Wave 0: one impact_report from #2001 and #2002

.claude/board/INTEGRATION_PLANS.md

@@ -1,3 +1,8 @@
+## 2026-11-11 — D-CODEGRAPH-EXPAND-1: what the Codegraph still needs, and who supplies it → `.claude/plans/codegraph-expansion-v1.md`
+
+**Status:** PLAN. Eight slices CG-1..CG-8 on Linear `P-EXO-18` (EXO-233..EXO-239, EXO-241; channel EXO-232; handover EXO-240). **Board:** [STATUS_BOARD](STATUS_BOARD.md) D-CODEGRAPH-EXPAND. Follows #1999, #2000, #2001; supplies inputs to D-CODEGRAPH-0, D-CODEGRAPH-0-BIN and D-CGMM-0.
+**Confidence:** every gap is measured in #2000 / #2001; the egglog, DialEgg and Kythe parts are hypotheses, unread.
+
 ## 2026-11-10 — D-FOUNDRY-PARITY-1: DR × DT64 as an operational ontology → `.claude/plans/foundry-parity-v1.md`
 
 **Status:** ACTIVE; Level R lab landed (#1991) and P1a arm C per-store cost (#1995); P1b (min/argmin) open. Evidence matrix over 18 Foundry capability rows, missing-contract register G1–G6, roadmap P0–P5. [entry](entries/2026-11-10-foundry-parity-1-lab.md) · [P1a](entries/2026-11-10-foundry-parity-1-arm-c.md) · STATUS_BOARD D-FOUNDRY-* · Linear EXO-223.

.claude/board/STATUS_BOARD.md

@@ -360,6 +360,23 @@ Plan: `.claude/plans/d-soc-fence-v1.md`. Plan only; nothing runs yet.
 
 **Evidence boundaries:** D-SAG-6 #1760 merged docs; Math Foundry #1693/#1694 E1 lab merged; D-NFC #1753 native-first; #1775 D-DRAV draft / AV1–AV12 NOT RUN; MORK oracle with unresolved production licence/allocator; EXO-148 stable durable types unresolved. No complete distributed reasoning implementation or measured AI/data-center scaling claim.
 
+## D-CODEGRAPH-EXPAND — measured gaps after #2001, and their suppliers (2026-11-11)
+
+Plan: `.claude/plans/codegraph-expansion-v1.md`. Coordination: Linear `P-EXO-18`.
+
+| D-id | Deliverable | Status |
+|---|---|---|
+| **D-CODEGRAPH-RECON-2-A** | coverage-aware `impact_report`, `cg_query impact-report` | In PR: #2001 |
+| **D-CRAI-REPORT-1** | read-only review report generator, ndarray #422 admission case | In PR: #2001 |
+| **CG-1** | closure-ownership edge, graded POSSIBLE | Queued (decision needed): EXO-233 |
+| **CG-2** | extraction driver from `cargo metadata` (targets, dependents, tests) | Queued: EXO-234 |
+| **CG-3** | store provenance: extraction revision, relative generated paths | Queued (format decision needed): EXO-235 |
+| **CG-4** | edge vocabulary mapped to Kythe names (document) | Queued: EXO-236 |
+| **CG-5** | co-research: body semantics through R2IL and egglog | Queued (needs go-ahead): EXO-237 |
+| **CG-6** | review report follow-ups (mask-risc extraction, re-grade, placement, advisory CI) | Queued: EXO-238 |
+| **CG-7** | report-rs #33 transfer case | Other session: EXO-239 / EXO-185 |
+| **CG-8** | effects, target kind and cfg as Codegraph rows | Queued: EXO-241 |
+
 ## D-CODEGRAPH-0 — resident Codegraph: Charon → ruff → lance-graph + crai-rs (2026-11-02)
 
 Plan: [d-codegraph-0-resident-codegraph-v1.md](../plans/d-codegraph-0-resident-codegraph-v1.md). Entry: [gap map](entries/2026-11-02-d-codegraph-0-gap-map.md).

