board: the Foundry split — lance-graph owns the agnostic thinking, consumers bind domain

Operator, 2026-09-07: "lance-graph owns the agnostic thinking / Akin to
Palantir foundry." Recorded as the general rule for every consumer session,
because it collapses four separate findings from this one session into a
single one: platform-side work performed tenant-side.

The same agent wrote, in a consumer, a sealed-cycle writer (LanceCycleWriter's
job), a version successor (a verified identity inside that sink), a
version-pinned read (temporal::QueryReference::at), and a second copy of the
rung x tenant cross (AlphaFocus, shipped upstream in #1220). Each looked like
its own mistake; they are one mistake with four faces.

The demarcation is not "is it generic code" but "is it domain knowledge".
Measured on medcare-cohorts::spog_masks: tenant_masks, rung_tenant_cell and
unlooked can all be written without naming the domain and are therefore
platform-side; domain_mask and horseshoe_mask (which Gs make a Domain, the TUI
fence) cannot, and are the tenant's. Three of five are thinking a tenant is
carrying — masks feel like data, which is how they slipped the test for a whole
deliverable.

Consequence for the spec: F5 recorded "scalar AlphaFocus vs SIMD spog_masks" as
an open operator PREFERENCE. That framing is withdrawn — the cell belongs
upstream by this rule. What stays open is narrower and genuinely architectural:
where an ndarray-backed mask algebra can live, given lance-graph-planner is
BBB-forbidden in a customer binary and lance-graph-contract is zero-dep.

EPIPHANIES E-LANCE-GRAPH-OWNS-THE-AGNOSTIC-THINKING-CONSUMERS-BIND-DOMAIN-1,
read with E-A-CONSUMER-THAT-OPENS-A-DATASET-HAS-ALREADY-LOST-1 (the writer
half) and E-TOPOLOGY-MASKS-MAGNITUDE-COMPOSE-NEVER-COLLAPSE-1 (what the
operations are).

Gates: append-only OK, no new citation decay, supersession index regenerated
last. Docs only; no code changed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KCGhDYoQBXs3poaR7sFuqp

