toolchain: JDK 28 installed and measured; the Valhalla flip is proven on production sources

Temurin 28+16-ea at /opt/jdks/jdk-28+16. Measured, not read: JEP 401 is
preview-gated on this build (isValue() true for value record and value class,
substitutability holds); FFM is final and flag-free (SysVx64Linker). All 37
production sources compile under JDK 28 as-is, and all six vocabulary types
flip with a one-word change and compile under --enable-preview with
isValue() == true at runtime.

Records the obtain route, since most are blocked here: apt, the Adoptium API
and every JDK distribution host are 403 at the egress gateway; anonymous git
ls-remote and GitHub release download paths pass. The EA asset name drops the
28U prefix.

Unblocks ISS-LGJ-TOOLCHAIN-MUST-BE-JDK28-VALHALLA-PANAMA: what remains is the
gate suite against a fresh liblgj_abi.so with re-pinned allocation numbers,
the build scripts carrying the preview flag, and valhalla-lab re-scoped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HScwwezRdMxFfTs3WLG19d

Author: claude

.claude/board/ISSUES.md

@@ -1,3 +1,26 @@
+## ISS-LGJ-TOOLCHAIN-MUST-BE-JDK28-VALHALLA-PANAMA — UNBLOCKED; JDK 28 installed and the flip proven (2026-09-19)
+
+⊘ The entry below says the migration is blocked because no JDK 28 can be
+fetched in this container. **That was true of apt and of every JDK
+distribution host — and wrong as a conclusion.** GitHub release *download*
+paths pass the gateway (`releases.atom` and the API do not), so
+`git ls-remote` gave the tag and a direct download gave the tarball:
+**`/opt/jdks/jdk-28+16`** (Temurin `28+16-ea`). Route, asset name and every
+probe are recorded in `.claude/knowledge/jdk-toolchain-facts.md` § "JDK 28 —
+INSTALLED AND MEASURED". Steps 1 and 2 of the plan below are **done and
+green**: JEP 401 is preview-gated on this build, FFM is final and flag-free,
+and all six vocabulary types flip with one word and report
+`isValue() == true` at runtime **on the production sources**, which compile
+clean under JDK 28 both as-is and flipped.
+
+**What remains, and it is only this:** the flip is proven in a scratch copy,
+not committed — landing it needs the gate suite (`ApiSurfaceTest`,
+`GraphHopTest` allowlist + G2, `AbiContractTest`, `g11_contract_import_fence`,
+the allocation gates) run against a freshly built `liblgj_abi.so` with
+re-pinned allocation numbers, plus the build scripts carrying
+`--enable-preview` repo-wide, plus `valhalla-lab`'s A/B re-scoped in the same
+PR. Nothing architectural is open.
+
 ## ISS-LGJ-TOOLCHAIN-MUST-BE-JDK28-VALHALLA-PANAMA
 
 **Status:** OPEN. **Filed:** 2026-09-19. **Severity:** high — the repo's

.claude/knowledge/jdk-toolchain-facts.md

@@ -19,6 +19,56 @@
   build baseline (SIGILL trap if omitted downstream — see `abi.md` §"SIGILL
   trap"). Any crate depending on `ndarray`'s AVX2 backend must mirror this.
 
+## JDK 28 — INSTALLED AND MEASURED (2026-09-19)
+
+**`/opt/jdks/jdk-28+16`** — Temurin `28+16-ea`, `openjdk version "28-beta"`,
+GA date 2027-03-23, build `Temurin-28+16-202609171655`. Verified by execution
+in this container, not by reading a release note:
+
+| probe | result |
+|---|---|
+| `value record LaneId(int)` / `value class` compiled with **no** flag | **rejected** — *"value classes are a preview feature and are disabled by default"* |
+| same source with `--release 28 --enable-preview` | compiles |
+| `LaneId.class.isValue()` / `MaskId.class.isValue()` | **true** |
+| `new LaneId(7) == new LaneId(7)` | **true** (substitutability) |
+| `Arena.ofConfined()` + `MemorySegment` get/set, **no** preview flag | works, `0xdeadbeef` round-tripped |
+| `Linker.nativeLinker()` | `SysVx64Linker` |
+
+**So on JDK 28: Panama FFM is FINAL and flag-free; JEP 401 is PRESENT and
+preview-gated.** `--enable-preview` is therefore repo-wide under the P0
+mandate, not optional.
+
+### The production flip is PROVEN, not projected
+
+Measured the same day, on a scratch copy of `java/src/main` (37 files):
+
+- **As-is under JDK 28, no preview, no source change: compiles clean.**
+- **All six vocabulary types flip with one word** — `public record X` →
+  `public value record X` for `LaneId`, `MaskId`, `Ordinal`, `FacetId`,
+  `RowRange`, `WideFieldMask` — and the whole tree compiles under
+  `--release 28 --enable-preview`.
+- At runtime **all six report `isValue() == true`**, and substitutability
+  holds. This is the lab's one-word claim, now demonstrated on the
+  PRODUCTION sources rather than on the lab's parallel vocabulary.
+
+### How it was obtained (the route matters — most are blocked)
+
+The egress gateway answers **403 to CONNECT** for `api.adoptium.net`,
+`packages.adoptium.net`, `repos.azul.com`, `apt.corretto.aws`,
+`jdk.java.net` and the launchpad PPAs, so **apt sources and the Adoptium API
+cannot reach a JDK here**; Ubuntu noble's own repos stop at `openjdk-25-jdk`
+and pypi `jdk4py` at 25.0.2.1. What DOES pass: **anonymous `git ls-remote`**
+(gave the tag list, newest `jdk-28+16-ea-beta`) and **GitHub release
+DOWNLOAD paths** (`github.com/.../releases/download/...` → 404 for a wrong
+name, i.e. passed through; `releases.atom` and `expanded_assets` → 403).
+The EA asset name **drops the `28U`**:
+
+```
+https://github.com/adoptium/temurin28-binaries/releases/download/jdk-28%2B16-ea-beta/OpenJDK-jdk_x64_linux_hotspot_28_16-ea.tar.gz
+```
+
+A future session that needs a JDK here uses that route, not apt.
+
 ## JDKs available locally
 
 | Path | Version | FFM (`java.lang.foreign`) | JEP 401 value classes | Vector API |