Skip to content

Commit d478dee

Browse files
AdaWorldAPIAdaWorldAPI
authored
Merge pull request #980 from AdaWorldAPI/claude/d-acr-0-attention-mask-audit
D-ACR-0: attention_mask audit — EXISTS-UNCALLED, and a rename register file wearing the name
2 parents c2c6510 + 46e5358 commit d478dee

3 files changed

Lines changed: 305 additions & 2 deletions

File tree

‎.claude/ATTENTION_MASK_AUDIT_2026_08_21.md‎

Lines changed: 222 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,222 @@
1+
# D-ACR-0 — `attention_mask` audit against piece E
2+
3+
> **Deliverable:** `alpha-channel-rung-overlay-v1.md` §4, `D-ACR-0`.
4+
> **Scope:** report only, no code — as the deliverable specifies.
5+
> **Falsifier:** *"the audit names a caller, or records EXISTS-UNCALLED."*
6+
> **Verdict: EXISTS-UNCALLED — and the shipped type is a DIFFERENT MECHANISM
7+
> wearing the name.** Both halves matter; the second is the load-bearing one.
8+
>
9+
> Every claim below is a read of the file named, this session. Every "absent"
10+
> is a grep that returned nothing, with the grep stated.
11+
12+
## 1. The question D-ACR-0 asks
13+
14+
Piece E of §1 graded `cognitive-shader-driver/src/attention_mask.rs` +
15+
`attention_mask_actor.rs` as *"shipped; **unaudited for this use**"* — the use
16+
being the operator's **eye-tracking residue carrier**: *"record WHERE the eye
17+
looked, not what it saw"*, an ephemeral overlay whose rows are the addresses a
18+
search visited.
19+
20+
So the audit's question is not "does it work" but **"is the shipped mask a
21+
residue carrier, or something else wearing the name?"**
22+
23+
## 2. Callers — measured
24+
25+
```
26+
grep -rn "AttentionMask|attention_mask" --include=*.rs . # workspace, minus target/
27+
```
28+
29+
Three hits outside the two files themselves. All three are non-consumers:
30+
31+
| hit | what it actually is |
32+
|---|---|
33+
| `lib.rs:93` `pub mod attention_mask;` | module declaration |
34+
| `lib.rs:94` `pub mod attention_mask_actor;` | module declaration |
35+
| `mailbox_soa.rs:11` | a **doc comment stating the opposite**: *"wrap, **NO AttentionMask/LRU**, NO cross-cycle rollup — those are W6's"* |
36+
37+
Sibling repos, same grep: `MedCare-rs` 0 files · `OGAR` 0 files ·
38+
`ndarray` 0 files.
39+
40+
**No caller exists anywhere.** The one file that names it in code-adjacent
41+
prose does so to declare that it does *not* use it. `EXISTS-UNCALLED` is
42+
recorded, per the falsifier's second branch.
43+
44+
## 3. What the type actually is
45+
46+
`AttentionMaskSoA` (`attention_mask.rs:46`):
47+
48+
```rust
49+
pub struct AttentionMaskSoA {
50+
pub entries: Vec<AttentionMaskEntry>, // (mailbox_id, w_slot, active, last_touched_cycle, plasticity_residual)
51+
pub max_active: usize,
52+
pub current_cycle: u32,
53+
}
54+
```
55+
56+
Its whole surface is `touch` / `evict_lru` / `tick` / `active_count` /
57+
`is_active` / `entries`. Read plainly: **an LRU admission-control table keyed
58+
by `MailboxId`, holding a 6-bit `w_slot` per entry.**
59+
60+
Three properties decide the verdict:
61+
62+
- **Keyed by mailbox, not by row or address.** The key is `MailboxId`
63+
(`= u32`, from `contract::collapse_gate`). There is no `NodeGuid`, no
64+
`NiblePath`, no classid, no row index anywhere in the file.
65+
- **It is not a mask.** `entries: Vec<_>` with `.iter().find(...)` in `touch`,
66+
`.iter().filter(...).min_by_key(...)` in `evict_lru`, `.iter().filter().count()`
67+
in `active_count`, `.iter().any()` in `is_active` — **every operation is an
68+
O(n) linear scan over a `Vec`.** No bitset, no set algebra, no
69+
union/intersect/andnot.
70+
- **It records occupancy, never a trajectory.** `last_touched_cycle` is
71+
overwritten on each `touch` (`:88`). The previous value is gone. A residue
72+
carrier must answer *"where did the eye look"* — this type can only answer
73+
*"is this mailbox currently claimed, and how stale."*
74+
75+
## 4. The name collision, traced to its origin
76+
77+
The shipped type is not a half-built residue carrier. It is a **complete
78+
implementation of a different design**, and that design is on the board:
79+
`causaledge64-mailbox-rename-soa-v1.md` §4 —
80+
81+
> *"**AttentionMask SoA — the session-ephemeral rename register file.**"*
