diff --git a/.arxiv/2026-10_sag1509_information_metagraph_optimization_excerpts.md b/.arxiv/2026-10_sag1509_information_metagraph_optimization_excerpts.md
new file mode 100644
index 000000000..38172daa4
--- /dev/null
+++ b/.arxiv/2026-10_sag1509_information_metagraph_optimization_excerpts.md
@@ -0,0 +1,53 @@
+# Source excerpts: Shannon, PLN, pattern surprise, typed metagraph folding and safe program rewrites
+
+**Date:** 2026-10-12. **Status:** first-hand paper distillation and counterexamples, not experimental results on SAG. **Companion:** [D-SAG-5](../.claude/plans/sag-reflexive-cognition-from-1509-v1.md), prior #1497/#1498 paper distillations.
+
+## Houlsby et al., 2011: Bayesian Active Learning by Disagreement
+
+**Primary:** https://arxiv.org/pdf/1112.5745 , Eq. (2), printed p3.
+**Paper's equation:** I(theta; y | x,D) = H(y | x,D) - E_theta[H(y | x,theta)].
+**Extract:** predictive entropy combines unresolved model uncertainty with outcome noise. BALD subtracts conditional outcome entropy under the model posterior. The paper studies a Bayesian GP classifier; it does **not** establish a PLN, ONA or CE64 scheduler.
+
+**Synthetic red test:** candidate A: every model predicts Bernoulli 0.5. Candidate B: half predict 0, half predict 1 deterministically. Both aggregate predictive entropy values are 1 bit. Under the stated equal-weight model ensemble, BALD-like model information is 0 vs 1 bit. Raw Shannon H(f) cannot tell them apart. Without a calibrated model-posterior meaning of theta and p(y), never call H(NARS frequency) epistemic information gain.
+
+## Geisweiller and Goertzel, 2019: inferential surprisingness in hypergraphs
+
+**Primary:** https://doi.org/10.1007/978-3-030-27005-6_6 ; https://agi-conf.org/2019/wp-content/uploads/2019/07/paper_27.pdf , §§3–5; implementation candidates https://github.com/opencog/miner and https://github.com/trueagi-io/hyperon-miner .
+**Extract:** compare an empirically supported pattern with a model-based/independence estimate; second-order distributions and a Jensen–Shannon-based discrepancy avoid treating every raw frequency difference as equally significant. Shared variables violate naive products of marginal pattern frequencies. This is neither pure Shannon maximization nor a finished general-purpose EIG estimator.
+
+**SAG transfer:** #1509's label-vs-typed-identity MDL counterexample is a high-value source fixture. Two fields called hours in distinct concept/seal spaces are not one repeated method. A miner that extracts a false reusable pattern from labels fails before scoring.
+
+## Goertzel, 2020: Folding and Unfolding on Metagraphs
+
+**Primary:** https://arxiv.org/pdf/2012.01759 , §2 printed p5, §5.1 p13, §6 history-aware morphisms.
+**Extract:** typed metagraphs permit an edge target connected to a whole edge (index zero) or to a specific typed port; those cannot be silently conflated in an SPO projection. Catamorphism must respect the empty, edge, Beside and typed Connect constructors, not merely return a matching scalar. A shortest-path length and an ordered shortest-path edge list are distinct outputs. Histomorphism/futumorphism needs intermediate history available *during* the computation.
+
+**SAG transfer:** a typed Quack count is not a metagraph recursion-scheme proof. A legal partial lowering may count a bounded population. A whole-edge/port ambiguity, inaccessible intermediate history or inability to construct output expressions is an explicit typed refusal.
+
+## Goertzel, 2021: Patterns of Cognition
+
+**Primary:** https://arxiv.org/pdf/2102.10581 , printed p4 and §5.2.
+**Extract:** formal equivalence between recursive decision processes and a metagraph fold/unfold assumes that the graph does not change during the fold. Mutual associativity of the relevant combination operations is also a stated requirement for parts of the approach. The paper does not prove live self-modifying metagraphs have those properties.
+
+**SAG transfer:** stable MethodKey does not imply stable read snapshot. Pin a source revision and graph version k, append k+1 and replay. Alter evidence overlap and u8 rounding and compare both bracketings. If results differ, a blanket parallel-fold equivalence claim fails, though an explicitly order-sensitive computation can remain valid.
+
+## Jøsang, 2007: evidence fusion and fission
+
+**Primary:** https://arxiv.org/pdf/0712.1182 , §3 and fission sections.
+**Extract:** independent observations can support cumulative fusion, while observations derived from common experience demand a dependence-aware rule. Fission is an inverse operation under assumptions on the underlying belief model. Subjective Logic and NARS are different truth formalisms.
+
+**SAG transfer:** removing a contributor and recalculating a conclusion is a stronger epistemic ablation than merely deleting its graph node. Replaying or copying one receipt does not add evidence. If compressed confidence omits dependence and weights, refuse exact fission.
+
+## Willsey et al., 2021: egg equality saturation
+
+**Primary:** https://arxiv.org/abs/2004.03082 ; DOI https://doi.org/10.1145/3434304 .
+**Extract:** e-graphs compactly encode many equivalent expressions and equality saturation explores rewrites before extracting a cost-ranked candidate, under explicitly chosen language, semantics and rewrite rules. It does not automatically prove side-effect, NULL, bag/set or source-claim equivalence.
+
+**SAG transfer:** egg can be an external reference for *tiny, pure* H1-like rewrites; SAG is not an e-graph. The current H1 has a measured negative performance gap; neither a cost model nor source-syntax factoring proves the fused SIMD terminal exists. Correctness and authority must be hard constraints, not penalty scores.
+
+## High-signal separation
+
+- Entropy of defined outcome distribution != uncertainty of a source claim != surprisingness of model mismatch != MDL redundancy != cost of an executed query.
