contract: classid canon:custom half-order flip — P0 route-through + P1 CanonHigh

.claude/board/AGENT_LOG.md

@@ -1,3 +1,34 @@
+## 2026-07-02 — Fleet flip EXECUTION (2× Sonnet edit agents + main thread) — 6 PRs open
+
+- **PRs:** lance-graph #628 (P0+P1+compat-reader), OGAR #147 (vocab flip +
+  18-file doc sweep, Sonnet agent), openproject-nexgen-rs #68, MedCare-rs
+  #180, woa-rs #177 (doc-only), q2 #71 (Sonnet agent: cockpit/osint-bake/
+  fma/cpic; cpic interim canon-high Genetics:q2 0x0E01_000N; SAMPLE_GUIDS
+  regenerated from real ingest).
+- **Zero-impact (no PR):** OGIT, tesseract-rs, openproject (Ruby).
+- **Deferred:** q2 .soa re-bakes (runtimed [patch] unfetchable in sandbox —
+  safe via legacy aliases + BodyV3 dual-accept; CI/dev follow-up) +
+  body.soa release re-upload. Merge order: #628 → #147 → consumers.
+
+## 2026-07-02 — Fleet flip inventories (5× Sonnet, read-only) + P1 flip landed
+
+- **Agents:** q2 / OGAR+OGIT / MedCare-rs+openproject-nexgen-rs+openproject /
+  woa-rs / tesseract-rs — exhaustive classid half-order site inventories with
+  Rule-7 negative-existence declarations. Outcomes: OGIT zero; openproject
+  (Ruby) zero; tesseract-rs zero (contract dep is unichar-only; OCR domain
+  already allocated as ConceptDomain::Ocr 0x08); woa-rs one stale doc comment
+  (erp/canon.rs Phase-3 mint); MedCare-rs auth test literal 0x0000_0B01 +
+  docs; openproject-nexgen op-canon ~13 pinned literals (bit math lives
+  upstream in ogar_vocab); OGAR = the canonical flip site
+  (ogar_vocab::app 4 fns + mint.rs tests + large doc sweep) + flags
+  ruff_spo_address::Facet (AdaWorldAPI/ruff git dep) as companion; q2 =
+  osint-bake/cockpit-server compose+decompose sites, fma/ + cpic/ standalone
+  schemes, BAKED artifacts (osint_scene.soa, fma.soa, SAMPLE_GUIDS.tsv,
+  aiwar.codebook, release body.soa) needing re-bake.
+- **Main thread:** D-CCF-1 (P1 flip) implemented in lance-graph-contract —
+  CanonHigh live, new-form constants + legacy aliases, hhtl dual-form
+  boundary. Gates green (773/759 + doctests + clippy + dependents). PR #628.
+
 ## 2026-07-01 (cont.) — v3-convergence-wiring D1/D2 execution (2 Sonnet grindwork agents + Fable finish)
 
 **Main thread (Fable 5) + two Sonnet 5 agents (edit-only, shared checkout, no worktrees).** (1) **P6 agent (D-VCW-2, completed):** extended `markov_soa` tests with `p6_palette_join` — self-match exactly 1.0 under a real zero-diagonal 256×256 palette table + hand-computed table arithmetic == `best_guess_match` output; 6/6 module green; correctly refused a planner dep (the TABLE is the join object, dependency flows AriGraph→sensor never reverse). Flagged the pre-existing planner deprecation clippy debt (→ TD-DEPRECATED-ACCESSORS-BLOCK-DEP-CLIPPY). (2) **D1b agent (D-VCW-1b, killed mid-test by worker restart; Fable finished):** driver-persistent `RwLock<RungElevator>` on `ShaderDriver` (per-call-local would never accumulate a streak — the agent's own correct design call), base-change reset so streaks never leak across dispatch contexts, gate fed POST-decision (provenance never alters the gate), `materialize_provenance(…, rung)` replaces the `ctx.rung = 1` proxy, `wire.rs`/`grpc.rs` 10-arm matches deduped through `RungLevel::from_u8`. Fable finished the second test honestly: rung is a +1 tie-weight in tactic scoring, so inequality is asserted for the EMPIRICALLY-differentiating input (rung 1→tactic 17, rung 9→tactic 3 at authoring), not claimed universal. Gates: driver 100/100, contract 755 regression green, fmt clean, driver-own lints clean (dep-closure clippy blocked by the pre-existing deprecation debt, recorded). Commit: this one.

