feat(wikidata-hhtl): the N4 second-domain falsifier — 16ⁿ router + class-meta-DTO proven domain-independent on Wikidata

.claude/board/EPIPHANIES.md

@@ -1,3 +1,21 @@
+## 2026-05-31 — FINDING: D-CLS (#441) ↔ D-ARM-14 (#438) converge on Wikidata-HHTL — the second-domain falsifier reuses the class-meta-DTO 1:1 (cross-session synthesis)
+
+**Status:** FINDING (cross-session reconciliation, confirmed by the D-ARM-14 session). Anchors the Wikidata-HHTL arc on the merged D-CLS machinery; no parallel layer grows.
+
+**The convergence:** 439/440/441 (D-CLS) and 436/438 (D-ARM-13/14) are convergent, not conflicting. The Wikidata "D-CLS triple" `(class_id, shape_hash, presence_bitmask)` = `(ClassId(u16), StructuralSignature, FieldMask)` — ALL #441 types. wikidata facet-bitmask = `FieldMask`; shape = `signature()`'s structural-hash (generalised from `OdooEntity` to any entity); presence = `FieldMask`.
+
+**The firewall split (clean territory, no collision):**
+- **Proposer side (the D-ARM-14 session's lane):** `arm-discovery::aerial` stays the zero-dep PROPOSER — similarity in discovery only, skeleton-only predicates, emits `(s,p,o,f,c)`. Validated by the proposer-layering FINDING (67903a8): aerial FEEDS the AST hub, is not the hub.
+- **Hub side (this/D-CLS session's lane):** `contract`/`ontology` own `FieldMask`/`signature`/`ClassView` + the new `contract::hhtl::NiblePath` router. "The hub side owns contract/ontology."
+
+**This slice (D-WIKI-HHTL-1):** `contract::hhtl::NiblePath` — the 16ⁿ Abstammung bucket router #438's wiring doc names as "downstream." DOLCE-agnostic (`basin: u8`). basin `0..3` = `dolce_id::{ENDURANT=0,PERDURANT=1,QUALITY=2,ABSTRACT=3}` (#441 cache u8), which ALSO matches arm-discovery's discovery-side `DolceCategory::basin()` ordering (#438) — both sides agree on the nibble WITHOUT either embedding the enum (OD-DOLCE: resolve through the cache, b31464d). + `FieldMask::inherit` (mask-inherits-as-delta; multi-parent = facet bit in the same mask, NOT a 2nd path). 4 teeth-tests; 501 contract lib green; zero-dep preserved.
+
+**One proposer-side alignment — NOT this session (the D-ARM-14 session owns it, its own branch):** `aerial::ontology::DolceCategory` currently hardcodes `dolce:…` IRIs; ratified pattern = emit `dolce_id` u8, resolve the IRI late from cache (proposer stores no semantics). `basin()` already matches `dolce_id` ordering → alignment, not rework. Recorded here for cross-session visibility only.
+
+**#438 council verdict (4f381a8):** no code action items — it reviewed a `discovery_origin` byte-grammar plan, not the crate; fixed a stale Wave-1 citation, escalated 2 spec decisions (tier-set + proposer-id width) to ISSUES, queued D-CHESS-BRINGUP-1.
+
+**Cross-ref:** #441 (D-CLS), #438 (D-ARM-14 P1), 67903a8 (proposer-layering), b31464d (OD-DOLCE), `splat-codebook-aerial-wikidata-compression.md`, `wikidata-hhtl-load.md`, `contract::hhtl`.
+
 ## 2026-05-31 — FINDING (research): arm-discovery is a PROPOSER that FEEDS the SPO-AST, not the SPO-AST itself — using it AS the AST would conflate proposer↔hub + push similarity into addressing
 
 **Status:** FINDING (read-only research, answering "can lance-graph-arm-discovery be the SPO-AST?"). No code; prevents a layering mistake.

