From 06c99fa352b71c1bf7ef94b562df72999b22c464 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 5 Sep 2026 07:50:50 +0000 Subject: [PATCH 1/4] membrane-tiers: regrade ledger L1 CLOSED, L2 CLOSED-BY-EXISTING-GATE MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Append-only regrade in place, dated 2026-09-05, of the two T2->T3 rows the mechanical fence could not see (int classid vs int facet are the same type). L1 CLOSED — WideFieldMask.ofFacets(int...) demoted to package-private in lance-graph-java (claude/membrane-l1-l2-semantic-leaks). Zero production callers. The name-side replacement needed no ABI: hop(classid, src) with native edge_participation narrowing already was it. Pinned by name in ApiSurfaceTest. L2 CLOSED-BY-EXISTING-GATE — the row overstated it. abi.md:312: "Java's public API never sees an address." The offset+stride carrier (Engine.LaneWindow) is internal.ffm, fenced from every public signature by ApiSurfaceTest's internal.* prefix; RowStore reads the stride FROM the served descriptor (NAMED, not GEOMETRY-LEAK). Structural pin added. The residual is a design ceiling, not a leak: layout-aware Valhalla views should be OGAR-emitted per ClassView (Tier 3), not hand-carved in the lab — a future wave. The ledger's own honesty clause worked as intended: a row written before the gate was read was corrected by reading the gate, not by adding machinery. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_016WkNBjHc2e3zuyz9i8qJEv --- .claude/knowledge/membrane-tiers.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.claude/knowledge/membrane-tiers.md b/.claude/knowledge/membrane-tiers.md index b4e1be668..e4e8ec0ac 100644 --- a/.claude/knowledge/membrane-tiers.md +++ b/.claude/knowledge/membrane-tiers.md @@ -92,8 +92,8 @@ reject the old spelling once closed. `[OPEN]` until the gate rejects it. | # | Leak (T1/T0 vocab in a T3 surface) | Replace with (T2 name) | Gate | Status | |---|---|---|---|---| -| L1 | `WideFieldMask.ofFacets(int... positions)` — slot indices cross | `classid` + `ClassView`-resolved field NAME; or a named `Reading` (RAILS/SPO) the ClassView selects | bbb-warden (semantic; reflection can't) | **[OPEN]** | -| L2 | 97 served `LgjLaneDesc` lanes — offset+stride cross to Java | field NAME; T2/`ClassView` owns geometry, Java never receives it to be "blind" about | bbb-warden | **[OPEN]** | +| L1 | `WideFieldMask.ofFacets(int... positions)` — slot indices cross | `classid` + `ClassView`-resolved field NAME; or a named `Reading` (RAILS/SPO) the ClassView selects | bbb-warden (semantic; reflection can't) + ApiSurfaceTest name-pin | **CLOSED 2026-09-05** — demoted to package-private (lance-graph-java `claude/membrane-l1-l2-semantic-leaks`). Zero production callers. Name-side replacement needed no ABI: `hop(classid, src)` + native `edge_participation` narrowing already was it. Pinned by name in `ApiSurfaceTest`. | +| L2 | 97 served `LgjLaneDesc` lanes — offset+stride cross to Java | field NAME; T2/`ClassView` owns geometry, Java never receives it to be "blind" about | ApiSurfaceTest `internal.*` prefix (already) | **CLOSED-BY-EXISTING-GATE 2026-09-05 — regraded; the row overstated it.** `abi.md:312`: "Java's *public* API never sees an address." The carrier (`Engine.LaneWindow`) is `internal.ffm`, fenced from every public signature by the prefix; used only inside `RowStore`/`Mask` (which READ the stride from the served descriptor, `abi.md:367` — NAMED, not GEOMETRY-LEAK) and the sanctioned lab consumers. Structural pin added (class exists AND is under a FORBIDDEN prefix). Residual is a design ceiling, not a leak: layout-aware Valhalla views should be OGAR-emitted per ClassView (Tier 3), not hand-carved in the lab — a future wave. | | L3 | `RowStore.classidAt / payloadLow64At / payloadHi32At` — per-row byte reads | fenced as inspection-only (javadoc line present); execution must not use them | ApiSurfaceTest note + bbb-warden | PARTIAL (fenced, not removed) | | L4 | `FacetMatchView.matchesOf(row) -> int` — raw facet bitset | `WideFieldMask.ofMatchBits` bridges