.claude/board/entries/2026-11-11-codegraph-recon-2.md

@@ -0,0 +1,25 @@
+# 2026-11-11 — Coverage-aware impact; report-rs #33 recovered from compiler facts
+
+**Status:** MEASURED (probe). `.claude/probes/2026-11-11-codegraph-recon-2/`. Follows
+`2026-11-11-codegraph-recon-1` (#2000). Board: EXO-229, EXO-230.
+
+`Codegraph::impact_report` (additive; `impact` unchanged) returns `impact`'s masks plus typed gaps:
+external consumers unobserved, targets not extracted or undeclared, excluded regions, unresolved
+dispatch, incomplete harvest, stale or unrecorded files, and `.rs` files under a read directory that
+`files.tsv` does not list. Missing coverage never enters `Graded.unknown`. A missing symbol carries
+its crate's gaps. 14 tests; every guard disable-verified red.
+
+report-rs `81705d9` through Charon (lib, default features, `crate::app` opaque): CRATE `COMPLETE`,
+yet 14 of 59 `src/` files unread (`iam.rs`, `main.rs`, `project_plan/*`, …). The store recovers the
+first #33 finding: `workbook_delta::WorkbookSource::poll` has no library caller and no path to
+`Ledger::ingest`; `Ledger::pull → source_fake::pull` is dynamic and reported UNKNOWN.
+
+Blind arms graded strictly against the EXO-185 key (12 items): source arm 12 correct; store arm
+7 correct, 3 partial, 2 unsupported; 0 wrong in both. The store's misses are configuration
+(feature-gated `iam`), targets (test callers) and manifest facts (Cargo.toml). n = 1 per arm.
+
+#2000 reproduces from its documented commands: rows equal, `machine-recovered.mmd` byte-identical,
+Charon recall column identical.
+
+OPEN: per-configuration stores (features, test targets); recording targets and opaque modules in
+the store instead of declaring them.

.claude/board/entries/README.md

@@ -25,10 +25,11 @@ index row, (3) no duplicate entry id. Checks 1 and 2 are deliberately
 opposite directions; the stranding this convention prevents shows up in
 exactly one of them, never both.
 
-597 entries, 2026-08-06 .. 2026-11-11.
+598 entries, 2026-08-06 .. 2026-11-11.
 
 | date | entry id | finding | file |
 |---|---|---|---|
+| 2026-11-11 | `codegraph-recon-2` |  | [2026-11-11-codegraph-recon-2.md](2026-11-11-codegraph-recon-2.md) |
 | 2026-11-11 | `codegraph-recon-1` |  | [2026-11-11-codegraph-recon-1.md](2026-11-11-codegraph-recon-1.md) |
 | 2026-11-10 | `lab-resolve-borrow-all` |  | [2026-11-10-lab-resolve-borrow-all.md](2026-11-10-lab-resolve-borrow-all.md) |
 | 2026-11-10 | `int8-direct-packed-b` |  | [2026-11-10-int8-direct-packed-b.md](2026-11-10-int8-direct-packed-b.md) |