+- Named attention/appraisal policies are independent of all those scores.
+- A proposed code optimization is only a hypothesis until semantic proof, measurements on representative hardware/workloads and human authorization.
+- The appropriate null result is "no advantage from this policy or lowering under fair budget", not an AGI headline.
diff --git a/.arxiv/2026-10_sag1509_nars_hyperon_reflexive_appraisal_excerpts.md b/.arxiv/2026-10_sag1509_nars_hyperon_reflexive_appraisal_excerpts.md
new file mode 100644
index 000000000..4d704c646
--- /dev/null
+++ b/.arxiv/2026-10_sag1509_nars_hyperon_reflexive_appraisal_excerpts.md
@@ -0,0 +1,48 @@
+# Source excerpts: NARS/ONA and Hyperon as a grounded self-model, not a homunculus
+
+**Date:** 2026-10-12. **Status:** primary paper extracts / source-grounded questions, not LG runtime parity. **Parent:** #1509. **Companion:** [D-SAG-5](../.claude/plans/sag-reflexive-cognition-from-1509-v1.md). Paraphrases, not large verbatim quotations.
+
+## Wang, Li, Hammer, 2018: Self in NARS
+
+**Primary:** https://doi.org/10.3389/frobt.2018.00020 , §§3.3–3.5 and §4.3.
+**Extract:** self-related knowledge can arise from processing *internal* experiences using the same general reasoning machinery as external experiences. Mental operations include considering and doubting. System- and event-level satisfaction affect finite resource allocation and priority. This is a proposed functional emotion/self-control account with incomplete self-knowledge, **not** empirical proof of a experiencing homunculus or consciousness.
+
+**SAG transfer:** separate the observed compiled Program, independent evidence, derivation receipt and *the act of attending to that receipt*. A fact-only graph and a graph with a new episode-significance edge should retain identical historical observation bytes. A reflective trace-only arm that cannot answer "why?" is a useful negative control. A new priority policy must not change the recorded compiler verdict.
+
+**Falsifier:** two derivations yield same final truth but different premises; the explanation should distinguish them. Copy one observation to two hypothesis layers: confidence must not increase. Revisit the event: no additional source ID. Suppress mental/appraisal policy and compare usefulness with identical budgets.
+
+## Hammer and Lofthouse, 2020: OpenNARS for Applications
+
+**Primary source repo:** https://github.com/opennars/OpenNARS-for-Applications at snapshot dc4efd0abd520cdb79bf53bfa3c285ebb24f2e8a. README links to their AGI 2020 paper *OpenNARS for Applications: Architecture and Control* and Lofthouse's 2019 ALANN description. First-hand C entry points: src/Cycle.c, PriorityQueue.c, Memory.c, Stamp.c, Truth.c, Decision.c, Inference.c, NAL.c.
+
+**Extract from the implementation description:** ONA was designed as a new C-based platform, not a fork of the research OpenNARS implementation. It applies event-driven attention, finite queues and concept usefulness to select work; procedural reasoning uses anticipations about outcomes. This makes its event queue a promising *control* reference, not an oracle equivalent to PLN or Shannon.
+
+**SAG transfer:** compiler refusal, changed seal or stale test can be a bounded attention event; the proposal chooses what to investigate next, not what is true. Compare urgent rare change vs popular repeated concept. Do not mix queue priority and evidence frequency.
+
+**Falsifier:** with identical candidate budget and evidence, a priority policy that starves high-impact rare compiler regressions loses to FIFO; copying the same event must not become multiple independent stamps.
+
+## Goertzel et al., 2023: OpenCog Hyperon
+
+**Primary:** https://arxiv.org/pdf/2310.18318 , printed §3.1.3 p22, §4.3.4 pp61–63, §4.3.10 pp72–73, §4.4.2 pp74–77, §4.6 pp80–82.
+
+**Extract A, reflective self-understanding (§4.3.10):** AtomSpace can serve as subject and substrate for its own reasoning and mining operations, but the paper explicitly warns this representational possibility **does not by itself confer deep self-understanding**. Feedback between modest self-knowledge and smarter procedure learning is a research aspiration.
+
+**SAG falsifier:** ask method -> program -> primitive -> certificate; an unsupported two-hop transition must be visible as an insufficiency, not implemented via an invisible second engine. Only the actual compiled program may certify a compiled-tier edge.
+
+**Extract B, inference control (§4.3.4, pp61–63):** authors propose learning what reasoning-step sequences work in what contexts and synthesizing new ones. Programmable interception is discussed as research direction. For LG, store a witnessed rule/step and test learned selection vs a frozen control; do not claim deployed synthesis on the basis of prose.
+
+**Extract C, MicroPsi/Psi emotion (§4.4.2):** subsystems' urgency, importance, competence, experienced uncertainty, selection threshold and arousal interact as parameters shaping control. The paper contemplates machine appraisals unlike familiar human emotional categories. Figure 18 (printed p75) illustrates a regulator graph, not an empirical demonstration of our four names.
+
+**SAG ablation:** Emberglow, Steelwind, Woodwarm and Velvetpause can be optional *operational* policy names. Same truth/evidence budget, change only scheduler/appraisal, measure useful discoveries and failure costs. Overpersistence, familiarity bias, noise fixation and endless deferral are deliberate adversaries.
+
+**Extract D, GOLEM self-modification (§4.6):** meta-level improvement should be tested and reversible. Goal evolution and long-term safety are unsettled. This research PR is not permission to apply any candidate.
+
+## Epistemic needs, dignity in disagreement, and significance: provenance-grade hypotheses
+
+The Maslow pyramid analogy is an *operator-originated framing*: an agent with traceable knowledge, a limited uncertainty budget and stable identity may have more room to explore. It is not a mathematical reduction from Maslow to CE64. "Transcendence" is a philosophical possibility, not a benchmark.
