plan: cypher-mask-lowering-v2 — mask engine beside upstream, one switch, refusals

.claude/board/AGENT_LOG.md

@@ -1,3 +1,19 @@
+## 2026-09-30 — 5+3 council on `cypher-mask-lowering-v2` (PR #1306)
+
+- The 5: prior-art, iron-rule, code truth, cascade-impact, creative-explorer.
+  0 VIOLATES; 38 findings. Draft v2: 21 changes (`run` over `&[NodeRow]`,
+  declared relationship carriers, `RF-*` refusals, D-CML-5a named).
+- The 3: overclaim-auditor, dilution-collapse-sentinel, firewall-warden.
+  1 BLOCK (§4: ordered compares and value aggregates marked "yes" over row
+  bytes), 27 FIX. v3: 14 more changes — D-CML-4 narrowed to equality/facet
+  predicates; D-CML-5a rescoped (ndarray first, field widths, all
+  contiguous-only ops); new D-CML-3b (no contract reading is a row pointer
+  yet); witness-loci hop Deferred, not withdrawn; pull hops via `Gather`
+  only; undirected variable length refused; RF-EXEC / RF-NOT-LOWERED;
+  census regraded.
+- No frozen decision overridden; F3's carrier list narrowed by declaration.
+  Plan only, plus the D-CML-10 storno note.
+
 ## 2026-09-30 — correction to the two D-LXC-1 / D-LXC-11 entries below
 
 - Their "70,396 triples", "G6 = 25" and "25 tags moved (G6 exact)" record

.claude/board/INTEGRATION_PLANS.md

@@ -1,3 +1,30 @@
+## 2026-09-30 (1) — cypher-mask-lowering-v2 — Cypher on masks as a fork-owned replacement behind one switch → `.claude/plans/cypher-mask-lowering-v2.md`
+
+**Status:** PROPOSAL (D-CML-0..10, 3b, 5a), ratified v3 by a 5+3 council. No code
+authorized. Partly supersedes
+`cypher-mask-lowering-v1.md`.
+
+- **New crate** `lance-graph-cypher-mask` reuses the upstream parser, semantic
+  analysis and logical plan through their public API. Zero edits to upstream files.
+- **Outcomes** are `Answer` or `Refusal(reason)`. v1's `Split`/`Grace` are removed:
+  there is no DataFusion fallback on our surface.
+- **One switch** `Route {Mask, Upstream}` chooses a whole engine per consumer, never
+  one query at a time.
+- **Hops** read relations stored in the row through a **declared** carrier, never an
+  external edge table. Traversal counts nothing.
+- **Two STOPs before any hop runs:** no contract reading of an in-row field is a row
+  pointer yet (D-CML-3b, contract-first), and mask-risc/ndarray read row bytes only
+  through four strided ops (D-CML-5a, substrate-first). The same gap blocks ordered
+  compares and value aggregates, so D-CML-4 starts with equality/facet predicates.
+- **Census:** 113 of 303 Full under an empty config (37.3 %); #1305 reports 70 of 313
+  once path multiplicity is classified. Neither is a bound on v2. Everything else is
+  refused.
+- **Harvested from #1305** (closed unmerged): six facts in plan §12; its classifier is
+  not ported.
+- **Open:** DataFusion stays in the build graph through the `lance-graph` dependency
+  (OQ-CML-1); where the relationship declaration lives long-term (OQ-CML-2); self-hop
+  vs `Foreign` planes (OQ-CML-4). The witness-loci relative hop is deferred (D-CML-6).
+
 ## 2026-09-29 (2) — deepnsm-v2-lexical-evidence-consumer-v1 rewritten against the DeepNSM → DeepNSM-v2 migration → `.claude/plans/deepnsm-v2-lexical-evidence-consumer-v1.md`
 