.claude/plans/codegraph-expansion-v1.md

@@ -0,0 +1,116 @@
+# D-CODEGRAPH-EXPAND-1: what the Codegraph still needs, and who supplies it (plan v1)
+
+> **2026-11-11 · PLAN.** Coordination: Linear project **Codegraph · Collaboration Board** (`P-EXO-18`),
+> channel EXO-232. GitHub is canonical; Linear records owners, evidence links and open decisions.
+> Follows #1999, #2000 and #2001. Every gap below was measured there; every statement about
+> egglog, DialEgg and Kythe is a hypothesis until its slice has read the source.
+
+## 1. Question
+
+After #2001 the Codegraph answers callers, callees and impact over real Charon stores, and says what
+it could not see. Which gaps remain, which can be closed by hand-written edges, and where do R2IL,
+egglog (mlir-egglog, eggcc, DialEgg) and Kythe fit?
+
+## 2. Answer in one table
+
+| gap | measured | kind of fix | supplier | slice |
+|---|---|---|---|---|
+| closure bodies have no edge from their parent | 96 in foundry-parity-lab; caused a missed division | derived edge, graded POSSIBLE | Codegraph crate | CG-1 |
+| consumer crates not in the store | 13 of 14 consumers of `admit` | extract dependents | extraction driver | CG-2 |
+| test targets and examples not extracted | 48 test sites for `LaneBinding::check`, none resolved | extract those targets | extraction driver | CG-2 |
+| wrong Cargo target extracted | `bench` binary instead of the library | name the target; residuals are a refusal | extraction driver | CG-2 |
+| dependents list built by hand | a wrong-column list removed a real gap | take it from `cargo metadata` | extraction driver | CG-2 |
+| store does not record its revision | witnesses stamped with the wrong revision | provenance in the store | ruff_charon | CG-3 |
+| absolute paths in the store | same input, different digest at another target dir | paths relative to `OUT_DIR` | ruff_charon | CG-3 |
+| Charon error inside a crate | r2il is PARTIAL on a `dyn Fn` type alias | minimal case, upstream or typed gap | Charon | CG-3 |
+| effects are extracted but not queryable | 213 effect rows in the foundry store; the Codegraph reads none | reader in the Codegraph | Codegraph crate | CG-8 |
+| target kind, cfg and feature are not rows | "example-only" was read from `Cargo.toml` by hand; 32 inactive regions skipped | hand-rolled rows | `cargo metadata`; cfg source undecided | CG-8 |
+| no def-use, no loop multiplicity | "the divisor is `per_staff`" was read by eye | new row kind from LLBC | ruff_charon | CG-5 |
+| edge names are local | no shared vocabulary with other tools | mapping to Kythe edge kinds | document | CG-4 |
+| what a body means | divisions classified by a source-span regex | rules over a lowered body | R2IL + egglog, unproven | CG-5 |
+| review evidence is partial | mask-risc read as source; corrected review not re-graded | extract, test, re-grade | review report | CG-6 |
+| one repository only | no held-out manual review yet | second repository | report-rs #33 | CG-7 |
+
+**The split that decides everything else:** extraction gaps (CG-1 to CG-3) are closed by extractors
+and drivers. An e-graph proves that two expressions are equivalent; it cannot supply a call edge that
+was never emitted. So egglog is a candidate for body semantics (CG-5) only.
+
+## 3. Slices
+
+| slice | Linear | owner repo | depends on | gate |
+|---|---|---|---|---|
+| CG-1 closure-ownership edge | EXO-233 | lance-graph | #2001; a decision on mask vs separate relation | `can_cook_guard` impact includes `methods` as POSSIBLE; closure-free twin gains nothing; disable run red |
+| CG-2 extraction driver | EXO-234 | lance-graph, uses ruff_charon | #2001 | `admit` reports no `ConsumersNotInStore`; residuals or a non-COMPLETE crate give PARTIAL, never empty success |
+| CG-3 store provenance | EXO-235 | ruff, checked in lance-graph | a format decision | two extractions at different target dirs are byte-identical; a store at another revision is refused |
+| CG-4 Kythe edge vocabulary | EXO-236 | lance-graph, document | CG-1 | every row cites the Kythe schema and a Codegraph source line |
+| CG-5 body semantics, co-research | EXO-237 | research | operator go-ahead | one rule classifies the two ceiling divisions and the oracle quotient of #422; disable run red |
+| CG-6 review report follow-ups | EXO-238 | lance-graph; crai-rs owns semantics | #2001 | mask-risc store exists; builder has negative controls; two operator decisions recorded |
+| CG-7 report-rs #33 transfer | EXO-239 (record: EXO-185) | report-rs session | #2001; CG-2 if needed | strict grading against the held-out manual review |
