AdaWorldAPI · AdaWorldAPI · Aug 18, 2026 · Aug 17, 2026 · Aug 17, 2026 · Aug 17, 2026
diff --git a/.claude/board/EPIPHANIES.md b/.claude/board/EPIPHANIES.md
diff --git a/.claude/board/LATEST_STATE.md b/.claude/board/LATEST_STATE.md
@@ -1,3 +1,111 @@
+## 2026-08-18 (measured) — W5c's real blocker found + cleared: RowStore::generate_with_edges
+
+Asked what was buildable while ruff_r2il PR2/PR3 are blocked. Was about to
+dispatch the graph consumer (W5c) on the strength of D1a's mechanism
+(writable masks, existing facet-match) being sufficient -- twice claimed
+this in earlier turns -- before re-reading `wave-consumer-graph.md`'s own
+STOP condition in full and catching a real, different blocker: plain
+`RowStore::generate()`'s payload is uniform noise, so any 1-2 hop BFS over
+it saturates to nearly every row regardless of decode convention --
+vacuous under the wave's own anti-vacuity falsifier. A data-shape problem,
+not a mechanism problem; caught before any workers spawned.
+
+Fixed with `RowStore::generate_with_edges` (native/lgj-abi) -- additive,
+`generate()` byte-identical for out-of-range `edge_classid` (pinned).
+Parameters chosen from a real measurement sweep
+(`examples/graph_density_probe.rs`), not guessed: at `n_rows=2000,
+gate_mask=0x0, radius=25`, a 10-row seed reaches 19 rows at 1 hop, 29 at 2
+hops -- pinned as a regression test. Two disable-runs (radius-wrap
+formula; sparsity gate) both went red exactly where expected, including
+one case (the gate disable) correctly NOT failing an orthogonal geometry
+test -- verified as the right outcome, not a vacuous one.
+
+`wave-consumer-graph.md` updated: STOP condition marked RESOLVED with the
+measured numbers; the file's stale "calcify, do not dispatch" header
+corrected (that gate was already lifted session-wide). **The graph
+consumer is now genuinely dispatchable** -- not dispatched in this pass,
+scoped to the generator only. Gates: lgj-abi 90/90 (+6), fmt/clippy clean.
+Full record: `EPIPHANIES.md`, the entry above the R2IL handshake one.
+
+## 2026-08-18 (even later) — ruff #96 is a different arm; found + read the REAL staging guide
+
+Checked "ruff 96 merged." It's `ruff_python_spo`'s plain-Python residual
+ledger (dismech/CURIE-constant harvest, ontology-shaped) — a sibling
+drill-loop, but a DIFFERENT crate and consumer than `ruff_r2il`, and
+unrelated to this repo's C-band/Ghidra/JavaRuntime track. No action needed
+here; recorded so the two arms aren't confused later since they share
+vocabulary.
+
+The genuinely relevant find was already on `ruff` main, unrelated to #96:
+`.claude/harvest/r2il/STAGED-CODEGEN-GUIDE.md`, explicitly addressed to
+"the sibling session ... (the Ghidra console work)" — this repo. It
+confirms PR2 (routes→V3) still hasn't landed and gives a 5-stage staging
+order (S1 ledger-read → S2 ore-join → S3 additive codegen → S4 one
+consumer → S5 target-profile fork) that does NOT wait on PR2 for its first
+two stages. Ran S1 against the real in-tree harvest artifacts: B1
+conservation PASS (dropped=0), B3 addressed-slag PASS (43 shapes,
+dominant_share 0.215), B2 at 91.30% (INVESTIGATE band), and the
+pre-registered 60-80%-classified prediction MISSED at a measured 14.15% —
+recorded honestly, which is the point of pre-registering it. Dominant
+residual is `opcode_not_in_convention`, expected: pass 1 only classifies 7
+of P-code's 74 opcodes by design. Full record + the stability table
