probe(dr-math): D-DRCA-3 DR #4 method routing falsifier

.claude/board/INTEGRATION_PLANS.md

@@ -1,3 +1,8 @@
+## 2026-10-30 — D-DRCA-3: DR #4 method routing falsifier (lab) → `.claude/plans/d-drca-3-dr4-method-routing-v1.md`
+
+**Status:** lab probe in `dr-math-binding-probe` (`src/dr4.rs`, `tests/dr4_method_routing.rs`); first DR #4 falsifier of D-DRDT §5. **Board:** [entry](entries/2026-10-30-d-drca-3-dr4-method-routing.md), [STATUS_BOARD](STATUS_BOARD.md) D-DRCA-3. DT-owned method key, guard witness and effect order are carried opaque; the effect-order oracle is ndarray #395's order law. No DT resolver (D-CMH-1), no MethodKey mint, no contract change.
+**Confidence:** 12 tests, 7 disable runs red; lab only.
+
 ## 2026-10-28 — D-DRDT: DR = HHTL16 Cartesian direct routing, DT = ClassId binding store → `.claude/plans/d-drdt-dr-dt-ownership-amendment-v1.md`
 
 **Status:** PROPOSED, docs only; amends D-DT64-6 §1 (per-cell WHEN×ON×DO, DR#3) and supersedes the DT64 "tensor register" noun of Bardioc-rs #9. **Board:** [entry](entries/2026-10-28-d-drdt-dr-dt-ownership-amendment.md), [STATUS_BOARD](STATUS_BOARD.md) D-DRDT. Records the DR/DT contract, reads the DR64/DR256 overview against existing pieces, gives the reuse/gap table for Cartesian and relational fold operators (proof: #1834, D-DRCA-1) and hands off DT method identity / guard / effect order and the DR #4 interface.

.claude/board/STATUS_BOARD.md

@@ -5,9 +5,9 @@
 | D-id | Deliverable | Status | Gate |
 |---|---|---|---|
 | D-DRDT-0 | amendment: DR/DT ownership, reuse/gap analysis, DT and DR #4 handoff (docs) | In PR | docs review |
-| D-DRCA-1 | HHTL16 Cartesian projection proof in `dr-math-binding-probe` (12 tests, 6 disable runs, stage costs) | In PR (#1834) | review; lab only |
-| D-DRCA-2 | DR256::WHERE × DR#3 and the stay / rebind / masked-read choice | Queued | D-DRCA-1 merged |
-| D-DRCA-3 | DR #4 falsifier: two methods, same read/write sets, different effect order, stay distinct; dropped guard refuses | Queued | DT MethodId contract (D-DRDT §4) |
+| D-DRCA-1 | HHTL16 Cartesian projection proof in `dr-math-binding-probe` (12 tests, 6 disable runs, stage costs) | Shipped (#1834) | review; lab only |
+| D-DRCA-2 | DR256::WHERE × DR#3 and the stay / rebind / masked-read choice | Shipped (#1836) | lab only |
+| D-DRCA-3 | DR #4 falsifier: two methods, same read/write sets, different effect order, stay distinct; dropped guard refuses | In PR (lab: `dr4.rs`, 12 tests, 7 disable runs; [entry](entries/2026-10-30-d-drca-3-dr4-method-routing.md)) | lab uses a test-minted method key; the real key and the DT resolver stay with D-CMH (MethodKey mint, D-CMH-1) |
 
 ## D-DT64-6 — DR64 routing, DT64 bind store, per-cell WHEN×ON×DO, OGIT reference predicates (2026-10-28)
 

.claude/board/entries/2026-10-30-d-drca-3-dr4-method-routing.md

@@ -0,0 +1,18 @@
+# D-DRCA-3: DR #4 method routing falsifier
+
+**Status:** TEST-PINNED, lab only. Code: `crates/dr-math-binding-probe/src/dr4.rs`, test `tests/dr4_method_routing.rs`; plan `.claude/plans/d-drca-3-dr4-method-routing-v1.md`. Contract: D-DRDT §5 (#1835).
+
+## Result
+
+- Two methods on one cell with equal read/write sets and effects `[Set(1), Add(1)]` vs `[Add(1), Set(1)]` (oracle 2 vs 1; `check_reorder` refuses the swap) stay two routed entries, each with its own effect-order reference. Two methods whose effects commute also stay two entries: merging is not DR's decision.
+- A declared guard with no witness refuses (`GuardDropped`), a different witness refuses (`GuardMismatch`), the right witness is carried; an unguarded method needs none.
+- Refused, each with its own variant: stale register frame, resolution under another frame issue (including another store at equal numbers), foreign class, duplicate key, coordinates outside 64 × 64, numeric fold, presence over a three-valued register.
+- Cell, row and column values equal a scalar loop; K3 value is masked by validity (the fixture has UNKNOWN cells with a 1 payload).
+- DT-owned values (method key, guard witness, effect-order reference) are opaque to DR. The effect-order law is ndarray #395's, ported verbatim into the test as the oracle.
+- 12 tests; 7 disable runs, each red on its named test.
+
+## Open
+
+- The method key is test-minted; the real one is DT's (D-CMH §2.1, decision ledger item 2). The DT resolver is D-CMH-1's `PreparedClass`, not built here.
+- DT gaps of D-DRDT §4 stay with the contract owner: no MethodId independent of name (`ActionDef.predicate`), single `field == value` guard, no effect order, no single lookup.
+- DR #4 over a `LocalSelection` or a `Chain` composition is untested.