 **Status:** PROPOSAL (D-LXC-1..10). No code authorized. Supersedes entry (1)

.claude/board/STATUS_BOARD.md

@@ -305,6 +305,24 @@ evaluates one; `execute` stays the consumer's call on a scratch it owns.
 | D-QCK-8 | accumulator gating — an `AND` gates each later child under the accumulator built so far, not only under a resident plane. The same rule `lgj-abi`'s `plan_lower` already had; the two lowerings now implement one law | Shipped. Disable-verified 3×: gate-never-on-accumulator, an `OR` gating its children on its own accumulator, and `hoist_gate_subset` never rotating — each reddens | `the_gate_reaches_every_comparison_and_is_dropped_only_where_it_vanishes` via the new `gate_shape` helper (all-gated / on-accumulator / dropped, three facts not two); `every_lowered_filter_agrees_with_an_independent_per_row_reading` is what catches the DROP going unsound |
 | D-QCK-9 | A1 `Filter::and_by_skip` — the caller's measured skip score orders an `AND`'s conjuncts. DuckDB's hill-climb NOT ported (see the corrected reason) | Shipped, with the matrix's A1 falsifier RUN (`examples/adaptive_order_probe.rs`, 65 536 rows × 5 conjuncts × all 120 permutations × 4 regimes). Order moves the skip fraction, so A1 is **ADAPT conditionally** — inert in 2 of the 4 regimes, and the pre-registered *representative predicate stream* half was never run (matrix §9). ⊘ **Corrected 2026-09-15:** this row read "the control signal is DEAD WORDS, not selectivity" — the probe never ranks by either signal and never calls `and_by_skip`, so only the between-regime diagnostic is supported; and the "hill-climb explores the wrong landscape" reason was MEASURED FALSE (`[4092, 3069, 2046, 1023, 0]`, deltas all −1023: a monotone ramp). The real reason is that this crate never executes | `skip_ordering_moves_the_work_and_never_the_answer`: the reordering agrees with the oracle (not with the other lowering), the emitted program's first predicate is the highest-scored, and descending/no-sort disables both redden. **The probe itself is run by no gate** — `cargo test` compiles an example and never executes it — so the four-row table is a measured-once observation, not a pinned one ⊘ **2026-09-15, operator ruling (E-256-BY-256-IS-EXACTLY-64K-THE-RAILS-SKIP-UNIT-IS-ITS-HI-BYTE-AND-A-QUARTER-BLOCK-IS-A-REMAINDER-1):** the clustered figures were the `/50` quarter-block cut's; re-measured on the byte boundary (`/48`, the rail's hi byte) → 116 survivors (0.177 %), 99.61 % in both words and 256-row blocks; selective in blocks 0.00 → 61.91 %. The probe now prints both units and the ramp. ⊘ Same day (E-THE-RAIL-IS-A-NEEDLE-NOT-A-MASK-…-1): "the rail's hi byte" as skip unit was my reading — a rail is a 2-byte row ADDRESS, not a mask; the block is the tile's 2-nibble cell; numbers unchanged. ⊘ Same day (E-A-THOUGHT-MASKS-ITSELF-BY-ITS-DISTANCE-FROM-ROOT-…-1): the radius is STEPLESS — the probe sweeps d = 40..=56, 2^(56−d) rows each; words saturate at d = 50, blocks at d = 48 |
 
