diff --git a/.claude/board/EPIPHANIES.md b/.claude/board/EPIPHANIES.md
index 2192e4ad..f84520d6 100644
--- a/.claude/board/EPIPHANIES.md
+++ b/.claude/board/EPIPHANIES.md
@@ -1,3 +1,19 @@
+## 2026-08-03 — E-THE-DEFECTS-LIVE-IN-THE-FALSIFIERS-NOT-THE-MEASUREMENTS-1 — across three consecutive probe PRs, every defect found by review was in a falsifier or a label; none was in a measurement
+
+**Status:** FINDING (observed, not designed). **Confidence:** High as a description of #862/#875/#876 — the three PRs' own review records are the evidence, and each states the pattern locally; what is new here is that the pattern is *consecutive and unbroken*, which only became visible when the three arc entries were written together during the 2026-08-03 backfill. Documentation-only.
+
+**The observation.** Reconstructing the missing arc entries for #862, #875 and #876 in one pass surfaced something none of them shows alone: across **three consecutive probe PRs and roughly a dozen review findings**, the measurements held every time and the machinery meant to be *capable of killing* them did not. #875 states it outright — *"a broken falsifier fails silently — it reports PASS"* — and #876 independently reports "eight defects, every one in a falsifier or a label, none in a measurement." #862's headline was retracted for two construction artifacts while its measurement discipline survived intact.
+
+**Why this is worse than the inverse.** A wrong measurement is loud: it contradicts something. A wrong falsifier is silent — it prints PASS and *looks like validation*. Three instances make the failure mode concrete: (a) **a permutation that isn't one** — #875's W1 shuffle arm was a cell-label bijection, so same-cell pairs survived it and the null scored **+0.645 on cell identity alone** while appearing to validate; (b) **a window too narrow to be real** — #875's W3 credited the anchor's own cell in both arms, capping the achievable ratio at 1.61 against a fire-threshold of 1.5 and a guard at 0.95, an **0.018-wide window** whose original pass was luck; (c) **a threshold that cannot bite** — #876's hand-tuned `flat_rate < 0.25` would have passed at 24.9 % while the prose claimed ≈1/17.
+
+**The compounding shape.** Fixing a falsifier defect twice reproduced it one level up: #876's mislabelled denominator was corrected and the correction repeated the same mislabel against the *population* instead of the *sample* — root cause being a thinning that bought nothing, ultimately **deleted rather than relabelled**. Separately, replacing a hand-tuned threshold with a declared null immediately falsified the author's *first formulation of the null itself*. Making the criterion explicit is what exposed both.
+
+**Consequences (already partly canon).** The workspace's falsifiability rule covers can-it-fire / can-it-stay-silent / inertness; these three PRs add the checks that fire *before* a run: **compute the maximum achievable value of the fire statistic under the silent guard** — a hair-wide window is mis-specified regardless of which side it lands on — and **both halves of a twin gate must measure the same quantity on the same basis**. Add: a null arm must be checked for *invariance leakage* (does the scramble preserve the thing being scored?), and when a sample keeps producing label errors and full enumeration is affordable, delete the sampling (#876 went exhaustive over all 32,640 pairs).
+
+**The CI corollary (#862, arguably the most consequential single item in the three).** `cargo test` **never executes an example's `main()`** — so every `assert!` in these probe examples had only ever run on a developer's local invocation. Until `rust-test.yml` was changed to run the probes explicitly, an entire class of falsifier was **decorative in CI**. A falsifier that never runs is the limit case of a falsifier that cannot fail.
+
+**Scope fence.** This says the *review-found* defects clustered in falsifiers; it does **not** claim the measurements were correct — only that no review round found a defect in one. That is an absence of evidence over three PRs, not proof, and the honest reading is that falsifier code got less scrutiny while being written than the numbers it guarded.
