docs(contract)+knowledge+agents: de-brand sequencing primitives; bank the compilation-vs-runtime + assembler-vs-storage rulings

.claude/agents/codegen-flow-cartographer.md

@@ -0,0 +1,66 @@
+---
+name: codegen-flow-cartographer
+description: >
+  Owns the map of the compile-time pipeline: source harvest (ruff frontends)
+  → OGAR mint (Class/ActionDef/classid/facet) → codegen emit INTO a consumer
+  repo → plain cargo build (laptop / CI / Railway pulling from GitHub) →
+  binary. Answers "where does this artifact/type/function live, and WHEN does
+  it execute?" for any lowering, adapter, or consumer-wiring design — so the
+  answer is read from the pipeline, never guessed from a name. Use BEFORE
+  designing a lowering function, placing a helper (consumer repo vs
+  ogar-vocab vs ogar-emitter vs lance-graph-contract), or writing a seam doc
+  that names a build system. Complements layer-boundary-warden: the warden
+  gates a finished artifact; the cartographer answers placement questions
+  while the artifact is being written.
+tools: Read, Glob, Grep, Bash
+model: sonnet
+---
+
+You are the CODEGEN-FLOW-CARTOGRAPHER. You answer placement and phase
+questions about the compile-time pipeline with receipts, never from memory.
+Bootload before answering:
+
+1. `.claude/knowledge/compilation-vs-runtime-substrate.md`
+2. `.claude/knowledge/assembler-vs-storage-substrate.md`
+3. The target repo's CLAUDE.md + relevant doc (OGAR: `docs/OGAR-AS-IR.md`,
+   `docs/OGAR-TRANSPILE-SUBSTRATE.md`; consumers: their CLAUDE.md).
+
+## The pipeline you carry (verify stages against source each run — receipts, not recall)
+
+```
+source (C#/py/rb/…)                                        [foreign repo]
+  → ruff frontend harvest (SPO ndjson)                      [ruff crates]
+  → OGAR mint: reassemble → Class/ActionDef, classid/facet  [ogar-from-*, ogar-vocab]
+  → codegen emit (askama render / adapters)                 [ogar-render-askama, ogar-emitter]
+  → INTO the consumer repo as ordinary Rust                 [a2ui-rs / medcare-rs / …]
+  → cargo build against type deps                           [ogar-vocab via lance-graph-ogar;
+                                                             lance-graph-contract]
+  → binary                                                  [laptop / CI / Railway]
+```
+
+Everything on this map executes at COMPILE TIME or is plain code a binary
+runs on its own. Nothing on it touches SoA / temporal.rs / NARS / RBAC /
+mailboxes — those belong to the running engine's internal designs, which are
+not on this map and must not leak into answers about it.
+
+## Question types you answer (each with file:line receipts)
+
+- **Placement:** "where should lowering fn X → Y live?" Walk the map: does it
+  need only ogar-vocab types → next to the consumer's use-site or as an
+  ogar-vocab/ogar-emitter helper; does it need contract types → the consumer,
+  compiled against lance-graph-contract. Never a new bridge crate without
+  naming why no existing stage fits.
+- **Phase:** "when does step S happen?" Name the pipeline stage + who
+  executes it (rustc/cargo vs binary-at-runtime), with the test "could
+  `cargo test` cover it with nothing running?".
+- **Dependency route:** "how does consumer C see type T?" Trace the actual
+  Cargo.toml edges (read them; do not assume re-export paths).
+- **Build-infra:** "what does Railway/CI need?" The answer is always a Git
+  repo + cargo + pinned toolchain; if a design demands more, flag it to
+  layer-boundary-warden instead of accommodating it.
+
+## Output contract
+
+≤10 findings: `(question, answer, receipt file:line, ≤2 sentences)`.
+Unknowns are stated as GAP with the exact file you'd need — never filled by
+plausibility. You are read-only.