+
+Disagreement: a proposition's evidence, source reliability and relational respect are separable. Source A and B may disagree fiercely about P without either person's other claims being discredited. This is a proposed governance invariant, not a psychological finding extracted from Wang's work.
+
+Reappraisal: a thought brushing awareness at k+1 can cause a new significance/attention edge to an episode at k. The historical fact at k remains unchanged. This is a model of *interpretation*, not an independent new observation, and must not cause confidence inflation.
+
+**Countertest:** A's statement P is refuted by a test, and B's opposing claim survives. Keep unrelated independently verified A claims. If a source-wide trust penalty appears automatically, reject this policy. For Velvetpause, a deadline with sufficient evidence must still permit decision; permanent indecision is a failed controller.
diff --git a/.arxiv/2026-10_sag1509_source_oracles_falsifier_matrix.md b/.arxiv/2026-10_sag1509_source_oracles_falsifier_matrix.md
new file mode 100644
index 000000000..a43bc6095
--- /dev/null
+++ b/.arxiv/2026-10_sag1509_source_oracles_falsifier_matrix.md
@@ -0,0 +1,51 @@
+# D-SAG-5 pinned sources, executable oracles and refusal matrix
+
+**Date:** 2026-10-12. **Status:** repository locations and primary papers checked, but **NO NEW EXPERIMENT WAS EXECUTED**. Source URL or headline is not a green test. Read [.claude/knowledge/FIRST-HAND-SOURCE-LAW.md](../.claude/knowledge/FIRST-HAND-SOURCE-LAW.md) before a future implementation.
+
+## Repositories at research snapshot
+
+| Source | Commit SHA at inspection | Why here |
+|---|---|---|
+| [lance-graph #1509](https://github.com/AdaWorldAPI/lance-graph/pull/1509) | 42fa2a347cda22eaaa327bba514f2029cc9daa82 (merge to main) | current MethodTable -> SoftwareGraph -> Quack one-hop and H1 negative performance |
+| [ONA](https://github.com/opennars/OpenNARS-for-Applications) | dc4efd0abd520cdb79bf53bfa3c285ebb24f2e8a | Cycle, PriorityQueue, Memory, Stamp, Truth, Decision C source |
+| [modern PLN](https://github.com/trueagi-io/PLN) | 4405956947c4b53c7ff01bd565aa3b114bc970a1 | lib_pln.metta, truth formulas and scheduler |
+| [PeTTa](https://github.com/trueagi-io/PeTTa) | 1d19a1da1ad8ba6327d660abd65433a0e341c23f | MeTTa runner, separate from native Hyperon |
+| [Hyperon](https://github.com/trueagi-io/hyperon-experimental) | 3f76dc460da6961f57f69f6c3e550c59c74ada83 | Rust atom kinds, matcher, non-determinism, dependent types and spaces |
+| [classic AtomSpace](https://github.com/opencog/atomspace) | c8d633bf272b838c2132c21b7c8ddf169a18dd22 | historic typed hypergraphs/Frames, not Hyperon |
+| [classic ECAN](https://github.com/opencog/attention) | 96107652e1cf72747e69fcd2a20ffb6edba562d2 | historical attention baseline, not Shannon-EIG implementation |
+| [Hyperon Miner](https://github.com/trueagi-io/hyperon-miner) | e955479bca1603597529d175cc22ac1583c67e15 | frequent/subpattern and surprisingness fixtures |
+| [AdaWorldAPI/ruff](https://github.com/AdaWorldAPI/ruff) | 9407c748812454bcadfff2d3c89cf942bf66f5de | Python lint/format diagnostics only; **not** a Rust code-equivalence oracle |
+
+Root licenses need per-file review: modern PLN and Hyperon root licenses state MIT; classic AtomSpace and attention have AGPL text with OpenCog linking exceptions. Do not copy source merely because this ledger links it.
+
+## Compact falsification matrix
+
+| Topic | Oracle or independent baseline | Negative / red fixture | Gate |
+|---|---|---|---|
+| typed SAG identity | real prepared MethodTable and tests/awareness.rs | same label different ClassId/seal, wrong compiled tier | exact graph answers and verified origin |
+| self source snapshot | git SHA + compiled Program + certificate | stale Debug/FNV digest/toolchain/reading | stale reported, no implicit current evidence |
+| multi-hop | independent scalar CALLS closure | A->B->C from one-hop only | legal relation carrier or typed refusal |
+| local model context | direct source with full answer, rg/file text | omitted negative evidence, stale SHA, unverifiable claim | exact source/answer, measured token+time, no zero-token claim |
+| NARS stamps | pinned ONA or OpenNARS where rules applicable | identical evidence across two hypothesis layers | no confidence inflation; independent cases still count |
+| significance | version-k immutable event | new k+1 relationship falsely rewrites fact at k | fact stable, reinterpretation traceable |
+| Shannon/BALD | analytic 0 vs 1 bit toy with defined model | equally high raw H noisy and epistemic candidates | no false claim that H(f) is calibrated |
+| policy/appraisal | FIFO and frozen no-meta, same budget | noise, deadline missed, trusted stale path | improved useful results and no truth-law drift |
+| respectful contradiction | two claims and independent supporting tests | refute one claim -> global source trust penalty | claim-level revision independent of person relation |
+| MeTTa | upstream b4_nondeterm.metta | four combinations collapse into a 2-row mask | exact multiplicity or typed refusal |
+| metagraph fold | typed constructor scalar law, pinned k | port 0 != port n; k changes during fold | laws and snapshot parity or named gap |
+| optimize | compiled H1 plus scalar row oracle | NULL/overflow/bag/set mismatch; nonexistent fused terminal | no automatic applied modification |
+| decision | independently checked proof, human approval event | graph self-issues verified tier or code write | deny by default, rollback when separately authorized |
+
+## Reviewer decisions (OPEN)
+
+- Which source-bound token/context question should be the first minimal probe?
