D-MCAL-6: build the consumers against the arc, don't grep them

.claude/board/INTEGRATION_PLANS.md

@@ -1,5 +1,24 @@
-## 2026-08-27 — LANDED (D-MCAL-4): domain evidence routes the phase DAG without MUL ground, `crates/lance-graph-contract/src/kanban.rs`
-
+## 2026-08-27 — GATE RUN (D-MCAL-6): the arc built against its real consumers, `.claude/plans/mul-consumer-build-gate-v1.md`
+
+Discharges the second half of F-MUL-6, the half a grep cannot reach. ada-rs was
+compiled against the combined arc head (#1065 merged + #1066 + #1067 + #1068 +
+#1069) via a temporary `paths` override — and the override was VERIFIED to bind
+rather than assumed, by compiling a probe that calls `KanbanColumn::veto()`, a
+method that exists only on the head under test. Without that check the gate
+could have passed against `main` and reported nothing. Result: ada-rs does not
+compile, with exactly three errors, and all three are the pre-existing #1045
+`reason:` break that predates every deliverable in this arc. Zero errors are
+attributable to the arc: the `PlannerContract::gate_check` removal touches
+nothing ada-rs implements, the `MulProvider::gate_check` deprecation is a
+warning by construction, and D-MCAL-4's two methods are additive. So the arc is
+source-compatible with its one live external implementor. The stopgap stays
+unpushed per the §6 invariant — supplying a texture and a flow ada-rs never
+measured would reproduce the exact defect the census found in MedCare-rs; the
+honest fix is D-MCAL-4's `veto()` route, which now exists. MedCare-rs is covered
+at symbol level plus in-tree pins rather than by a compile, and that asymmetry
+is stated as a LIMITATION in §3 rather than reported as a pass. §5 records what
+the gate does not certify, including the 15 other dependent repos whose
+non-involvement rests on a grep.
 Discharges F-MUL-1 and F-MUL-2. Two methods, no type: `KanbanColumn::advance()`
 (forward successor) and `KanbanColumn::veto()` (Prune iff legal — the Libet
 free-won't edge). `advance_on_gate` now delegates to both, so one copy of the
@@ -23,6 +42,65 @@ equivalence so the wrappers cannot drift from the DAG walk they wrap. Each case
 the fabricating route it replaces, which is F-MUL-5's premise (removing the
 fabrication costs no behaviour), and exercises advance/stay/veto from one domain
 axis so no arm can pass by accident.
+## 2026-08-27 — DECIDED + LANDED (D-MCAL-2): the two gate-returning trait methods, `crates/lance-graph-contract/src/{mul,plan}.rs`
+
+Fate decided on the D-MCAL-1 census, not on argument. `PlannerContract::gate_check`
+is REMOVED: zero implementors org-wide, zero callers, and invalid at three
+points (returns the execution-gate type; takes `SituationInput` so a planner
+trait performed a MUL assessment; could not express the planner's own
+Proceed/Sandbox/Compass shape). The two in-tree `.gate_check(` call sites bind
+the planner's INHERENT method returning `Gate` and are untouched — the removal
+is source-breaking in principle and provably inert in practice.
+`MulProvider::gate_check` is DEPRECATED rather than removed: it has one
+external implementor (ada-rs), so removal waits for D-MCAL-4 to express the
+domain fact as a domain fact and D-MCAL-6 to build it green. The trait keeps
+`assess` (the legitimate direction: situation in, calibration state out) and
+`compass`. Both stale doc-comments corrected — neither trait was implemented by
+lance-graph-planner, and crewai-rust/n8n-rs were evicted 2026-06-21. F-MUL-5's
+MUL half is discharged by three new falsifiers proving both genuine arms
+(Dunning-Kruger, allostatic depletion) are readable straight off
+`MulAssessment` with no verdict constructed, plus the mandatory can-stay-silent
+twin on a non-degenerate input and an axis-independence check (F-MUL-7's
+premise at the surface D-MCAL-2 keeps).
+## 2026-08-27 — DOC-FIRST + PINNED (D-MCAL-3): the execution gate named for what it is, `crates/lance-graph-contract/src/{mul,kanban}.rs`
+
+`contract::mul::GateDecision` gets a "what this type actually is" section: it
+is the EXECUTION / COMMIT gate, not MUL's output, and it lives in a module
+called `mul` for historical reasons that have been misleading consumers for as
+long as the name has existed. The consumer table is inlined from the D-MCAL-1
+census — kanban phase moves, ActionState, tier-router Rest dispatch, supervisor
+next-column; none routes to a compass, an exploration, or a learn-first path,
+and none reads the calibration payload. The MUL-shaped output the diagram calls
+for already exists as the planner's `MulGateDecision{Proceed, Sandbox, Compass}`.
+NO rename: it would touch four in-tree consumers plus two external repos and
+bury a semantic decision inside a mechanical diff, so the symbol move is its own
+PR, tracked as `ISS-MUL-GATE-NAMED-FOR-THE-WRONG-LAYER` and blocked on D-MCAL-4
++ D-MCAL-6. Three falsifiers pin the behaviour so a future change is a diff, not
+a drift: `Hold` returns None from EVERY column (F-MUL-4's red state — a
+phase-stay with no learning path, OQ-MCAL-2); its anti-vacuity twin proving
+`Flow` does move and does not invent successors the DAG lacks; and a routing
+test proving two `Block`s with DIFFERENT (texture, flow) pairs route identically
+from every column — the naming evidence in executable form.
+## 2026-08-27 — LANDED (D-MCAL-4): domain evidence routes the phase DAG without MUL ground, `crates/lance-graph-contract/src/kanban.rs`
+
+Discharges F-MUL-1 and F-MUL-2. Two methods, no type: `KanbanColumn::advance()`
+(forward successor) and `KanbanColumn::veto()` (Prune iff legal — the Libet
+free-won't edge). `advance_on_gate` now delegates to both, so one copy of the
+DAG rule survives and MUL-holding callers are unaffected. The gap being closed:
+the only prior route into the DAG demanded a TrustTexture AND a FlowState, so a
+domain that measured neither had to invent both — which is exactly what ada-rs
+(consent veto) and medcare-first-thought (evidence contradiction, 4 sites) did.
+Since routing never read those coordinates, naming the transition directly
+loses nothing and fabricates nothing. D-MCAL-5's prohibition is respected: no
+fourth gate enum, because these are transitions named as transitions rather
+than a new verdict vocabulary; "stay put" is `None` and needs no symbol.
+Anti-vacuity satisfied MECHANICALLY rather than by assertion: the falsifier file
+compiled against `main` fails with `no method named veto` / `no method named
+advance`, which is the red state in its strongest form — on main the domain path
+does not exist. Each case additionally proves the domain route is IDENTICAL to
+the fabricating route it replaces, which is F-MUL-5's premise (removing the
+fabrication costs no behaviour), and exercises advance/stay/veto from one domain
+axis so no arm can pass by accident.
 ## 2026-08-27 — DECIDED: NO fourth gate enum, and no promotion either (D-MCAL-5), `crates/lance-graph-contract/src/mul.rs`
 