+
 ## 2026-08-02 — E-D-MBX-SPINE-IS-STRAIGHT-TRACK-VERSION-IS-NOT-A-FLEET-STEP-SIGNAL-1 — the D-MBX production ownership map is ratified, and P4's fleet-wide fan-step is corrected to sparse sealed-transition application
 
 **Status:** RATIFIED (operator ruling, 2026-08-02) + CORRECTION of a same-session drift. **Confidence:** High for the ownership map (verified against `Cargo.toml` deps) and the sparse correction (it removes a direct contradiction with `E-COMPLETE-CYCLE-IS-PHYSICALLY-SPARSE-NOT-A-FULL-REWRITE-1`). Documentation-only — no Rust/tests changed. Recorded in `.claude/plans/cycle-loop-closure-driver-v1.md` §3, §9–§11.
diff --git a/.claude/board/PR_ARC_INVENTORY.md b/.claude/board/PR_ARC_INVENTORY.md
index 51025721..9f62c7b7 100644
--- a/.claude/board/PR_ARC_INVENTORY.md
+++ b/.claude/board/PR_ARC_INVENTORY.md
@@ -44,6 +44,12 @@
 > this entry drove #875/#876 itself and wrote no entry at the time; naming that
 > is the point. Reconstruction (forensic method: merged diffs + commit messages
 > + PR bodies + the review record, never inference) is queued, not done.
+>
+> **⊘ Correction (2026-08-03, same session):** "queued, not done" held for about
+> an hour. The operator ruled the backfill belongs to **this** session — the one
+> still holding the context — rather than to a later forensic pass, and the four
+> entries now sit directly below this one, each marked RECONSTRUCTED with its
+> sources. The gap is closed, not merely recorded.
 
 **Merged:** `6bc9115` (branch `claude/x265-x266-plans-review-h9osnl`, commits `1c0959e`..`02413ef`). 3 commits, 8 files, +356/−21. Plan + board + doc-comments only; no behavioural code change.
 
@@ -58,6 +64,65 @@
 - **Docs** — the plan; the four module headers; board files per the mandatory hygiene rule.
 - **Confidence (2026-08-03):** working as a *plan* — no code paths changed, so nothing here can regress behaviour. Its central claims are deliberately unproven: claim (a) is CONJECTURE until W2 measures it against the pre-registered thresholds, claim (b) is capped at reliability. The doc-header pass is verified mechanically (diff adds only `//!` lines; neither edited file appears in a `cargo fmt --check` diff — though `lance-graph-ontology` carries extensive PRE-EXISTING fmt drift in `hydrators/` and `odoo_blueprint/`, untouched here).
 
+## 2026-08-02 — lance-graph #879 — D-MBX-A6-P4 cycle loop-closure driver: sparse seal/apply + the MUL-gate thought seam
+
+> **RECONSTRUCTED 2026-08-03** (see the arc-gap note on #880). Sources: the PR body, merged diff stats, the merge commit, and a full-diff review this session ran against the merged code. Not written at merge time.
+
+**Merged:** `130d7b2` (branch `claude/medcare-rs-continue-ufsazd`, head `71d1db1`). 6 commits, 10 files, +2,617/−19.
+
+- **Added** — `lance-graph-supervisor::cycle_driver` (feature `cycle-driver`): `seal_cycle` (one WAL write → Vn+1, returns the sealed paired-transition set), `collect_casts` (durable `position_base` cursor; extras beyond one move/owner return as `HeldIntent`), `apply_sealed_transitions` (phase + per-owner recovery watermark advanced **together**, partial prefix preserved on `Err`), `recover_fleet` (single-pass partition), `cognitive_pass` / `run_cognitive_work[_gated]_over`. Makes #878's `persist_sink` cycle/WAL bootstrap load-bearing — its first caller.
+- **Locked** — **a `DatasetVersion` is global knowledge, NOT permission to advance every mailbox.** Only owners holding a sealed `paired_move` step; the version tick never fans a step across the fleet. Apply is **writer-fires-inline** (no message bus) per the ratified sparse-cycle ruling. Sealed set == applied set (so recovery and normal apply share one rule).
+- **Honesty ledger (the entry's most reusable content)** — control-loop contract **PROVEN** (19 falsifiers); **actor-owned production wiring NOT proven** (`MailboxFleet` + its `HashMap` impl is the probe/registry fleet); **cognitive-shader-driver / MailboxSoA thought NOT proven** (the MUL gate is real, its qualia inputs are caller-extractor-fed); **durability FAKE** (contract-probe `WalSink`; `LanceShardSink` does not exist). Shipping a ledger that says "compile+test green ≠ storage proven" is the practice worth copying.
+- **Falsifiers** — the **64k/17 headline**: 65,536 mailboxes, 17 sealed → exactly 17 advance, 65,519 byte-identical, one WAL write, zero dataset reads. Plus failed-seal byte-identical retry; restart-stable positions across writer reconstruction; normal-apply-advances-watermark (no post-crash replay); held-move-lands-next-cycle; multi-move no-truncation; mid-apply prefix preservation; MUL-gate discrimination (three inputs → three outcomes); O(dirty)-not-O(fleet).
