P0 implemented: JDK 28 + Valhalla value classes + Panama, 409 checks green

The six vocabulary types (LaneId, MaskId, Ordinal, FacetId, RowRange,
WideFieldMask) are now public value record; bench/run.sh pins jdk-28+16 and
carries --release 28 --enable-preview. Measured on Temurin 28+16-ea: the full
gate suite is 409 checks / 0 failures both unflipped and flipped, all six
types report isValue() == true at runtime, and FFM stays final and flag-free.

Also fixes a cross-repo break that blocked the build entirely: lance-graph's
mask_risc::ExecError gained RangeOutOfBounds with the Pred::Range work and
exec_error_to_status maps it exhaustively, so lgj-abi did not compile against
lance-graph main. The new variant joins the documented bug-in-this-file family
and the doc enumeration is extended with it. Native suite: 187 tests green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HScwwezRdMxFfTs3WLG19d

Author: claude

.claude/board/EPIPHANIES.md

@@ -1,3 +1,44 @@
+## E-THE-VALHALLA-FLIP-COST-ONE-WORD-SIX-TIMES-AND-THE-GATES-DID-NOT-MOVE-1 (2026-09-19)
+
+**Finding, measured end to end today.** The P0 mandate (JDK 28 + Valhalla +
+Panama) is implemented. `/opt/jdks/jdk-28+16`, Temurin `28+16-ea`.
+
+| arm | result |
+|---|---|
+| JDK 28, sources unchanged, no preview | compiles; **409 checks, 0 failed** |
+| JDK 28, six types `public value record`, `--enable-preview` | compiles; **409 checks, 0 failed** |
+| `isValue()` on all six at runtime | **true**; `new LaneId(7) == new LaneId(7)` → true |
+| FFM without any preview flag | final; `SysVx64Linker`; `MemorySegment` round-trip clean |
+
+**The lab's central claim is now demonstrated on production sources:** the
+migration is one word, six times, and the gate suite does not move. It was
+previously proven only on `valhalla-lab`'s parallel vocabulary.
+
+**A cross-repo break found on the way, and it was blocking everything.**
+`lgj-abi` did not compile against current lance-graph `main`:
+`mask_risc::ExecError` gained `RangeOutOfBounds { lo, hi, n_rows }` with the
+`Pred::Range` work, and `exports.rs`'s `exec_error_to_status` maps `ExecError`
+**exhaustively**. Fixed by joining the documented *"would be a bug in THIS
+file, not in a caller's plan"* family (`LGJ_ERR_ALLOCATION_FAILED`) — the ABI
+lowering emits no `Pred::Range`, exactly as it emits no sum terminal and no
+blend — and the doc comment's enumeration was extended so the list stays
+exhaustive in prose too. **An exhaustive match across a repo boundary is a
+tripwire, not a safety net:** it converts an upstream additive change into a
+downstream build failure, and nothing in either repo's CI noticed, because no
+CI job here compiles the native crate.
+
+**Two false failures I nearly reported, both mine, both caught by reading.**
+The flipped suite showed `1 FAILED` twice. Both times it was
+`DoctrineFenceTest` refusing to run — it requires `java/src/main/java` AND
+`native/lgj-abi/src` relative to CWD, and I had run the flipped build from a
+scratch directory that had neither. The fence is *correct*: its first check is
+*"a fence that cannot find its corpus must fail, not skip."* Running the flip
+in the real tree (committed first, restored with `git checkout`) gave the true
+result. **A harness artifact and a regression look identical in a summary
+line** — this is the ruff trap "a disable that does not apply is
+indistinguishable from a guard that is not load-bearing", met from the other
+direction.
+
 ## E-VALHALLA-IS-THE-STORAGE-MEMBRANE-AND-IT-IS-MANDATORY-1 (2026-09-19)
 
 **Operator ruling.** *LGJ MUST use JDK 28 and MUST use Valhalla and Panama.*

CLAUDE.md

@@ -61,13 +61,16 @@ indistinguishable from owning the thing.
   Value classes change how cheaply a descriptor is carried; they never make a
   population crossable.
 
-**Status: MANDATED, NOT YET IMPLEMENTED.** No JDK 28 is installed in the
-current container (`/opt/jdks` does not exist; system `java` is 21.0.10) and
-`jdk.java.net` is blocked by the egress proxy, so the migration cannot be
-executed from here. Tracked with its concrete steps in
-`.claude/board/ISSUES.md` `ISS-LGJ-TOOLCHAIN-MUST-BE-JDK28-VALHALLA-PANAMA`.
-A session that finds a JDK 28 available does the migration; a session that
-does not must not restate the superseded JDK-26 framing as current.
+**Status: IMPLEMENTED 2026-09-19, gates green.** `/opt/jdks/jdk-28+16`
+(Temurin `28+16-ea`). The six vocabulary types — `LaneId`, `MaskId`,
+`Ordinal`, `FacetId`, `RowRange`, `WideFieldMask` — are `public value record`,
+all report `isValue() == true` at runtime, and the full suite is **409 checks,
+0 failures** under `--release 28 --enable-preview` against a freshly built
+`liblgj_abi.so` (abi 0.11, `ndarray::simd avx512`) — byte-for-byte the same
+409 as the unflipped baseline on the same JDK. `bench/run.sh` carries the pin
+and the flag. Measured facts and the obtain route (most JDK hosts are
+egress-blocked here; GitHub release *download* paths are not) live in
+`.claude/knowledge/jdk-toolchain-facts.md`.
 
