Causality audit: type the causal edge, declare kernel effects — and withdraw the source registry as a falsified design

.claude/board/EPIPHANIES.md

@@ -1,3 +1,79 @@
+## 2026-07-27 — E-THE-TWO-COPIES-HAD-ALREADY-DRIFTED-1 — **the "migrate both together" rule was justified by a hypothetical asymmetry; the migration found a REAL one.**
+
+**Status:** FINDING (measured while migrating, not predicted). **Confidence:** High — the divergence is two lines of source.
+
+The argument for moving `lance-graph-planner::nars::belief` and `deepnsm-v2::belief` onto the canonical registry in ONE change was that fixing one alone would leave "two incompatible independence semantics wearing matching comments." That was reasoning about a risk. Doing the work showed the copies had **already diverged**:
+
+- **Planner:** `if stamp != Stamp::default() && b.stamp.disjoint(stamp)` — with a doc-comment calling the empty-stamp guard *load-bearing*: the no-source sentinel is disjoint from EVERY stamp, so treating it as independent evidence lets a repeated unsourced observation pool into itself and inflate confidence without bound.
+- **deepnsm-v2:** `if b.stamp.disjoint(stamp)` — no guard. The same repeated unsourced observation pools.
+
+Same struct name, same `source(id) = 1 << (id % 64)`, same S4 doc-bullet, same "CONSERVATIVE folding" comment — and a different answer to *when may evidence pool*. Neither file was wrong about itself; the pair was wrong about each other, and nothing could have noticed, because nothing compared them.
+
+**Two lessons, and the second is the load-bearing one:**
+1. Duplicated types do not merely risk drifting. On a long enough timeline they HAVE drifted, and the copy you are not currently reading is the one that surprises you.
+2. **A shared doc-comment is negative evidence of agreement.** Both copies carried the same explanatory prose about conservative folding, which is exactly why the behavioural difference stayed invisible — the prose was the thing being kept in sync, so it read as though the code was. This is `E-VACUOUS-ASSERTION-IS-THE-HOUSE-STYLE-1` in a new place: matching narration standing in for verified sameness.
+
+Aligned to the planner's (correct) behaviour, with the divergence documented at the site rather than quietly harmonized. A `Default`-derived `Stamp` means `Stamp::default()` still compiled after the migration, so the guard's absence would NOT have surfaced as a compile error — it was found by reading, which is the only thing that could have found it.
+
+Refs: `E-A-LOCAL-BITSET-IS-NOT-SELF-DESCRIBING-PROVENANCE-1`, `E-THE-UNCONTESTED-AXIS-IS-THE-ONE-THAT-MERGES-1` (nobody had contested whether the two copies agreed).
+
+## 2026-07-27 — E-A-LOCAL-BITSET-IS-NOT-SELF-DESCRIBING-PROVENANCE-1 — **the `Stamp` folding was CONSERVATIVE, not unsound — and the real defect is one level up: a bitset does not carry the mapping that gives its bits meaning.**
+
+**Status:** FINDING + shipped contract (`source_registry`). **Confidence:** High. **Correction:** supersedes an audit claim, made earlier in the same arc, that `1u64 << (id % 64)` "manufactures false independence". It does not, and both crates' own doc-comments said so.
+
+**What folding actually does.** A collision makes two DISTINCT sources look *overlapping*. NARS revision then refuses to pool them → evidence is LOST, never double-counted. The no-double-count guarantee survives the bound; the failure is conservative in the safe direction. Getting this backwards mattered: it would have justified an urgent "correctness" fix over the real, duller problem.
+
+**What it genuinely destroys** — everything downstream of knowing *which bit is whom*: pooling past 64 sources, leave-one-out, withdrawal, and any interpretation of an evidence count (`count_ones()` becomes a lower bound of unknown tightness). Hence the rule: **a term id, domain id, witness id or corpus id must NEVER be silently interpreted as a bit position.** The bound is on SIMULTANEOUSLY REPRESENTED identities, not on id magnitude — `SourceId(50_000)` legitimately takes slot 0 when it registers first, and exhaustion is a reported `CapacityExceeded`, not a wrap.
+
+**The subtler defect the registry exposes: a stamp is meaningless without its registry.** Registry A may give source X slot 0 while registry B gives source Z slot 0 — so `Stamp(0b1)` denotes different evidence in each, and `disjoint()` will answer confidently either way. A local bitset is not self-describing provenance. Pinned as a test (`slot_zero_means_different_sources_in_different_registries`) so the hazard stays visible rather than becoming folklore.