+- **Review** — an operator-forwarded audit (explicitly "grain of salt"); each finding verified against code first, and **all eight accepted items were real defects**, several severe: a WAL failure LOST the drained cycle; `stream_position = CastId` walked into the trap P3d had already documented in prose; a `deferred` counter sealed a durable move that apply never made but recovery **would** (divergent semantics). Notably, the team's own P4e negative control had already proven the `StalePhase` stall and the gap shipped anyway. **Declined with reason:** routing P4b through `KanbanActor` mailboxes (contradicts the writer-fires-inline ruling) — the honesty half was taken in docs instead.
+- **Deferred** — actor-owned wiring; `MailboxSoaView::qualia()` live dispatch; `LanceShardSink`.
+- **Confidence (2026-08-03, reconstructed):** working within its declared scope; the ledger's four boundaries are the load-bearing caveats and were re-verified by an independent full-diff review this session (clean, 4 caveats carried forward into `kanban-64k-inverted-awareness-v1`). #880 later **withdrew** the `MailboxFleet`-over-registry path as structurally impossible — this entry's "bridging is open" was correct, and the bridge that was imagined is not the one that can be built.
+
+## 2026-08-01 — lance-graph #876 — the ruler reads the address as a NUMBER, not a hierarchy: intake blindness kills the residue sweep, and "stride 4 isn't golden" is refuted
+
+> **RECONSTRUCTED 2026-08-03** (see the arc-gap note on #880). Sources: the PR body, merged diff stats, the merge commit, and this session's direct authorship. Not written at merge time.
+
+**Merged:** `dcd9cc9` (branch `claude/x265-x266-plans-review-h9osnl`, head `d6e6d45`). 4 commits, 3 files, +617. Additive; no change to helix's shipped API.
+
+- **Added** — `crates/helix/examples/probe_hhtl_intake_blindness.rs`: 3 gates + 7 focused unit tests. **CONSUMES** `helix::curve_ruler::CurveRuler`; nothing re-derived.
+- **The result is that the queued sweep did NOT run** — and not running it *is* the finding. Two failure modes were pre-registered before measurement; running them first was decisive.
+- **Locked (H1, fatal)** — `from_hhtl(path, depth)` has no parameter that could carry a carving, so level structure has no channel into `from_place(p) = p % 17`. Empirically the entire difference between two carvings is a **constant rotation of 2 across all 256 cells, variance 0**. A residue-vs-granularity sweep therefore **cannot carry signal**; reporting "4⁴ doesn't help the calculator" from it would have been a false negative manufactured by the seam. #875's address result is untouched.
+- **Withdrawn (H2)** — the "stride 4 clumps" suspicion is NOT confirmed, and the design conclusion drawn from it is **retracted everywhere it appeared**: the premise that a 4-ary tier consumes four ruler steps is not wired into anything that ships (`ResidueEncoder::encode` reads only `start_offset`; the shipped `NiblePath` is `FAN_OUT = 16`). This retracts a suspicion; it does **not** establish that the constants are "matched to 4-ary".
+- **Locked (H3, direction)** — the flat seed carries **no** ancestry lift and is mildly ancestry-**averse**: eligible-pair agreement 4.4643 % vs a 5.5147 % base rate, **Δ −1.05 pp**, exhaustive over all 32,640 cell pairs (no sampling). The unblock is to feed the ruler the address's *hierarchy*, not its integer value — a helix API change needing its own review.
+- **Review** — eight defects across the arc, **every one in a falsifier or a label, none in a measurement**: sorted histograms hid that every cell moved; a design conclusion drawn from an unwired premise; a mislabelled denominator — and then **the fix reproduced the same error one level up**, root cause being a thinning that bought nothing (removed rather than relabelled); a hand-tuned threshold that would have passed at 24.9 % while the prose claimed ≈1/17; and the replacement null immediately falsified the author's *first* formulation of it. One gate correctly FAILED on zero evidence when `256 as u8 == 0` emptied a loop.
+- **Docs** — `EPIPHANIES.md` `E-THE-RULER-READS-THE-ADDRESS-AS-A-NUMBER-NOT-A-HIERARCHY-1`; `exec-runs/hhtl-intake-blindness.md`. Both carry dated `⊘` correction markers.
+- **Transferable rules** — a calculator's **intake** can silently discard the structure a probe is trying to measure (check what the consumer *reads* before sweeping what the producer *emits*); when a sample keeps generating label errors and full enumeration is cheap, delete the sampling; **a hand-tuned threshold cannot fail informatively, a declared null can**.
