external driver d′ | Queued (not authorized) | `anc_n` answers identical; no fixpoint state in mask-risc |
-| **D-MTP-4** | Fork fix for the expression-width trie panic (≥ 1,024 children), test first; distinct from the id-decoding fix `1ffdbd6` | Queued (needs operator's word) | red before, green after |
+| **D-MTP-4** | Fork fix for the expression-width trie panic (≥ 1,024 children), test first; distinct from the id-decoding fix `1ffdbd6` | Fix EXISTS on the fork (corrected 2026-10-16): `5c9afd4` on `ccr-9f3b8075-74u47l-trie-expr-width`, failing tests first (`b5ae248`); `1ffdbd6` is upstream PR trueagi-io#1107 (head == `1ffdbd6`). Both fixes landed on fork `main` via fork PR `AdaWorldAPI/hyperon-experimental#1`, MERGED 2026-10-16 (merge `e55dc61`; local `cargo test -p hyperon-space` 39 passed on the merge, 2 failed at `trie.rs:539` on the tests-only commit `b5ae248`). lance-graph still pins `3f76dc4`, which panics; the pin bump to `e55dc61` is a separate, measured PR and is the operator's call | red before, green after (already on the branch); pin bump to `e55dc61` OPEN |
 | **D-MTP-6** | datafrog as the exact Rust oracle (probe/test only) | Measured 2026-10-14 (v4): join 10⁶ in 65–69 ns/pair, seeded ancestors 10⁶ in 286–298 ns/tuple; counts match; not yet a committed probe | bag-of-pairs equality with Hyperon and PeTTa |
 | **D-MTP-5** | PeTTa as second oracle in the probes | Queued (not authorized) | PeTTa/Hyperon divergences recorded, never averaged |
 
@@ -63,7 +64,7 @@ Plan: `.claude/plans/relalg-v1.md`. Crate: `crates/lance-graph-relalg` (own work
 | **D-HOLO-H14d** | C's own operation in four stages, C only: (1) relalg symbolic reduction of the thought's set expression, (2) materialize `R = P_a ∧ P_b ∧ A` (or `∨`) over presence planes, (3) Lance 13 read pruned by `R`, (4) COUNT/EXISTS from `R` or the operation on `T_a[i], T_b[i]` for survivors; sub-ids -1 … -5 | Measured 2026-10-16 (v4, entry 2026-10-16-d-holo-h14d-logic-mask-read): stage 1 decides 675/2,000 programs with 0 runs, 396 answered only after the rewrite, 2 widened (ISS-RELALG-ABSORPTION-AFTER-DE-MORGAN), passes 1,065 vs 5,898; R costs 2–10 ns per 64-address word; Lance scans exactly |R| everywhere, bytes 1.00x at uniform 1 % full tile, 0.19x clustered 1 %, 0.01–0.12x inside a 1,024/8,192 aperture; payload ~6 ns per lane load, reads == |R| × k, not flat at small |R| (fixed word scan; prediction 4 falsified); fused Σ ~1.3 ns per value; point query 8–45 ns hot; returned to the operator | `R` == per-address reference; rewritten == as written on 2,000 programs; payload reads == |R| × k; Lance rows == |R| with reference values; five disable runs red |
 | **D-RA-1** | `Rel` + `normalize` + `symbolic` + R2IL lowering | Shipped #1546 `c21bd165` (11 tests, 11 disable runs red; four comparisons on one lane 8 → 2 ops; 70/2,000 small descriptions refused as written, all run rewritten) | == row oracle over 400 generated descriptions × 5 measures |
 | **D-RA-2** | Rules into the contract set IR (D-CMR-1/-6); relalg keeps only lowering or is deleted | Queued (maintainer decision) | relalg tests pass unchanged against the contract IR |
-| **D-RA-3** | Datalog rules as algebra values; names are labels resolved through the label codebook, never strings in a rule | Queued (after D-RA-2) | codebook-built rules == hand-written `Rel`; unknown label refused at resolution |
+| **D-RA-3** | Datalog rules as algebra values; names are labels resolved through the label codebook, never strings in a rule — council v3 (2026-10-16) places the Datalog VALUES in `metta::datalog`; D-RA-2 still gates relalg | Queued (after D-RA-2) | codebook-built rules == hand-written `Rel`; unknown label refused at resolution |
 | **D-RA-4** | Bound recursion via external frontier driver over D-CMR-5 preimage | Queued (after D-CMR-5) | == row-oracle closure; frontier past bound refused |
 