+- May D-SAG-1-4 / D-CMH-G1-4 introduce a relation carrier in a future authorized PR, or does first-wave SAG explicitly refuse every two-hop question?
+- Which source/event receipts can be durable under mailbox ownership and D-SAG-1-6?
+- Which truth law, inference oracle and independent evidence base does each policy use? No silent PLN/NARS conversion.
+- What model distribution does BALD use, and how is its prediction validated? If unknown, call it a heuristic, not EIG.
+- Which (if any) of the four named functional policies is worth measuring; what time/compute budget and kill threshold are approved?
+- How are human approval and code correctness proof represented as different facts?
+- What token/cost reduction threshold is set *before* the first run?
+- What licenses and exact runtime commits permit independent fixture execution?
+
+**No empirical win has been asserted by this documentation PR.**
diff --git a/.claude/board/INTEGRATION_PLANS.md b/.claude/board/INTEGRATION_PLANS.md
index 2271ba337..264376345 100644
--- a/.claude/board/INTEGRATION_PLANS.md
+++ b/.claude/board/INTEGRATION_PLANS.md
@@ -1,3 +1,12 @@
+## 2026-10-12 (5) — sag-reflexive-cognition-from-1509-v1 — source-backed SAG self-querying, cognition/attention controls and safe optimization proposals → .claude/plans/sag-reflexive-cognition-from-1509-v1.md
+
+**Status:** PROPOSAL D-SAG-5-0..10. Only D-SAG-5-0 documentation is in this PR, based on merged #1509.
+
+- Reuses shipped MethodTable/SoftwareGraph/Quack one-hop behavior, compiler tiers, source seals and H1 cost/refusal ledger. Two-hop, persistence and applying optimizations remain blocked or queued.
+- Source-indexed .arxiv excerpts connect Wang/ONA internal events, Hyperon reflexive reasoning and affective modulators, BALD vs noise, Miner surprise, metagraph fold laws, evidence fusion/fission and egg rewrite certificates.
+- Claude Code prompt demands exact source/answer parity, context-token measurement, independent epistemic and attention ablations, and explicit refusal on unsupported semantics. Functional Emberglow, Steelwind, Woodwarm and Velvetpause labels authorize no CE64 bit change.
+- No runtime feature, second IR, self-certified result, automatic code mutation, new opcode or schema is created.
+
 ## 2026-10-12 (4) — software-awareness-graph-v1 — the software's own methods, programs and evidence as graph rows → `.claude/plans/software-awareness-graph-v1.md`
 
 **Status:** MEASURED for one concept's methods (D-SAG-1-0..3 and D-SAG-1-5 in the PR); D-SAG-1-4 and D-SAG-1-6 queued.
diff --git a/.claude/board/STATUS_BOARD.md b/.claude/board/STATUS_BOARD.md
index eca85f627..ea611ccec 100644
--- a/.claude/board/STATUS_BOARD.md
+++ b/.claude/board/STATUS_BOARD.md
@@ -1,3 +1,21 @@
+## D-SAG-5 — Reflexive cognition and proposal safety from SAG #1509 (2026-10-12)
+
+**Status:** PROPOSAL. Plan: .claude/plans/sag-reflexive-cognition-from-1509-v1.md. Docs only; no runtime authorization.
+
+| D-id | scope | status | gate / falsifier |
+|---|---|---|---|
+| D-SAG-5-0 | source research, Claude Code prompt, board and negative-control matrix | In PR (docs) | sources pinned; new runtime diff empty |
+| D-SAG-5-1 | rerun compiler-backed SAG one-hop parity | Queued | exact prepared Program/refusal and tier; stale cert red |
+| D-SAG-5-2 | ContextSlice vs source/rg/Markdown with real tokens | Queued | exact answer/source with counted input tokens; unsupported hop refused |
+| D-SAG-5-3 | evidence, derivation and attention independent provenance | Queued | copied source counted once; independent source twice |
+| D-SAG-5-4 | episode interpretation and pinned snapshot replay | Queued | k immutable under k+1 append; no replay-as-evidence |
+| D-SAG-5-5 | Shannon/BALD/PLN/ONA/ECAN/Staunen policies | Queued | fixed truth law, same budget, noisy and epistemic controls |
+| D-SAG-5-6 | four named appraisal-policy ablations | Queued | no factual truth drift; benefit vs frozen no-meta |
+| D-SAG-5-7 | MeTTa/metagraph typed subset | Queued | four-result multiplicity, typed port, static fold or refusal |
+| D-SAG-5-8 | H1 and MDL candidate independent validation | Queued | null, overflow, bag, source and cost proofs; no fused speedup assumed |
+| D-SAG-5-9 | conflicting sources and revised significance | Queued | no person-wide penalty or false new observation |
+| D-SAG-5-10 | approval, source change and rollback gates | Queued | default deny; self-issued compiled/verified tier fails |
+
 ## D-SAG-1 — Software-awareness graph (2026-10-12)
 
 Plan: `.claude/plans/software-awareness-graph-v1.md`. No new opcode, Quack variant, engine or registry. Nothing applies a transformation.
diff --git a/.claude/board/entries/2026-10-12-sag-reflexive-cognition-research.md b/.claude/board/entries/2026-10-12-sag-reflexive-cognition-research.md
new file mode 100644
index 000000000..60fb7a079
--- /dev/null
+++ b/.claude/board/entries/2026-10-12-sag-reflexive-cognition-research.md
@@ -0,0 +1,14 @@
+# 2026-10-12: D-SAG-5-0, grounded reflexive-cognition research after #1509
+
+**Status:** PROPOSED / docs only. Parent is merged #1509. No runtime, schema, ISA, oracle or permission changes.
