plan: mask-membrane-valhalla-integration-v1 (the layered consolidation) - #47

The PR #44->#46 arc's rulings synthesized into one wave plan under the
operator's layer model: masking underneath (hop = MASK x CLASSVIEW ->
MASK as the execution currency), Panama the membrane (shape/meaning/
operations cross, ownership does not), Valhalla cheap addresses
(describe the one substrate, never become a second one), everything
else underneath (placement, publication, worker topology, sealed
horizon -- substrate-private).

Seven frozen decisions cited (F1-F7) so no wave can re-litigate them,
including the measured F7 ground truth: compute parallelizes 3.27x but
the convergence tail is ~90% of a 64K cycle, so the write seam stays
blocked with GridLake and carries no D-id.

Waves ordered safety-first: W0 mechanical fences for the council-
corrected doctrine (each proven able to fire); W1 close the membrane's
two named gaps (epoch re-check, minors 2-4 lazy holders); W2 finish
the mask layer (fused single-plane pass, sweeps over facet-major);
W3 Valhalla promotions on measured evidence only; W4.1 temporal read
binding via the contract's clean vocabulary. Falsification conditions
for the ordering itself are pre-registered in the plan.

Board hygiene same-commit: INTEGRATION_PLANS prepend, STATUS_BOARD
D-LGJ-MMV-0..4 rows.

1. The measured range now includes its slowest arm: 3.8-5.9x (3.8
   all-rows / 4.7 classid / 5.9 hop2) -- stating 4.7-5.9x silently
   excluded the all-rows measurement, against the plan's own
   measure-then-pin premise.
2. W1.1's overhead gate now targets the cached-descriptor accessors
   THEMSELVES (classidAt/payload accessors via lane(), Mask's cached
   words) -- the banked hop/columnar benches run entirely through
   native operations and are structurally blind to per-access epoch
   overhead; they stay only as a regression backstop.
3. The D-LGJ-MMV-1a status row now names BOTH accepted outcomes
   (wire the check, or the falsifier-backed unreachability proof) so
   the documented fallback can truthfully complete the row.

1. The W1.1 Phase-0 council spec is now COMMITTED
   (.claude/plans/epoch-recheck-phase0-v1.md) instead of "written
   in-session" -- a spec that exists only in a transcript is not a spec.
2. The epoch-only fallback export is declared a full ABI citizen: its
   own minor bump, manifest + abi.md entry, requireMinor at the call
   site, and an old-library rejection leg -- or the fallback recreates
   the missing-symbol failure class W1 exists to remove.
3. W1.2 now states the structural invariant (requireMinor BEFORE the
   first lazy-holder reference) and requires one independent negative
   probe per minor -- the existing minor-4 gate rides Mask.minus and
   cannot discriminate alone; an unprobed minor may not be claimed.
4. The W1-completion "unconditional" paragraph is scoped to resolution
   (a); under fallback (b) the issue closes DOWNGRADED-DOCUMENTED, the
   scope-note stays live, and no unconditional claim is made.
5. The W1/W2 flip condition gets reproducible units: same 65,536-row
   fixture, ns/accessor-call over >=1M calls median-of-5, threshold 2x
   accessor baseline; W2 proceeds on its own native paths regardless,
   but nothing reading through a cached descriptor ships an
   unconditional-safety claim while W1.1 is unresolved.

Plus the MD040 language tag on the layer diagram fence.

CodeRabbit's Major on the epoch re-check design, verified real and
absorbed as a council constraint rather than deferred: the epoch fetch
and the cached LaneWindow/words read are two steps, so a cross-thread
close (or same-slot reuse) between them defeats the check. Two honest
frames recorded with it: the race is PRE-EXISTING (the closed-boolean
guard carries the identical window — the re-check neither introduces
nor widens it), and it is cross-thread-only (unreachable within one
thread). The Phase-0 spec now requires the council to choose, as an
explicit output: (i) serialize/lease covering both steps + a mandatory
interleaving falsifier, or (ii) a written scoped contract with doctrine
wording matching that scope — never (ii)'s semantics under (i)'s
wording, the exact overclaim class PR #46 corrected. Savant #1's
question set upgraded accordingly; W1.1 in the integration plan mirrors
the constraint and scopes what 'resolved' means to the chosen arm.