 ## D-CMR — Concept-chain normalization: preserve the equation, not the intermediate result (2026-10-13)

.claude/board/TECH_DEBT.md

@@ -4596,3 +4596,25 @@ bijection needs re-seeding. Pair: D-IDENTITY-4.
 - **TD-CI-EXCLUDED-FUSE (F5):** main's CI never compiles the workspace-`exclude`d `lance-graph-ogar`, so its compile-time `COUNT_FUSE` fires only in *consumers'* builds (medcare hit E0080 twice). Fix: one CI job `cargo check`-ing the excluded crate against OGAR main. Effort S.
 - **TD-OGAR-LOCK-UNDECIDED (F3):** `lance-graph-ogar/Cargo.lock` is gitignored → fresh checkouts build the fuse against OGAR HEAD (floating canary) while the workspace lock pins. Decide canary-vs-pin; document in one sentence. Effort S.
 - **TD-BOARD-PREPEND-CONFLICTS (F6):** at fleet cadence the append-only board files (EPIPHANIES/LATEST_STATE/PR_ARC) are the only recurring rebase-conflict cost (~30-60 min/day/session). Per-entry board files + generated index make the conflict structurally impossible. Council-sized; forwarded to the V3/coordination session.
+
+## TD-METTA-FRONT-END-PROCEDURES-REROUTE-1 (2026-10-16) — OPEN
+
+`lance-graph-metta::datalog` (council v3 R-1b) lowers its bound plan into quack `Query` and `quack::lower`, exactly as
+`lance-graph-cypher-quack` does today. `sql-polyfill-r2il-v1.md:115-117` records the DECISION that once the procedures crate
+exists every front end lowers through the procedures. When it lands, both front ends re-route; neither may be cited as a reason to
+skip it. Close by: the re-route PR for both, with byte-identical `Program`s before and after.
+
+## TD-METTA-NO-CI-LINE-1 (2026-10-16) — OPEN
+
+No `.github/workflows` job names `crates/lance-graph-metta` (own workspace root, excluded; `grep -rn lance-graph-metta
+.github/workflows` is empty, 2026-10-16). Council gate G7 is therefore a LOCAL gate until a job exists; an excluded crate with
+no CI line rots invisibly (the tesseract-rs `spider_doc_ir` precedent). Close by: a `member-tests`-shaped job running
+`cargo test --manifest-path crates/lance-graph-metta/Cargo.toml` (datafrog + hyperon git dev-deps resolved).
+
+## TD-CONTRACT-NARS-INFERENCETYPE-DOC-DRIFT-1 (2026-10-16) — OPEN
+
+`crates/lance-graph-contract/src/nars.rs:12-23` `pub enum InferenceType` documents its variants (Deduction, Induction, Abduction, Revision, Synthesis)
+as CAM search modes ("exact CAM search", "wide CAM scan", "DN-tree traversal") while the shipped meaning is the NAL truth law
+(`causal_edge::isa::truth::code`, D-NALP-4) with the argument-order split recorded in
+`.claude/research/2026-10-15-nars-metta-ce64-mapping-inventory.md` §6. Doc-only; close by one PR that rewrites the five doc
+comments to the truth-function meaning and names the OpenNARS/ONA order convention.

.claude/board/entries/2026-10-14-metta-polyfill-map.md

@@ -27,3 +27,5 @@
 
 **Open:** whether `match &self` can reach whole conjunctions without patching Hyperon; D-MTP-1..5
 not authorized; the expression-width panic has no fix yet.
+
+Addendum 2026-10-16: "the expression-width panic has no fix yet" was wrong when the next session re-read the fork. ⊘ Corrected 2026-10-16 (the fork was read, not the board): TWO fixes exist on `AdaWorldAPI/hyperon-experimental` — `1ffdbd6` (`fix-trie-key-value`, id decoding above 1023) is upstream PR trueagi-io#1107 (`refs/pull/1107/head` == `1ffdbd6`, open against upstream main `3f76dc4`), and `5c9afd4` on `ccr-9f3b8075-74u47l-trie-expr-width` (2026-10-14; `b5ae248` adds the failing ≥ 1,024-children tests first, `5c9afd4` splits the `TrieKey` value bits so expression width is bounded by trie recursion depth, ~1,100 children debug / 2,048 release on a 2 MB stack, not by `TK_MAX_EXPRESSION_SIZE`). Neither is on the fork's `main`; the lance-graph pins (`rev = 3f76dc4`) therefore still carry the panic. What waits on the operator is merging `5c9afd4` to the fork's main and/or upstreaming it, not writing the fix.