.claude/board/LATEST_STATE.md

@@ -42,6 +42,8 @@
 
 ## Current Contract Inventory (lance-graph-contract)
 
+> **2026-05-31 — MERGED (#441, D-CLS arc, merge `a77e119`)**: `lance_graph_contract::class_view::{FieldMask (u64 presence bitmask), ClassView (resolver trait), ClassProjection, RenderRow}` + `ClassView::render_rows` (off-bits-skipped). `ClassId = u16` (reuses `soa_view::class_id`). The class meta-DTO **flies ABOVE the agnostic SoA** — labels/shape/DOLCE resolve LATE from the OGIT cache, nothing semantic in the row (C2 presence≠semantics; N3 stable positions; out-of-range mask bits IGNORED not folded — Codex P2). Ontology side: `class_resolver::RegistryClassView` (impls `ClassView` over the live `OntologyRegistry`, DOLCE via `classify_odoo`) + `odoo_blueprint::class_signature::{StructuralSignature, OdooEntity::signature()/object_view() carrier methods, audit, shape_families, curated_entities, corpus_summary}` (deterministic FNV-1a structural-hash group-by, NOT Aerial-cluster). Zero-dep preserved; extends `ontology::{ObjectView,FieldRef,DisplayTemplate}`, reuses `class_id` (no new newtype). 497 contract + 240 ontology lib tests. D-CLS-{FM,RES,SIG,AUDIT,RENDER} all Shipped.
+>
 > **2026-05-30 — PR-in-flight addition** (D-MBX-A6 Phase 2 — Rubicon lifecycle + ExecTarget): `lance_graph_contract::kanban::{ExecTarget (Native/Jit/SurrealQl/Elixir), RubiconTransitionError}` + `KanbanColumn::{next_phases, can_transition_to}` (the Rubicon lifecycle DAG) + `KanbanMove.exec: ExecTarget` field + `MailboxSoaOwner::try_advance_phase()` (checked lifecycle enforcement → `Result<KanbanMove, RubiconTransitionError>`). Zero-dep; `KanbanMove` still ≤16 B; 489 contract lib tests (+4); downstream cargo-check clean. Lifecycle enforcement + planner exec-target are now contract-level invariants. Resolves the #437 deferred exec-target NOTE. Cross-ref D-MBX-A6 / #437.
 >
 > **2026-05-30 — PR-in-flight addition** (D-MBX-A6 Phase 1 — planner⟷ractor⟷surreal meta-DTO): `lance_graph_contract::kanban::{KanbanColumn (6: Planning/CognitiveWork/Evaluation/Commit/Plan/Prune), KanbanMove}` — the 4-phase Rubicon kanban transition; `KanbanMove` is `Copy`, ≤16 B, carries `MailboxId` + `witness_chain_position` (R4 pointer) + `libet_offset_us` (−550 ms anchor, D-MBX-8). `lance_graph_contract::soa_view::{MailboxSoaView, MailboxSoaOwner}` — zero-dep **borrow trait** for the transparent zero-copy SoA view (R1 "one SoA never transformed"); `&[T]` column accessors (energy/edges_raw/meta_raw/entity_type) mirror `MailboxSoA::*_at`; the read/owner split makes "view is read-only" structural (surreal implements only the read half). `orchestration::StepDomain::Kanban` variant + `"kanban."` prefix. Consumed via the EXISTING `OrchestrationBridge` (planner emits, ractor owns/drives via `MailboxSoaOwner`, surreal_container projects via read-only `MailboxSoaView`) — NO parallel DTO family (lab-vs-canonical ruling). Contract `[dependencies]` still empty. 485 contract lib tests green (+6 new); `cargo check` clean on planner/cognitive-shader-driver/supervisor (StepDomain variant additive-safe). Consumer impls deferred. See E-SOA-VIEW-IS-A-BORROW; `unified-soa-convergence-v1.md §5+§8.4`.