it; callers take the typed value | bbb-warden | PARTIAL | | L5 | `Engine.LaneWindow.setU64` — raw word write | `importRows` (named breach) is the only sanctioned writer | ApiSurfaceTest (internal.ffm already fenced from public) | CLOSED | From c7760125bebbc6f9bf96da83b453bb6b1c616284 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 5 Sep 2026 07:58:07 +0000 Subject: [PATCH 2/4] membrane-tiers: attribute the L1/L2 pins to lance-graph-java#75, not this ledger PR MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodeRabbit (#1175 review, line 96): 'Structural pin added' misattributed the ApiSurfaceTest pin to this markdown-only PR. The pin is real and new, but it lives in the paired code PR, lance-graph-java#75 — cite it on both rows. Its suggested 'Existing structural pin' would have been wrong the other way. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_016WkNBjHc2e3zuyz9i8qJEv --- .claude/knowledge/membrane-tiers.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.claude/knowledge/membrane-tiers.md b/.claude/knowledge/membrane-tiers.md index e4e8ec0ac..369ecc617 100644 --- a/.claude/knowledge/membrane-tiers.md +++ b/.claude/knowledge/membrane-tiers.md @@ -92,8 +92,8 @@ reject the old spelling once closed. `[OPEN]` until the gate rejects it. | # | Leak (T1/T0 vocab in a T3 surface) | Replace with (T2 name) | Gate | Status | |---|---|---|---|---| -| L1 | `WideFieldMask.ofFacets(int... positions)` — slot indices cross | `classid` + `ClassView`-resolved field NAME; or a named `Reading` (RAILS/SPO) the ClassView selects | bbb-warden (semantic; reflection can't) + ApiSurfaceTest name-pin | **CLOSED 2026-09-05** — demoted to package-private (lance-graph-java `claude/membrane-l1-l2-semantic-leaks`). Zero production callers. Name-side replacement needed no ABI: `hop(classid, src)` + native `edge_participation` narrowing already was it. Pinned by name in `ApiSurfaceTest`. | -| L2 | 97 served `LgjLaneDesc` lanes — offset+stride cross to Java | field NAME; T2/`ClassView` owns geometry, Java never receives it to be "blind" about | ApiSurfaceTest `internal.*` prefix (already) | **CLOSED-BY-EXISTING-GATE 2026-09-05 — regraded; the row overstated it.** `abi.md:312`: "Java's *public* API never sees an address." The carrier (`Engine.LaneWindow`) is `internal.ffm`, fenced from every public signature by the prefix; used only inside `RowStore`/`Mask` (which READ the stride from the served descriptor, `abi.md:367` — NAMED, not GEOMETRY-LEAK) and the sanctioned lab consumers. Structural pin added (class exists AND is under a FORBIDDEN prefix). Residual is a design ceiling, not a leak: layout-aware Valhalla views should be OGAR-emitted per ClassView (Tier 3), not hand-carved in the lab — a future wave. | +| L1 | `WideFieldMask.ofFacets(int... positions)` — slot indices cross | `classid` + `ClassView`-resolved field NAME; or a named `Reading` (RAILS/SPO) the ClassView selects | bbb-warden (semantic; reflection can't) + ApiSurfaceTest name-pin | **CLOSED 2026-09-05** — demoted to package-private (lance-graph-java `claude/membrane-l1-l2-semantic-leaks`). Zero production callers. Name-side replacement needed no ABI: `hop(classid, src)` + native `edge_participation` narrowing already was it. Pinned by name in `ApiSurfaceTest` (added in lance-graph-java#75, the paired code PR). | +| L2 | 97 served `LgjLaneDesc` lanes — offset+stride cross to Java | field NAME; T2/`ClassView` owns geometry, Java never receives it to be "blind" about | ApiSurfaceTest `internal.*` prefix (already) | **CLOSED-BY-EXISTING-GATE 2026-09-05 — regraded; the row overstated it.