+(FlatFact payload bytes and the placeholder VarnodeFacet classid are
+explicitly NOT stable yet): `EPIPHANIES.md`, the entry above
+`E-LGJ-GHIDRA-G1-G2-SUPERSEDED-BY-R2IL-1`.
+
+No wave-gate change — PR2/PR3 still unmerged, `wave-ogar-machine-pm1.md`
+gate #3 stands as previously repointed. Next unblocked step (not scheduled,
+available when there's a reason to spend it): S2, still read-only.
+
+## 2026-08-18 (later) — Ghidra G1/G2 waves reconciled: superseded by ruff_r2il, not built
+
+Checked what "the other session writing the autoadapting drill-down proposer"
+(ruff/r2sleigh) actually unblocks here, against the merged PR rather than the
+summary. `AdaWorldAPI/ruff` PR #94 shipped `crates/ruff_r2il` — a typed
+intake arm (ore/furnace/slag) reading r2sleigh's R2IL/SSA directly, with an
+addressed residual ledger deliberately left non-empty for a follow-on pass.
+That follow-on IS the drill-down proposer: PR2 in the R2IL plan's own wave
+ladder, reading `ResidualLedger::by_address` and proposing finer convention
+rows, converging pass over pass. **Not landed yet** — gated on PR1's corpus
+numbers. PR3 (the classid mint in `lance-graph-contract::ogar_codebook`,
+item O5) is gated on PR2. So there is nothing new to CONSUME here today.
+
+What there IS: `wave-ghidra-g1-g2.md` (a bespoke `analyzeHeadless` lift
+script + a hand-rolled LE image format) is now superseded, not merely
+lower-priority — the R2IL plan's own stop condition already answers the
+question those waves existed to answer ("direct r2il/r2ssa consumption
+solves the upstream seam — YES, 43s"). Marked superseded in place;
+`wave-ogar-machine-pm1.md`'s gate #3 repointed from "Ghidra G1+G2 merged" to
+"ruff_r2il PR2+PR3 merged" so the real dependency is visible instead of a
+dead one. Full record + a separately-found, pre-existing `ogar_codebook`
+mirror-drift gap (flagged, not fixed): `EPIPHANIES.md`
+`E-LGJ-GHIDRA-G1-G2-SUPERSEDED-BY-R2IL-1`.
+
+No code changed; C-band ruling (`E-LGJ-THE-DOMAIN-BYTE-CARRIES-ALTITUDE-1`,
+merged as OGAR PR #276) is unaffected — its `0xC4` fence is now literally
+true in code rather than anticipated.
+
+## 2026-08-18 — C-band ruling recorded: the domain byte carries ALTITUDE
+
+Operator ruling (*"Java is an entire different layer that's why I chose
+another higher level"*): the classid domain byte is **stratified by layer**,
+not a flat namespace. The C-band is the stratum ABOVE the Rust substrate —
+**C0** Java/Panama/Valhalla (the membrane, and the FLOOR of that layer),
+**C1** ogar-bricks + Databricks (the analyst estate), **C4** Ghidra (a tenant
+of C0's layer — Ghidra is itself a JVM application per this repo's G0
+archaeology — and explosive, for the blast radius of turning any binary into
+addressable rows).
+
+Full entry, including the three of my own proposals it corrects and the
+root-cause (I clustered by SHAPE — everything becomes `(function : value)`
+calls in a 512-byte node — where the real axis is ALTITUDE):
+`EPIPHANIES.md` `E-LGJ-THE-DOMAIN-BYTE-CARRIES-ALTITUDE-1`.
+
+**Consequence for this repo, and it is the only one:** W6's schema/classid
+field on `LgjResourceInfo`/`LgjLaneDesc` carries a **C0** concept. Nothing on
+the current wave list is blocked by the allocation — the reservation is
+OGAR-side and operator-gated (reserving costs nothing; minting is 5+3-gated).
+
 ## 2026-08-17 (dispatch 4) — W5b bricks shipped: authorization IS a mask, measured
 