82+
83+
Its job there is the exact inverse of a residue overlay:
84+
85+
| | rename register file (what shipped) | residue carrier (piece E) |
86+
|---|---|---|
87+
| direction | **wide identity → narrow slot** | **visited address → recorded** |
88+
| why LRU | slots are **scarce** (5-bit G / 6-bit W / 8-bit style) and must be recycled | — nothing is scarce; the overlay is discardable whole |
89+
| keyed by | `MailboxId` | the graph's own address (`NodeGuid`/`NiblePath`) |
90+
| answers | *"which slot currently holds this identity"* | *"where did rung-n look"* |
91+
| history | none — `last_touched_cycle` is overwritten | the point of the thing |
92+
93+
The originating plan is explicit that CE64 needs this because a `u32` OGIT
94+
domain cannot fit in 5 bits: the rename table is what lets a wide identity ride
95+
in a narrow field. **That is a compression concern, not an attention concern.**
96+
The word "attention" in the name refers to *which identities are currently
97+
resident in the scarce slot file* — a cache-occupancy sense, not the
98+
eye-tracking sense §0 uses.
99+
100+
This is the **fourth homonym collision** this arc has had to separate, after
101+
§3a's four "witness" surfaces, §3k's four "nibble" encodings, and §3l's three
102+
"hydration" meanings. Same discipline applies: the shared word is not evidence
103+
of a shared mechanism.
104+
105+
**The dependency map already warned about exactly this**
106+
(`bindspace-mailbox-soa-dependency-map-v1.md:108`, `:191`):
107+
108+
> *"`attention_mask.rs` / `attention_mask_actor.rs` define their OWN
109+
> `AttentionMaskSoA` — share only the `MailboxId`/`w_slot` vocabulary.
110+
> **Do NOT conflate** with `MailboxSoA<N>`."*
111+
> *"independent `AttentionMaskSoA`; do not fold into the migration."*
112+
113+
That warning was aimed at a different conflation (vs `MailboxSoA`), but it
114+
generalises, and it is the reason piece E's grade was *"unaudited"* rather
115+
than *"shipped for this"*.
116+
117+
## 5. Incompleteness even against its OWN spec
118+
119+
Worth recording so a future session does not read "shipped" as "finished":
120+
121+
| the rename-SoA plan §4 specifies | what shipped |
122+
|---|---|
123+
| `g_slots: [Option<u32>; 32]` (5-bit OGIT domain) | **absent** |
124+
| `w_slots: [Option<WitnessId>; 64]` (6-bit witness palette) | present only as a bare `w_slot: u8` field — no `WitnessId`, no slot table |
125+
| `style_slots: [Option<StyleId>; 256]` (8-bit style) | **absent** |
126+
| fixed-size arrays (the point — a register FILE) | a growable `Vec` |
127+
| *"Owned by a singleton ractor actor `AttentionMaskActor`"* | trait scaffold only — `attention_mask_actor.rs:2`: *"concrete ractor binding is sprint-12+ work"* |
128+
129+
Two further dead surfaces, both measured:
130+
131+
- **`plasticity_residual: u8`** — *"reserved for sprint-12+ learning signal"*.
132+
Grep across the workspace returns exactly two hits: its declaration
133+
(`:36`) and its initialisation to `0` (`:98`). **It is never read and never
134+
written non-zero.** A field that only ever holds its zero value carries no
135+
information — the same shape as the `closed_class_guess` 150/150 defect the
136+
falsifiability rule names.
137+
- **`AttentionMaskMsg::BindReply`** — its handler is
138+
`AttentionMaskOutcome::NoOp` (`actor:97`). The variant exists, carries three
139+
fields, and does nothing. `reply_to: u32` is discarded via `..` in the one
140+
pattern that matches it.
141+
142+
## 6. The singleton problem — the design predates a ruling that killed it
143+
144+
§4 of the originating plan says the actor is a **singleton** ("one global
145+
instance per session"). That is the shape the V3 mailbox ruling removed:
146+
**no singleton CollapseGate; one mailbox = one kanban board as tenant**
147+
(`CLAUDE.md` ★ V3 entry point; `E-CE64-MB-4` one-writer-per-mailbox).
148+
149+
So the unfinished ractor binding is not merely unfinished — **finishing it as
150+
specified would rebuild a singleton the substrate deliberately eliminated.**
151+
Anyone picking `attention_mask_actor.rs` up should treat "sprint-12+ work" as
152+
superseded, not queued.
153+
154+
## 7. Consequences for `D-ACR-1`
155+
156+