+## cypher-mask-lowering-v2 (D-ids minted 2026-09-30, `.claude/plans/cypher-mask-lowering-v2.md`)
+
+| D-id | scope | status | gate / falsifier |
+|---|---|---|---|
+| D-CML-0 | verify the upstream/fork file split; crate skeleton `lance-graph-cypher-mask` (member, `lance-graph` at `default-features = false`) + import fence; CI lines; `nm` over a release `[[example]]` (OQ-CML-1) + `cargo tree` features check | Queued | F-CML-UP (one byte in `parser.rs` reddens); F-CML-FENCE (per module path) |
+| D-CML-1 | `Route {Mask, Upstream}` + `run` stub refusing everything with `RF-NOT-LOWERED` | Queued | under `Mask` a counting shim on the upstream entry reads 0 (F-CML-NOMIX) |
+| D-CML-2 | classifier over the public `LogicalOperator` → lowerable or a §5 `Refusal`; ⊘ 2026-09-30: #1305's `consumer_semantics()` NOT ported (plan §12) — only its three pattern-shape refusals and fixtures; W0-b census re-run per refusal variant | Queued | F-CML-REFUSE (every variant fired by a committed query) + F-CML-QUIET |
+| D-CML-3 | `LabelBinding` label → `LabelDTO` → `u32` classid; property layout `(offset, width, kind)`; relationship carrier/direction declarations checked against `ClassView::edge_codec_flavor` | Queued | an unbound label refuses (`RF-UNBOUND-LABEL`); F-CML-UNDECLARED; F-CML-CARRIER |
+| D-CML-3b | contract-first: a row-pointer reading of an in-row field (`ClassView` / flavor variant, declared width; a `u8:u8` rail never widened) | Queued — its own contract PR | a class without the reading refuses every relationship declaration |
+| D-CML-4 | node + equality/facet predicate + Boolean lowering through `mask_risc::execute` over `&[NodeRow]` (`EqU32Strided`, `NeU32Strided`, `MatchFacetStrided`, `Ternlog`); ordered compares / value aggregates refuse `RF-NOT-LOWERED` until 5a; `match_nodes_by_class` unused | Queued | F-CML-SUPPORT set equality vs DataFusion `DISTINCT`; wrong-immediate reddens |
+| D-CML-5a | substrate-first: strided lanes with a declared field width for ordered `I32` compares, `MaskedSum/Min/MaxI32`, `Gather`, `ScatterOrU32`, `CountKeyRunsU32`, `EqU32Via` — `ndarray::simd` first, then mask-risc; proposed as scope for mask-risc PR5; decides OQ-CML-4 | Queued — its own PRs | differential against each contiguous form |
+| D-CML-5 | hop over a declared in-row carrier: pull (`Gather`, one program per hop, source as a `Foreign` plane) first; push (`ScatterOrU32`) only as the last hop; no external edge table | Queued — waits on 3b and 5a | asymmetric fixture; one-population refusal |
+| D-CML-6 | relative hop over the witness loci (`Relative{locus}` carrier, row order = stream order) | Deferred — needs a linear mask-shift primitive in `ndarray::simd` | — |
+| D-CML-7 | variable length as reachability, lower bound 0/1, directed pull hops only, `visited` starts empty; `min > 1` and undirected refused (RF-DEPTH) | Queued | F-CML-BAG: `count(*)` after ONE hop refused; `A→B→A` `*1..2` returns A |
+| D-CML-8 | the differential: DataFusion (dev-dependency only) on support + quack's DuckDB fixtures | Queued | F-CML-SUPPORT across D-CML-4..7 |
+| D-CML-9 | enumerate every Cypher-executing call site; then the first consumer able to take the switch: `cognitive-shader-driver`'s bridge first gets the rows, a `LabelBinding` and a legacy route (it has neither route today), then flips after its own non-trivial census | Queued | its census count recorded either way |
+| D-CML-10 | storno note on `lance-graph-as-the-modelgraph-v1.md` §16.2 (`NodeMapping` field route superseded by `LabelBinding`) | In PR #1306 | — |
+
 ## mask-risc-executor (PR3 — D-ids minted 2026-09-14, `.claude/plans/mask-risc-executor-v1.md`)
 
 | D-id | scope | status | gate / falsifier |

.claude/board/SUPERSESSION-INDEX.md

@@ -141,7 +141,7 @@ a licence to act on it.
 | **RESCOPE** | `entropy-closure-causal-ground-v1` | `ThinkingStyle` | PROPOSAL (measured, unbuilt) — 2026-08-26. P | 3/8 |
 | **RESCOPE** | `foundry-consumer-parity-v1` | `BindSpace` | Active | 0/0 |
 | **RESCOPE** | `foundry-roadmap-unified-smb-medcare-v1` | `BindSpace` | Active | 0/0 |
-| **RESCOPE** | `lance-graph-as-the-modelgraph-v1` | `BindSpace` | PROPOSAL (operator-set endgame, 2026-09-16). | 3/6 |
+| **RESCOPE** | `lance-graph-as-the-modelgraph-v1` | `BindSpace` | PROPOSAL (operator-set endgame, 2026-09-16). | 3/8 |
 | **RESCOPE** | `lf-integration-mapping-v1` | `BindSpace` | Active (2026-04-25) | 0/0 |
 | **RESCOPE** | `lite-unified-surrealql-lance-v1` | `BindSpace` | CONJECTURE / design. **Test via feature gate | 0/0 |
 | **RESCOPE** | `ogit-cascade-supabase-callcenter-v1` | `BindSpace` | plan, not implementation. | 0/16 |