Author: claude

.claude/board/EPIPHANIES.md

@@ -1,3 +1,65 @@
+## 2026-09-07 — E-LANCE-GRAPH-OWNS-THE-AGNOSTIC-THINKING-CONSUMERS-BIND-DOMAIN-1 — the Foundry split, and why four separate violations in one session were one violation
+
+**Status:** OPERATOR RULING (2026-09-07, verbatim: *"lance-graph owns the
+agnostic thinking / Akin to Palantir foundry"*), given after catching a
+consumer-side reimplementation of the owned writer.
+**Confidence:** High on the rule. The `spog_masks` consequence below is measured
+against the shipped code; the BBB placement question it raises is OPEN.
+
+**The rule.** lance-graph is the platform: it owns the ontology (contract types)
+and the OPERATIONS — the mask algebra, the cognitive cycle, the writer, the
+temporal read. A consumer (MedCare-rs, woa-rs, smb-office-rs, …) is a tenant: it
+supplies DOMAIN SHAPE and consumes thinking. It never implements thinking, and it
+never implements substrate. This restates MedCare's own commitment #4 (*"Thinking
+lives only in lance-graph. No `medcare-thinking` duplicate crate"*) as a
+POSITIVE architecture rather than a prohibition, which is what makes it
+checkable.
+
+**Why it is worth an entry: it collapses four findings into one.** In a single
+session the same agent wrote, in a consumer, a sealed-cycle writer
+(`LanceCycleWriter`'s job), a version successor (`sealed_version = base_version
++ 1`, a verified identity inside that sink), a version-pinned read
+(`temporal::QueryReference::at`), and a second copy of the rung × tenant cross
+(`AlphaFocus::{cell, unlooked}`, shipped upstream in #1220). Each was caught
+separately and each looked like its own mistake. Under the Foundry split they
+are one mistake with four faces: **platform-side work performed tenant-side.**
+
+**The demarcation is not "is it generic code", it is "is it domain
+knowledge".** Measured on `medcare-cohorts::spog_masks`:
+
+| function | what it does | owner |
+|---|---|---|
+| `tenant_masks` | sweep distinct classids, OR-fold per `graph_of` | **agnostic** — nothing medical |
+| `rung_tenant_cell` | AND of a rung mask and a tenant mask | **agnostic** |
+| `unlooked` | tenant AND-NOT any-rung | **agnostic** |
+| `domain_mask` | which Gs constitute a `Domain` | **tenant** — domain knowledge |
+| `horseshoe_mask` | the per-row TUI fence for the U-shaped lane | **tenant** — domain knowledge |
+
+Three of five are thinking that a tenant is carrying. The tell is that the first
+three can be written without knowing the word "medical", and the last two cannot.
+
+**Consequence — F5 in `spog-alpha-channel-v1.md` was mis-framed by its own
+author.** It recorded "scalar `AlphaFocus` (#1220) vs SIMD `spog_masks`
+(D-SPG-3)" as an open OPERATOR PREFERENCE. It is not a preference: the cell
+belongs upstream by this rule, and the tenant should call it. What remains open
+is narrower and genuinely architectural — **where an ndarray-backed mask algebra
+can live**, given that `lance-graph-planner` is BBB-forbidden in a customer
+binary (Iron Rule 1) and `lance-graph-contract` is zero-dep by construction. A
+contract feature-gate, or a new BBB-allowed crate between them, are the two
+shapes; neither is this entry's to choose.
+
+**Falsifier.** For any function in a consumer crate, ask whether it can be
+written without naming the domain. If yes and it is not a thin call into
+lance-graph, it is thinking in the wrong repo — regardless of how mechanical it
+looks. Masks feel like data and slipped through this test for a whole
+deliverable.
+
+Read with `E-A-CONSUMER-THAT-OPENS-A-DATASET-HAS-ALREADY-LOST-1` (same day, the
+writer half) and `E-TOPOLOGY-MASKS-MAGNITUDE-COMPOSE-NEVER-COLLAPSE-1` (same
+day, what the operations ARE).
+
+---
+
 ## 2026-09-07 — E-A-CONSUMER-THAT-OPENS-A-DATASET-HAS-ALREADY-LOST-1 — re-deriving a proven identity from outside the thing that proves it is the tell
 