The audit's purpose is to tell `D-ACR-1` what it can reuse. The answer is
157+
**nothing structural**, and that is a cleaner starting position than a partial
158+
fit would have been:
159+
160+
1. **Do not extend `AttentionMaskSoA`.** It is a correct implementation of a
161+
different contract, uncalled, keyed by the wrong thing, and O(n) per
162+
operation. Extending it would fold two mechanisms into one type — the
163+
conflation §3a/§3k/§3l each had to unpick.
164+
2. **Do not reuse the name.** A fifth homonym is avoidable here at zero cost:
165+
`RowFocusMask` is already the board's own name for the primitive (S3.1b),
166+
and it says what it is — a mask, over rows.
167+
3. **The governing choice rules out the shipped shape anyway.** §3k's
168+
operator-stated default is
169+
`Mask × ClassView/WideFieldMask → Mask`, bulk, *"never per-row, never
170+
per-frontier-size"*. `AttentionMaskSoA` is a per-entry linear scan — the
171+
precise shape `lance-graph-java`'s `Predicate.java` doc calls
172+
*"catastrophic"* (*"64,000 objects and 64,000 crossings for 64,000
173+
entities"*). It is not a starting point that can be optimised into
174+
compliance; it is the anti-pattern named.
175+
176+
### A measured constraint `D-ACR-1` must design around
177+
178+
`D-ACR-1`'s scope line says *"composable with `WideFieldMask` per S3.1b"*.
179+
Measured this session (`class_view.rs:221`, `:251`, `:510`):
180+
181+
- `WideFieldMask` positions are **`u8`** — the universe is **capped at 256**,
182+
with a loud refusal (`WideMaskCapError::UniverseExceedsSocCap`) above it,
183+
*"never a silent drop or truncation."*
184+
- It has real set algebra (`union`, `intersect`, `with`, `has`,
185+
`from_positions`, `EMPTY`).
186+
- Its sibling `FieldMask` is `u64` with `MAX_FIELDS = 64`, and positions
187+
`>= 64` are **silently dropped** by `from_positions` / `with` (`:88`,
188+
`:100`) — documented as deliberate, but a trap if confused with the wide
189+
form.
190+
191+
**So "composable" cannot mean "the same type".** `WideFieldMask` addresses
192+
**field positions** (≤ 256 of them); a `RowFocusMask` addresses **rows**
193+
(a population, unbounded). These are two different bases, and composing them
194+
is precisely the latent-third-basis problem the plan already parked:
195+
196+
> §6 **Y2** — *"`RowFocusMask × WideFieldMask` basis collision — the HTT
197+
> **X4** latent-third-basis problem applies verbatim the moment a focus mask
198+
> meets a field mask"* — *"X4 is audited, not solved, deliberately."*
199+
200+
The audit's contribution is to make that concrete rather than latent: the
201+
collision is not a subtle semantic worry, it is a **cardinality mismatch with
202+
a hard, loud cap on one side.** `D-ACR-1` must state which basis it is in and
203+
what the composition operator means, before it composes anything — otherwise
204+
the first `RowFocusMask` over a population > 256 either refuses loudly (if it
205+
borrows `WideFieldMask`'s cap) or drops silently (if it borrows `FieldMask`'s
206+
rule). Neither is a design; both are an inherited accident.
207+
208+
## 8. Verdict
209+
210+
| question | answer |
211+
|---|---|
212+
| Does a caller exist? | **No.** `EXISTS-UNCALLED`, workspace-wide + three sibling repos. |
213+
| Is it a residue carrier? | **No.** It is a **rename register file** (`causaledge64-mailbox-rename-soa-v1.md` §4) — wide identity → scarce narrow slot, LRU because slots are scarce. |
214+
| Is it a mask? | **No.** `Vec` + linear scan; no bitset, no set algebra. |
215+
| Is it complete against its own spec? | **No.** 2 of 3 slot tables absent; `Vec` not fixed array; ractor binding never built; one field write-once-zero; one message variant a NoOp. |
216+
| Can `D-ACR-1` build on it? | **No** — and it should not try. Piece D stays what §1 called it: *"the only one that is a missing primitive."* |
217+
218+
**Piece E's grade is corrected from *"shipped; unaudited for this use"* to
219+
*"shipped for a DIFFERENT use; uncalled; not a basis for piece D."*** Six of
220+
nine pieces still exist or are planned (§1's count is unchanged — E existing
221+
was never the claim that E fits); what changes is that E is now known not to
222+
serve D, so `D-ACR-1` starts clean instead of starting from an assumed reuse.