 `wave-consumer-bricks.md` executed (2 Sonnet workers K1/K2, disjoint main/test

diff --git a/.claude/board/PR_ARC_INVENTORY.md b/.claude/board/PR_ARC_INVENTORY.md
@@ -8,6 +8,40 @@
 > anti-pattern the imported board rules name. Backfilled below in one
 > pass rather than left stale; PR #4 onward gets its entry at merge time.
 
+## PR #12 — consumer example: Bricks, mask-first authorization (merged 2026-08-17, squash `8f16e8d`)
+
+- **Added:** `consumers/bricks/` — the second consumer proof over the
+  unchanged core. `Bricks`/`BricksSession`/`BricksQuery`/`Role`/`Orders`/
+  `UnauthorizedQueryException`; `BricksAuthTest` 62/62. Wave
+  `wave-consumer-bricks.md`, 2 Sonnet workers (K1 main / K2 test,
+  disjoint), orchestrator-gated.
+- **Locked:** authorization is a **predicate in the same lazy chain** as
+  `where(...)`, composed before execution and fused into the same single
+  crossing — not a post-filter. `Role.EU_ONLY` = `REGION.eq(EU)`;
+  `DENY_ALL` = `REGION.eq(0xFFFF)`, a real impossible predicate that pays
+  a real crossing and counts 0; fail-closed throws BEFORE any crossing
+  (no default-allow path exists); aggregate-only egress is **structural**
+  (`BricksQuery`/`long`/`Map` are the only public return types — asserted
+  by reflection, so no row-shaped type can be added without breaking the
+  test). Disable-run: `requireAuthorized` short-circuited → exactly the
+  3 can-fire fail-closed checks red, 59 green; restored 62/62.
+- **A measured correction, recorded rather than smoothed over:** a **sum
+  terminal costs 2 crossings** (plan eval into the mask +
+  `lgj_reduce_sum_i32`), unlike `count()`'s 1 — so `sumBy()` is **32
+  crossings (16 groups × 2), IDENTICAL at 1K and 64K rows**. K1's Javadoc
+  claimed one crossing per group; the measurement corrected the doc. The
+  thesis assertion is the shape (crossings ∝ groups, never rows), which
+  is why the same literal is pinned at both row counts.
+- **Deferred:** a native grouped-aggregate kernel (one crossing, 16
+  buckets) — named in the Javadoc as the W6-tier follow-up, deliberately
+  not built because nothing has measured a need; W5c graph (shelved on
+  the D1 ruling + the edge-bearing generator substrate change).
+- **Docs:** STATUS_BOARD D-LGJ-W5 → bricks DONE; LATEST_STATE dispatch-4
+  entry, which also owns that W5a (#11) shipped without one.
+- **Confidence:** High — zero new membrane surface, zero core changes,
+  core suite unaffected at 188/188; every falsifier disable-verified.
+  Both bot reviewers at usage limits (no human or bot review obtained).
+
 ## PR #11 — consumer example: World/Trades (merged 2026-08-17, squash `db7bdf1`)
 
 - **Added:** `consumers/trades/` — own compile unit, core consumed as a

diff --git a/.claude/plans/lgj-soa-substrate-v1.md b/.claude/plans/lgj-soa-substrate-v1.md
@@ -32,7 +32,7 @@
 | **W3** | Java `RowStore` facade: no FFM in public signatures; structured `MemoryLayout` (`sequence(32, struct(u32 classid, 12B payload))`); minor-≥2 gate; `FacetMatchView` zero-copy accessor over a Java-arena segment; `RowStoreParityTest` transcribing the generator | OPEN — next |
 | **W4** | Bench Component F: Java Vector API per-row facet scan (one `IntVector` 16-lane chunk = 4 facets, same algorithm as the Rust kernel) vs `lgj_row_facet_match` crossing vs scalar VarHandle walk — the "where does execution belong" question re-asked on the REAL layout | OPEN |
 | **W5** | The three consumer examples (own plan files, below) | PLANNED |
-| **W6** *(named, not scheduled)* | ClassView wiring — and with it an explicit **schema/classid field** on `LgjResourceInfo`/`LgjLaneDesc` (additive, one minor bump), so a resource names WHICH layout contract its bytes obey instead of implying it via `kind`. Provenance + rationale: `.claude/knowledge/prior-art-and-the-layout-bridge-claim.md` §3 ("one key, many projections" made literal at the membrane). Also the `align(64)` base guarantee (real `NodeRow`) and, only if measurement asks, fused plans over facet lanes | NAMED |
+| **W6** *(named, not scheduled)* | ClassView wiring — and with it an explicit **schema/classid field** on `LgjResourceInfo`/`LgjLaneDesc` (additive, one minor bump), so a resource names WHICH layout contract its bytes obey instead of implying it via `kind`. Provenance + rationale: `.claude/knowledge/prior-art-and-the-layout-bridge-claim.md` §3 ("one key, many projections" made literal at the membrane). **The classid that field carries is a C0 concept** — the Java/Panama/Valhalla layer naming itself from inside its own stratum, not a substrate concept borrowed downward; see `.claude/board/EPIPHANIES.md` `E-LGJ-THE-DOMAIN-BYTE-CARRIES-ALTITUDE-1` (the reservation is OGAR-side and operator-gated, and W6 is not blocked on it). Also the `align(64)` base guarantee (real `NodeRow`) and, only if measurement asks, fused plans over facet lanes | NAMED |
 