+| CG-8 effects, target kind, cfg as rows | EXO-241 | lance-graph | #2001; shares `cargo metadata` with CG-2 | "which divisions does `max_quantities` reach" is answered inside the Codegraph crate; a missing effects file is a gap |
+
+Handover prompt for the CG-7 session: EXO-240.
+
+**Order.** CG-1, CG-2 and CG-8 first; they are small, measured and independent. CG-7 can start now from the
+#2001 branch. CG-3 waits for a format decision. CG-4 is a document and can run beside anything. CG-5
+needs a go-ahead and is research before it is a build.
+
+## 3a. The CG-5 probe (proposed by the report-rs session, checked 2026-11-11)
+
+Recover the ndarray #422 answer with no manual reading:
+
+1. target-kind and cfg rows (CG-8);
+2. def-use rows from LLBC through ruff_charon (a new row kind, so it needs the CG-3 format decision);
+3. a small egglog rule pack: reachable from the entry point, contains a division, divisor traces to
+   `per_staff`.
+
+**Pass:** it reports `arm_b.rs:245` and `method.rs:58`, each with a proof.
+**Fail:** removing the division in a scratch copy leaves the answer unchanged.
+
+Checked against source before adoption:
+- **Confirmed.** `mlir-egglog` here is a Python toy compiler for NumPy expressions; DialEgg is not
+  checked out; `egglog` and `eggcc` are. `crates/egglog-r2il-probe` exists. `KYTHE.md` records 24
+  agreeing symbols and no `ref/call` edges. The divisor is `per_staff: 4 + (m as i32 % 5)`
+  (`fixture.rs:105`).
+- **Corrected.** The store has ten predicate codes, not six. Division sites needed no token scan:
+  ruff_charon already emits them as `ASSERT DivisionByZero` effects, and what is missing is a reader
+  (CG-8). Charon is built on this machine but is not on `PATH`.
+- **Agreed.** No MLIR in the path: Rust does not lower to it, so it would be a third representation.
+  What transfers from DialEgg is the pattern, one egglog term per IR operation, applied to LLBC.
+  egglog derives and proves; it is a cold oracle arm, never a per-query path, because the Codegraph
+  already computes closure over masks.
+
+## 4. Mapping to plans and issues that already exist
+
+This plan adds no second Codegraph programme. It supplies measured inputs to these:
+
+| existing | what it already owns | relation to this plan |
+|---|---|---|
+| D-CODEGRAPH-0 (`d-codegraph-0-resident-codegraph-v1.md`, EXO-229) | Charon → ruff → resident rows, queries | CG-1 and CG-2 are its next increments |
+| D-CODEGRAPH-0-BIN (`d-codegraph-0-binary-lanes-v1.md`) | binary lanes, a provenance header, per-row `(artifact, FunDeclId)` | CG-3 is the text-store half of the same provenance question; decide them together |
+| D-CODEGRAPH-0-D | a local stdio MCP over the queries | not in this plan; `cg_query` is its CLI precursor |
+| D-CGMM-0 (`d-cgmm-*.md`, EXO-155) | Kythe-shaped immutable evidence, lazy demand, FieldViewDef, DT64 binding | CG-4 feeds D-CGMM-1 (source facts); CG-1 feeds D-CGMM-8 (evidence and call graph) |
+| EXO-85, EXO-84 | MeTTa / Datalog assimilation, native polyfill | CG-5 must not duplicate these; it asks one narrower question |
+| EXO-73, EXO-101 | recursion driver, datafrog parity | unaffected; the Codegraph closure is not a new recursion driver |
+| D-CMR-8 (`d-cmr-concept-chain-normalization-v1.md`) | equality-saturation probe, `egg` / `egglog` as references only | CG-5 reuses its stance: reference and probe, not a runtime |
+| `ascent-byods-dr-fold-polyfill-v1.md`, entry 2026-10-21 | earlier evaluation of egglog, datafrog and Ascent | CG-5 starts from that evaluation |
+| D-FOUNDRY-PARITY-1 (EXO-227) | G1 to G6 | CG-6 carries the open #422 verification |
+| EXO-230 | navigation and the review evidence packet | CG-6 |
+| EXO-185 | report-rs #33 | CG-7 |
+
+## 5. Constraints
+
+- No new graph database, no second Rust parser, no blocking CI reviewer.
+- These change only by a decision issue in `P-EXO-11`: the Charon and ruff_charon artifact formats,
+  the lance-graph-contract / ClassView API, DT64 admission, Quack / mask-RISC execution, XLOG
+  semantics, crai-rs review semantics.
+- A name-derived edge is POSSIBLE, never CONFIRMED.
+- Nothing from CG-5 enters a per-query path. Cold costs are reported in microseconds and are not gates.
+- Every guard has a test that fails when the guard is disabled.
+
+## 6. Open decisions
+
+1. May a name-derived closure edge enter `impact`'s masks, or is it a separate relation (CG-1)?
+2. May the ruff_charon store format gain a revision and relative paths, and is that decided together
+   with D-CODEGRAPH-0-BIN's provenance header (CG-3)?
+3. Go-ahead for the CG-5 co-research pass.
+4. Where the review report generator lives, and whether the advisory CI job is built (CG-6).