‎.claude/board/EPIPHANIES.md‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,84 @@
1+
## 2026-08-21 — E-ATTENTION-MASK-IS-A-RENAME-REGISTER-FILE-NOT-A-RESIDUE-CARRIER-1 — the fourth homonym collision of this arc, and the only one where the shipped type is COMPLETE for a different contract
2+
3+
**Status:** FINDING (D-ACR-0, report-only deliverable; every claim a read of
4+
the file named or a stated grep). **Confidence:** High — the caller count is a
5+
workspace-wide grep plus three sibling repos; the origin is the shipped type's
6+
own originating plan, quoted.
7+
8+
`alpha-channel-rung-overlay-v1.md` §1 piece E graded
9+
`cognitive-shader-driver/src/attention_mask.rs` + `attention_mask_actor.rs`
10+
*"shipped; unaudited for this use"* — the use being the operator's
11+
eye-tracking residue carrier. The audit
12+
(`.claude/ATTENTION_MASK_AUDIT_2026_08_21.md`) returns **both** branches of the
13+
falsifier at once, and the second is the load-bearing one.
14+
15+
**EXISTS-UNCALLED.** Three hits outside the two files, all non-consumers: two
16+
`pub mod` lines in `lib.rs`, and `mailbox_soa.rs:11` — a doc comment stating
17+
the *opposite* (*"wrap, **NO AttentionMask/LRU**, NO cross-cycle rollup"*).
18+
`MedCare-rs` / `OGAR` / `ndarray`: 0 files each.
19+
20+
**And it is a different mechanism wearing the name.** The shipped type is a
21+
complete implementation of `causaledge64-mailbox-rename-soa-v1.md` §4 —
22+
*"AttentionMask SoA — the session-ephemeral **rename register file**"*: wide
23+
identity (`u32` OGIT domain / `WitnessId` / `StyleId`) → scarce narrow slot
24+
(5-bit G / 6-bit W / 8-bit style), LRU **because slots are scarce**. That is a
25+
COMPRESSION concern. "Attention" there means *which identities are currently
26+
resident in the slot file* — cache occupancy, not where the eye looked. A
27+
residue carrier runs the opposite direction (visited address → recorded), is
28+
keyed by the graph's own address rather than `MailboxId`, and is discardable
29+
whole precisely because nothing is scarce.
30+
31+
Three properties settle it independently of provenance: keyed by `MailboxId`
32+
(no `NodeGuid`/`NiblePath`/classid anywhere in the file); **not a mask** —
33+
`Vec<AttentionMaskEntry>` with `.iter().find` / `.min_by_key` / `.filter().count`,
34+
i.e. O(n) linear scan per operation, no bitset, no set algebra; and it records
35+
occupancy, never a trajectory (`last_touched_cycle` is overwritten on each
36+
`touch`, so the previous look is gone).
37+
38+
**Why this one is worse than the three homonyms before it.** §3a separated four
39+
"witness" surfaces, §3k four "nibble" encodings, §3l three "hydration"
40+
meanings — in each, the collision was between things that plainly did
41+
different jobs once named. Here the shipped type is *finished and correct for
42+
its own contract*, so it reads as available. The near-miss is the trap:
43+
"shipped" invited reuse, and reuse would have folded a compression register
44+
file into an attention overlay.
45+
46+
**Consequence, recorded so D-ACR-1 does not re-derive it:** piece E regrades
47+
from *"shipped; unaudited for this use"* to ***"shipped for a DIFFERENT use;
48+
uncalled; not a basis for piece D."*** §1's six-of-nine count is unchanged —
49+
E existing was never the claim that E fits. `D-ACR-1` starts clean, which is a
50+
better position than a partial fit; and the governing choice rules the shipped
51+
shape out anyway, since a per-entry linear scan is the exact
52+
*"64,000 objects and 64,000 crossings"* shape `lance-graph-java`'s
53+
`Predicate.java` calls catastrophic, not a starting point that optimises into
54+
`Mask × ClassView/WideFieldMask → Mask` compliance.
55+
56+
**Two dead surfaces measured in passing**, both matching shapes the
57+
falsifiability rule already names: `plasticity_residual: u8` is declared and
58+
initialised to `0` and **never read, never written non-zero** (two grep hits
59+
total) — a field that only holds its zero value carries no information, the
60+
`closed_class_guess` 150/150 shape; and `AttentionMaskMsg::BindReply` carries
61+
three fields to a handler that returns `NoOp`.
62+
63+
**One superseded plan step, flagged rather than queued:** the originating §4
64+
specifies a **singleton** actor (*"one global instance per session"*), and
65+
`attention_mask_actor.rs:2` still calls the concrete ractor binding
66+
*"sprint-12+ work"*. Finishing it as written would rebuild the singleton the
67+
V3 mailbox ruling removed (`E-CE64-MB-4`, one-writer-per-mailbox). Treat that
68+
line as superseded, not pending.
69+
70+
**A measured constraint this hands to D-ACR-1.** Its scope says *"composable
71+
with `WideFieldMask`"*. Measured: `WideFieldMask` positions are `u8` —
72+
universe capped at **256**, with a loud `UniverseExceedsSocCap` refusal above
73+
it; its sibling `FieldMask` is `u64`/`MAX_FIELDS = 64` and **silently drops**
74+
positions `>= 64`. A row population is neither. So "composable" cannot mean
75+
"the same type", and §6 **Y2**'s parked `RowFocusMask × WideFieldMask` basis
76+
collision is not a subtle semantic worry — it is a **cardinality mismatch with
77+
a hard, loud cap on one side**. D-ACR-1 must state its basis and its
78+
composition operator before composing, or it inherits one of two accidents:
79+
loud refusal past 256 (borrowing the wide cap) or silent truncation past 64
80+
(borrowing the narrow rule).
81+
182
## 2026-08-21 — E-HHTL-IS-MINTED-IN-THE-ARTIFACT-NOBODY-CITES-1 — "zero on every baked row in both production bakes" is precise about the two it names and silent about the third, where the five OBO namespaces are 100% minted
283