.claude/board/entries/2026-09-30-cypher-mask-v2-is-a-replacement-not-a-phase.md

@@ -0,0 +1,19 @@
+# 2026-09-30 — Cypher on masks is a replacement engine beside upstream, not a phase inside it
+
+**Status:** VERIFIED-IN-CODE · OPEN. Plan `.claude/plans/cypher-mask-lowering-v2.md` (D-CML-0..9).
+
+## Read (2026-09-30, `main` `0d31c54f`)
+- `crates/lance-graph/Cargo.toml` `[dependencies]`: `datafusion` is a **non-optional** dependency of `lance-graph`.
+- `error.rs` `GraphError`: `DataFusionError` is inside it (a variant source and a `From` impl).
+- Consequence: any crate that reuses the parser has DataFusion in its build graph, even if it never calls it. Removing DataFusion from our surface is possible; removing it from the build is not possible without an upstream edit (OQ-CML-1).
+- `parser.rs`, `ast.rs`, `semantic.rs` and `logical_plan.rs` do not import DataFusion themselves.
+- `examples/w0b_corpus_census.rs` already drives parse → plan from outside the planner, using only the public API.
+- v1's seam (inside `query.rs`) and the modelgraph plan's `NodeMapping` field (inside `config.rs`) are both edits to upstream files. v2 moves both into the new crate.
+- W0-b: 113 of the 303 classified queries lower fully (37.3 %). This counts before path multiplicity is classified, so it is an **upper bound**. #1305 reports **70 of 313 (≈ 22 %)** once multiplicity is classified; that has not been re-run here (plan §5, §12 H-5). Under v2 the rest are refusals.
+
+- #1305 closed unmerged; its six must-have facts are in plan §12 (branch `ccr-2fcc2bd3-8o7m2l` @ `67abd29` keeps the rest). Its `consumer_semantics()` is not ported: per-path carriers are refused, not carried.
+
+## Open
+- Whether the assumed upstream/fork split of files holds (D-CML-0).
+- Which in-row carriers hold absolute vs relative targets, and whether mask-risc needs a `Shift` op (OQ-CML-2).
+- Whether `lance-graph-python` is fork-owned (OQ-CML-3).

.claude/board/entries/README.md

@@ -25,12 +25,13 @@ index row, (3) no duplicate entry id. Checks 1 and 2 are deliberately
 opposite directions; the stranding this convention prevents shows up in
 exactly one of them, never both.
 
-178 entries, 2026-08-06 .. 2026-10-03.
+179 entries, 2026-08-06 .. 2026-10-03.
 
 | date | entry id | finding | file |
 |---|---|---|---|
 | 2026-10-03 | `dir-sim-soa-quack` | Directory simulation on SoA + Quack: one-edge mutation 853 B at 1k and 100k users | [2026-10-03-dir-sim-soa-quack.md](2026-10-03-dir-sim-soa-quack.md) |
 | 2026-09-30 | `deepnsm-v2-coverage-bands` |  | [2026-09-30-deepnsm-v2-coverage-bands.md](2026-09-30-deepnsm-v2-coverage-bands.md) |
+| 2026-09-30 | `cypher-mask-v2-is-a-replacement-not-a-phase` |  | [2026-09-30-cypher-mask-v2-is-a-replacement-not-a-phase.md](2026-09-30-cypher-mask-v2-is-a-replacement-not-a-phase.md) |
 | 2026-09-29 | `deepnsm-v2-counted-pick-tag-deltas` |  | [2026-09-29-deepnsm-v2-counted-pick-tag-deltas.md](2026-09-29-deepnsm-v2-counted-pick-tag-deltas.md) |
 | 2026-09-26 | `deepnsm-v2-lexical-evidence-survives-routing` |  | [2026-09-26-deepnsm-v2-lexical-evidence-survives-routing.md](2026-09-26-deepnsm-v2-lexical-evidence-survives-routing.md) |
 | 2026-09-25 | `window-scheduling-and-two-level-ternlog` |  | [2026-09-25-window-scheduling-and-two-level-ternlog.md](2026-09-25-window-scheduling-and-two-level-ternlog.md) |

.claude/plans/cypher-mask-lowering-v1.md

@@ -2,6 +2,10 @@
 
 > **Status:** PLAN (pre-5+3-council). No code. No mint. No cargo run in this repo
 > during authoring.
+> ⊘ **Partly SUPERSEDED 2026-09-30 by `cypher-mask-lowering-v2.md`** on three points:
+> there is no seam inside the upstream `query.rs`; `Split`/`Grace` become `Refusal`;
+> the label binding lives outside `GraphConfig`. The lowering table, §5.2, §5.3 and
+> the falsifier discipline stand.
 > **Register discipline:** every "exists" claim carries `file:line`. Anything
 > argued rather than read is marked **[claimed, unverified]**. Measured numbers
 > are quoted with their source; nothing here is a performance claim.