 Wave rule (house style): one wave = one reviewable PR; gates run centrally
 (orchestrator only — agents never run cargo); every safety property lands

diff --git a/.claude/waves/wave-consumer-graph.md b/.claude/waves/wave-consumer-graph.md
@@ -1,10 +1,13 @@
 # Wave: consumer example — graph traversal (facet edges, crossings ∝ hops)
 
-> Executes `consumer-graph-traversal-v1.md`. **DO NOT DISPATCH** —
-> operator ruling 2026-08-17: calcified, not executed, until called.
-> Gates: W3 merged AND the hop-decode capability question resolved (see
-> Decision D1 below — this wave has a genuine open design decision the
-> other two consumer waves do not).
+> Executes `consumer-graph-traversal-v1.md`. Gates: W3 merged (DONE) AND
+> the hop-decode capability question resolved (Decision D1 below — ruled
+> D1a) AND the edge-bearing generator STOP condition resolved (DONE,
+> `RowStore::generate_with_edges`, see below). **DISPATCHABLE** — the
+> calcify-only gate ("2026-08-17: calcified, not executed, until called")
+> was lifted session-wide once autonomous dispatch was authorized (W5a/W5b
+> both shipped under it); this wave's own, GENUINE extra gate (the
+> generator) is what actually held it back, and is now cleared.
 
 ## Decision D1 (orchestrator resolves BEFORE any worker spawns)
 
@@ -59,8 +62,22 @@ offset by 4 bytes → hop-correctness must go red (proves the decode is
 load-bearing); restore. Board + PR per rhythm; if D1b was chosen, the
 membrane PR merges FIRST and this wave's PR references it.
 
-**STOP conditions:** payload reading ambiguity (→ orchestrator, possibly
-a generator extension in a substrate-plan PR — the fixture's payload
-today is PRNG noise, so this wave NEEDS a deliberate edge-bearing
-generator arm: that is a substrate change, not a consumer hack — flagged
-here so nobody discovers it mid-dispatch).
+**STOP condition RESOLVED (2026-08-18):** the deliberate edge-bearing
+generator arm this wave's STOP condition named now exists —
+`RowStore::generate_with_edges(n_rows, seed, edge_classid, edge_gate_mask,
+edge_radius)` (native/lgj-abi, landed as its own substrate-tier change,
+NOT a consumer hack, per this file's own rule). It reuses `generate()`'s
+classid stream byte-for-byte (an out-of-range `edge_classid` reproduces
+`generate()` exactly — pinned by test) and, for a SPARSE, gated subset of
+`edge_classid`-matching facets, writes a bounded-local-neighbourhood
+target row instead of raw noise — the mechanism that keeps a 1-2 hop BFS
+non-vacuous. Measured (`examples/graph_density_probe.rs`, not guessed):
+plain `generate()`'s uniform-random payload saturates a 2-hop BFS to
+nearly every row (the ORIGINAL problem this STOP condition named); at
+`n_rows=2000, edge_classid=0, edge_gate_mask=0x0, edge_radius=25`, a
+10-row seed set reaches exactly 19 rows at 1 hop and 29 at 2 hops — three
+different, non-empty, non-total sizes, pinned as a regression test
+(`measured_hop_counts_are_three_distinct_non_empty_non_total_sizes`).
+**G1's payload-reading-convention documentation task now has real,
+measured ground to document** rather than an open question — this wave
+is dispatchable.
diff --git a/.claude/waves/wave-ghidra-g1-g2.md b/.claude/waves/wave-ghidra-g1-g2.md
@@ -1,11 +1,26 @@
 # Wave: Ghidra G1 (lift proof) + G2 (program image format)
 
