fix: #25 P2 canonical-identity keying + docstring back-refs + F-1 attestation

[AdaWorldAPI]

Summary

Bundles three small thematically-related changes per the runtime-session bundling guidance:

1. feat: ogar-knowable-from — trait-mediated §10.3 producer seam (ADR-010 OGAR-side close) #25 P2 fix — register_class_knowable_from now takes an OGIT-prefixed canonical identity explicitly (closes the Codex P2 from PR feat: ogar-knowable-from — trait-mediated §10.3 producer seam (ADR-010 OGAR-side close) #25).
2. Docstring back-references — cites the cross-session triangulation receipts (bardioc feat: ogar-adapter-surrealql — emit wired, parse stub, knowable_from seam #18 + lance-graph #470).
3. F-1 OGAR-side attestation — adds §3.3 to HEALTHCARE-TRANSCODING.md citing MedCare-rs's column_mask_bridge.rs as the production instance reference, with symbol+line citations (per other-session nudge for refactor-resilience).

1. #25 P2 — canonical-identity keying

The bug (from Codex P2 on PR #25): register_class_knowable_from(class, store) keyed by bare class.name. Two producers emitting a class with the same unqualified name under different OGIT prefixes (ogit-op/WorkPackage vs ogit-erp/WorkPackage) collide → wrong knowable_from stamp on join.

The fix — new signature:

pub fn register_class_knowable_from<S: KnowableFromStore>(
    class: &Class,
    class_identity: &str,    // NEW — OGIT-prefixed canonical identity
    store: &S,
) -> Result<u64, KnowableFromError>

Caller constructs via ogar_ontology::class_identity(prefix, &class.name) or inline format!("{prefix}/{}", class.name). Both class.name and class_identity validated non-empty.

Canonical-form invariant (also documented in the function docstring): the function does NOT canonicalize. Caller's responsibility to use one consistent canonicalization pipeline — Ogit-Op/WorkPackage and ogit-op/WorkPackage would register under separate keys.

Tests (9 total in the crate, all passing):

• New: same_class_name_under_different_prefixes_does_not_collide — pins the Codex P2 motivating case.
• New: register_empty_class_identity_rejects_without_storing — covers the new validation.
• Updated: existing 6 tests now pass explicit class_identity strings demonstrating the prefix pattern (ogit-erp/Account, ogit-op/WorkPackage, etc.).

2. Docstring back-references

The function's docstring now cites the cross-session triangulation surface (lifted from ADR-022 reception receipts):

The prefix-radix shape of class_identity (ogit-erp/sale.order/…) matches the runtime-side trie-append surface named in bardioc PR #18 / lance-graph PR #470: "Rubicon's LanceMembrane::commit_event keyed on inv.object_instance becomes a trie append; standing-wave reads at v_ref = traverse_subtree(prefix, v_ref)." The OGAR-side registry shape is the producer mirror of that consumer surface.

3. F-1 attestation in HEALTHCARE-TRANSCODING.md §3

New §3.3 Production-instance reference: MedCare-rs's column_mask_bridge. Cites by symbol+line:

MedCare-rs symbol	Role
redaction_mode_for(reason: SensitivityReason) -> RedactionMode (line 128)	Reason-to-transform mapping
column_mask_policy_for_table(table: &str) -> Option<ColumnMaskPolicy> (line 165)	Per-table dispatch
build_medcare_column_mask_registry() -> ColumnMaskRegistry (line 192)	Registry wiring
RedactionMode::{Hash, Constant, Null, Truncate(n)}	Production-richness delta

Frames the §3.1 palette256/Hamming-popcount as the fast-path inner gate and MedCare's RedactionMode as the plan-rewrite transform layer — the two compose in the DataFusion query path. Closes the F-1 attestation loop from MedCare PR #162; matches the precedent ODOO-TRANSCODING.md sets for Woa-rs.

Verification

• cargo check --workspace --all-targets — clean
• cargo test --workspace — 82/82 passing (80 prior + 2 net-new in ogar-knowable-from)
• PII abort-guard scan (case-insensitive, word-boundary matching on the German PII token set) — CLEAN on both changed files.

Notes on the abort-guard improvement

The pre-push abort-guard now uses word-boundary matching (\bDiagnose\b) rather than substring matching — Diagnose (German singular PII label) is still blocked, but English diagnoses (plural of "diagnosis", used in §1's FHIR Condition mapping) is correctly allowed. This makes the guard production-ready for the OGAR public docs.

Compatibility

• Caller-facing: register_class_knowable_from signature changed (new class_identity: &str arg). No production callers outside the crate today — the change is contained.
• Architectural: aligns the OGAR-side identity surface with the runtime-side trie-append pattern (bardioc feat: ogar-adapter-surrealql — emit wired, parse stub, knowable_from seam #18 / lance-graph #470 / ADR-022 receipts). Same NiblePath, same VART reference backend.

https://claude.ai/code/session_01PBTGaPCSnnt6u3pjXpbLwY