.claude/probes/2026-11-11-codegraph-recon-1/REPORT.md

@@ -241,3 +241,31 @@ GRAPH=1 crates/sag-ra-probe/target/release/sag-ra-probe "$PWD" > ra_graph.tsv
 cargo run --release --manifest-path crates/lance-graph-codegraph/Cargo.toml --example cg_query -- $STORE . sweep
 python3 .claude/probes/2026-11-11-codegraph-recon-1/recon.py score --store $STORE --src . --corpus corpus.tsv --ra ra_graph.tsv
 ```
+
+## Reproduction check (before merge)
+
+The documented commands were re-run from scratch into a fresh directory at `90fc5a7`: Charon and
+`ruff_charon import` on the four crates, then rust-analyzer `GRAPH=1`. The results were compared with
+the artifacts this report was built from.
+
+- `machine-recovered.mmd`, `reconciled.mmd` and `score.tsv` regenerate **byte-identical**, and
+  `cg_query sweep` gives the same 9,138 positions / 9,569 answered / 8,707 empty.
+- **Text rows:** byte-identical for dt64, quack and r2il. Contract's rows and `files.tsv` differ only
+  in the absolute path of two build-script outputs (`manifest_metadata.rs`, `ogit_namespace.rs` under
+  `CARGO_TARGET_DIR/…/build/lance-graph-contract/<hash>/out/`). Their content hashes are identical,
+  and after normalising that path the rows are identical.
+- **LLBC:** byte-identical except for one embedded `--dest-file` path.
+- **`rows.bin`:** differs only in its provenance block (the LLBC digest and the Charon config string,
+  which both carry that path) and in the header digest that covers it.
+- **rust-analyzer graph:** identical apart from its `*_ms` timing rows (0 of about 820k rows differ).
+
+**Finding:** the store is reproducible in content but not location-independent. Paths of generated
+files and the LLBC location are recorded verbatim, so the same input at a different `CARGO_TARGET_DIR`
+gives a different digest. Two consumers are affected differently:
+- **Refresh** compares store digests, so it treats the two stores as different.
+- **The freshness check** (`impact_report`) does not compare digests. It hashes each file listed in
+  `files.tsv`. A recorded path that no longer exists is reported as `MissingSource`; a path that still
+  exists with the same content gives no gap, whatever the store digest.
+
+Owner: EXO-229 (ruff_charon could record generated files relative to
+`OUT_DIR`).

.claude/probes/2026-11-11-codegraph-recon-2/GRADES.tsv

@@ -0,0 +1,26 @@
+#version 1
+#schema key	arm	grade	note
+K1.1	M	CORRECT	both identities, source_fake.rs:19 and workbook_delta/source.rs:210
+K1.1	C	PARTIAL	both identities CONFIRMED; defining lines UNKNOWN (the store records spans, not struct lines)
+K1.2	M	CORRECT	source_fake.rs:29 impl Source
+K1.2	C	CORRECT	IMPLEMENTS rows; witness source_fake.rs:39 (the pull fn, not the impl line)
+K1.3	M	CORRECT	inherent poll, returns Poll, no Source impl
+K1.3	C	CORRECT	no Source impl for the delta type, ABSENT-IN-SCOPE
+K1.4	M	CORRECT	Ledger::pull calls src.pull (333) then ingest (334); projection.rs:409 passes source_fake
+K1.4	C	CORRECT	ingest edge CONFIRMED at source.rs:334; dyn Source call reported UNKNOWN, not CONFIRMED
+K1.5	M	CORRECT	no src caller of poll; callers in tests/p20 and examples/workbook_sync.rs; lands in Workbook::ingest
+K1.5	C	PARTIAL	poll has 0 callers in the lib scope and no edge to Ledger::ingest; test/example callers not named (targets not extracted, reported as a gap)
+K1.6	M	CORRECT	does not claim poll has no callers at all
+K1.6	C	CORRECT	ABSENT-IN-SCOPE with tests/examples UNOBSERVED; never "no callers"
+K2.1	M	CORRECT	iam.rs:250, behind feature iam (lib.rs:22-23)
+K2.1	C	UNSUPPORTED	iam.rs reported unread, feature off, call UNOBSERVED
+K2.2	M	CORRECT	no authorize_scoped anywhere
+K2.2	C	CORRECT	ABSENT-IN-SCOPE, with the iam build UNOBSERVED
+K2.3	M	CORRECT	gating stated; default build does not compile iam
+K2.3	C	CORRECT	does not claim report-rs never authorizes
+K3.1	M	CORRECT	no dt64-lance dependency (Cargo.toml), no MapLog in any file
+K3.1	C	PARTIAL	no MapLog symbol in scope; the dependency fact is outside the store and not stated; lance-feature build left UNOBSERVED
+K3.2	M	CORRECT	IdentityFrame holds MapTable (frame.rs:55-57), advanced in commit (189-203)
+K3.2	C	CORRECT	MapTable::new frame.rs:69, advance frame.rs:195 in IdentityFrame::commit, called from ingest.rs:264
+K3.3	M	CORRECT	absence stated over every file and Cargo.toml, independent of features
+K3.3	C	UNSUPPORTED	did not frame it as a dependency-scope fact