.claude/board/EPIPHANIES.md

@@ -1,3 +1,60 @@
+## 2026-07-02 — E-CLASSID-COMPAT-READER — the P0 sweep missed rbac.rs: `class as u16` in ClassGrant::permits; fixed via a mint-forward compat reader
+
+**Status:** SHIPPED (follow-up on the P1 flip commit, PR #628 arc).
+
+**Correction:** the D-CCF-0 route-through sweep covered ogar_codebook /
+hhtl / canonical_node but NOT `rbac.rs` — `ClassGrant::permits` derived its
+class discriminator via `class as u16` (the exact codex-P2 collapse
+pattern), and `lance-graph-rbac AuthProvider::classid()` hand-widened
+`u32::from(class_id)`, and `lance-graph-ogar` carried `0x0000_0B01`-form
+literals. All three surfaced only when the flip landed.
+
+**Mechanism added:** `ogar_codebook::classid_canon_compat` — the
+mint-forward CANON reader for surfaces that must serve BOTH stored forms
+(RBAC grant matching, reads over un-re-baked corpora): active canon when
+plausible (`>= 0x0100 && != 0x1000`), legacy-order fallback otherwise.
+Sound because real render prefixes are §2-allocated (`0x0000..0x0007`) and
+the marker is `0x1000`; documented limitation — the future canon slot
+exactly `0x1000` (domain-0x10 root) stays reserved-unusable until marker
+retirement (P4). RBAC now authorizes pre-flip persisted rows without
+re-bake (fails OPEN-to-correct-concept, never collapses classes).
+
+**Lesson (Rule-7 adjacent):** a route-through sweep's own coverage claim
+needs the same exhaustive-grep declaration as a negative-existence claim —
+"all sites routed" was asserted from the plan's §2 inventory, not from a
+whole-crate `as u16`/`u32::from` sweep.
+
+## 2026-07-02 — E-CLASSID-FLIP-P1-LANDED — CanonHigh is live: canon HIGH / custom LOW, legacy aliases resolve persisted rows, OGAR#95 reconciled as the custom-half render catalogue
+
+**Status:** SHIPPED (PR #628 arc; P0 route-through fd9bf6b → P1 flip this commit).
+
+1. **`CLASSID_ORDER = CanonHigh`** — one-const flip per
+   `E-CLASSID-SPLIT-ORDER-IS-A-FLIP`. New mint surface: v1 classes
+   `0x0700_0000` (OSINT) / `0x0A01_0000` (FMA) / `0x0100_0000` (PROJECT) /
+   `0x0200_0000` (ERP); V3 classes `0x0701_1000` (OSINT:q2, appid
+   normalized) / `0x0A01_1000` (FMA:q2) / `0x0E01_1000` (CPIC Genetics:q2,
+   normalized `:00`→`:01` per the ruling).
+2. **Mint-forward boundary:** every pre-flip stored form stays registered as
+   a `CLASSID_*_LEGACY` read-only alias key in `BUILTIN_READ_MODES` —
+   persisted rows resolve forever until re-baked; retirement gated on corpus
+   proof (codex P2 #627). `hhtl::from_guid_prefix` (v1 fold) accepts BOTH
+   pure-canon stored forms and folds them to the IDENTICAL path; genuinely
+   marked classids (both halves nonzero) still refuse.
+3. **OGAR#95 reconciliation (plan P2) resolved by construction:** the app
+   prefix IS the custom half — `render_classid(prefix, concept)` composes
+   concept HIGH / prefix LOW (`patient` under Healthcare = `0x0901_0005`).
+   The #95 allocation table becomes the CUSTOM-half render catalogue; prefix
+   VALUES unchanged. OGAR `ogar_vocab::app` flips in lockstep (operator:
+   "also flip ogar to match").
+4. **Domain routing on legacy-form ids intentionally does NOT route** —
+   old rows resolve via concrete alias keys, not `classid_concept_domain`
+   (documented on the function). New mints route correctly off the canon.
+
+Gates: contract 773 (guid-v3-tail) / 759 (default) + doctests green; clippy
+-D warnings clean; dependents green (callcenter 163, cognitive-shader-driver
+104, planner 204). Fleet inventories (q2 / OGAR+OGIT / medcare+openproject /
+woa-rs / tesseract-rs) recorded in AGENT_LOG; consumer PRs follow.
+
 ## 2026-07-02 — E-CLASSID-CANON-HIGH-TRIGGERED — the operator pulled the flip trigger: canon (domain:appid) moves to the HIGH half, `0x1000` was a temporary reminder, OSINT low byte = appid space, q2 gate waived
 