.claude/board/entries/README.md

@@ -25,10 +25,11 @@ index row, (3) no duplicate entry id. Checks 1 and 2 are deliberately
 opposite directions; the stranding this convention prevents shows up in
 exactly one of them, never both.
 
-502 entries, 2026-08-06 .. 2026-10-29.
+503 entries, 2026-08-06 .. 2026-10-30.
 
 | date | entry id | finding | file |
 |---|---|---|---|
+| 2026-10-30 | `D-DRCA-3` |  | [2026-10-30-d-drca-3-dr4-method-routing.md](2026-10-30-d-drca-3-dr4-method-routing.md) |
 | 2026-10-29 | `palette512-turbovec9-nsl-worksteal` |  | [2026-10-29-palette512-turbovec9-nsl-worksteal.md](2026-10-29-palette512-turbovec9-nsl-worksteal.md) |
 | 2026-10-28 | `thought-layers-nan-skip` |  | [2026-10-28-thought-layers-nan-skip.md](2026-10-28-thought-layers-nan-skip.md) |
 | 2026-10-28 | `lane-layout-from-classview` |  | [2026-10-28-lane-layout-from-classview.md](2026-10-28-lane-layout-from-classview.md) |

.claude/plans/d-drca-3-dr4-method-routing-v1.md

@@ -0,0 +1,85 @@
+# D-DRCA-3: DR #4 method routing falsifier (lab)
+
+**Date:** 2026-10-30. **Status:** PROPOSED → implemented as a lab probe in
+`crates/dr-math-binding-probe` (`src/dr4.rs`, `tests/dr4_method_routing.rs`).
+**Parent:** D-DRDT (`d-drdt-dr-dt-ownership-amendment-v1.md`, #1835) §5 "Handoff:
+DR #4", first falsifier. **Not:** a DT resolver, a MethodKey mint, an ABI, a
+contract change, or method execution.
+
+## Overview
+
+#1835 §5 defines DR #4 as the route from a mapped coordinate set to a method
+operation, and fixes what it must preserve and refuse. Its first falsifier:
+*two methods on one cell with the same read/write sets and different effect
+order must stay distinct through routing, and a dropped guard must refuse.*
+
+DR stores neither a method's meaning nor its effects (#1835 §1). So the lab
+treats every DT-owned value as **opaque**: the method key, the signature
+revision, the guard witness and the effect-order reference are carried, never
+interpreted. The meaning lives in the test's DT stub, which is also the
+oracle that proves two routed methods really are different.
+
+### Ownership boundaries kept
+
+- **Method identity is DT's, and is not minted here.** D-CMH
+  (`class-method-schema-hotplug-v1.md` §2.1, decision ledger item 2) leaves the
+  16-byte `MethodKey` to the OGAR owner. The lab uses a test-minted
+  `[u8; 16]`, named as such.
+- **The DT resolver is D-CMH-1's `PreparedClass`, not this probe.** No second
+  resolver, no contract type. `Resolution` here is a lab stand-in for DT's
+  answer, constructed only by the test.
+- **The effect-order law is #395's** (ndarray `examples/pof_antennas/order_law.rs`:
+  `Effect`, `run_effects`, `commutes`, `check_reorder`), ported verbatim into
+  the test as the oracle. DR does not decide commutation.
+
+## Checklist
+
+- [x] Read the parent contract (#1835 §4–§5), D-CMH (§2.1, §7), the #395 order law,
+  and the existing lab API (`lib.rs`, `where_dr3.rs`, `hhtl16.rs`).
+- [x] Tests first (`tests/dr4_method_routing.rs`), confirmed red before the module exists.
+- [x] `src/dr4.rs`: `route` over one admitted `BoundDr64` and one `Resolution`.
+- [x] Disable runs, each red on a named test.
+- [x] README section, board entry, STATUS_BOARD row, entries index.
+
+## Contract under test
+
+`route(store, register, resolution, op, observed_guards) -> Result<Routed, Dr4Refusal>`
+
+**Preserves** (one output entry per input method, in input order): method key,
+signature revision, read and write field sets, guard witness, effect-order
+reference, and the register's frame.
+
+**Refuses**, in this order:
+
+| refusal | when |
+|---|---|
+| `Frame(Refusal)` | the register's frame is not its store's current seal |
+| `ResolvedUnderOtherFrame` | DT resolved the methods under another frame issue (another revision, a reseal or another store, even at equal numbers) |
+| `ForeignClass` | the resolution or a method belongs to another class than the register |
+| `DuplicateMethod` | one method key appears twice (two keys with equal sets are fine) |
+| `OutOfRegister` | the operation's coordinates are outside 64 × 64 |
+| `UnsupportedAlgebra` | the method declares an algebra DR does not have (a numeric fold) |
+| `NotBoolean` | a presence method over a three-valued register |
+| `GuardDropped` / `GuardMismatch` | a declared guard has no witness, or another one |
+
+## Falsifiers
+
+1. Two methods, equal read/write sets, effects `[Set(1), Add(1)]` vs
+   `[Add(1), Set(1)]`: the oracle gives 2 vs 1 and `check_reorder` refuses the
+   swap; routing returns two entries with their own effect references.
+2. Commuting effects (`[Add(2), Add(3)]` vs reversed): the oracle gives equal
+   results and the swap is legal; routing **still** returns two entries.
+   Merging is not DR's decision.
+3. A required guard with no witness refuses; a different witness refuses; the
+   right witness is carried into the output. An unguarded method needs none.
+4. Stale register frame, stale resolution, foreign store at equal numbers,
+   foreign class, duplicate key, out-of-register, numeric algebra, presence over
+   three-valued: each refuses with its own variant.
+5. Values equal an independent scalar loop for cell, row and column, two- and
+   three-valued (K3 value masked by validity).
+
+## Not done
+
+DT resolver (D-CMH-1); MethodKey mint; guard evaluation (DR only carries
+witnesses); effect execution; DR #4 over a `LocalSelection` (D-DRCA-2) or a
+`Chain` composition; production placement.