.claude/agents/layer-boundary-warden.md

@@ -0,0 +1,54 @@
+---
+name: layer-boundary-warden
+description: >
+  Pre-flight gate against layer-confusion — the failure mode that filed a
+  Klickwege issue at the wrong repo (lance-graph #691) and then gated a
+  compile-time lowering behind runtime ownership ceremony (OGAR #208, closed
+  as hallucinated). Fires BEFORE: filing any cross-repo issue; writing any
+  seam/lowering/ingest design; any sentence that pairs a consumer repo
+  (a2ui-rs / medcare-rs / smb-office-rs / woa-rs / q2) with SoA, temporal.rs,
+  NARS, RBAC, mailbox, write-on-behalf, or lance-graph-planner; any design
+  containing the words "ingest", "send to storage", or "ask lance-graph to".
+  Runs the two checklists (compilation-vs-runtime, assembler-vs-storage) and
+  returns a phase + ownership verdict. Verdicts: COMPILE-TIME-CLEAN /
+  RUNTIME-CLEAN / MIXED-SPLIT-IT (design must become two documents) /
+  DOOR-KNOCKER (block: a build or a typed-value constructor is asking the
+  substrate for permission) / WRONG-SHELF (block: responsibility assigned to
+  the wrong repo — includes filing before reading the target repo's docs).
+tools: Read, Glob, Grep, Bash
+model: sonnet
+---
+
+You are the LAYER-BOUNDARY-WARDEN. You do not design; you gate. Your two
+canon docs — read them in full before every run:
+
+1. `.claude/knowledge/compilation-vs-runtime-substrate.md`
+2. `.claude/knowledge/assembler-vs-storage-substrate.md`
+
+## Procedure (bounded; no synthesis beyond the verdict)
+
+1. **Phase test.** For the artifact under review (issue draft / seam doc /
+   plan section), answer: who executes each described step — cargo/rustc, or
+   a running engine? Anything answerable by "cargo test with nothing running"
+   is compile-time. If both phases appear in one design → MIXED-SPLIT-IT.
+2. **Door-knocker test.** Does any build step, codegen step, or typed-value
+   construction require permission, ownership routing, RBAC, mailbox
+   identity, or membrane crossing? If yes → DOOR-KNOCKER (block, with the
+   offending sentence quoted). Constructing a value of a type you compiled
+   against is never a ceremony.
+3. **Shelf test.** For each responsibility the artifact assigns: check the
+   ownership quick-map in `assembler-vs-storage-substrate.md`. IR/minting/
+   codegen → OGAR; compile-against types → lance-graph-contract; query/plan →
+   lance-graph; durability → calcification (no API). "Ingest"/"send to
+   storage" vocabulary → WRONG-SHELF. If the artifact targets a repo whose
+   CLAUDE.md/doc-family was not read first (no receipt in the artifact) →
+   WRONG-SHELF with reason "filed before reading".
+4. **Receipt discipline.** Every verdict cites file:line or quotes the
+   offending sentence. A verdict without a receipt is malformed — redo it.
+
+## Output contract
+
+≤8 findings, each: `(test#, verdict, receipt, ≤2 sentences)`.
+Final line: `WARDEN: <COMPILE-TIME-CLEAN|RUNTIME-CLEAN|MIXED-SPLIT-IT|DOOR-KNOCKER|WRONG-SHELF> — <one-line reason>`.
+You are read-only. You never redesign — a design you dislike gets a verdict,
+not an alternative.

.claude/board/AGENT_LOG.md

@@ -1,3 +1,8 @@
+## 2026-07-14 — 5+3 council: OGAR-vs-lance-graph layer-confusion audit + contract doc-label cleanup
+- **Deliverable:** doc-comment label-bleed removed from `contract::class_view::{execute_compute_dag, execute_defaults}` (were branded "the ActionDef value executor" + carried MedCare/sono provenance in the zero-dep contract). E-LAYER-CONFUSION-OGAR-VS-SPINE-1 prepended. New issue #692 (contract::action shape-parity fuse gap).
+- **Council:** 5 falsification savants (Sonnet ×4 / Opus ×1) + 3 brutal reviewers (Sonnet). Grades: 3 WRONG, 1 UNSOUND, 1 WRONG-not-catastrophic. Reviewers raised 2 BLOCK + 6 FIX against the orchestrator's own remediation (all accepted). #690 placement verified CORRECT (not reverted).
+- **Board:** EPIPHANIES prepended; companion corrections in MedCare-rs (E-MEDCARE-30, PR #211), a2ui-rs (CROSS-SESSION-SEAMS retracted-in-part), OGAR #208.
+
 ## 2026-07-12 — chess-arc-spine-evidence-carve — E-THINKING-SPINE-CHESS-EVIDENCE-1 + temporal-markov plan addendum
 
 - **Deliverable:** `.claude/plans/temporal-markov-and-style-classes-v1.md` addendum (6 graded mappings of the chess arc onto Track A/B) + `EPIPHANIES.md` `E-THINKING-SPINE-CHESS-EVIDENCE-1` pointer entry.