 The deliverable asked: if a public MUL output is still needed, derive it from
@@ -66,45 +144,6 @@ Explore, Sandbox, Human}` stays not-adopted. Side finding filed as
 String }` still carries the heap-allocating free-text field #1045 removed from
 the contract's gate — same defect, one crate over, and unfixable today because
 its typed successor is the blocked scaffold.
-## 2026-08-27 — DOC-FIRST + PINNED (D-MCAL-3): the execution gate named for what it is, `crates/lance-graph-contract/src/{mul,kanban}.rs`
-
-`contract::mul::GateDecision` gets a "what this type actually is" section: it
-is the EXECUTION / COMMIT gate, not MUL's output, and it lives in a module
-called `mul` for historical reasons that have been misleading consumers for as
-long as the name has existed. The consumer table is inlined from the D-MCAL-1
-census — kanban phase moves, ActionState, tier-router Rest dispatch, supervisor
-next-column; none routes to a compass, an exploration, or a learn-first path,
-and none reads the calibration payload. The MUL-shaped output the diagram calls
-for already exists as the planner's `MulGateDecision{Proceed, Sandbox, Compass}`.
-NO rename: it would touch four in-tree consumers plus two external repos and
-bury a semantic decision inside a mechanical diff, so the symbol move is its own
-PR, tracked as `ISS-MUL-GATE-NAMED-FOR-THE-WRONG-LAYER` and blocked on D-MCAL-4
-+ D-MCAL-6. Three falsifiers pin the behaviour so a future change is a diff, not
-a drift: `Hold` returns None from EVERY column (F-MUL-4's red state — a
-phase-stay with no learning path, OQ-MCAL-2); its anti-vacuity twin proving
-`Flow` does move and does not invent successors the DAG lacks; and a routing
-test proving two `Block`s with DIFFERENT (texture, flow) pairs route identically
-from every column — the naming evidence in executable form.
-## 2026-08-27 — DECIDED + LANDED (D-MCAL-2): the two gate-returning trait methods, `crates/lance-graph-contract/src/{mul,plan}.rs`
-
-Fate decided on the D-MCAL-1 census, not on argument. `PlannerContract::gate_check`
-is REMOVED: zero implementors org-wide, zero callers, and invalid at three
-points (returns the execution-gate type; takes `SituationInput` so a planner
-trait performed a MUL assessment; could not express the planner's own
-Proceed/Sandbox/Compass shape). The two in-tree `.gate_check(` call sites bind
-the planner's INHERENT method returning `Gate` and are untouched — the removal
-is source-breaking in principle and provably inert in practice.
-`MulProvider::gate_check` is DEPRECATED rather than removed: it has one
-external implementor (ada-rs), so removal waits for D-MCAL-4 to express the
-domain fact as a domain fact and D-MCAL-6 to build it green. The trait keeps
-`assess` (the legitimate direction: situation in, calibration state out) and
-`compass`. Both stale doc-comments corrected — neither trait was implemented by
-lance-graph-planner, and crewai-rust/n8n-rs were evicted 2026-06-21. F-MUL-5's
-MUL half is discharged by three new falsifiers proving both genuine arms
-(Dunning-Kruger, allostatic depletion) are readable straight off
-`MulAssessment` with no verdict constructed, plus the mandatory can-stay-silent
-twin on a non-degenerate input and an axis-independence check (F-MUL-7's
-premise at the surface D-MCAL-2 keeps).
 