-> Executes `ghidra-integration-v1.md` G1 then G2. **DO NOT DISPATCH** —
+> **SUPERSEDED — 2026-08-18, do not dispatch under any circumstance.**
+> `AdaWorldAPI/ruff` PR #94 (`crates/ruff_r2il`) merged a typed intake arm
+> that consumes r2sleigh's R2IL/SSA DIRECTLY — in-process, ~43s, no JVM
+> roundtrip, no bespoke text-dump format to invent and parse. That plan's
+> own stop condition already closed the question this wave existed to
+> answer: *"§22.1: direct r2il/r2ssa consumption solves the upstream seam
+> — YES."* Building G1 (an `analyzeHeadless` post-script emitting a custom
+> P-code text dump) or G2 (a second, bespoke LE image format) now would be
+> a competing, throwaway lift path duplicating work already merged and
+> typed. Full reconciliation record:
+> `.claude/board/EPIPHANIES.md` `E-LGJ-GHIDRA-G1-G2-SUPERSEDED-BY-R2IL-1`.
+> This file is kept for its archaeology (G0's real 74-opcode/`PcodeEmulator`
+> findings still stand as reference) — never dispatch the two waves below.
+
+> ~~Executes `ghidra-integration-v1.md` G1 then G2. **DO NOT DISPATCH** —
 > shelved with the consumer waves per the operator's calcify-first ruling;
 > G1 is technically independent of W3 but momentum stays on the substrate
 > waves until called. Cross-repo: G1's script lands in `AdaWorldAPI/ghidra`
 > (cloned at `/workspace/ghidra`, 12.2 DEV, Java 25+); G2's loader lands
-> here. One PR per repo; ghidra PR merges first.
+> here. One PR per repo; ghidra PR merges first.~~ *(pre-supersession text,
+> kept for the record.)*
 
 ---
 

diff --git a/.claude/waves/wave-ogar-machine-pm1.md b/.claude/waves/wave-ogar-machine-pm1.md
@@ -7,9 +7,17 @@
 > 1. W3 merged (Java facade — the consumer workflow exists).
 > 2. At least ONE W5 consumer example shipped (the
 >    consumer-never-grows-the-membrane rule has a proven round-trip).
-> 3. Ghidra G1+G2 merged (a real program image format exists — P-M1 must
->    consume the REAL format, not a probe-local sketch that would become
->    a second format).
+> 3. **[RECONCILED 2026-08-18 — was "Ghidra G1+G2 merged"]** `ruff_r2il`
+>    PR2 (route→V3 projection + codebook wiring, `AdaWorldAPI/ruff`) AND
+>    PR3 (the classid mint for the R2IL container concept in
+>    `lance-graph-contract::ogar_codebook`, O5) merged — a real,
+>    already-typed program image exists on THAT path. `wave-ghidra-g1-g2.md`
+>    is superseded and will never satisfy this gate; do not dispatch it to
+>    try. PR1 (ore/furnace/slag intake + the addressed residual ledger) is
+>    already merged; PR2 is explicitly gated on PR1's corpus numbers and is
+>    the in-flight "drill-down proposer" work — check
+>    `AdaWorldAPI/ruff/.claude/plans/r2il-behavioral-ir-v1.md`'s Wave plan
+>    section before re-deriving this gate's status.
 > 4. An explicit operator go (this direction is exploratory by ruling).
 
 ## What P-M1 is (and is deliberately not)