.claude/board/entries/2026-10-16-metta-datalog-assimilation-council-v3.md

@@ -0,0 +1,41 @@
+# 2026-10-16 — metta-datalog-assimilation: /5plus3 council ratifies the W1–W3 spec (D-ASM-1..4)
+
+STATUS: done | OUTCOME: `.claude/plans/metta-datalog-assimilation-v1-council-v3.md` is the executable spec for D-ASM-1..4; the
+plan's decisions A–E and G and its §6 stamp OPEN carry ⊘ council notes; `metta-polyfill-v1.md` §5 "never stored as text" amended.
+Nothing is authorized to build; D-ASM-1..4 stay Queued. | OPEN: cross-table projections (two-hop, both ends projected) have no
+tuple carrier (W4+); `hyperon-probe/golden` is absent and the 26-script baseline must be measured before `LanceSpace` exists.
+
+The premise gate (premise-auditor) returned PREMISE-SPLIT before any savant was cast, and the stamp sub-premise PREMISE-WRONG:
+- a conjunctive body has an EXISTENCE half (one table's row set through fk lanes — quack `Filter::Semijoin`/`EqU32Via`, as D-MTP-1
+  shipped) and an ANSWER half (binding tuples with multiplicity) and they are different signatures; "join in relalg" was filing the
+  second under the first;
+- a bag is a KEYED COUNT (`Terminal::GroupReduce{Count}`, `mask-risc/src/ir.rs:420-446`); `CountKeyRunsU32` is `COUNT(DISTINCT)`
+  (`:369-389`) and can only be the dedup falsifier;
+- `SpaceMut::add` returns `()` (`hyperon-space/src/lib.rs:237`): there is no refusal channel at `add`, so `LanceSpace` ROUTES at
+  `add` (non-row atoms to an inner `GroundingSpace`, counted by kind) and REFUSES at `query` (Hyperon `Error` atoms);
+- a stamp is motion, not content: it travels BESIDE the atom as an evidence lane at the same coordinate, never inside it;
+- a compound term is interned once, frame-side; a per-row 64-byte tenant files a label as a row value (+12.5 % of the stride).
+
+The five savants (prior-art Opus; iron-rule, code-truth, cascade, different-views Sonnet) returned 49 findings: CONFIRMS 17,
+PRIOR-ART-AT 7, GAP 11, RISK 12, VIOLATES 3. Load-bearing: `b4_nondeterm` never reaches the fold (every fact is an `=` rule with a
+nested head) so it is the ROUTING fixture and the multiplicity fixture is purpose-built; quack `GroupAddr::Pair` already carries
+same-table two-variable projections, so only cross-table ones are refused; "the existing label codebook" was prose — a u16
+`LabelCodebook` that mints only at `add` is W1 scope; `BindingsSet` construction is population-proportional by Hyperon's own trait
+and becomes the one named exit `materialize_bindings` with a bound; `hyperon-probe/golden` does not exist on disk.
+
+The three reviewers (overclaim, dilution/collapse, firewall) on draft v2: 0 BLOCK, 2 FIX-P1 (the reserved evidence lane must be
+written `3` = `NO_PROVENANCE`, not 0; fold-bag and inner-bag are two tagged categories concatenated only at the trait boundary),
+16 FIX-P2 (every number sourced or labelled POLICY PIN; fork-relative paths; F6 carries its own amendment; `cargo tree` gate for
+the library build), all applied in v3.
+
+Not an Epiphany: every finding is a correction of this plan's own text or a measured property of shipped code; the durable
+residue is the ratified spec and the ⊘ notes. MIRROR — BIAS CHECK: the v1 spec filed the join in relalg because the plan said so
+(anchoring on the plan's own wording); the premise gate, not the savants, caught it.
+
+**Addendum (2026-10-16, later):** fork PR `AdaWorldAPI/hyperon-experimental#1` merged (`e55dc61`), so both trie fixes are on fork `main`. lance-graph's `hyperon-*` pin is still `3f76dc4`; D-MTP-4's remaining step is the pin bump, OPEN, not authorized here.
+
+**Addendum (2026-10-16, Codex review on #1576):** five findings, all verified against code (two P1): the keyed count undercounts
+FOREIGN fan-out (`Semijoin` mask × `GroupReduce{Count}`), and `Space::query -> BindingsSet` has no error channel. Applied as
+spec §10 (v3.1): R-3 limit + G2b split (ii pinned two-sided) + N1c; R-5 `try_query` / counted-empty trait path / `(lance-match …)`
+grounded op; N4 rewritten; plan §E and D-ASM-5 reworded around the interned term table; D-MTP-2 gate = the 26-script baseline.
+OPEN (operator): what the adapter answers for a foreign fan-out query in W1–W3 (tagged bag is the written default).