supervisor+contract: quarantine the legacy actor surfaces; correct stale phase-progression comments

.claude/board/EPIPHANIES.md

@@ -1,3 +1,21 @@
+## 2026-08-04 — E-ACTOR-IS-NOT-THE-PHASE-PATH-1 — #879 is the complete phase-progression path; KanbanActor has no assigned architectural responsibility
+
+**Status:** RATIFIED (operator ruling, 2026-08-04) + CORRECTION of a same-week over-reach in `kanban-64k-inverted-awareness-v1` §A1. **Confidence:** High. Documentation and legacy-surface quarantine only — **no runtime behaviour changed, no #879 redesign, no future actor proposal.**
+
+**The ruling, in the required words.** *"#879 is the complete and independent production phase-progression path. KanbanActor has no assigned architectural responsibility. It is legacy experimental compatibility code retained only because existing probes or consumers still reference it. No new production architecture may depend on it. Its presence does not designate it as the future home of an ownership, planning-initiation, concurrency, cognition, reasoning, or lifecycle mechanism."*
+
+**The production path** (complete and standalone in #879): `plan evaluation → KanbanMove intent → BatchWriter → sparse seal → one WAL/version → inline apply of the sealed transitions`. No actor bridge, actor fleet, actor-owned driver, actor custody model, or actor message path is required.
+
+**The transport/engine separation (do not conflate).** The legacy surfaces are `KanbanMsg::{Advance, MulAdvance, Tick}` plus the re-exported helpers `deliver_kanban_step` / `drive_mul_advance` / `drive_version_tick` / `drive_scheduled_tick` / `run_to_absorbing`. **`MulAdvance` and `drive_mul_advance` are only legacy actor-message wrappers — NOT the canonical MUL reasoning engine.** The living MUL gate is independent (`lance_graph_contract::mul::i4_eval::gate_decision_i4`) and is consumed directly by the #879 path via `cycle_driver::shade_owner` and `run_cognitive_work_gated[_over]`; marking the wrappers legacy does not deprecate the gate. The NARS tactic recipes and the awareness rung ladder are **separate and untouched** — they are not part of KanbanActor and no coupling is implied.
+
+**Stale comments corrected in the same pass** (`cycle_driver.rs` is canonical #879 code and NOT stale — only inherited comments were): the driver header no longer describes an actor-owned tree with an open bridge; the honesty ledger no longer lists "actor-owned production wiring" as an unproven deliverable (it is not a deliverable); `run_cognitive_work` is documented as *"a sequential contract-probe adapter used to prove the seal→apply→intent roundtrip — it does not define the production execution model; production cognition may run independently and concurrently over the sealed Vn, with completed immutable outcomes converging only at the deterministic ordering/coalescing/seal boundary."* The same obsolete ractor-drives framing was corrected in `supervisor/lib.rs`, `contract::kanban`, `contract::soa_view`, and `contract::orchestration`.
+
+**Caller/spawn migration inventory** (kept strictly as deletion-impact evidence and the removal work-list — no architectural legitimacy): `kanban_actor.rs`'s own `#[cfg(test)]` unit tests; `tests/w2b_real_owner_probe.rs` (60/103/144); `onebrc-probe/src/lane_e.rs:170` — library source, not a test — via `drive_version_tick`. An earlier draft claimed every spawn was in one file; that was a single-file check written up as a repository-wide census, caught by external review. Operational fix: re-run the search at write-time and keep the command with the claim.
+
+**The correction this supersedes.** §A1 first offered a two-seam design gate (per-mailbox `KanbanMsg` apply — the message bus #879's writer-fires-inline ruling had already excluded — vs a "guarantee-dummy owner"), and the first fix of that then framed the actor as an ownership injector and sketched a future planning-initiation adapter. All of it is struck: the corrections kept building. The reusable lesson: **when correcting an over-built design, the correction must not itself build** — check a reviewer's framing against standing rulings, and check a self-proposed replacement against whether anything asked for it.
+
+**W1 ledger corrected:** SHIPPED — a held owner is rescheduled, re-polled, wakes, and advances later (#879's own falsifiers). OPEN — protect callers from retrying `run_cycle` with the drained writer instead of retrying `SealFailure.casts`; OPEN — surface/count a missing owner in `cognitive_pass` instead of silently skipping.
+
 ## 2026-08-03 — E-THE-DEFECTS-LIVE-IN-THE-FALSIFIERS-NOT-THE-MEASUREMENTS-1 — across three consecutive probe PRs, every defect found by review was in a falsifier or a label; none was in a measurement
 