 ## The mask-native invariant (operator-ruled, 2026-08-18)
 

bench/run.sh

@@ -10,7 +10,7 @@ set -euo pipefail
 BENCH="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$BENCH/.." && pwd)"
 
-JDK="${JDK:-/opt/jdks/jdk-26.0.2}"
+JDK="${JDK:-/opt/jdks/jdk-28+16}"   # P0: JDK 28 + Valhalla (JEP 401, preview) + Panama FFM
 LIB_DIR="${LIB_DIR:-$ROOT/target/release}"
 
 OUT="$BENCH/out"
@@ -29,13 +29,14 @@ fi
 
 echo "== compiling the library API"
 rm -rf "$OUT"; mkdir -p "$OUT/api" "$OUT/bench" "$BENCH/results"
-"$JDK/bin/javac" -d "$OUT/api" $(find "$ROOT/java/src/main/java" -name '*.java')
+"$JDK/bin/javac" --release 28 --enable-preview -d "$OUT/api" $(find "$ROOT/java/src/main/java" -name '*.java')
 
 echo "== compiling the benchmarks (annotation processing ON: JMH needs it to emit BenchmarkList)"
 # -proc:full is REQUIRED on JDK 23+: annotation processing is off by default there, and without it
 # JMH's generator never runs and the harness fails at startup with "Unable to find the resource:
 # /META-INF/BenchmarkList" — which looks like a classpath problem and is not one.
 "$JDK/bin/javac" \
+    --release 28 --enable-preview \
     -proc:full \
     --add-modules jdk.incubator.vector \
     -cp "$CP_LIBS$OUT/api" \
@@ -45,6 +46,7 @@ echo "== compiling the benchmarks (annotation processing ON: JMH needs it to emi
 echo "== running"
 cd "$BENCH"
 JAVA_TOOL_OPTIONS= "$JDK/bin/java" \
+    --enable-preview \
     --enable-native-access=ALL-UNNAMED \
     --add-modules jdk.incubator.vector \
     -Dstdout.encoding=UTF-8 \

java/src/main/java/com/adaworldapi/lancegraph/FacetId.java

@@ -18,7 +18,7 @@
  *
  * @param index zero-based facet index, {@code 0..32} exclusive (a row has exactly 32 facets)
  */
-public record FacetId(int index) {
+public value record FacetId(int index) {
 
     /** Facets per row — 32, the canonical `32 × 16 B = 512 B` row (abi.md §11). */
     public static final int COUNT = 32;

java/src/main/java/com/adaworldapi/lancegraph/LaneId.java

@@ -28,7 +28,7 @@
  *
  * @param index zero-based lane index within its resource
  */
-public record LaneId(int index) {
+public value record LaneId(int index) {
 
     public LaneId {
         if (index < 0) {

java/src/main/java/com/adaworldapi/lancegraph/MaskId.java

@@ -20,7 +20,7 @@
  *
  * @param token the opaque registry token
  */
-public record MaskId(long token) {
+public value record MaskId(long token) {
 
     /** Which registry slot. Diagnostic only. */
     public int slot() {

java/src/main/java/com/adaworldapi/lancegraph/Ordinal.java

@@ -16,7 +16,7 @@
  *
  * @param value zero-based position
  */
-public record Ordinal(int value) {
+public value record Ordinal(int value) {
 
     public Ordinal {
         if (value < 0) {

java/src/main/java/com/adaworldapi/lancegraph/RowRange.java

@@ -16,7 +16,7 @@
  * @param start        first row, inclusive
  * @param endExclusive one past the last row
  */
-public record RowRange(long start, long endExclusive) {
+public value record RowRange(long start, long endExclusive) {
 
     public RowRange {
         if (start < 0) {

java/src/main/java/com/adaworldapi/lancegraph/WideFieldMask.java

@@ -31,7 +31,7 @@
  * when their bits are equal, never because they are the same object — nothing here relies on
  * reference equality, so flattening changes no observable behaviour.
  */
-public record WideFieldMask(long value) {
+public value record WideFieldMask(long value) {
 
     private static final int FACET_COUNT = 32;