** `abi.md:312`: "Java's *public* API never sees an address." The carrier (`Engine.LaneWindow`) is `internal.ffm`, fenced from every public signature by the prefix; used only inside `RowStore`/`Mask` (which READ the stride from the served descriptor, `abi.md:367` — NAMED, not GEOMETRY-LEAK) and the sanctioned lab consumers. Structural pin added in lance-graph-java#75, the paired code PR (class exists AND is under a FORBIDDEN prefix) — this ledger row records it, it does not add it. Residual is a design ceiling, not a leak: layout-aware Valhalla views should be OGAR-emitted per ClassView (Tier 3), not hand-carved in the lab — a future wave. | | L3 | `RowStore.classidAt / payloadLow64At / payloadHi32At` — per-row byte reads | fenced as inspection-only (javadoc line present); execution must not use them | ApiSurfaceTest note + bbb-warden | PARTIAL (fenced, not removed) | | L4 | `FacetMatchView.matchesOf(row) -> int` — raw facet bitset | `WideFieldMask.ofMatchBits` bridges it; callers take the typed value | bbb-warden | PARTIAL | | L5 | `Engine.LaneWindow.setU64` — raw word write | `importRows` (named breach) is the only sanctioned writer | ApiSurfaceTest (internal.ffm already fenced from public) | CLOSED | From 80ec6561d94d79d46ed3ce3738d0bc3d761beccd Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 5 Sep 2026 08:03:34 +0000 Subject: [PATCH 3/4] membrane-tiers: L1 closes by SHAPE (final class, private ctor), not by demoting one factory Codex + CodeRabbit P2 on lance-graph-java#75: a public record's canonical ctor and ofMatchBits(int) were still public bits-in paths, so demoting ofFacets alone did not fence L1. #75 now makes WideFieldMask a final class with a private ctor and both bit-level factories package-private; the ApiSurfaceTest pin is on the shape (no public ctor, not a record, every public factory zero-arg). This row records that. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_016WkNBjHc2e3zuyz9i8qJEv --- .claude/knowledge/membrane-tiers.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.claude/knowledge/membrane-tiers.md b/.claude/knowledge/membrane-tiers.md index 369ecc617..df42594a3 100644 --- a/.claude/knowledge/membrane-tiers.md +++ b/.claude/knowledge/membrane-tiers.md @@ -92,7 +92,7 @@ reject the old spelling once closed. `[OPEN]` until the gate rejects it. | # | Leak (T1/T0 vocab in a T3 surface) | Replace with (T2 name) | Gate | Status | |---|---|---|---|---| -| L1 | `WideFieldMask.ofFacets(int... positions)` — slot indices cross | `classid` + `ClassView`-resolved field NAME; or a named `Reading` (RAILS/SPO) the ClassView selects | bbb-warden (semantic; reflection can't) + ApiSurfaceTest name-pin | **CLOSED 2026-09-05** — demoted to package-private (lance-graph-java `claude/membrane-l1-l2-semantic-leaks`). Zero production callers. Name-side replacement needed no ABI: `hop(classid, src)` + native `edge_participation` narrowing already was it. Pinned by name in `ApiSurfaceTest` (added in lance-graph-java#75, the paired code PR). | +| L1 | `WideFieldMask.ofFacets(int... positions)` — slot indices cross | `classid` + `ClassView`-resolved field NAME; or a named `Reading` (RAILS/SPO) the ClassView selects | bbb-warden (semantic; reflection can't) + ApiSurfaceTest name-pin | **CLOSED 2026-09-05** — `WideFieldMask` is a `final class` with a private ctor; `ofFacets` AND `ofMatchBits` package-private (lance-graph-java#75). Demoting one factory was not a fence — a public record's canonical ctor took the raw bits (codex + coderabbit P2, fixed same PR). Zero production callers. Pin is on the SHAPE: no public ctor, not a record, every public factory zero-arg. Name-side replacement needed no ABI: `hop(classid, src)` + native `edge_participation` narrowing already was it. Pinned by name in `ApiSurfaceTest` (added in lance-graph-java#75, the paired code PR). | | L2 | 97 served `LgjLaneDesc` lanes — offset+stride cross to Java | field NAME; T2/`ClassView` owns geometry, Java never receives it to be "blind" about | ApiSurfaceTest `internal.*` prefix (already) | **CLOSED-BY-EXISTING-GATE 2026-09-05 — regraded; the row overstated it.