.claude/board/PR_ARC_INVENTORY.md

@@ -35,6 +35,32 @@
 
 ---
 
+## #441 odoo-classes-bitmask-render (D-CLS arc) — classes as a SoA-view with presence bitmask
+
+**Status:** MERGED 2026-05-31 (merge commit `a77e119`), branch `claude/sleepy-cori-aRK2x`. 5 feature slices + 4 review-round fixes; 973 insertions, purely additive (0 deletions). Built AFTER a council + brutal-honest review of the #440 *plan* caught 3 P0 factual errors — these slices sidestep them by construction.
+
+**Added:**
+- `lance-graph-contract::class_view` (NEW module, zero-dep): `FieldMask(u64)` presence bitmask + `ClassView` resolver **trait** + `ClassProjection` + `RenderRow` + `ClassView::render_rows` (off-bits-skipped). `ClassId = u16` (reuses the existing `soa_view::class_id` width). Extends `ontology::{ObjectView, FieldRef, DisplayTemplate}`; does not duplicate. (D-CLS-FM + D-CLS-RENDER)
+- `lance-graph-ontology::class_resolver` (NEW module): `RegistryClassView` impls `ClassView` over the live `OntologyRegistry`; DOLCE resolved LATE via `classify_odoo(ogit_uri)`; per-class memo over the O(n) registry scan. (D-CLS-RES)
+- `lance-graph-ontology::odoo_blueprint::class_signature` (NEW module): `StructuralSignature` + `OdooEntity::signature()`/`object_view()` (carrier methods) + `audit`/`shape_families`/`curated_entities`/`corpus_summary`. Deterministic FNV-1a over kind+field/method-kind histograms + state-machine. (D-CLS-SIG + D-CLS-AUDIT)
+
+**Locked:**
+- **The class flies ABOVE the agnostic SoA** (classes.md "the meta-DTO resolves; it does not store"): SoA row = agnostic bytes (class_id + presence bits only); `ClassView` = the late-bound parser+schema; `FieldMask` = which optional fields are present. Nothing semantic in the row.
+- **C2 — `FieldMask` is presence, NEVER semantics.** `render_rows` yields a row iff its bit is set; never branches on meaning.
+- **N3 — stable append-only bit positions** (field position `i` = declared-field `i`). Out-of-range positions (≥ `MAX_FIELDS`=64) are **IGNORED, not folded** (Codex P2 fix `250b66f`) — `& 63` folding would alias pos 64→bit 0 and silently corrupt the presence contract.
+- **Structural-signature = deterministic group-by-on-hash, NOT Aerial+ clustering** (that entry point does not exist — confirmed in review). Name-independent.
+- **DOLCE resolved from the OGIT cache** (OD-DOLCE ratification); **reuse the existing `class_id`** (no colliding newtype). These two sidestep the canonical-enum contest + 6-vs-4 DOLCE dispute caught in the #440-plan review.
+- **`signature`/`object_view` are carrier methods on `OdooEntity`**, not free functions (CodeRabbit `21c37eb`, CLAUDE.md "The Click" litmus).
+- Zero-dep contract preserved; dependency-inversion (contract owns the trait, ontology owns the answers — like `MailboxSoaView`).
+
+**Deferred:** the askama render-**engine** crate (`render_rows` is the LOGIC, not the engine); the registry `by_entity_type_id` O(1) index (RegistryClassView memoizes over the O(n) scan today); naming the discovered shape-families (Wave-2 human step); **Wikidata-HHTL** (the classes.md-N4 second-domain falsifier reusing `FieldMask`/`signature`/`ClassView`).
+
+**Docs:** EPIPHANIES (the #440-plan REVIEW VERDICT, the OD ratifications, each of the 5 slices, the FieldMask-no-fold fix, and the arm-discovery-is-a-proposer-not-the-SPO-AST finding); STATUS_BOARD D-CLS-* rows → Shipped; this PR_ARC entry; LATEST_STATE Contract-Inventory blockquote.
+
+**Confidence (2026-05-31):** working — 497 contract + 240 ontology lib tests green; clippy `-D warnings` + rustfmt clean; merged clean after Codex P2 + 2 CodeRabbit findings (all real, all resolved in the babysit loop before merge).
+
+---
+
 ## callcenter/audit-fix — fix(callcenter): `with_jsonl_audit` returns `Result<Self, AuditError>` (branch work)
 
 **Status:** On branch `claude/activate-lance-graph-att-k2pHI` (HEAD `ea2a378`, not yet a PR). 1-line `.rs` change + this board record (EPIPHANIES E-AUDIT-1, prepended 2026-05-27).