 **Status:** DOCTRINE (operator ruling, verbatim anchors in the plan §0).

.claude/board/LATEST_STATE.md

@@ -100,6 +100,7 @@ Membrane consumers can now pull BOTH halves of a render `classid` BBB-safely fro
 
 | PR | Merged | Title | What it added |
 |---|---|---|---|
+| **#627** | 2026-07-02 | classid canon:custom flip TRIGGERED (doc-only) | Operator ruling recorded + `classid-canon-custom-flip-v1.md` ACTIVE: canon `domain:appid` → hi u16, custom (`0x1000` temporary marker) → lo; `0x0701_1000` / `0x07:01::1000`; OSINT low byte = appid space (zero vocab rows, OGAR #146 67→65 fuse balanced); q2 gate WAIVED; ISSUES ×4 resolved/ruled; codex P2 guards locked (class_id via `classid_canon(id)` never `as u16`; legacy keys demote not retire). Merge `c8e1ec4`. |
 | **#626** | 2026-07-02 | V3 convergence wiring: tenant-carve certification, RungElevator, P6 wave probe, seam-list plan | "Wire, don't invent": `RungLevel::{from_u8,elevate,de_elevate,pearl_level,causal_mask_bits}` + `RungElevator` (sustained-BLOCK policy over P2/P3-certified masks; converged with `escalation::rung_delta` via `apply_delta` — one ladder, two signal sources) wired through the driver (persistent elevator, `ctx.rung=1` proxy retired, grpc rung saturates-never-wraps per codex P2); BOTH V3 tenant carves matrix-certified (Cognitive + Compressed); P6 probe (wave dist == certified palette read, markov_soa verified); `[patch.crates-io] ndarray` → local sibling path (fetch deadlock gone; first in-sandbox core build, 925/925). Plan `v3-convergence-wiring-v1.md`; worker Rule 7. Branch `claude/v3-substrate-migration-review-o0yoxv`, merge `5aaee33`. |
 | **#542** | 2026-06-18 | E-OGAR-IS-FOUNDRY capstone + 5+3 council + the key→row baton | Foundry/Gotham = "write the OGAR class schema + inheritance"; everything else is generic machinery over it (ontology=`classid→ClassView`+inheritance, AR=DO/THINK, pipelines=`compute_dag`, apps=Jinja-over-classes, query=Cypher⇄SurrealQL one IR). Added `MailboxSoaView::row_for_local_key -> Option<usize>` (default `None`, deferred-binding — the key→row baton for a future `Backend::MailboxSoa` router). Epiphanies `E-OGAR-IS-FOUNDRY`/`E-CYPHER-IS-THE-KANBAN-AST`/`E-GUID-IS-THE-GRAPH`; plan `cypher-kanban-ast-unification-v1`. Council corrections: `from_guid_prefix` is on `NiblePath` not `NodeGuid`; "odoo proof" = CONJECTURE; `ogar-adapter-surrealql` not a crate. Branch `claude/q2-substrate-grounding`, merge `faca377f`. |
 | **#540** | 2026-06-18 | `lite-unified` additive default-OFF coexistence feature gate | **+35/-5, 2 files.** `lite-unified = []` in `crates/lance-graph/Cargo.toml` (empty until SurrealQL-on-lance lowering lands). **datafusion stays DEFAULT — NOT deprecated, NOT made optional.** Process, not switch; promoted per query-shape once OQ-LU-2a is green. Zero behavior change at default features. Branch `claude/lite-unified-gate`, merge `ef7e97ef`. |