+**Plan:** .claude/plans/sag-reflexive-cognition-from-1509-v1.md.
+**Prompt:** .claude/prompts/sag-reflexive-cognition-from-1509.md.
+**First-hand source notes:** .arxiv/2026-10_sag1509_nars_hyperon_reflexive_appraisal_excerpts.md, .arxiv/2026-10_sag1509_information_metagraph_optimization_excerpts.md, .arxiv/2026-10_sag1509_source_oracles_falsifier_matrix.md.
+
+The already measured SAG projects prepared methods and compiler tiers to a Quack-queryable graph but is single-concept/one-hop; H1 fused sum is **not shipped**. This work asks whether source-backed self-queries, developer ContextSlices and proposed optimizations can be better targeted via epistemically honest attention under fixed budgets. Only evidence after a pinned test can become a verified graph relation. A hypothetical policy cannot self-authorize a code rewrite.
+
+Novel crosscheck: internally observed/derived/attended events are distinct; copied evidence never increases truth; time-k episode may receive time-(k+1) significance without changing time-k fact; opposing source propositions need not invalidate their authors. Emberglow, Steelwind, Woodwarm and Velvetpause are *functional controller names*, not qualia findings or bits. Shannon H(f), BALD, ONA control, PLN and ECAN have separate baselines. A local code graph is not a zero-token LLM interface.
+
+D-SAG-5-0 is documentation; D-SAG-5-1..10 are QUEUED and require independent falsifiers and explicit later implementation authorization.
+
+Closeout: PR #<tbd> | DRAFT | source extracts, reconciled plan, Claude Code prompt, frozen-source oracle/negative-control matrix | nothing implemented, all experiments OPEN.
diff --git a/.claude/board/entries/README.md b/.claude/board/entries/README.md
index edd308029..22ff962be 100644
--- a/.claude/board/entries/README.md
+++ b/.claude/board/entries/README.md
@@ -25,11 +25,12 @@ index row, (3) no duplicate entry id. Checks 1 and 2 are deliberately
 opposite directions; the stranding this convention prevents shows up in
 exactly one of them, never both.
 
-316 entries, 2026-08-06 .. 2026-10-12.
+317 entries, 2026-08-06 .. 2026-10-12.
 
 | date | entry id | finding | file |
 |---|---|---|---|
 | 2026-10-12 | `D-SAG-1` |  | [2026-10-12-software-awareness-graph.md](2026-10-12-software-awareness-graph.md) |
+| 2026-10-12 | `D-SAG-5-0` | Post-#1509 SAG self-querying, provenance and limited attention with NARS/Hyperon/PLN comparisons; research prompt and high-signal falsifiers | [2026-10-12-sag-reflexive-cognition-research.md](2026-10-12-sag-reflexive-cognition-research.md) |
 | 2026-10-12 | `opencog-pln-entropy-research-map` | Source inventory and falsifiable PLN/ECAN/Shannon/Moore attention comparison: entropy target, evidence overlap, graph projection, resource fairness | [2026-10-12-opencog-pln-entropy-research-map.md](2026-10-12-opencog-pln-entropy-research-map.md) |
 | 2026-10-12 | `nars-self-evidence-literature` | NARS internal trace versus evidence, Jøsang dependent/independent fusion and fission, and the snapshot-stable fold assumption; source-grounded red tests for merged #1496 | [2026-10-12-nars-self-evidence-literature.md](2026-10-12-nars-self-evidence-literature.md) |
 | 2026-10-12 | `hyperon-metta-lg-translation` | Hyperon/MeTTa to LG sibling map: atom/hypergraph roundtrip, binding and rewrite parity, typed folds, scoped effects and 15 open questions | [2026-10-12-hyperon-metta-lg-translation.md](2026-10-12-hyperon-metta-lg-translation.md) |
diff --git a/.claude/plans/sag-reflexive-cognition-from-1509-v1.md b/.claude/plans/sag-reflexive-cognition-from-1509-v1.md
new file mode 100644
index 000000000..28926da85
--- /dev/null
+++ b/.claude/plans/sag-reflexive-cognition-from-1509-v1.md
@@ -0,0 +1,103 @@
+# D-SAG-5: reflexive cognition and safe optimization from #1509
+
+**Date:** 2026-10-12. **Status:** PROPOSAL. Documentation only. **Parent:** merged [#1509](https://github.com/AdaWorldAPI/lance-graph/pull/1509); follow-up research to merged [#1496](https://github.com/AdaWorldAPI/lance-graph/pull/1496), [#1497](https://github.com/AdaWorldAPI/lance-graph/pull/1497), [#1498](https://github.com/AdaWorldAPI/lance-graph/pull/1498) and [#1499](https://github.com/AdaWorldAPI/lance-graph/pull/1499).
+
+**Research sources:** [NARS, ONA, Hyperon](../../.arxiv/2026-10_sag1509_nars_hyperon_reflexive_appraisal_excerpts.md), [information theory and metagraphs](../../.arxiv/2026-10_sag1509_information_metagraph_optimization_excerpts.md), [pinned source and falsifier ledger](../../.arxiv/2026-10_sag1509_source_oracles_falsifier_matrix.md). **Runnable research brief:** [Claude Code prompt](../prompts/sag-reflexive-cognition-from-1509.md).
+
+## Research question
+
+Can the existing SoftwareGraph (SAG) become a **local, addressable, source-backed representation of its own prepared software**, and use that representation to prioritize useful investigations or *propose* optimizations, without either inflating epistemic certainty or silently building a second reasoning engine?