.claude/board/EPIPHANIES.md

@@ -1,3 +1,13 @@
+## 2026-07-14 — E-LAYER-CONFUSION-OGAR-VS-SPINE-1 — a session-wide OGAR-vs-lance-graph layer conflation, caught by a 5+3 council; contract doc-comment label-bleed cleaned
+
+**Status:** FINDING (5+3 council, source-receipted; MedCare-rs E-MEDCARE-30 carries the full grades).
+
+A cross-arc session conflated **OGAR** (the V3 assembler substrate — owns `Class`/`ActionDef` IR, the live active-record graph) with **lance-graph** (the query/storage spine + the zero-dep contract). It filed a Klickwege live-edge ingest issue at lance-graph (#691) when the landing is OGAR's job (Lance persistence is the substrate's own *calcification*, never an ingest API — "nobody runs the compiler on the hard disk"). #691 closed → OGAR #208.
+
+A 5+3 falsification council then audited the session's downstream claims. Load-bearing result for THIS repo: **#690's `execute_defaults` is CORRECTLY placed** — OGAR's `ogar-class-view` *consumes* `lance_graph_contract::class_view::ClassView` (`ogar-class-view/lib.rs:62,364`); the primitives are pure sequencing (delegate all value semantics to a consumer closure, import no `ActionDef`). It is NOT OGAR-Core reimplementation and NOT the same fault as #691. **What WAS wrong (this commit fixes it):** the `execute_compute_dag`/`execute_defaults` doc-comments branded them "the ActionDef value executor" and baked one consumer's provenance ("the medcare transpile arc's lane-3a increment", "the sono `Recal_*` family") into the ZERO-DEP contract that every consumer inherits — label-bleed. They are generic sequencing primitives, not an `ActionDef`-body interpreter (that is OGAR's `ACTIONDEF-VALUE-DISPATCH-PROPOSAL.md`). Doc-comments reworded to describe the primitive generically + scope-note the ActionDef-interpreter boundary. **Highest residual (filed #692, not fixed here):** `contract::action::{ActionDef,ActionInvocation,ActionState}` re-declare OGAR IR names with no shape-parity fuse while the sibling codebook mirror has one.
+
+**Meta-lesson:** confident architectural claims written fast off spot-reads are the Lie-Detector failure signature; the fix is the council BEFORE a claim enters canon. Cross-refs: MedCare-rs E-MEDCARE-30, OGAR #208, lance-graph #692, a2ui-rs CROSS-SESSION-SEAMS.md (retracted-in-part).
+
 ## 2026-07-14 — E-RUNG-CONTENT-LADDER-1 — the rung-content ladder ruled; persona-36 demarcated as a separate storyline (corrects E-STYLE-FAMILY-VS-RUNBOOK-1's "runbook" label)
 
 **Status:** RULED (operator, 2026-07-14). Canonical text: `.claude/v3/knowledge/persona-vs-rung-ladder.md` (linked from CLAUDE.md § V3 SUBSTRATE).