 **Status:** FINDING, operator-caught (2026-09-07: *"that's not a convenience you're

.claude/plans/spog-alpha-channel-v1.md

@@ -132,7 +132,7 @@ loses to a sparse arm below 0.1 % active. A 762,041-bit mask is 11,907 words =
 | F2 | **Domain = mask over the combined image**, never a per-domain file. Tenant mask for G = `eq_u32_strided_to_mask(bytes, 0, 512, n_rows, classid, out)` over the mmap; domain view = `OR` over its Gs; horseshoe lanes fenced by a `value[0..2]` TUI-equality mask. | §1b; operator hint; `RailStore`'s grouping is the in-memory precedent |
 | F3 | **G is the contract's `graph_of` (canon-high u16)**, one tenant per G. MedCare's coarser `Domain` (byte `0x91..0x9D`, `domain_block.rs`) is a GROUPING of Gs, expressed as mask `OR` — no second G reading is minted, and no bit math on a composed classid appears in consumer code (`Domain::of_classid` already answers it). | `spog_tenants.rs:38-40`; worker rule 4 |
 | F4 | **The rung byte carries the attention rung only.** `domain_rung` (Domain+1) is retired as a rung writer once the tenant read replaces `reflection` — the domain is `graph_of(addr)`, read from the key, never from the stamp. Until D-SPG-5 lands, the two writers stay separate overlays (they do today). Trap: never carry a rung ordinal in the residue band (temporal 09 Stage 2). | D-RLR-5 (a); temporal 06 "unrecorded semantic collision" |
-| F5 | **Placement:** the SIMD cross cannot live in the zero-dep contract. The contract gains ONE method (`AlphaMask::words(&self) -> &[u64]`, plus the paired `from_words` constructor guarded by the same length law) — a method on the carrier, not a type. The live cross runs in MedCare (`medcare-cohorts` already depends on `ndarray`; the BBB rule keeps `lance-graph-planner` out of the customer binary). An agnostic synthetic probe may live in `lance-graph-planner/examples/`. **⊘ 2026-09-07 (rebase onto `main` after #1220):** the contract now ships a cross of its own — `alpha_focus::AlphaFocus::{cell, matrix, unlooked, rung_reach}`, scalar `and`/`and_not` over the two masks, no `ndarray`. F5's ruling is about the **SIMD/ternlog** cross and is unchanged by that; but `cell` and `unlooked` now exist in two places, and which one a consumer should reach for is an OPEN question for the operator, not settled here. | temporal 09 Stage 2; CLAUDE.md litmus (method on carrier) |
+| F5 | **Placement:** the SIMD cross cannot live in the zero-dep contract. The contract gains ONE method (`AlphaMask::words(&self) -> &[u64]`, plus the paired `from_words` constructor guarded by the same length law) — a method on the carrier, not a type. The live cross runs in MedCare (`medcare-cohorts` already depends on `ndarray`; the BBB rule keeps `lance-graph-planner` out of the customer binary). An agnostic synthetic probe may live in `lance-graph-planner/examples/`. **⊘ 2026-09-07 (rebase onto `main` after #1220):** the contract now ships a cross of its own — `alpha_focus::AlphaFocus::{cell, matrix, unlooked, rung_reach}`, scalar `and`/`and_not` over the two masks, no `ndarray`. F5's ruling is about the **SIMD/ternlog** cross and is unchanged by that; but `cell` and `unlooked` now exist in two places, and which one a consumer should reach for was recorded here as an open operator preference — **⊘ that framing was wrong (operator, 2026-09-07: *"lance-graph owns the agnostic thinking / Akin to Palantir foundry"*).** It is not a preference: the cell is agnostic thinking and belongs upstream; the tenant calls it. `tenant_masks` / `rung_tenant_cell` / `unlooked` are all writable without naming the domain and are therefore platform-side; only `domain_mask` and `horseshoe_mask` (which Gs make a `Domain`, the TUI fence) are MedCare's. What stays genuinely open is narrower: **where ndarray-backed mask algebra can live**, given `lance-graph-planner` is BBB-forbidden in a customer binary and `lance-graph-contract` is zero-dep — a contract feature-gate, or a BBB-allowed crate between them. See `E-LANCE-GRAPH-OWNS-THE-AGNOSTIC-THINKING-CONSUMERS-BIND-DOMAIN-1`. | temporal 09 Stage 2; CLAUDE.md litmus (method on carrier) |
 | F6 | **Cycle = Lance version.** ~~`cycle = dataset.version() + 1` at seal time~~ — the identity is right and the AGENT was wrong: `sealed_version = base_version + 1` is a **verified identity inside `LanceCycleWriter`** (`graph::cycle_sink`, #911), not something a consumer computes by opening the dataset. A caller that reads a version and then appends has written a TOCTOU: Lance's `Append` rebases even on a single attempt (measured, `lance-9.0.0/src/io/commit.rs`), so a read-then-write "refuse, don't renumber" guard cannot do what it claims. Idempotency is durable instead — `(cycle, batch_hash)` in the same commit, reconcile FIRST. `SHADOW_CYCLE = 1` stays for the byte-identical debug view. | operator "sealed batch per cycle"; #911/#912 Phase A; temporal 06 |
 | F7 | **Explicit mask ABI traversal, never VSA.** Nothing here bundles; `I-VSA-IDENTITIES`' niche is untouched. | alpha-overlay plan §3k (operator, 2026-08-21) |
 | F8 | **DataFusion is not extended.** Step 5 (containment: `with_row_id`/`with_row_addr` OFF + a test) comes AFTER the tenant masks exist, or the flags are the only identity the consumer has. | IDEAS 2026-09-07 containment card; grace-period ruling |