+
+**Ruling: arena-local by CONTAINMENT, and registry-bearing stamps REJECTED.** The owning arena holds the registry, mints every stamp, and performs every union/disjoint; callers pass a `SourceId` and no stamp crosses an API boundary. Enforced structurally — private bits, no `Serialize`, constructible only from a registry-issued `SourceSlot`.
+
+The rejected alternative (`{registry_id, bits}`) exists precisely to make arena A's evidence meaningful inside arena B — i.e. a handoff between two independently-owned state containers. **That is the shape #477 deleted at the mailbox layer** (no inter-mailbox carrier, one writer per mailbox), reappearing one layer down under a new name. Containment is not merely cheaper; it is the option consistent with the ratified ownership model. Same fold, different altitude — cf. `E-AGENT-LOG-SHARED-SINK-ANTIPATTERN-1`, where the shared-mutable-sink came back one layer *up*.
+
+**Flip condition, named so it is falsifiable:** if replay must reconstruct evidence from PERSISTED state rather than rebuilding the arena, containment breaks. The answer even then is not a registry field on every stamp — it is a **frozen source census**: a versioned artifact from which a deterministic sorted-`SourceId` → `SourceSlot` allocation is regenerated and checked against a digest. Mapping identity stays addressable by epistemic view instead of riding in the hot carrier.
+
+**Sequencing discipline held.** The two `BeliefArena`s (planner + deepnsm-v2) are migrated TOGETHER. Fixing one alone leaves two incompatible independence semantics wearing matching comments — worse than fixing neither, because the asymmetry is silent.
+
+Refs: `contract::source_registry`, `E-THE-UNCONTESTED-AXIS-IS-THE-ONE-THAT-MERGES-1` (the arena-locality assumption was itself an uncontested axis until probed), `E-CE64-MB-4`, PR #477.
+
+## 2026-07-27 — E-THE-UNCONTESTED-AXIS-IS-THE-ONE-THAT-MERGES-1 — **the general form of eigenvalue blindness, demonstrated on the reviewer.** Across five adversarial rounds refining the `E-WE-HAVE-PEARL-VOCABULARY…-1` fix list, every merged carrier that got caught had been *argued about*; the one that slipped through was the axis nobody had contested yet. It was folded **one sentence after the prohibition against folding was written**, by the author of the prohibition.
+
+**Status:** FINDING + rule. **Confidence:** High — the instance is in this session's own transcript, not inferred.
+
+**The mechanism.** A contested axis accumulates names, counterexamples, independent carriers, tests, boundaries. An uncontested axis stays a background assumption, and *because nobody perturbs it, it looks naturally unified*. So the dominant interpretation is not merely the best-supported one — it is often the one whose hidden dimensions were never independently activated. The error under adversarial pressure does not die; **it relocates to wherever the pressure isn't.**
+
+**The migration, in order, all in one session:** missing architecture (grep used as comprehension) → confidence confused with effect → subject-matter domain confused with causal locus → single `SupportBasis` confused with provenance geometry → arena-local bit meaning assumed from privacy alone. Each round's fix was correct; each round's *next* defect sat one axis further from where anyone was looking.
+
+**The schema-level falsifier this yields — the orthogonality audit.** For any proposed compound carrier over dimensions A and B, require TWO witnesses: *A varies while B is fixed*, and *B varies while A is fixed*, both on non-trivial inputs. Consequences:
+- Both witnesses exist ⇒ genuinely independent; never irreversibly merge them.
+- **Only ONE direction has a witness ⇒ the other axis is DERIVED**, and belongs in a method, not a stored field.
+- Neither ⇒ one axis, described twice.
+
+**It reproduced an independent decision on first use.** Run against `KanbanMove`: `(from, to)` varies while `libet_offset_us` holds (any mid-cycle arc — witness exists), but no legitimate input makes the offset vary while `(from, to)` holds. One-directional ⇒ derived ⇒ delete the field. That is exactly the A5 conclusion reached four rounds earlier by unrelated reasoning. A schema rule that re-derives a decision made on other grounds has some claim to being real rather than merely well-phrased.
+
+**Operating corollary:** after resolving the currently disputed dimensions, deliberately perturb the ones that survived without discussion — not because they are probably wrong, but because they received the least epistemic pressure. "We fixed the contested axes" is the moment to start looking, not to stop.