** `abi.md:312`: "Java's *public* API never sees an address." The carrier (`Engine.LaneWindow`) is `internal.ffm`, fenced from every public signature by the prefix; used only inside `RowStore`/`Mask` (which READ the stride from the served descriptor, `abi.md:367` — NAMED, not GEOMETRY-LEAK) and the sanctioned lab consumers. Structural pin added in lance-graph-java#75, the paired code PR (class exists AND is under a FORBIDDEN prefix) — this ledger row records it, it does not add it. Residual is a design ceiling, not a leak: layout-aware Valhalla views should be OGAR-emitted per ClassView (Tier 3), not hand-carved in the lab — a future wave. | | L3 | `RowStore.classidAt / payloadLow64At / payloadHi32At` — per-row byte reads | fenced as inspection-only (javadoc line present); execution must not use them | ApiSurfaceTest note + bbb-warden | PARTIAL (fenced, not removed) | | L4 | `FacetMatchView.matchesOf(row) -> int` — raw facet bitset | `WideFieldMask.ofMatchBits` bridges it; callers take the typed value | bbb-warden | PARTIAL | From 736706d64a81261f5b4d4c511c5a49c6fc251150 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 5 Sep 2026 08:27:18 +0000 Subject: [PATCH 4/4] membrane-tiers: scope the ledger to lance-graph-java; carve out the contract's Rust field masks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Operator question on #1175: did the L1 row demote WideFieldMask.ofFacets for ALL consumers? No — only lance-graph-java's Java MIRROR changed. But the ledger did not say so: its "T2->T3 leaks" header was unscoped and the L1 row named `WideFieldMask.ofFacets` bare, so a Rust consumer inheriting this doc could read it as "positional field-mask construction is a leak; demote it". That reading would be wrong and harmful. The contract's Rust `class_view::{FieldMask, WideFieldMask}` — `with(u8)`, `from_positions(&[u8])`, EMPTY/FULL — are public, positional, and stay that way: they are the selection tier's own vocabulary, used by T2 code across the tree (planner style_strategy/meta_basin, ontology class_resolver/wikidata_hhtl, sigma-tier-router, the probes). T2 owns geometry; building a field mask by position at T2 is the design. A positional constructor is a leak ONLY on a T3 surface, where a slot index crosses into a consumer-facing facade — L1's Java mirror case, and nothing else. Added: an explicit scope paragraph under the ledger header (this ledger is lance-graph-java's; each consumer keeps its own), the contract carve-out, the L1 subject named as the Java mirror, and one doctrine line: a type's tier is decided by who consumes it, not by its shape. Additions only. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_016WkNBjHc2e3zuyz9i8qJEv --- .claude/knowledge/membrane-tiers.md | 31 ++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) diff --git a/.claude/knowledge/membrane-tiers.md b/.claude/knowledge/membrane-tiers.md index df42594a3..a567965a0 100644 --- a/.claude/knowledge/membrane-tiers.md +++ b/.claude/knowledge/membrane-tiers.md @@ -28,6 +28,13 @@ substrate beneath them is T0. NAME `where`, T2 owns the descriptor, T1 owns the mask op, T0 owns the bytes. The same word lives at every tier and means one thing at each. +**A type's tier is decided by who consumes it, not by its shape.** The +contract's `WideFieldMask`/`FieldMask` (positional, public) are T2 objects +when T2 code — planner, ontology, routers — builds them; a Java mirror that +re-exposes the same positional construction to an end consumer has moved it +to T3, and THAT is the leak. Fencing the mirror never implies fencing the +contract type. + ## The polyfill is the worked instance ndarray's `simd.rs` (T1 membrane) → `simd_ops.rs` (staging) → `simd_{arch}.rs` @@ -87,12 +94,34 @@ ruling stopped. ## ENTROPY LEDGER — T2→T3 leaks (append-only; close downward) +**Scope (made explicit 2026-09-05, operator question on #1175).** This +ledger is **lance-graph-java's** — its T3 is the Java facade +(`com.adaworldapi.lancegraph.*`), and every row below names a *Java mirror* +type on that facade. Each consumer keeps its own T2→T3 ledger; this one is +NOT a prescription for any other consumer's surface. + +**Carve-out — the contract's Rust field masks are T2, not a leak.** +`lance_graph_contract::class_view::{FieldMask, WideFieldMask}` — with +`with(u8)`, `from_positions(&[u8])`, `EMPTY`/`FULL` — are **public, +positional, and stay that way**. They are the selection tier's own +vocabulary and are used by T2 code throughout the tree (planner +`style_strategy`/`meta_basin`, ontology `class_resolver`/`wikidata_hhtl`, +`sigma-tier-router`, the probes). **T2 owns geometry; constructing a field +mask by position at T2 is the design.