.claude/board/STATUS_BOARD.md

@@ -568,11 +568,13 @@ Plan path: `.claude/plans/unified-soa-convergence-v1.md`. Handover `.claude/hand
 | D-MBX-A6-P2 | Rubicon lifecycle enforcement + exec-target tag: `KanbanColumn::{next_phases, can_transition_to, is_absorbing}` (the lifecycle DAG) + `MailboxSoaOwner::try_advance_phase` (checked, `RubiconTransitionError`) + `ExecTarget{Native,Jit,SurrealQl,Elixir}` on `KanbanMove` | lance-graph-contract | 120 | LOW | **In PR** | builds on P1; 489 lib tests (+4); downstream cargo-check clean; gates the ractor owner-impl + planner emit (P3) |
 | D-MBX-A6-P3a | StyleStrategy: thinking-style -> cluster -> mechanism -> recipe_kernels Tactic selection (planning substrate; carries tau JIT addr) | lance-graph-planner | 130 | LOW | **In PR** | #439; first cut of A6-P3 consumer wiring; planner now consumes contract recipes/styles; deferred: i4-32D decode, Outcome->Candidate, tau->JIT, membrane commit |
 | D-MBX-A6-P3-M1 | `Tactic::requires() -> ThoughtMask` + `ThoughtField`/`ThoughtMask` (checklist-as-data keystone): 34 tactics declare their ThoughtCtx field-reads; `covered_by` = reliability-coverage gate | lance-graph-contract | 120 | LOW | **In PR** | #439; the panel-recalibrated keystone (extraction not construction); makes P1/P7/P11 derived; teeth-test asserts masks varied not stub |
-| D-CLS-FM | `class_view`: FieldMask(u64 presence) + ClassView meta-DTO resolver trait + ClassProjection (the class flies ABOVE the SoA; labels resolved late from OGIT cache, zero in the bytes) — extends ObjectView, reuses class_id | lance-graph-contract | 270 | LOW | **In PR** | #441 D-CLS contract foundation; OD-gates ratified; presence!=semantics (C2); N3 stable positions; 3 teeth-tests |
-| D-CLS-RES | `class_resolver`: `RegistryClassView` impls `ClassView` over the live OntologyRegistry — the ontology-side 'parser' (class_id -> shape, DOLCE resolved LATE via classify_odoo from the cache URI, memoized over the O(n) registry scan) | lance-graph-ontology | 200 | LOW | **In PR** | #441 D-CLS; makes the contract trait live; field-set supplied (D-CLS audit deferred); 4 teeth-tests |
-| D-CLS-SIG | `class_signature`: deterministic structural-signature audit of curated OdooEntity consts (FNV-1a over kind+field-hist+method-hist+state-machine) -> shape-family group-by + `object_view()` derives the real ObjectView bit-basis (fills the D-CLS-RES placeholder) | lance-graph-ontology | 230 | LOW | **In PR** | #441 D-CLS; the HONEST D-CLS-3 (group-by-on-structural-hash, NOT aerial-cluster vaporware, classes.md:43); 4 teeth-tests over real l1 data |
-| D-CLS-AUDIT | `class_signature` corpus audit: `curated_entities()` (all 15 l-lanes, 64 consts) + `corpus_summary()` + falsifiable test that the real curated corpus collapses entities->fewer shape-families (classes.md:42 CONFIRMED on real data, not asserted) | lance-graph-ontology | 90 | LOW | **In PR** | #441 D-CLS Wave-2 input; +clippy fix (unused FieldMask import in class_resolver) |
-| D-CLS-RENDER | `ClassView::render_rows` + `RenderRow{label,predicate}` — the off-bits-skipped render surface (C2 presence-only; template-agnostic, askama engine deferred to its own crate-Wave) | lance-graph-contract | 50 | LOW | **In PR** | #441 D-CLS; the render LOGIC (classes.md:49), not the engine; +doc-lint fix |
+| D-CLS-FM | `class_view`: FieldMask(u64 presence) + ClassView meta-DTO resolver trait + ClassProjection (the class flies ABOVE the SoA; labels resolved late from OGIT cache, zero in the bytes) — extends ObjectView, reuses class_id | lance-graph-contract | 270 | LOW | **Shipped** | #441 D-CLS contract foundation; OD-gates ratified; presence!=semantics (C2); N3 stable positions; 3 teeth-tests |
+| D-CLS-RES | `class_resolver`: `RegistryClassView` impls `ClassView` over the live OntologyRegistry — the ontology-side 'parser' (class_id -> shape, DOLCE resolved LATE via classify_odoo from the cache URI, memoized over the O(n) registry scan) | lance-graph-ontology | 200 | LOW | **Shipped** | #441 D-CLS; makes the contract trait live; field-set supplied (D-CLS audit deferred); 4 teeth-tests |
+| D-CLS-SIG | `class_signature`: deterministic structural-signature audit of curated OdooEntity consts (FNV-1a over kind+field-hist+method-hist+state-machine) -> shape-family group-by + `object_view()` derives the real ObjectView bit-basis (fills the D-CLS-RES placeholder) | lance-graph-ontology | 230 | LOW | **Shipped** | #441 D-CLS; the HONEST D-CLS-3 (group-by-on-structural-hash, NOT aerial-cluster vaporware, classes.md:43); 4 teeth-tests over real l1 data |
+| D-CLS-AUDIT | `class_signature` corpus audit: `curated_entities()` (all 15 l-lanes, 64 consts) + `corpus_summary()` + falsifiable test that the real curated corpus collapses entities->fewer shape-families (classes.md:42 CONFIRMED on real data, not asserted) | lance-graph-ontology | 90 | LOW | **Shipped** | #441 D-CLS Wave-2 input; +clippy fix (unused FieldMask import in class_resolver) |
+| D-CLS-RENDER | `ClassView::render_rows` + `RenderRow{label,predicate}` — the off-bits-skipped render surface (C2 presence-only; template-agnostic, askama engine deferred to its own crate-Wave) | lance-graph-contract | 50 | LOW | **Shipped** | #441 D-CLS; the render LOGIC (classes.md:49), not the engine; +doc-lint fix |
+| D-WIKI-HHTL-1 | `contract::hhtl::NiblePath`: the 16ⁿ Abstammung bucket router (subClassOf nibble path, bit-shift O(1), `root`/`child`/`basin`/`parent`/`is_ancestor_of`) + `FieldMask::inherit` (mask-inherits-as-delta). DOLCE-agnostic (`basin: u8` = dolce_id 0..3, resolved through the cache — NO enum); multi-parent = facet bit in the same mask, NOT a 2nd path. The downstream router #438 names. | lance-graph-contract | 155 | LOW | **In PR** | Wikidata-HHTL slice 1 = the 16ⁿ router (hub-side); reuses #441 FieldMask; convergent with D-ARM-14 (firewall preserved). 4 teeth-tests; 501 contract lib green. See FINDING D-CLS↔D-ARM-14 (EPIPHANIES). |
+| D-WIKI-HHTL-2 | `wikidata_hhtl`: the N4 second-domain falsifier — `WikidataClass` (curated real QIDs: human/person/city/film/tv-series/event) routed through the SAME class-meta-DTO: `nibble_path()` (basin=cache dolce_id, NO enum), `presence_mask()`=FieldMask, `signature()`=StructuralSignature over the canonical property-set, `dcls_triple()`=(ClassId,StructuralSignature,FieldMask), + `WikidataClassView` impls the #441 `ClassView`. | lance-graph-ontology | 290 | LOW | **In PR** | Wikidata-HHTL slice 2; classes.md N4 CONFIRMED on data: corpus collapses to fewer shape-families (film≡tv-series twin), triple shape domain-independent, ClassView resolves Wikidata unchanged, subclass inherits path+mask-as-delta. Reuses contract::hash::fnv1a. 5 teeth-tests; 245 ontology lib green. Deferred: the 115M streaming load (separate plan). |
 