.claude/knowledge/assembler-vs-storage-substrate.md

@@ -0,0 +1,77 @@
+# Assembler vs storage substrate — OGAR assembles; Lance calcifies; nobody compiles on the hard disk
+
+> READ BY: layer-boundary-warden, codegen-flow-cartographer, integration-lead,
+> truth-architect, any session about to file an issue, name an "ingest API",
+> or assign a responsibility across the OGAR ↔ lance-graph boundary.
+>
+> Born 2026-07-14 from a real failure chain: a Klickwege live-edge issue filed
+> at lance-graph (#691, closed) because "SPO store" pattern-matched to the
+> query engine's triple store; then two more wrong re-framings before the
+> operator's rulings landed. Companion doc:
+> `compilation-vs-runtime-substrate.md` (the compile-time/runtime split).
+
+## The distinction
+
+**OGAR is the assembler substrate** — the V3 compiler layer. It owns the IR
+and the minting: `Class` / `ActionDef` / `ActionInvocation` (ogar-vocab), the
+classid canon and content-blind facet, the frontends (`ogar-from-*`), the
+adapters/emitters, codegen into consumer repos. It is where structure is
+*assembled*. It is not a database.
+
+**lance-graph is the spine; Lance is the disk.** lance-graph carries the
+zero-dep *type* contracts (`lance-graph-contract` — which OGAR itself
+consumes, e.g. `ogar-class-view` implements `lance_graph_contract::ClassView`)
+and the query/planner machinery. Lance columnar storage is **where facts
+calcify**: versions, tombstones, episodic history. Persistence is the
+substrate's own calcification — Lance's columnar I/O writes LE bytes from the
+in-place store ("zero-copy from creation to Lance tombstone"). **There is no
+ingest API**: nothing "sends data to storage" as a request, and no producer
+design should ever name one.
+
+**The operator's two rulings, verbatim spirit:**
+1. "There's a difference between storage and assembler substrate."
+2. "Nobody would be stupid enough to use a hard-disk substrate for a
+   compiler."
+
+## Ownership quick-map (where does X live?)
+
+| X | Home | Why |
+|---|---|---|
+| `Class` / `ActionDef` / `ActionInvocation` IR | OGAR (`ogar-vocab`) | assembler owns the IR |
+| classid canon, facet, minting | OGAR | assembler owns identity |
+| codegen / frontends / emitters | OGAR (`ogar-from-*`, `ogar-emitter`) | assembler produces code + SPO facts |
+| zero-dep type contracts (`ClassView`, masks, sequencing primitives) | lance-graph-contract | the compile-time handshake OGAR + consumers build against |
+| query engine, planner, temporal reads | lance-graph | the spine |
+| persistence, versions, tombstones | Lance (via lance-graph) | calcification, not ingestion |
+| live edges / new facts *landing* | the assembler-side graph of active record | facts are assembled, then calcify |
+
+## Failure signatures (all observed, one session, 2026-07-14)
+
+- **Wrong-repo filing:** "it's SPO-shaped → lance-graph `graph/spo/`". No —
+  the triple store is query machinery; the *landing* of new facts is
+  assembler-side. (lance-graph #691 → OGAR.)
+- **"Ingest API" vocabulary:** any design that says a producer "ingests into
+  storage" has inverted calcification into a service call.
+- **"V3 substrate = lance-graph":** lance-graph hosts V3 *type contracts and
+  docs*; the substrate being described — the graph of active record — is
+  OGAR. Reading board docs' location as ownership is the trap.
+- **Compiler-on-disk:** designing assembly/compile steps as if they run
+  against storage. See the companion doc's door-knocking-compiler test.
+
+## The 30-second checklist
+
+- **Is this thing IR/minting/codegen?** → OGAR. **Types both sides compile
+  against?** → lance-graph-contract. **Query/plan over persisted state?** →
+  lance-graph. **Durability?** → calcification, not an API — stop designing
+  an endpoint.
+- **Before filing a cross-repo issue:** open the target repo's CLAUDE.md +
+  doc family FIRST (OGAR's `docs/` index; consult-don't-guess is P0). The
+  #691 failure was filing from pattern-match without reading OGAR at all.
+- **Naming test:** if the design contains "ingest", "send to storage", or
+  "ask lance-graph to", rewrite until those words are gone or the design
+  moved to the runtime-engine document where it belongs.
+
+Cross-refs: OGAR `CLAUDE.md` (canonical GUID/node canon, doc family),
+`docs/OGAR-AS-IR.md` (the compiler framing), lance-graph
+`E-LAYER-CONFUSION-OGAR-VS-SPINE-1`, MedCare-rs `E-MEDCARE-30`,
+`compilation-vs-runtime-substrate.md`.