 **Status:** FINDING (observed, not designed). **Confidence:** High as a description of #862/#875/#876 — the three PRs' own review records are the evidence, and each states the pattern locally; what is new here is that the pattern is *consecutive and unbroken*, which only became visible when the three arc entries were written together during the 2026-08-03 backfill. Documentation-only.

.claude/board/PR_ARC_INVENTORY.md

@@ -62,6 +62,7 @@
 - **Review** — three external rounds, every finding verified against source before acting. Consistency round (3): a κ/ICC contradiction between the C2 rule and the D3 fusion measure; a task reference that resolved to an unrelated GitHub PR (qualified as session-local everywhere); a stale "no production caller" ground-state row. Inline round (4): a missed wave-table gate row; the `write-on-behalf.md` caller status. External P1/P2: the `MailboxFleet` impossibility (above) and vague W2 thresholds ("materially below"/"must converge") — the PR's own inertness rule turned on itself, fixed by pre-registration. **Claim-ceiling check passed clean twice** (claim (a) conditional on W2, claim (b) capped at reliability). **Process finding:** the "no production caller yet" fact went stale **three times** on this one branch; the durable form is citing the call site, never asserting the absence.
 - **Process (governance)** — an operator-ruled **separation-of-concerns violation** occurred mid-arc: private-consumer identifiers were written into public plan/board text, the PR body, and PR comments. Remediated the same session — source files scrubbed, the three unmerged commits rewritten into one clean commit and force-pushed (`--force-with-lease`, unmerged PR branch only; `main` never touched), PR body rewritten, bot comments patched via REST. Honest residue recorded at the time: force-push removes refs but GitHub may retain orphaned SHAs until GC, comment/PR-body edit histories persist in the UI, and **pre-existing** occurrences on merged `main` history (older board entries, crate filenames) were surfaced for an operator decision rather than rewritten unilaterally. The standing lesson: the public/private boundary is a *drafting-time* rule, not a review-time cleanup.
 - **Docs** — the plan; the four module headers; board files per the mandatory hygiene rule.
+- **⊘ Correction (2026-08-04, operator ruling `E-ACTOR-IS-NOT-THE-PHASE-PATH-1`):** the "Withdrawn" line above is right that `MailboxFleet`-over-registry is impossible, but **both replacement seams are also struck**. #879 remains the canonical and independent phase-progression path (`plan evaluation → KanbanMove intent → BatchWriter → sparse seal → one WAL/version → inline apply`); no actor bridge, fleet, owned driver, or custody model is required. "First ACTOR-OWNED caller of `emit_bootstrap_intent`" is withdrawn as a milestone; the actor surface is marked LEGACY in source. Two drafting defects, recorded: a reviewer's framing was checked against source but not against standing rulings, and the *replacement* I then wrote invented an ownership architecture nothing had asked for.
 - **Confidence (2026-08-03):** working as a *plan* — no code paths changed, so nothing here can regress behaviour. Its central claims are deliberately unproven: claim (a) is CONJECTURE until W2 measures it against the pre-registered thresholds, claim (b) is capped at reliability. The doc-header pass is verified mechanically (diff adds only `//!` lines; neither edited file appears in a `cargo fmt --check` diff — though `lance-graph-ontology` carries extensive PRE-EXISTING fmt drift in `hydrators/` and `odoo_blueprint/`, untouched here).
 