+
+Refs: `E-WE-HAVE-PEARL-VOCABULARY-NOT-PEARL-MECHANICS-1` (the arc this refines), `causal_audit` (the typing that resulted), `E-ZERO-DELTA-DOES-NOT-MEAN-NO-EFFECT-1`.
+
+## 2026-07-27 — E-ZERO-DELTA-DOES-NOT-MEAN-NO-EFFECT-1 — **a census of all 34 recipe kernels falsified an audit claim made from grep counts: 15 kernels return `delta_conf = 0.0` on every branch while mutating `ThoughtCtx`.**
+
+**Status:** FINDING (full-file census, then encoded as executable masks + tests). **Confidence:** High — the numbers come from reading all 34 `apply` bodies, and the masks are now enforced by a suite that fails on drift.
+
+**The defect in the reasoning, worth preserving because it is seductive.** `Tactic::run` calls `apply(ctx)` **first**, then adds `Outcome.delta_conf` to `ctx.confidence`. So `apply` holds `&mut ThoughtCtx` for its whole body and the returned delta says *nothing* about whether the context survived. An audit that counted `0.0` literals and concluded "evaluation-inert" was measuring one of eight possible effects and reporting it as all of them. `Htd` reorders the entire candidate vector — every downstream `max_idx`, prune and fuse reads a different array — and reports zero.
+
+**Census result:** 27 Operational · 6 Demonstration · 1 Stub. The 15 silent mutators write `candidates`/`beliefs`/`sd`/`rung`/`dissonance`/`temperature`. Three kernels that *look* operational land nothing: **`Etd`** sorts a CLONE of `candidates` and never writes it back (the computed decomposition is discarded); **`Cas`** computes `_level` and drops it; **`Sdd`** detects distortion, reports it in the note, and hardcodes `delta_conf = 0.0` outside the branch. Wiring any of them up is a behaviour change requiring an explicit decision — recorded as `Demonstration`, not silently fixed.
+
+**The fix is declaration + falsifier, not documentation.** `Tactic` gains two non-defaulted methods: `writes() -> ThoughtMask` (POSSIBLE writes, the mirror of `requires()`'s may-read) and `maturity() -> KernelMaturity{Operational,Demonstration,Stub}`. Maturity lives on the **impl**, never on the `Recipe` catalogue entry: a `Recipe` describes what the tactic *is*, maturity describes what *this code currently does* and changes the day someone finishes it — folding an implementation property into a concept record is the same merged-carrier mistake one level down.
+
+**Seven tests make the declarations falsifiable** (`recipe_kernels::effect_census`): no kernel writes outside its mask; every declared write is reachable on some probe; `Operational` implies a real effect; non-Operational implies none; the four context-blind kernels are input-invariant; the maturity split is non-trivial in both directions; and a regression guard pinning that zero-delta-implies-inert stays false.
+
+**The census also caught its own fixtures first.** `maturity_operational_implies_an_effect` failed on `Mcp` — not a kernel defect, a **probe gap**: every probe inherited `ThoughtCtx::new`'s `confidence = 0.5`, so Mcp's `confidence > 0.7 && free_energy > 0.5` branch was unreachable and Mcp looked inert. A can-fire test found the hole in the test matrix before it found one in the code, which is the argument for writing them.
+
+**Side finding, from the write mask existing at all:** `Lsi` declared `Sd` in `requires()` but only ever *wrote* it — an output over-declared as an input, invisible until reads and writes had separate carriers. Corrected.
+
+Refs: `recipe_kernels::{KernelMaturity, Tactic::writes}`, `E-THE-UNCONTESTED-AXIS-IS-THE-ONE-THAT-MERGES-1`, the falsifiability rule in CLAUDE.md.
+
 ## 2026-07-27 — E-WE-HAVE-PEARL-VOCABULARY-NOT-PEARL-MECHANICS-1 — **operator suspicion confirmed by audit.** Asked directly ("I'm not convinced that we implemented MIT proposed causality learning properly"), the answer is: correct. We have the Pearl taxonomy comprehensively — `pearl_level()`, the SPO 2³ mask → SEE/DO/IMAGINE mapping, `InferenceOp::Counterfactual`, `RungLevel::Counterfactual`, a `pearl_junction` module — and **the Pearl operator not at all.** The one kernel carrying the counterfactual label XORs three hardcoded constants, ignores its context, and multiplies its confidence contribution by `0.0`.
 
 **Status:** FINDING (audited on the main thread, file-level). **Confidence:** High.