.claude/knowledge/compilation-vs-runtime-substrate.md

@@ -0,0 +1,75 @@
+# Compilation vs runtime substrate — contracts compile types; the engine thinks alone
+
+> READ BY: layer-boundary-warden, codegen-flow-cartographer, integration-lead,
+> baton-handoff-auditor, core-first-architect, any session filing a cross-repo
+> issue or writing a seam/lowering design that mentions a consumer repo
+> (a2ui-rs / medcare-rs / smb-office-rs / woa-rs / q2) together with any of:
+> SoA, temporal.rs, NARS, RBAC, mailbox, write-on-behalf, lance-graph-planner.
+>
+> Born 2026-07-14 from a real failure: three consecutive drafts of one issue
+> (OGAR #208, closed as hallucinated) gated a *compile-time lowering* behind
+> *runtime* ownership ceremony. Operator ruling is the canon here; OGAR #208's
+> repurposed body is the short form; #209 is the corrected work item.
+
+## The two phases, kept apart
+
+**Compile time.** ruff harvests source → OGAR mints IR (`Class`/`ActionDef`,
+classids, facets) → codegen emits Rust **into the consumer repo**. The
+consumer depends on `ogar-vocab` (re-exported via `lance-graph-ogar`) and/or
+`lance-graph-contract` as **plain type dependencies** — the compile-time
+handshake. cargo builds the repo: on a laptop, in CI, on Railway pulling from
+GitHub. A binary comes out. **That is the entire compilation story.**
+
+**Run time.** The SoA, the `temporal.rs` standing wave / version-range reads,
+NARS, RBAC, mailbox write-on-behalf, lance-graph-planner strategies — the
+running engine's *internal* mechanics when the cognitive substrate executes.
+They are real, and they are nobody's checkpoint: they never gate a consumer's
+build, and they never gate a consumer *constructing a typed value* it
+compiled against.
+
+## The door-knocking compiler (the canonical absurdity — operator's image)
+
+> "No compiler goes to lance-graph knocking on the door of every SoA
+> little-endian contract politely asking: *please, may I first download the
+> code into the SoA, so my second pass can compile the same binary
+> interlacing temporal.rs and NARS, if I'm allowed to compile on behalf of
+> the SoA using RBAC and lance-graph-planner?*"
+
+If a design, issue, or seam doc implies that sentence anywhere, it is wrong
+**at the frame** — do not fix the details, refile the frame. Symmetrically:
+"contracts compile types" (medcare-rs commitment #7) means the contract crate
+is a compile-time handshake — it never serializes, never negotiates, never
+"receives".
+
+## Consequences (each one was violated at least once before this doc existed)
+
+1. **A lowering function is a plain Rust function.** `X → ogar_vocab::Y` is
+   code in a repo, unit-tested by `cargo test` with nothing running. It needs
+   type-level decisions (field semantics, identity resolution), never
+   permission decisions.
+2. **Emitting a typed value is not a write ceremony.** Constructing an
+   `ActionInvocation` is `struct` literal syntax. Where values are *recorded*
+   when an engine runs is a runtime/storage concern that belongs to the
+   engine — a separate design, a separate doc, never a gate on the
+   compile-time seam.
+3. **Build infrastructure sees only cargo.** Railway/CI pull a Git repo and
+   run `cargo build`. If a plan requires the build to touch the substrate,
+   the plan is wrong.
+4. **Runtime doctrine stays in runtime designs.** Mailbox ownership /
+   write-on-behalf / membrane crossing are V3 *engine* rules. Citing them in
+   a codegen or type-seam issue is the tell that phases got mixed.
+
+## The 30-second checklist (run it BEFORE filing/designing, not after)
+
+- **Who executes this step?** cargo/rustc → compile time. A running engine →
+  runtime. "Both" → split the design into two documents.
+- **Could this be unit-tested with nothing running?** Yes → it is
+  compile-time; strip every runtime word from the design.
+- **Does the design make a build or a constructor ask permission?** Then it
+  is the door-knocking compiler. Refile.
+- **Is a contract crate described as receiving/ingesting/serializing?**
+  Contracts compile types. Refile.
+
+Cross-refs: `assembler-vs-storage-substrate.md` (the sibling distinction),
+OGAR #208 (repurposed) / #209 (corrected work item), medcare-rs CLAUDE.md
+commitment #7, `ogar-consumer-preflight.md` (the classid consumer spellbook).