 ## 2026-08-27 — MEASUREMENT COMPLETE (no code, no type): per-symbol MUL consumer census, `.claude/plans/mul-consumer-census-v1.md`
 

.claude/board/ISSUES.md

@@ -1,35 +1,28 @@
 # Issues Log — Open + Resolved (double-entry, append-only)
 
-## ISS-PLANNER-SANDBOX-STILL-CARRIES-FREE-TEXT (2026-08-27) — OPEN
+## ISS-F-MUL-6-HALF-BUILT (2026-08-27) — OPEN
 
-`lance_graph_planner::mul::gate::MulGateDecision::Sandbox { reason: String }`
-still carries the free-text field that #1045 removed from the contract's gate,
-for the same reasons: it heap-allocates on a decision path, and it stores a
-*rendering* of state that exists in typed form beside it.
+D-MCAL-6 built **one** of two known consumers. ada-rs was compiled against the
+combined arc head (3 errors, all pre-existing #1045, zero from the arc).
+MedCare-rs was **not** built — it is covered by symbol-level reasoning plus the
+in-tree pins, which is exactly what F-MUL-6 says is not a substitute for a
+build.
 
-Found while measuring D-MCAL-5. The defect is one crate over from where it was
-fixed, which is why the earlier sweep missed it.
+The first version of the gate report marked the falsifier *discharged* anyway.
+That contradicted its own §0 criterion, and was corrected on review (#1070):
+the falsifier is **OPEN**.
 
-**The typed successor already exists and is already ruled.** T10
-(`mul-calibration-not-verdict-v1.md`, operator-ruled 2026-08-26):
-
-    Sandbox := Counterfactual + Revision
+**Consequence, and the reason this is an issue rather than a footnote:** the
+contract rename tracked by `ISS-MUL-GATE-NAMED-FOR-THE-WRONG-LAYER` is blocked
+on D-MCAL-6. If this gate is read as passed, the rename unblocks without the
+compatibility proof it is supposed to wait for.
 
-so the arm's payload is not a string describing why a sandbox was chosen — it
-is the counterfactual lane the reasoning was routed into
-(`contract::counterfactual::CounterfactualMailbox`) and the revision verdict
-that lane exits through (`revise_if_minority_wins`).
+**To close:** stand up the MedCare-rs build (`ogar-obo`, `jc`,
+`medcare-cohorts` and the lance stack, all git deps) and compile
+`medcare-first-thought` against the arc head. Expected result is green —
+MedCare touches no symbol the arc changed — but expected is not measured.
 