crates/dr-math-binding-probe/README.md

@@ -135,3 +135,18 @@ One WHERE halves the fresh read. Warm reuse breaks even at N = 1 and pays from N
 - A negated selection costs its own WHERE, which is the price of `NOT UNKNOWN` staying UNKNOWN.
 - One 64-slot frame per table; no larger focus, no DR256 resident register, no reuse of a scattered (`ScatterOrU32`) mask.
 - `project` is 64 scalar probes (~1 µs); admission (~76–82 ns) is not broken down.
+
+## D-DRCA-3: DR #4 method routing (`dr4`)
+
+The first DR #4 falsifier of D-DRDT §5 (#1835): two methods on one cell with the same read/write sets and a different effect order must stay distinct through routing, and a dropped guard must refuse. Module `src/dr4.rs`, test `tests/dr4_method_routing.rs`, plan `.claude/plans/d-drca-3-dr4-method-routing-v1.md`.
+
+- **DR carries DT's values opaque.** `MethodKey`, `GuardWitness` and `EffectOrderRef` are 16-byte references that `route` compares for equality and never interprets. The method key is DT's to mint (D-CMH §2.1); the test mints its own, named as such. `Resolution` (class, frame, methods) is DT's answer handed in by the caller; this crate has no DT resolver (that is D-CMH-1's `PreparedClass`).
+- **One entry per input method, in input order.** Key, signature revision, read and write field sets, guard witness and effect-order reference pass through unchanged, with the register's frame on the result. Nothing is merged: two methods whose effects commute are still two entries, because merging is the law owner's decision.
+- **Refusals, in order:** a stale register frame (`Frame(..)`); a resolution made under another frame issue, including another store at equal numbers (`ResolvedUnderOtherFrame`); the resolution or a method for another class (`ForeignClass`); a duplicate key (`DuplicateMethod`; equal read/write sets are not a duplicate); coordinates outside 64 × 64 (`OutOfRegister`); a numeric fold (`UnsupportedAlgebra`); a presence read over a three-valued register (`NotBoolean`); a declared guard with no witness (`GuardDropped`) or another one (`GuardMismatch`). DR checks witnesses; it evaluates no guard.
+- **Values** come from the existing register reads: cell, row and column presence, and K3 value + validity with the value masked by validity.
+
+Oracle: the DT stub in the test holds each method's real effects and guard. The effect-order law is ndarray #395's `Effect` / `run_effects` / `commutes` / `check_reorder` (`examples/pof_antennas/order_law.rs`), ported verbatim. In the core fixture `[Set(1), Add(1)]` and `[Add(1), Set(1)]` give 2 and 1 and the swap is refused, so the two references DR keeps apart are provably different methods; the commuting control `[Add(2), Add(3)]` and its reverse give equal results and the swap is legal, and routing still keeps both. Values are compared against plain scalar loops over the register words.
+
+Twelve tests; seven disable runs, each restored from the commit and each turning its named test red: entries collapsed by equal read/write sets (3 tests red), a dropped guard accepted, a mismatched witness accepted, the resolution frame not checked, a method's class not checked, a duplicate key accepted, the K3 value not masked by validity.
+
+**Not done.** The DT resolver (D-CMH-1), a minted `MethodKey`, guard evaluation, effect execution, DR #4 over a `LocalSelection` (D-DRCA-2) or a `Chain` composition, production placement.