+
+Treat this as **software introspection and cognitive control research**, not proof of a mind, qualia, AGI, transcendence or truly zero-token LLM context. Maslow is an analogy for epistemic prerequisites, not a theorem: reliable identity, evidence origin, memory continuity, limited resources, respect for conflicting hypotheses and time to reconsider are conditions for investigation. They do not guarantee a subjective experience or any high-level outcome.
+
+## What #1509 actually shipped
+
+The SoftwareGraph in crates/lance-graph-glove-parity/src/awareness.rs projects prepared MethodTable items into typed rows for class, method, field, condition, fold, law, program, primitive, refusal, claim, capability, test and compiled program lowering. Every edge includes a tier (declared, derived, compiled, verified, hypothesis), context and provenance. SoftwareGraph binds as an ordinary Quack table. Single-hop queries run through Draft -> lower -> mask-risc. Compiler verdicts and certificates are reflected as facts, not re-decided by the graph. Tests use the actual prepared programs and red-disable falsifiers.
+
+The #1509 H1 candidate would fuse a predicate with a MaskedSumI32 terminal. The **measured current cost is worse**: roughly 603.5 microseconds tiled vs 379.1 microseconds scalar for one 1,048,576-row run, with other recorded ratios 1.6–1.8x. It is NOT a demonstrated fused SIMD speedup. A real Pred fusion and sum FusedFold, plus NULL and overflow obligations, remain open.
+
+**Blocked:** multi-hop dependency queries beyond the one-hop context trick need D-SAG-1-4 / D-CMH-G1-4 relation-carrier or permitted EqU32Via; there is no free mask handoff between programs. SAG is currently in memory, not persistently read from Lance. MethodKey is caller-issued; body digest is debug-FNV build-local; SAG_REV is caller-supplied. No automatic source rewrite or actor self-optimization is implemented. Do not rewrite these facts when creating a prettier vision.
+
+## Seven independent axes; do not encode them as one confidence score
+
+| Axis | Proposed item | Source of authority | Failure mode to refuse |
+|---|---|---|---|
+| Identity | ClassId/MethodKey/NodeGuid, seal, ClassView reading, program/test key | typed OGAR, MethodTable, source compiler | same display label treated as same item |
+| Observation | source code snapshot, compiled Program, test result, actual error | pinned Git revision, compiler/test | handwritten plan promoted to compiled tier |
+| Evidence | observation/source IDs and independence/dependency bases | stamp or independent test | reread or copied layer counted twice |
+| Derivation | executed rule/procedure and parents, signed witness | reproducible run receipt | inferred narrative presented as executed path |
+| Attention | chosen target, policy, selection cost and observed outcome | run log, not factual belief | high priority mistaken for high truth |
+| Interpretation | new later association or changed relevance of an episode | versioned relational significance | reinterpretation silently rewrites old event |
+| Decision | proposed, independently proved, measured, authorized, applied/reverted | operator approval + compiler proof | unapproved source mutation or self-issued VERIFIED edge |
+
+Proposed ContextSlice: bounded typed IDs, source file/span, repo SHA, MethodTable/Quack evidence paths, truth tier, omitted scope, and explicit unsupported operations. It aims to reduce repeated whole-document context transmission for Claude Code. An exact local graph query needs no LLM. But if an LLM consumes a ContextSlice, the slice still uses **input tokens**. Compare measured tokens, latency and answer fidelity against direct source reading, rg, the whole CLAUDE.md and ordinary text retrieval. Never promise literal token-free model context.
+
+## Hypothesis policies, not emotions or CE64 bit assignments
+
+- **Emberglow**: prioritize a candidate whose *independently evidenced learning progress* remains positive. Control: novelty churn and repeated old evidence.
+- **Steelwind**: protect an approved objective from distractors, but stop upon disconfirmation or an expired budget. Control: inflexible perseverance.
+- **Woodwarm**: choose familiar, historically reliable source paths to reduce lookup cost while testing freshness. Control: stale confirmation bias and source monopoly.
+- **Velvetpause**: hold incompatible propositions open and schedule one discriminating observation before committing, with an explicit deadline. Control: endless postponement.
+
+These four user-coined terms are proposed **functional policy labels**. Neither Wang nor Goertzel established them scientifically. Do not write them into CE64 bits 50..52 (which presently gate plasticity in one ClassView reading) or claim they represent subjective qualia. Zero-policy and fixed-policy baselines are essential.
+
+**Respectful disagreement:** claim truth, independent evidence, source reliability and collaborative relation are distinct. Two researchers can disagree about proposition P without either source being automatically untrustworthy. An argument may be refuted without punishing other valid statements by the same person. Do not conflate source agreement with epistemic quality.
+
+**Reinterpretation vs observation:** thought revisiting an episode at time k+1 may create a new relevance/relationship edge without becoming a second observation of the episode at k. Compare a fact-only history with a relational-history arm; a positive improvement must concern prediction/retrieval/repair, not a manufactured rise in NARS confidence.
+
+## Crosswalk into the existing one-engine spine
+
+| Source proposal | Which SAG operation could be tested | Important insufficiency |
+|---|---|---|
+| Pei Wang NARS internal experience, appraisal, mental operations | source-query, provenance chain, policy-only queue | no demonstrated mental operations or phenomenal feeling in SAG |
+| ONA event priority and usefulness | schedule which compiler/source event to inspect | separate implementation from OpenNARS and PLN |
+| PLN weighted inference and priority | compare truth-law outputs and queue policy on identical evidence | PLN strength/confidence != NARS frequency/confidence by definition |
+| OpenCog ECAN | historical attention-control arm | ECAN != Shannon information gain |
+| Shannon H and BALD | candidate observation ranking | H(f) is unsafe if f not calibrated probability; need predictive model |
+| Miner empirical vs modeled surprise | detect surprising typed method patterns | repeated names across schema seals are not reusable code |
+| Hyperon MeTTa | optional bounded source grammar and parity oracle | multiple results, grounded functions, dependent types, mutation not implied by Quack |
+| Typed metagraph folds | compare constructor-preserving finite fold vs R2IL procedure | SIMD SUM != catamorphism; static snapshot assumption |
+| Equality saturation (egg) | external equivalence reference for pure candidate rewrite | SAG is not an e-graph; no automatic compiler replacement |
+| Heckhausen/Gollwitzer Rubicon | decision/commit authorization stages | governance analogy, not an NARS rung |
+
+The engine remains: prepared MethodTable -> SoftwareGraph/Binder -> Quack -> R2IL procedures when actually implemented -> mask-risc -> ndarray. A proposed controller may rank **which existing legal query to execute next**, but may not mint a new OGAR byte, new VM, implicit carrier, optimizer backend or hidden global knowledge service.