 ## 2026-08-02 — lance-graph #879 — D-MBX-A6-P4 cycle loop-closure driver: sparse seal/apply + the MUL-gate thought seam

.claude/board/STATUS_BOARD.md

@@ -5,7 +5,7 @@ Plan: `.claude/plans/kanban-64k-inverted-awareness-v1.md` (operator anchors a/b;
 | D-id | Deliverable | Repo | Status | Evidence |
 |---|---|---|---|---|
 | D-KIA-0 | jc capability map + dichotomous-statistics decision note (phi/KR-20/kappa naming; Spearman dropped at view 2) | lance-graph | Queued | plan W0 |
-| D-KIA-A1 | actor-fleet driver seam — design gate (guarantee-dummy single owner vs per-mailbox KanbanMsg apply; MailboxFleet-over-registry withdrawn per codex P1); first ACTOR-OWNED caller of owner_adapter::emit_bootstrap_intent; #879 caveat fixes (retry footgun guard, held_owners strand falsifier, missing-owner counter) | lance-graph | Queued | plan W1 |
+| D-KIA-A1 | ⊘ RESCOPED 2026-08-04 (E-ACTOR-IS-NOT-THE-PHASE-PATH-1): #879 is the complete phase-progression path; KanbanActor has no assigned architectural responsibility (legacy compatibility code). SHIPPED: held-owner reschedule/wake. OPEN: run_cycle drained-writer retry guard; missing-owner counter in cognitive_pass | lance-graph | Queued | plan W1 |
 | D-KIA-A2 | parallelism falsifier (protocol pre-registered: median-of-5, >=2x at >=4k owners, +/-10% stay-silent; kill = regrade claim (a)) | lance-graph | Queued | plan W2 |
 | D-KIA-B1 | catalog binary-range criterion contract type + generalized catalog-mirror drift guard | lance-graph | Queued | plan W3 |
 | D-KIA-C5 | cohort-statistic witness type under the ELEVATED carve-out + held-out anti-circularity gate | lance-graph | Queued | plan W4 |

.claude/plans/kanban-64k-inverted-awareness-v1.md

@@ -85,6 +85,52 @@ mailbox-phase state, no second owner, no ack*:
     (`KanbanMsg::Advance`, the shipped S4 edge).
 Either seam lands the first **actor-owned** `emit_bootstrap_intent` caller
 (the existing `cognitive_pass` caller is HashMap-fleet-driven).
+
+> **⊘ CORRECTION (operator ruling, 2026-08-04) — A1 above is WRONG as written;
+> there is no design gate and no actor seam to choose.**
+>
+> **#879 is the complete and independent production phase-progression path.**
+>
+> **KanbanActor has no assigned architectural responsibility. It is legacy
+> experimental compatibility code retained only because existing probes or
+> consumers still reference it. No new production architecture may depend on
+> it. Its presence does not designate it as the future home of an ownership,
+> planning-initiation, concurrency, cognition, reasoning, or lifecycle
+> mechanism.**
+>
+> The production path, complete and standalone in #879:
+> `plan evaluation → KanbanMove intent → BatchWriter → sparse seal →
+> one WAL/version → inline apply`.
+> **No actor bridge, actor fleet, actor-owned driver, or actor custody model is
+> required.** #879 is not being redesigned by this correction.
+>
+> 1. Both A1 seams are struck — the per-mailbox `KanbanMsg` apply (the message
+>    bus #879's writer-fires-inline ruling already excluded) *and* the
+>    guarantee-dummy owner framing, which invented an ownership architecture the
+>    ruling does not call for.
+> 2. **"First ACTOR-OWNED caller of `emit_bootstrap_intent`" is withdrawn** as a
+>    milestone. Corrected W1 ledger (statuses fixed 2026-08-04): **SHIPPED** —
+>    a held owner is rescheduled, re-polled, wakes, and advances later (#879's
+>    own falsifiers). **OPEN** — protect callers from retrying `run_cycle` with
+>    the drained writer instead of retrying `SealFailure.casts`. **OPEN** —
+>    surface/count a missing owner in `cognitive_pass` instead of silently
+>    skipping.
+> 3. `KanbanMsg::{Advance, MulAdvance, Tick}` and the five re-exported driver
+>    helpers are marked **LEGACY** in source (disclosure in the first five header
+>    lines of `kanban_actor.rs`). Marked, not deleted: `onebrc-probe`'s Lane E is
+>    a live consumer via `drive_version_tick`. No runtime behaviour changed.
+> 4. **Caller/spawn migration inventory (corrected).** Kept strictly as
+>    evidence for why immediate deletion would break current consumers and as
+>    the removal work-list — it confers no architectural legitimacy. `KanbanActor` is spawned in three places, none
+>    of them the supervisor tree: `kanban_actor.rs`'s own `#[cfg(test)]` tests;
+>    `tests/w2b_real_owner_probe.rs` (60/103/144); and
+>    `onebrc-probe/src/lane_e.rs:170` — **library source, not a test**. An earlier
+>    version of this line claimed every spawn was in one file: a single-file check
+>    written up as a repository-wide census, caught by external review. Third
+>    absence-claim of this arc to rot; the operational fix is to re-run the search
+>    at write-time and keep the command with the claim.
+>
+> Board: `EPIPHANIES.md` `E-ACTOR-IS-NOT-THE-PHASE-PATH-1`.
 - Design constraint: the seal/collect side stays single-writer (one
   `BatchWriter`); parallelism lives in the **thought phase** (owners think
   concurrently, cast ahead-fire), never in the seal. Ordering is already the
@@ -99,8 +145,9 @@ Either seam lands the first **actor-owned** `emit_bootstrap_intent` caller
   (symmetry with `apply_sealed_transitions`).
 
