build: production targets x86-64-v4 (D-PROD-V4)

.cargo/config-v3.toml

@@ -1,6 +1,7 @@
-# Portable distribution baseline: x86-64-v3 (AVX2), every x86_64 since
-# Haswell. REQUIRED for anything shipped from this tree, now that the default
-# `.cargo/config.toml` is `native`. Mirrors ndarray/.cargo/config-v3.toml.
+# x86-64-v3 (AVX2), every x86_64 since Haswell. NOT the production target:
+# production always runs on v4 and ships with config-v4.toml. Kept for
+# building or testing the AVX2 arm on purpose. Never cite a timing from a v3
+# build: production does not run that arm. Mirrors ndarray/.cargo/config-v3.toml.
 #   cargo build --config .cargo/config-v3.toml ...
 [target.'cfg(target_arch = "x86_64")']
 rustflags = ["-Ctarget-cpu=x86-64-v3"]

.cargo/config-v4.toml

@@ -0,0 +1,12 @@
+# Production target: x86-64-v4 (AVX-512 F + BW + CD + DQ + VL), nothing above
+# it. Production always runs on v4, so everything shipped from this tree
+# builds with this file (Dockerfiles) or the same flag (wheel, images that
+# copy no .cargo). Mirrors ndarray/.cargo/config-v4.toml without its
+# `-Dwarnings`, which is a CI rule, not a build-image rule.
+#   cargo build --config .cargo/config-v4.toml ...
+# On a host without AVX-512 the binary does not SIGILL mid-run: ndarray's
+# startup `cpu_guard` names the missing features and exits before `main`.
+# `config-avx512.toml` (Sapphire Rapids) is stricter and SIGILLs on earlier
+# AVX-512 silicon such as Cascade Lake, so it is not the production default.
+[target.'cfg(target_arch = "x86_64")']
+rustflags = ["-Ctarget-cpu=x86-64-v4"]

.cargo/config.toml

@@ -30,10 +30,11 @@
 # (`cfg!(target_feature = "avx512f")`), never by "it was the default".
 #
 # A default build is therefore tuned to the BUILD HOST and is NOT portable.
-# Anything shipped pins its tier explicitly:
+# Production always runs on x86-64-v4, so anything shipped builds for v4:
 #
-#   portable baseline (AVX2):  cargo build --config .cargo/config-v3.toml ...
-#   AVX-512 (v4):              cargo build --config .cargo/config-avx512.toml ...
+#   production (x86-64-v4):    cargo build --config .cargo/config-v4.toml ...
+#   AVX2 arm on purpose:       cargo build --config .cargo/config-v3.toml ...
+#   Sapphire Rapids only:      cargo build --config .cargo/config-avx512.toml ...
 #
 # CI: build.yml, rust-test.yml and style.yml set `RUSTFLAGS` with an explicit
 # `-C target-cpu=x86-64-v3` (a RUSTFLAGS env REPLACES every cargo-config
@@ -43,9 +44,11 @@
 # (.github/scripts/resolve-native-rustflags.sh, used by dir-sim-persist.yml and
 # identity.yml) and keys the cache to those flags; without that, an artifact
 # built on a runner with AVX-512 is reused on one without and dies with SIGILL.
-# The same script works locally: RUSTFLAGS="$(.github/scripts/resolve-native-rustflags.sh)". Everything else that ships pins x86_64 to v3 without
-# touching other architectures: the Dockerfiles that copy this tree replace
-# this file with config-v3.toml (x86_64-only), the thinking-engine images set
+# The same script works locally: RUSTFLAGS="$(.github/scripts/resolve-native-rustflags.sh)".
+# Everything that ships builds x86_64 for v4 without touching other
+# architectures: the Dockerfiles that copy this tree replace this file with
+# config-v4.toml (x86_64-only), `Dockerfile` and `Dockerfile.avx512` set
+# RUSTFLAGS to x86-64-v4, the thinking-engine images set
 # CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUSTFLAGS, and `make publish` in
 # python/ sets RUSTFLAGS only on an x86_64 host. Note that the per-target
 # variable is JOINED with this file's entry, with `native` last (measured), so

.claude/board/LATEST_STATE.md

@@ -1,11 +1,12 @@
-## 2026-10-13 — main after #1505, #1506, #1507–#1509, #1514, #1516, #1518, #1520, #1523, #1524, #1526 (merged); #1525 open
+## 2026-10-13 — main after #1505, #1506, #1507–#1509, #1514, #1516, #1518, #1520, #1523, #1524, #1525, #1526 (merged); #1529 open
 