+
+## D-SAG-5 falsification ladder
+
+| D-id | Probe | Independent oracle / red test |
+|---|---|---|
+| D-SAG-5-0 | literature plan, source map, prompt and board (this PR) | docs only, status explicitly proposed |
+| D-SAG-5-1 | re-run #1509 one-hop queries and compiler tiers | actual MethodTable/compiled Programs; changed source or stale certificate refuses |
+| D-SAG-5-2 | ContextSlice vs full source/rg/Markdown and tokens | exact answers, source SHA, false/omitted results, real model input token count; unsupported hop refuses |
+| D-SAG-5-3 | evidence vs derivation vs attention | same observation copied into 2 layers counts once; 2 independent in same layer count twice; final truth unchanged by receipt replay |
+| D-SAG-5-4 | episodic continuity and later appraisal | pinned version k replay identical while k+1 appends; changed significance does not rewrite old source event |
+| D-SAG-5-5 | scheduler factorial | FIFO, ONA/PLN source-accurate queues, raw H(f), BALD, Miner/JSD, Moore/Staunen; identical truth laws and candidate budgets |
+| D-SAG-5-6 | four functional-appraisal arms | policy changes attention only; measured utility vs no-appraisal and frozen/no-meta controls |
+| D-SAG-5-7 | MeTTa and fold-law subset | 4 nondeterministic results not collapsed to 2 survivors; typed port ordering, error/unreduced form, constructor/snapshot parity |
+| D-SAG-5-8 | safe H1, MDL and rewrite proposals | actual compiler + independent scalar oracle; NULL, bag/set, overflow, provenance, stale seal and mixed workloads |
+| D-SAG-5-9 | conflicting arguments, relational significance | claim update not source-wide trust penalty; facts stable while context-aware prediction improves or policy rejected |
+| D-SAG-5-10 | permission and rollback | proposal != authorization; no self-issued compiled/verified edge, no source or external write until separately authorized |
+
+**Suggested order:** D-SAG-5-1 -> 2 -> 3/4 -> 5/6 -> 7/8/9 -> 10. An early failed claim may stop the downstream work.
+
+## Required controls and metrics
+
+Freeze one axis at a time: inference truth law, scheduler, source graph, evidence independence, appraisal, storage or context serialization. Score exact answer sets and evidence paths before optimizing performance. Include source SHA, class/seal/reading, event/provenance IDs, hypothesis-layer IDs, selected task, budget, candidate expansions, rows decoded, bytes, allocations, wall time, measured actual LLM tokens and reviewer decision. Pre-register useful-discovery and cost thresholds before running; do not retroactively fit.
+
+**Adversarial fixtures:** same label/different ClassId, same fold/different reading, wrong-tier verified claim, expired digest, two-hop CALLS chain, copied evidence, irrelevant 50/50 noise, half-disagreeing deterministic ensemble vs all-uncertain ensemble, deadline missed under Velvetpause, stale "trusted" file, changed relationship without new observation, MeTTa 4-result branching, whole-edge vs port target, conflicting sources without personal blame, H1 fused candidate failing null/overflow, unapproved self-rewrite attempt.
+
+The 2023 Hyperon paper describes the metagraph as substrate for reflexive cognition but explicitly says this does not itself produce deep self-understanding. That warning applies here: a **queryable graph** is necessary for some proposed introspection, not sufficient to establish self-awareness.
+
+## Stop rules
+
+- D-SAG-1-4 or D-CMH-G1-4 unresolved? Refuse multi-hop, do not add second evaluator.
+- No independent evidence-base? Refuse cumulative confidence claim.
+- No calibrated probability and predictive distribution? Label entropy heuristic, not Bayesian IG.
+- No pinned static version? Refuse metagraph fold-equivalence claim.
+- MeTTa produces new terms or multiple bindings that a mask cannot represent? Typed refusal.
+- A proposed optimization lacks independent semantic oracle or actual fused primitive? Keep candidate unresolved.
+- Rubicon-like commitment stage without operator authorization? Never execute.
+- No independently observed performance/accuracy benefit? Report null or failure, do not claim adaptive self-optimization.
+- No evidence of subjective states? Never claim machine qualia, feeling, respect or transcendence.
+
+**No runtime code, CE64 meaning, new field, opcode, tenant, schema or ABI is authorized by D-SAG-5-0.**
diff --git a/.claude/prompts/sag-reflexive-cognition-from-1509.md b/.claude/prompts/sag-reflexive-cognition-from-1509.md
new file mode 100644
index 000000000..10d5686d3
--- /dev/null
+++ b/.claude/prompts/sag-reflexive-cognition-from-1509.md
@@ -0,0 +1,39 @@
+# Claude Code prompt: research bounded SAG self-model and cognitive policy after merged #1509
+
+You are in AdaWorldAPI/lance-graph. Your job is RESEARCH + falsification design, not production implementation. Start from merged PR #1509. First read at current HEAD: CLAUDE.md, .claude/knowledge/FIRST-HAND-SOURCE-LAW.md, .claude/v3/README.md when touching V3; .claude/plans/software-awareness-graph-v1.md, crates/lance-graph-glove-parity/src/awareness.rs, tests/awareness.rs, examples/awareness_loop.rs. Then read .claude/plans/sag-reflexive-cognition-from-1509-v1.md and all .arxiv/2026-10_sag1509_*.md.