 **A2 — the parallelism falsifier.** The claim is only honest if measured:
-N actors thinking concurrently (tokio joinset over `MulAdvance`-gated work)
-vs. the same N sequentially, same corpus, same seals.
+N owners thinking concurrently (tokio joinset over cycle-driver MUL-gated
+`CognitiveWork` — NOT the deprecated `MulAdvance` actor arm; corrected
+2026-08-04) vs. the same N sequentially, same corpus, same seals.
 - **Can-fire:** concurrent wall-clock materially below sequential at 4k+
   owners with non-trivial per-thought work.
 - **Stay-silent:** with trivial thought bodies the two must converge (else the
@@ -147,6 +194,7 @@ convention.
 actually provide toward ICC/α/ρ with variance components? Output: a one-page
 capability map. Everything below adjusts to what's found.
 
+
 **C2 — name the dichotomous statistics correctly.** Over binary catalog
 criteria: Pearson→**φ** (report the marginal-capped ceiling), Cronbach's
 α→**KR-20**, ICC→**κ-family agreement**, Spearman **degenerates and is
@@ -213,7 +261,7 @@ only if the comparison runs on jc's non-binary escalation):
 | Wave | D-id | Deliverable | Gate to pass | Model |
 |---|---|---|---|---|
 | W0 | D-KIA-0 | jc capability map (C1) + dichotomous-statistics decision note (C2 naming) | read-only; note on board | main thread |
-| W1 | D-KIA-A1 | actor-fleet driver seam — design gate: guarantee-dummy single owner vs per-mailbox `KanbanMsg` apply (`MailboxFleet`-over-registry withdrawn, codex P1) + first ACTOR-OWNED `emit_bootstrap_intent` caller + #879 caveat fixes | existing 19 falsifiers stay green over the actor fleet; strand falsifier; no-ack audit clean | Opus design → Sonnet impl |
+| W1 | D-KIA-A1 | ⊘ RESCOPED 2026-08-04 — no design gate, no actor seam choice, no actor-owned `emit_bootstrap_intent` milestone (all withdrawn; actors do not drive). #879 is the canonical phase-progression path and is not redesigned. SHIPPED: held-owner reschedule/wake (#879 falsifiers). OPEN: run_cycle drained-writer retry guard (retry `SealFailure.casts`, not the writer); missing-owner counter in `cognitive_pass` | existing 19 falsifiers stay green; strand falsifier; no-ack audit clean | Opus design → Sonnet impl |
 | W2 | D-KIA-A2 | parallelism falsifier (protocol pre-registered in §2 A2: median-of-5, ≥2× at ≥4k owners, ±10 % stay-silent) | can-fire + stay-silent both green, else regrade claim (a) | Opus |
 | W3 | D-KIA-B1 | catalog criterion contract type + catalog-mirror drift guard | field-isolation matrix; `v3-envelope-auditor` verdict LAYOUT-CLEAN/GATED | Sonnet impl, Opus gate |
 | W4 | D-KIA-C5 | witness type under ELEVATED ruling + C6 held-out gate | zero-copy verdict ELEVATED recorded; anti-circularity falsifier | Opus |