.claude/board/PR_ARC_INVENTORY.md

@@ -35,6 +35,24 @@
 
 ---
 
+## #627 lance-graph: classid canon:custom flip TRIGGERED — migration plan v1 + operator ruling record (doc-only)
+
+**Status:** MERGED 2026-07-02 (merge commit `c8e1ec4`), branch `claude/v3-substrate-migration-review-o0yoxv`. Doc-only: records the operator ruling arc and activates the §2.3 migration.
+
+**Added:** `.claude/plans/classid-canon-custom-flip-v1.md` (the TRIGGERED atomic Canon:Custom half-order flip — canon `domain:appid` → HIGH u16, custom/marker → LOW; stored `0x0701_1000`, human-readable `0x07:01::1000`; ONE flippable `compose_classid/split_classid/CLASSID_CANON_HIGH`; mint-forward with an I-LEGACY version boundary; phases P0 route-through → P1 flip+coexist → P2 OGAR#95 app-prefix reconciliation [operator checkpoint] → P3 q2 re-mints → P4 `0x1000` retirement [operator checkpoint]). Board: EPIPHANIES `E-CLASSID-CANON-HIGH-TRIGGERED`, INTEGRATION_PLANS prepend, STATUS_BOARD `D-CCF-0..4`, ISSUES status flips ×4.
+
+**Locked:** OSINT low byte = APPID space domain-wise (`00` = domain, `01` = q2 — zero vocabulary rows, executed OGAR PR #146, codebook 67→65, COUNT_FUSE balanced with zero mirror changes); `0x1000` = temporary reminder, not a format bit; the SoA `class_id` discriminator derives via `split_classid(id).canon` NEVER `as u16` (codex P2 — post-flip `as u16` collapses every class to `0x1000`); legacy registry keys DEMOTE to read-only aliases, retirement only on corpus proof (codex P2 — mint-forward means persisted old-form rows resolve forever until re-baked).
+
+**Correction (2026-07-02, appended — CodeRabbit on #628):** the exact exported symbols are `ClassidOrder::CanonHigh` (the flippable order const `CLASSID_ORDER`, set via the enum — there is no `CLASSID_CANON_HIGH` bool) and `classid_canon(id)` (the canon accessor — `split_classid(id)` returns a tuple, `.canon` is not a field). The intent of the two guard lines above is unchanged.
+
+**Deferred:** P2 + P4 operator checkpoints; implementation phases (D-CCF-0 starts immediately post-merge).
+
+**Docs/board:** as Added; OGAR side in `DISCOVERY-MAP.md` `D-OSINT-APPID-NOT-CONCEPT` (OGAR #146, merged `a0c7936`).
+
+**Confidence (2026-07-02):** HIGH for the record (verbatim operator anchors in plan §0); the flip itself is unimplemented by design (doc-first). Both codex P2 findings amended pre-merge.
+
+**Cross-ref:** OGAR #146; #626 (V3 set completion that armed the trigger); `soa-value-tenant-migration-v2.md` §2.3; `E-CLASSID-SPLIT-ORDER-IS-A-FLIP`.
+
 ## #626 lance-graph: V3 convergence wiring — tenant-carve certification, RungElevator, P6 wave probe, seam-list plan
 
 **Status:** MERGED 2026-07-02 (merge commit `5aaee33`), branch `claude/v3-substrate-migration-review-o0yoxv`. The "wire, don't invent" arc: every deliverable a probe or a wiring of EXISTING types (`E-V3-TENANTS-ALREADY-EXIST-WIRE-DONT-INVENT`); operator all-in, Sonnet-grindwork/Fable-decisions model split.