-**Blocked, and honestly so:** both of those entry points are `todo!()`, blocked
-on D-PERSONA-5 (ractor outer-swarm registration). So this cannot be fixed by
-swapping the field today — the replacement carrier is declared, not built.
-`tests/d_mcal_5_arms_already_public.rs::sandbox_arm_carrier_is_declared_but_not_implemented`
-pins that unimplemented state with `#[should_panic]`, so when D-PERSONA-5 lands
-the pin fails and this issue surfaces again instead of aging quietly.
 
-**Not fixed by minting anything.** D-MCAL-5's prohibition applies here too: the
-fix is to finish the counterfactual scaffold, never to add a gate variant that
-names the sandbox.
 ## ISS-MUL-GATE-NAMED-FOR-THE-WRONG-LAYER (2026-08-27) — OPEN
 
 `contract::mul::GateDecision` is measured (D-MCAL-1) as the **execution /
@@ -59,8 +52,36 @@ builds green). Renaming before those land would break consumers twice.
 what it gates — `contract::execution_gate` or alongside `contract::kanban` —
 with a deprecated re-export at `mul::GateDecision` for one cycle, per
 I-LEGACY-API-FEATURE-GATED's rule that a name must not silently change meaning.
+## ISS-PLANNER-SANDBOX-STILL-CARRIES-FREE-TEXT (2026-08-27) — OPEN
+
+`lance_graph_planner::mul::gate::MulGateDecision::Sandbox { reason: String }`
+still carries the free-text field that #1045 removed from the contract's gate,
+for the same reasons: it heap-allocates on a decision path, and it stores a
+*rendering* of state that exists in typed form beside it.
+
+Found while measuring D-MCAL-5. The defect is one crate over from where it was
+fixed, which is why the earlier sweep missed it.
+
+**The typed successor already exists and is already ruled.** T10
+(`mul-calibration-not-verdict-v1.md`, operator-ruled 2026-08-26):
+
+    Sandbox := Counterfactual + Revision
+
+so the arm's payload is not a string describing why a sandbox was chosen — it
+is the counterfactual lane the reasoning was routed into
+(`contract::counterfactual::CounterfactualMailbox`) and the revision verdict
+that lane exits through (`revise_if_minority_wins`).
 
+**Blocked, and honestly so:** both of those entry points are `todo!()`, blocked
+on D-PERSONA-5 (ractor outer-swarm registration). So this cannot be fixed by
+swapping the field today — the replacement carrier is declared, not built.
+`tests/d_mcal_5_arms_already_public.rs::sandbox_arm_carrier_is_declared_but_not_implemented`
+pins that unimplemented state with `#[should_panic]`, so when D-PERSONA-5 lands
+the pin fails and this issue surfaces again instead of aging quietly.
 
+**Not fixed by minting anything.** D-MCAL-5's prohibition applies here too: the
+fix is to finish the counterfactual scaffold, never to add a gate variant that
+names the sandbox.
 ## ISS-NO-CAUSAL-SIGN-ON-EDGES (2026-08-26) — OPEN
 