crates/lance-graph-contract/src/kanban.rs

@@ -2,8 +2,10 @@
 //!
 //! The seam where three subsystems meet over the ONE per-mailbox SoA:
 //! - **lance-graph-planner** emits a [`KanbanMove`] (the plan's output unit),
-//! - **ractor** (the mailbox owner, `lance-graph-supervisor`) drives the
-//!   transition — advancing a [`KanbanColumn`] *is* the mailbox lifecycle step,
+//! - **lance-graph-supervisor**'s sealed-cycle driver applies the transition
+//!   (the #879 path: plan evaluation → `KanbanMove` intent → `BatchWriter` →
+//!   sparse seal → one WAL/version → inline apply) — advancing a
+//!   [`KanbanColumn`] *is* the mailbox lifecycle step,
 //! - **surrealdb** (`surreal_container`) projects the columns as the kanban view
 //!   over SoA-shaped Lance rows.
 //!
@@ -31,8 +33,9 @@ use crate::mul::GateDecision;
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default)]
 #[repr(u8)]
 pub enum KanbanColumn {
-    /// `t < -550 ms` (Libet readiness-potential window): ractor owns the SoA;
-    /// counterfactual pre-planning / expansion happens here. The spawn state.
+    /// `t < -550 ms` (Libet readiness-potential window): the mailbox owner
+    /// holds the SoA; counterfactual pre-planning / expansion happens here. The
+    /// spawn state.
     #[default]
     Planning = 0,
     /// `t >= -550 ms`: the SoA mutates under cognitive operations; the Σ-commit
@@ -72,9 +75,9 @@ impl KanbanColumn {
     /// Is this an **absorbing** column — the mailbox cycle ends here with no
     /// successor (`Commit` = calcify to cold path, `Prune` = drop)?
     ///
-    /// `Plan` is NOT absorbing (it re-deliberates back to `Planning`). The ractor
-    /// lifecycle driver tombstones the mailbox iff the cycle reaches an absorbing
-    /// column — the LE-3 cycle-end commit/SLA decision hooks here.
+    /// `Plan` is NOT absorbing (it re-deliberates back to `Planning`). The
+    /// sealed-cycle driver tombstones the mailbox iff the cycle reaches an
+    /// absorbing column — the LE-3 cycle-end commit/SLA decision hooks here.
     #[inline]
     pub fn is_absorbing(self) -> bool {
         matches!(self, Self::Commit | Self::Prune)
@@ -160,7 +163,8 @@ impl KanbanColumn {
 /// restating the literal.
 pub const LIBET_COMMIT_WINDOW_US: u32 = 550_000;
 
-/// One kanban transition: the planner's output unit and the ractor's lifecycle step.
+/// One kanban transition: the planner's output unit and the sealed cycle's
+/// lifecycle step (applied inline by the #879 path after the sparse seal).
 ///
 /// `Copy` and small (≤ 16 B) so it rides the airgap as owned microcopy, never a
 /// borrow into the SoA (R1). The witness is a *pointer* (R4).
@@ -431,7 +435,7 @@ mod tests {
         assert!(!KanbanColumn::Plan.is_absorbing());
         assert!(KanbanColumn::Plan.is_terminal()); // terminal decision, but...
         assert!(KanbanColumn::Plan.can_transition_to(KanbanColumn::Planning)); // ...re-enters.
-                                                                               // The ractor driver tombstones iff absorbing.
+                                                                               // The sealed-cycle driver tombstones iff absorbing.
         assert!(!KanbanColumn::Planning.is_absorbing());
         assert!(!KanbanColumn::Evaluation.is_absorbing());
     }

crates/lance-graph-contract/src/orchestration.rs

@@ -50,8 +50,9 @@ pub enum StepDomain {
     /// Medcare reality-check vertical (clinic data sovereignty).
     Medcare,
     /// 4-phase Rubicon kanban transition over the per-mailbox SoA — the seam
-    /// where the planner (emits), ractor (owns/drives), and surrealdb (projects)
-    /// meet. `step_type` prefix `"kanban."`. See [`crate::kanban`].
+    /// where the planner (emits), the supervisor's sealed-cycle driver
+    /// (applies), and surrealdb (projects) meet. `step_type` prefix
+    /// `"kanban."`. See [`crate::kanban`].
     Kanban,
 }