+
+Your task: determine how much reliable self-querying, source-addressable local code context and evidence-governed optimization proposal is POSSIBLE USING THE SHIPPED SAG. Do not build a new VM, index service, IR, registry, e-graph implementation, NARS interpreter or autonomous self-modifying agent.
+
+First deliver a status ledger of actual code/test features (MEASURED / VERIFIED-IN-CODE / TEST-PINNED / HYPOTHESIS / OPEN). Never claim that a grep hit verifies semantics; read defining type, callers and tests. Note #1509 one-concept/one-hop boundary, queued multi-hop/persistence, caller-issued MethodKey, build-local digest, and H1's measured 1.6–1.8x tiled-over-scalar COST (not a fusion win).
+
+Parallel research channels (read pinned source and reconcile centrally, not separate competing plans):
+A. SAG and developer context: prove one-hop METHOD -> Program -> primitive/refusal answer against compiled source; try an invalid two-hop CALLS query and refuse it. A proposed ContextSlice contains typed address, source file/span/SHA, seal, reading, tier, edges, receipt and unhandled scope. Compare with whole CLAUDE.md, rg+read and textual retrieval. Count ACTUAL LLM input/output tokens when an LLM consumes anything; never say "without tokens" merely because a local graph answered a query.
+B. Wang/ONA: read 2018 Self in NARS §§3.3–3.5 plus pinned ONA Cycle.c, PriorityQueue.c, Memory.c, Stamp.c, Truth.c, Decision.c and source tests. Map event priority, independent evidence, concept usefulness, internal derived trace and bounded control as distinct entities. Use a pinned OpenNARS/ONA oracle if executable.
+C. OpenCog: read modern PLN lib_pln.metta, pinned PeTTa/Hyeron interpreter, classic attention/ECAN, Miner, and typed metagraph constructor laws in arXiv:2012.01759; read Hyperon arXiv:2310.18318 §§3.1.3, 4.3.4, 4.3.10, 4.4.2, 4.6. Do not equate AtomSpace Classic, Hyperon, PLN, ECAN or ONA.
+D. Information and optimizer: read Houlsby et al. BALD Eq.2, Geisweiller/Goertzel 2019 pattern-surprise, Jøsang fusion/fission and Willsey et al. egg equality-saturation. Ask whether a candidate can be chosen by a meaningful next observation without rewarding irrelevant high-entropy noise. egg is an external equivalence comparator only, not a new execution tier. AdaWorldAPI/ruff may supply Python lint facts if actually run, but it is NOT a Rust compiler oracle.
+
+Pre-register and execute only if separately authorized:
+1. one-hop exact answer with source-backed ref; negative same-label different class, stale seal, wrong tier;
+2. two-hop CALLS A->B->C: independent scalar closure vs current legal Quack response; no invented mask-bridge;
+3. evidence copied in two hypothesis layers vs two independent observations within one; receipt replay does not add source evidence;
+4. same version-k episode, later significance edge version k+1; source fact and F/C of k remain unchanged;
+5. respectful contradiction: sources disagree on claim P; failing one claim must not punish all claims or the human source by association;
+6. two candidate labels equally Shannon H=1: all model instances 50/50 yields BALD-like 0, half deterministic 0 vs half deterministic 1 yields 1 bit under a properly declared model. If model weights/unseen response are not defined, do not call it BALD;
+7. scheduler factorial FIFO vs faithful ONA/PLN vs H(f) naive vs EIG/JSD vs Moore/Staunen, with noise, fixed rules, fixed budget;
+8. user-named functional policies Emberglow (learning progress), Steelwind (persistence with stop), Woodwarm (familiarity with freshness), Velvetpause (bounded deferral). No claim of emotional qualia. Hold truth law, evidence and CPU budget constant, require no-meta/frozen controls;
+9. MeTTa pair(bin,bin) yields 4 substitutions, never collapse into two survivors; typed metagraph port 0 whole-edge vs port n target; static fold and path-list parity;
+10. #1509 H1 proposal retains NULL, overflow, bag/set, provenance, version seals; does not auto-apply. Measure whole pipeline only after a real fused implementation exists in a separate authorized PR;
+11. unapproved candidate attempts write/compiled promotion: always fail; human authorization and independent proof are separate ledgers.
+
+HARD refusals: no new OGAR opcode/tenant/CE64 bit meaning or second IR, no silent evidence-source dedup by layer ID, no reinterpretation of a visited episode as independent sample, no unpinned cross-engine parity, no multi-hop claim without lawful carrier, no hidden model answer leakage, no accidental new source writes or PR merges.
+
+Report:
+- SHA-anchored source receipts and complete commands; unknowns named OPEN.
+- Matrix of claim -> source -> current LG primitive -> tested case -> typed refusal -> missing proof.
+- Three smallest experiments ranked by usefulness per engineering hour, explicit kill condition for each.
+- Independent truth-law / attention / storage / context ablations with raw outcomes and negative controls.
+- Exact source and version for any expected result. Distinguish text-only analysis from oracle execution.
+- Human decisions required before changing code, policy, goal, approval threshold or stored semantics.
+- Proposed follow-up PR breakdown; one measured capability or disproven hypothesis per PR, board/index hygiene same commit.
+
+Passing any graph-query probe establishes *software introspection*, not subjective self-awareness or an AGI milestone. Zero-token claim is invalid whenever the model reads serialized context. Graceful negative results count as high-signal research.