+- **Confidence (2026-08-03, reconstructed):** working — the negative result is the deliverable and is the stronger claim. Brief-gates AGREEMENT and COST remain **NOT RUN**, blocked on H1 rather than skipped.
+
+## 2026-07-31 — lance-graph #875 — WordNet's 4⁴ fold makes HHTL adjacency semantic: 2.47 hops the 16-ary router cannot address
+
+> **RECONSTRUCTED 2026-08-03** (see the arc-gap note on #880). Sources: the PR body, merged diff stats, the merge commit, and this session's direct authorship. Not written at merge time.
+
+**Merged:** `c0e42eb` (branch `claude/x265-x266-plans-review-h9osnl`, head `4804d35`). 6 commits, 4 files, +1,154. Additive only — no core/contract type change.
+
+- **Added** — `lance-graph-contract/examples/probe_wordnet_44_activation.rs` (zero-dep crate, 5 gates) + the corpus generator `build_isa_tree.py` (generator committed, corpus gitignored per that directory's convention).
+- **Measured** — WordNet 3.1, 82,192 noun synsets, 65,292 leaves, depth 19. W1 ancestry-by-construction: real **+0.4938** vs shuffled **−0.0356**. W2 monotone ladder 15.78→12.76→11.15→8.69→7.05 hops. **W3 out-of-cell recall over the full corpus: band 0.763 vs random-12 0.031 = 24.71×.** W4 (the headline): inside one top nibble the 16-ary router sees ONE bucket (10.55) where 4-ary splits **11.15 vs 8.69 = 2.47 hops**. W5 fold balance 256/256 cells used.
+- **Locked** — WordNet's `@` hypernym relation **is** ground-truth ancestry, so the address *encodes* structure rather than discovering it (unlike a k-means codebook, which is capped by the Base17 fold ceiling). A graded escalation band is implementable at **12 of 256 cells (4.7 %)** where 16-ary offers 15 siblings or nothing. Operator-fixed division of labour: the 4⁴ fold is the **ADDRESS**, **CLAM is the established CALCULATOR**, HHTL+helix residue is the alternative, and the probe's LCA walk is an **ORACLE — scoring only, never a runtime path**.
+- **Review** — six rounds. **Every defect found was in a falsifier, never in a measurement** — the entry's most portable line: *a broken falsifier fails silently, it reports PASS*. The first fold reproduced the le-contract's own bucket-rollover warning (one cell 15,769 leaves against a median of 20 — **arity alone does not balance a fold of a real taxonomy**). The W1 falsifier could not falsify (a cell-label permutation is a bijection, so same-cell pairs survived it and the shuffle arm scored +0.645 *while looking like validation*). W3 credited the anchor's own cell in both arms, capping the achievable ratio at 1.61 against a fire-threshold of 1.5 and a guard at 0.95 — **an 0.018-wide window; the original pass was luck**. The pool was 31 % of the corpus, fixed by scoring all 65,292 rather than relabelling the caveat. The cover guard was then recomputed like-for-like, found **INERT (0.840, not >0.95) and dropped** per the inertness rule.
+- **Locked (generalized checks for the next twin gate)** — before running, compute the maximum achievable value of the fire statistic *under* the silent guard: a hair-wide window is mis-specified regardless of which side it lands on; and both halves must measure the same quantity on the same basis.
+- **Boundaries** — structure probe, not a codec probe; first-parent-only turns the DAG into a tree so a polysemous concept gets ONE address (`dog` lands in the informal-term-for-a-man sense — reported, not hidden; both arms see the same tree); 4-ary is measured **better, not cheaper** (no traversal-cost benchmark ran).
+- **Docs** — `EPIPHANIES.md` `E-WORDNET-MAKES-THE-4-ARY-ADDRESS-SEMANTIC-1`; `exec-runs/wordnet-44-activation.md`.
+- **Confidence (2026-08-03, reconstructed):** working — the null validates itself (random-12 scores 0.031 against an expected 12/255 ≈ 0.047), and home-cell inflation was masking the effect rather than creating it. The queued successor `PROBE-CLAM-VS-HELIX-RESIDUE` was **blocked one PR later by #876's H1** (the ruler cannot see the carving) — pre-registered failure mode (a) confirmed.