 `CausalEdge64` carries **no Inc/Dec polarity**. Measured: `grep -niE

.claude/board/LATEST_STATE.md

@@ -1,3 +1,29 @@
+## 2026-08-27 — D-MCAL-2 (IN PR) — the two gate-returning trait methods
+
+### Current Contract Inventory — CHANGED (one method removed, one deprecated)
+
+| symbol | before | after |
+|---|---|---|
+| `contract::plan::PlannerContract::gate_check` | `fn gate_check(&self, situation: &SituationInput) -> GateDecision` | **REMOVED** |
+| `contract::mul::MulProvider::gate_check` | required method, undocumented direction | **`#[deprecated]`** with migration pointer; still required, removal scheduled after D-MCAL-4/D-MCAL-6 |
+| `contract::mul::MulProvider::{assess, compass}` | unchanged | unchanged — the kept, legitimate direction |
+| `contract::plan::PlannerContract::{plan_full, plan_auto, set_selector, orchestrate}` | unchanged | unchanged |
+
+**Breakage surface, measured before the cut (D-MCAL-1):** `PlannerContract` has
+**zero implementors org-wide** and zero callers. The two in-tree `.gate_check(`
+call sites — `lance-graph-planner/src/api.rs:637` and
+`lance-graph/src/lance_native_planner.rs:61` — bind the planner's **inherent**
+method returning `Gate` (`MulGateDecision{Proceed, Sandbox, Compass}`), not the
+trait, and are untouched. `MulProvider` has exactly one implementor anywhere
+(`ada-rs::contract_impls::AdaMulAdapter`), which is why it is deprecated rather
+than cut: the invariant is that a source-breaking contract change is not
+verified until the known consumer builds (D-MCAL-6).
+
+**Tests:** +3 falsifiers in `mul.rs` discharging F-MUL-5's MUL half — both
+genuine arms (Dunning-Kruger, allostatic depletion) readable off
+`MulAssessment` with no verdict constructed; the mandatory can-stay-silent
+twin on a non-degenerate input; axis independence (F-MUL-7's premise).
+1224 lib tests green, clippy `--all-targets` clean.
 ## 2026-08-27 — D-MCAL-4 (IN PR) — a domain route into the phase DAG
 
 ### Current Contract Inventory — CHANGED (two methods added, no type minted)
@@ -24,6 +50,9 @@ transition directly loses nothing and fabricates nothing.
 ada-rs's shape) and F-MUL-2 (evidence contradiction, MedCare's shape) each
 assert the route is correct, that no `GateDecision` is constructed in the
 domain path, and that the route is IDENTICAL to the fabricating path it
+replaces. Red-first verified mechanically: the same file against `main` fails
+to compile (`no method named veto`), i.e. on `main` there is no route into the
+DAG that does not construct MUL ground.
 replaces. **Red-first claim CORRECTED (codex review, same day):** the earlier text said
 the red state was proved mechanically because the file failed to compile against
 `main`. That was wrong. `next_phases()` is public on `main` and already returns
@@ -35,33 +64,6 @@ coordinates and both measured producers invented them. This is an
 ergonomics-and-naming fix with a measured behavioural consequence, not a new
 capability. `veto_agrees_with_the_pre_existing_next_phases_route` pins the
 equivalence.
-## 2026-08-27 — D-MCAL-2 (IN PR) — the two gate-returning trait methods
-
-### Current Contract Inventory — CHANGED (one method removed, one deprecated)
-
-| symbol | before | after |
-|---|---|---|
-| `contract::plan::PlannerContract::gate_check` | `fn gate_check(&self, situation: &SituationInput) -> GateDecision` | **REMOVED** |
-| `contract::mul::MulProvider::gate_check` | required method, undocumented direction | **`#[deprecated]`** with migration pointer; still required, removal scheduled after D-MCAL-4/D-MCAL-6 |
-| `contract::mul::MulProvider::{assess, compass}` | unchanged | unchanged — the kept, legitimate direction |
-| `contract::plan::PlannerContract::{plan_full, plan_auto, set_selector, orchestrate}` | unchanged | unchanged |
-
-**Breakage surface, measured before the cut (D-MCAL-1):** `PlannerContract` has
-**zero implementors org-wide** and zero callers. The two in-tree `.gate_check(`
-call sites — `lance-graph-planner/src/api.rs:637` and
-`lance-graph/src/lance_native_planner.rs:61` — bind the planner's **inherent**
-method returning `Gate` (`MulGateDecision{Proceed, Sandbox, Compass}`), not the
-trait, and are untouched. `MulProvider` has exactly one implementor anywhere
-(`ada-rs::contract_impls::AdaMulAdapter`), which is why it is deprecated rather
-than cut: the invariant is that a source-breaking contract change is not
-verified until the known consumer builds (D-MCAL-6).
-
-**Tests:** +3 falsifiers in `mul.rs` discharging F-MUL-5's MUL half — both
-genuine arms (Dunning-Kruger, allostatic depletion) readable off
-`MulAssessment` with no verdict constructed; the mandatory can-stay-silent
-twin on a non-degenerate input; axis independence (F-MUL-7's premise).
-1224 lib tests green, clippy `--all-targets` clean.
-
 ## 2026-08-26 — #1059 MERGED (e5f750e) — the Octopus causal-CoT audit (measurement only; NO contract change)
 
 ### Current Contract Inventory — UNCHANGED