** A positional constructor is a leak +ONLY when it sits on a **T3** surface — a consumer-facing facade or +low-code layer — so that a slot index crosses *into* T3 from an end +consumer. L1 below is that case (the Java mirror re-exposed slot +construction to Java consumers); it says nothing about the Rust type it +mirrors, which was not changed and must not be "demoted" on the strength +of this row. Which tier a type belongs to is decided by WHO CONSUMES IT, +not by its shape. + Each row: the leak, the T2 name that replaces it, and the gate that will reject the old spelling once closed. `[OPEN]` until the gate rejects it. | # | Leak (T1/T0 vocab in a T3 surface) | Replace with (T2 name) | Gate | Status | |---|---|---|---|---| -| L1 | `WideFieldMask.ofFacets(int... positions)` — slot indices cross | `classid` + `ClassView`-resolved field NAME; or a named `Reading` (RAILS/SPO) the ClassView selects | bbb-warden (semantic; reflection can't) + ApiSurfaceTest name-pin | **CLOSED 2026-09-05** — `WideFieldMask` is a `final class` with a private ctor; `ofFacets` AND `ofMatchBits` package-private (lance-graph-java#75). Demoting one factory was not a fence — a public record's canonical ctor took the raw bits (codex + coderabbit P2, fixed same PR). Zero production callers. Pin is on the SHAPE: no public ctor, not a record, every public factory zero-arg. Name-side replacement needed no ABI: `hop(classid, src)` + native `edge_participation` narrowing already was it. Pinned by name in `ApiSurfaceTest` (added in lance-graph-java#75, the paired code PR). | +| L1 | lance-graph-java **Java mirror** `WideFieldMask.ofFacets(int... positions)` — slot indices cross into the Java facade (NOT the contract's Rust `WideFieldMask`, which is T2 and unchanged) | `classid` + `ClassView`-resolved field NAME; or a named `Reading` (RAILS/SPO) the ClassView selects | bbb-warden (semantic; reflection can't) + ApiSurfaceTest name-pin | **CLOSED 2026-09-05** — `WideFieldMask` is a `final class` with a private ctor; `ofFacets` AND `ofMatchBits` package-private (lance-graph-java#75). Demoting one factory was not a fence — a public record's canonical ctor took the raw bits (codex + coderabbit P2, fixed same PR). Zero production callers. Pin is on the SHAPE: no public ctor, not a record, every public factory zero-arg. Name-side replacement needed no ABI: `hop(classid, src)` + native `edge_participation` narrowing already was it. Pinned by name in `ApiSurfaceTest` (added in lance-graph-java#75, the paired code PR). | | L2 | 97 served `LgjLaneDesc` lanes — offset+stride cross to Java | field NAME; T2/`ClassView` owns geometry, Java never receives it to be "blind" about | ApiSurfaceTest `internal.*` prefix (already) | **CLOSED-BY-EXISTING-GATE 2026-09-05 — regraded; the row overstated it.** `abi.md:312`: "Java's *public* API never sees an address." The carrier (`Engine.LaneWindow`) is `internal.ffm`, fenced from every public signature by the prefix; used only inside `RowStore`/`Mask` (which READ the stride from the served descriptor, `abi.md:367` — NAMED, not GEOMETRY-LEAK) and the sanctioned lab consumers. Structural pin added in lance-graph-java#75, the paired code PR (class exists AND is under a FORBIDDEN prefix) — this ledger row records it, it does not add it. Residual is a design ceiling, not a leak: layout-aware Valhalla views should be OGAR-emitted per ClassView (Tier 3), not hand-carved in the lab — a future wave. | | L3 | `RowStore.classidAt / payloadLow64At / payloadHi32At` — per-row byte reads | fenced as inspection-only (javadoc line present); execution must not use them | ApiSurfaceTest note + bbb-warden | PARTIAL (fenced, not removed) | | L4 | `FacetMatchView.matchesOf(row) -> int` — raw facet bitset | `WideFieldMask.ofMatchBits` bridges it; callers take the typed value | bbb-warden | PARTIAL |