+
+## 2026-07-29 — lance-graph #862 — PROBE-BABEL-STANCES slice 2: two Rosetta stones, and a retraction that inverts the headline
+
+> **RECONSTRUCTED 2026-08-03** (see the arc-gap note on #880). Sources: the PR body, merged diff stats, the merge commit. Not written at merge time; this session did not author it.
+
+**Merged:** `4b02cbc` (branch `claude/x265-x266-plans-review-h9osnl`, head `85b2c5b`). 5 commits, 9 files, +1,632/−343.
+
+- **⊘ Retraction (the point of the PR)** — slice 1's headline `KNOW` "residual that escapes the coordinate system" measured an artifact of the probe's own construction, twice: the coordinate was a **LEMMA, not a synset** (so the residual measured English surface-lemma reuse, not expressiveness escaping the grid), and **`en-kjv` sat inside its own resultant** (a guaranteed-constructive phasor in a measurement made against itself; amplitude 0.500 where correct exclusion gives 0.333). What survives untouched: the graded-phase correction, the per-row VERIFIED/CHECK discipline, and the 3:7 convergence with `probe_eyes_opened`'s B2.
+- **Added** — a stratified convergence grid (WordNet **synset** × POS × COCA-shaped frequency band; two addresses are distinct only when ≥2 axes agree they differ, so lane silence at NAKED/DIE is *expected* rather than a defect) and per-lane stones (each lane owns a private `BeliefArena` + interner — **one writer per stone**; CHECK rows enter at c = 0.5 so curatorial uncertainty is carried in the belief instead of laundered).
+- **Locked** — divergence is **attributed, not pooled** (Morphologie / Syntax / Semantik / Pragmatik). Slice 1's pooled measure read the Czech case as "0.286π mild semantic divergence"; the split shows it is **pure aspect morphology** (sem 0.000, morph π). **Translationese:** the pragmatic channel is antiphase in all six lanes at `KNOW`, coherence 1.000 — coherent antiphase is inheritance of one convention, not independent convergence — and stays silent at NAKED and DIE (can-fire *and* can-stay-silent). **Valency: the distinction moves levels, it never disappears** — English marks `KNOW`'s two coordinates by subcategorization frame while its lexeme collapses them.
+- **Review** — three codex findings, all resolved; the resolution **inverted the headline rather than patching it**. Two further defects self-caught during the run: a CHAODA-shaped outlier divided by a MAD of exactly 0 (printing a meaningless robust-z of 2.6e6), and the quale term **conflated surprise with uncertainty** so a CHECK row's low confidence ranked two reconstruction lanes above four verified ones.
+- **Locked (CI)** — **`cargo test` never executes an example's `main()`**, so every `assert!` in these probes had only ever run on a developer's local invocation. `rust-test.yml` now runs `probe_eyes_opened` and `probe_babel_stances` explicitly. (Codex P2 — arguably the most consequential item in the PR: until it landed, an entire class of falsifier was decorative in CI.)
+- **Boundaries** — the fixture's `morph` field carves `prefix|stem`, typologically biased toward prefixing languages; an agglutinative lane carries its switch on a suffix where this carving cannot see it, so spine slot 6 is left explicitly RESERVED rather than filled with a reconstruction. At stem scale bigrams **quantize** (`gewahr ∩ kennen` share zero bigrams → φ snaps to π, phase dead again), so the graded LCS radix path stays the phase generator with a profile cosine as cross-check; full HHTL+helix routing needs a trained lexeme codebook — 30 curated rows are not a codebook.
+- **Confidence (2026-08-03, reconstructed):** working — the retraction is the deliverable. Note the shape: a probe whose headline finding was withdrawn by its own follow-up, with the *discipline* (per-row verification, channel attribution, exclusion of self from a resultant) surviving intact. #875/#876 repeat this shape twice more; see the falsifier-defect pattern that all three share.
+
 ## 2026-07-27 — lance-graph #856 — Base17 fold ceiling measured DIMENSIONAL + GOLDEN_STEP proven a relabel + #855's 11 post-merge review comments closed
 
 > **Recovery note (2026-07-27, forensic session):** this entry, and the five below it down through #851, were reconstructed after the arc's memory practice broke down for six PRs in a row (#851–#856): no `PR_ARC_INVENTORY` entry was written for any of them at the time, and no handover was left. Sourced only from merged diffs, commit messages, PR bodies, and the GitHub review-comment record — never from inference. See `.claude/handovers/2026-07-27-*-arc-841-856-postmortem.md` for the full account of how the gap happened.