 ---
 

.claude/board/TECH_DEBT.md

@@ -13,6 +13,34 @@
 ---
 
 
+## Open Debt
+
+### TD-WIKI-SCALE (D-WIKI-HHTL / #442) — three scale-freezes the N4 falsifier inherits
+
+**Status: Open.** Surfaced by the D-ARM-14 session's review of #442 (the hub-side
+Wikidata-HHTL arc). All three are FINE at the curated-corpus + Odoo scale this PR
+ships; they bite only at the deferred 115M streaming load:
+
+1. **`StructuralSignature` u32 birthday ceiling (~77k).** `wikidata_hhtl::WikidataClass::signature()`
+   and Odoo's `class_signature` both return `StructuralSignature(u32)` (#441's type). ~50% collision
+   probability near ~77k distinct shape-families → two genuinely different shapes alias to one family
+   (a correctness MERGE, not a perf nit) at Wikidata scale. **Pay by:** widen `StructuralSignature`
+   to `u64` — a #441 contract decision (touches the Odoo signature path too); land it WITH the
+   deferred load slice, not unilaterally in #442.
+2. **`NiblePath` MAX_DEPTH=16 ceiling — now SIGNALED, not silent.** `child()` saturates silently past
+   depth 16; real P279 chains run deeper, so two distinct deep classes truncated at 16 would collide on
+   one path. #442 adds `is_full()` + `try_child() -> Option` so the deferred loader DETECTS the ceiling
+   and switches to a ref (the bit-budget escape) instead of colliding. **Pay by:** the deferred loader
+   gates every descent on `is_full()`/`try_child()`; the ref-escape store is its own slice.
+3. **`signature()` allocates+sorts a `Vec` per call; `dolce_category_id()` defaults `ENDURANT` on
+   unknown class_id** (silent default vs signaling absence — mirrors `RegistryClassView`). Both fine
+   for the fixture. **Pay by:** at load scale hash the property-set without a per-call alloc
+   (pre-sorted columnar input); decide whether unknown-class DOLCE should be `Option`-signaled (a #441
+   `ClassView` trait decision).
+
+Cross-ref: #442, #441 (StructuralSignature/ClassView), the D-ARM-14 review, `wikidata-hhtl-load.md`,
+FINDING D-CLS↔D-ARM-14 (EPIPHANIES).
+
 ### TD-ARM-CARRIER-FORK (D-ARM-13 / streaming-arm-nars-discovery-v1)
 
 **Status: Open.** Surfaced by the 3-savant brutal review of D-ARM-13