384
**Status:** FINDING (measured directly on the pinned `.soa` bytes, SHA-256

‎.claude/board/STATUS_BOARD.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,8 @@ the rest.
5050

5151
| D-id | Scope | Status | Falsifier |
5252
|---|---|---|---|
53-
| D-ACR-0 | Audit `attention_mask.rs`/`attention_mask_actor.rs`: residue carrier, or a name collision? Report only | **Next** | names a caller, or records EXISTS-UNCALLED |
54-
| D-ACR-1 | `RowFocusMask` — the one missing primitive (S3.1b names it; no crate contains it) | Queued — gates on D-ACR-0 | can-fire AND can-stay-silent on non-trivial input |
53+
| D-ACR-0 | Audit `attention_mask.rs`/`attention_mask_actor.rs`: residue carrier, or a name collision? Report only | **Shipped** 2026-08-21 — `.claude/ATTENTION_MASK_AUDIT_2026_08_21.md`. Verdict **EXISTS-UNCALLED** + a name collision: the shipped type is a *rename register file* (`causaledge64-mailbox-rename-soa-v1.md` §4), not a residue carrier | recorded EXISTS-UNCALLED (0 callers workspace-wide + 3 sibling repos); piece E regraded — not a basis for D-ACR-1 |
54+
| D-ACR-1 | `RowFocusMask` — the one missing primitive (S3.1b names it; no crate contains it) | **Next** — D-ACR-0 cleared it; starts clean (no reuse of `AttentionMaskSoA`). Must state its basis first: `WideFieldMask` is `u8`-capped at 256 positions (loud refusal above), `FieldMask` silently drops `>= 64` — a row population is neither | can-fire AND can-stay-silent on non-trivial input |
5555
| D-ACR-3 | The one-way invariant as a test: no ontology-owned write traces to a patient-tagged read through ANY call path (corrected from write-authorization-only after CodeRabbit found a session-derived value can flow to the ontology owner via a shared parameter/return, then be written as the owner's own act) | Queued — gates on D-ACR-1 | a write whose call graph includes a session-tagged read is the bug, even if the write itself is authored by the ontology owner |
5656
| D-ACR-2 | Mint the Rung-ladder rail | Queued — gates on operator mint decision (HTT §8 Q3) | `rail_carving` gains its first non-default consumer |
5757
| D-ACR-4 | Second-order row at the same address, separate table | Queued | a rung-2 read reconstructs where rung-1 looked, on a fixture with an independent answer |

0 commit comments

Comments
 (0)