.claude/board/STATUS_BOARD.md

@@ -4,10 +4,10 @@ Plan: `.claude/plans/classid-canon-custom-flip-v1.md`. Operator trigger 2026-07-
 
 | D-id | Title | Crate(s) | Status | Evidence |
 |---|---|---|---|---|
-| D-CCF-0 | compose_classid/split_classid/CLASSID_CANON_HIGH + route all sites (zero behavior) | lance-graph-contract | Queued | plan §3/§4 P0 |
-| D-CCF-1 | Flip + mint new-form classids (0x0701_1000 / 0x0A01_1000 / 0x0E01_1000) coexisting | lance-graph-contract | Queued | gated on P0 probes |
-| D-CCF-2 | OGAR#95 hi-u16 app-prefix reconciliation | contract + OGAR | Blocked (operator checkpoint) | plan §2 row / §4 P2 |
-| D-CCF-3 | q2 re-mints (osint-bake + cpic via contract pull; dissolves ISS-Q2-CPIC-MIRROR) | q2 (gate WAIVED) | Queued | plan §4 P3 |
+| D-CCF-0 | compose_classid/split_classid/CLASSID_CANON_HIGH + route all sites (zero behavior) | lance-graph-contract | Shipped (fd9bf6b) | plan §3/§4 P0 |
+| D-CCF-1 | Flip + mint new-form classids (0x0701_1000 / 0x0A01_1000 / 0x0E01_1000) coexisting | lance-graph-contract | In PR (#628) | gated on P0 probes |
+| D-CCF-2 | OGAR#95 hi-u16 app-prefix reconciliation | contract + OGAR | In PR (OGAR #147; prefix = custom half) | plan §2 row / §4 P2 |
+| D-CCF-3 | q2 re-mints (osint-bake + cpic via contract pull; dissolves ISS-Q2-CPIC-MIRROR) | q2 (gate WAIVED) | In PR (q2 #71; .soa re-bakes deferred to CI/dev; cpic interim 0x0E01_000N, full contract pull tracked) | plan §4 P3 |
 | D-CCF-4 | 0x1000 marker retirement | all | Blocked (operator checkpoint) | plan §4 P4 |
 
 ## v3-convergence-wiring-v1 — wire, don't invent (the seam list)

crates/lance-graph-contract/Cargo.toml

@@ -46,10 +46,11 @@ guid-v2-tail = []
 # guid-v3-tail (P-A, plan: soa-value-tenant-migration-v2.md §2.1/§2.2) — gates the
 # V3 cascade-key per-classid entries. The V3 identity AXIS itself (TailVariant::V3
 # + ReadMode::tail_variant) is unconditional, latent (nothing reads tail_variant
-# yet) → non-breaking. The gated entries pin the generation marker in the HIGH
-# (custom) u16, preserving the canon LOW-u16 0xDDCC domain byte (so
-# `classid_concept_domain` still routes the legacy domain). OSINT-V3 (0x1000_0700)
-# is the wired exemplar; FMA-V3 (0x1000_0A01) + Genetics follow. Default OFF.
+# yet) → non-breaking. Since the classid half-order flip (P1, 2026-07-02,
+# classid-canon-custom-flip-v1.md) the CANON `domain:appid` sits in the HIGH u16
+# and the gen-marker 0x1000 in the LOW (custom) u16: OSINT-V3 = 0x0701_1000,
+# FMA-V3 = 0x0A01_1000, CPIC-V3 = 0x0E01_1000; the pre-flip 0x1000_DDCC forms
+# stay registered as read-only legacy aliases (mint-forward). Default OFF.
 #
 # Implies `guid-v2-tail`: V3 is a *reading* of the SAME leaf·family·identity 3×u16
 # tail bytes v2 mints (the (part_of:is_a) cascade reinterprets them, never re-carves),