 - **On `main`, live:** `.cargo/config.toml` defaults to `-Ctarget-cpu=native` with `config-v3.toml` as the portable baseline and `debug = 0` everywhere (#1505); `compute_dag_kahn` checks all 256 field positions (#1506); R2IL `MIN`/`MAX` lowering onto mask-risc (#1518, the part outside glove-parity).
 - **Merged then withdrawn by #1524 (D-CMR-RESET):** the class-method layer of `lance-graph-glove-parity` (`method`, `call`, `decl`, `gremlin`, `awareness`; #1507, #1508, #1509, #1514, #1516, #1518, #1520). Prior state: `backup/session-011BMJ-2026-10-12`. Inventory: entry `2026-10-12-session-reset-inventory.md`.
 - **Docs only:** SAG capstone (#1523): `ProposedMethod`, four-state status; not built.
-- **Open:** #1525 D-NALP W1/W2 (`lance-graph-nal`: NodeGuid-keyed beliefs, byte apertures, `Question`/`TruthAtLeast`/`Choice` over compiled mask-risc programs; mask-risc `CompiledProgram`).
+- **On `main` (#1525, merged `08635ed`):** D-NALP W1/W2, `crates/lance-graph-nal` (NodeGuid-keyed beliefs, byte apertures, `Question`/`TruthAtLeast`/`Choice` over compiled mask-risc programs; mask-risc `CompiledProgram`).
+- **Open:** #1529 D-PROD-V4 (shipped images and the wheel build at x86-64-v4; `linux-build-v4` compiles the v4 arm in CI without running it).
 - **CI (#1526, merged `abc0a1f`):** the native default plus `rust-cache` reused AVX-512 artifacts on runners without them (SIGILL in `dir-sim log in Lance`). `native` is now written out as each runner's exact feature list, and the cache is keyed to it.
-- **Rules carried from this session (operator):** classid-dependent methods go through the existing `hotplug.rs` plug-and-play; NAL/NARS operations are global core methods (no classid check, no plug, no `BeliefClass`); internal pins are forbidden (the v3 pins in the Dockerfiles and wheel build are an open decision).
+- **Rules carried from this session (operator):** classid-dependent methods go through the existing `hotplug.rs` plug-and-play; NAL/NARS operations are global core methods (no classid check, no plug, no `BeliefClass`); internal pins are forbidden (the v3 pins in the Dockerfiles and wheel build are replaced by v4 in #1529).
 
 ## 2026-10-12 — dir-sim membership path witness + role evidence on branch `ccr-0455e606-wmtsor` (unmerged)
 

.claude/board/PR_ARC_INVENTORY.md

@@ -1,3 +1,10 @@
+## 2026-10-13 — lance-graph PR #1525 (merged `08635ed`, branch `ccr-9f3b8075-74u47l-nalp`, head `077bb0a`, 16 commits) — D-NALP-1/2: NAL queries as NodeGuid apertures over the fold path
+
+- **Added:** new crate `crates/lance-graph-nal` (excluded, own workspace root, like `lance-graph-r2il`). A belief's key is its NodeGuid in the reading `nal-statement-v1` (`[classid, S, copula, P, id]`); `f` and `c` are value lanes in the key's sealed order. A selection is `Aperture { key, bytes }` (4 = class, 6 = subject, 10 = statement), resolved to one range by `SealedFacetLane::bound_aperture`. `nal::{Question, TruthAtLeast, Choice}` lower their R2IL procedure over `FoldDialect` once at bind and keep the mask-risc `Program`; calls run `execute_compiled` with the aperture range as the extent. mask-risc gains `CompiledProgram`.
+- **Locked:** no new opcode (`FN = None` for every operation); no foreign keys. Measured (release, AVX-512, n = 1,048,576, median of 101, answers checked before timing): Question 19–20 ns, TruthAtLeast 81–127 ns, Choice 248 ns, bind 274 ns, row loop 495–559 µs; the subject range passed as an ANDed mask instead of the extent took 195 µs. 7 oracle tests over unsorted input; 7 disable runs red.
+- **Deferred / open:** R2IL `RANGE` takes its bounds from two `u8` immediates, so it cannot name a range past row 255 (procedures use `FoldDialect::emit_pred(Pred::Range)`; needs an `ogar-r2il` change). No argmax fold: `Choice` returns the maximum confidence, not the belief. D-NALP-1's ClassView `WideFieldMask` projection and binder mask, and W3 (revision) onward, are not built.
+- **Confidence:** high for the three queries at the measured size; the `u8` range limit is real and unfixed.
+
 ## 2026-10-13 — lance-graph PR #1526 (merged `abc0a1f`, branch `ccr-9f3b8075-74u47l-cpukey`, head `8342c9f`, 4 commits) — CI: spell target-cpu=native out per runner and key the cache to it
 
 - **Added:** `.github/scripts/resolve-native-rustflags.sh`: prints `-Ctarget-feature=` with the runner's exact native feature list and no CPU name, and fails unless `rustc --print cfg` under those flags equals native; `--cpu` prints the name for logs. `dir-sim-persist.yml` and `identity.yml` set `RUSTFLAGS` from it before each of their three rust-cache steps, key the cache on its hash, and write the CPU to the job summary.

.claude/board/STATUS_BOARD.md

@@ -53,8 +53,8 @@ Plan: `.claude/plans/nal-polyfill-v1.md`. Template: D-SQLP. No opcode, tenant or
 | D-id | scope | status | gate / falsifier |
 |---|---|---|---|
 | **D-NALP-0** | Plan, board rows | In PR | docs only |
-| **D-NALP-1** | Statement layout + declared ClassView reading; additive `WideFieldMask` projection path on `ClassView`; binder's mask; term width decision | In PR #1525 (NodeGuid reading `nal-statement-v1`, term width u16, aperture selection; ClassView wide projection and binder mask still queued) | only the mask's lanes are read; undeclared reading and masked-out field refuse; Small = Wide answers |
-| **D-NALP-2** | Query procedures: select, truth threshold, choice by confidence, support count | In PR #1525 (`crates/lance-graph-nal`: NodeGuid key, byte apertures; 7 oracle tests, 7 disable runs red; 19–248 ns at 1,048,576 rows) | equal to a row-at-a-time oracle; one-pattern threshold disable red; no new opcode |
+| **D-NALP-1** | Statement layout + declared ClassView reading; additive `WideFieldMask` projection path on `ClassView`; binder's mask; term width decision | Partial: #1525 merged `08635ed` (NodeGuid reading `nal-statement-v1`, term width u16, aperture selection); ClassView wide projection and binder mask Queued | only the mask's lanes are read; undeclared reading and masked-out field refuse; Small = Wide answers |
+| **D-NALP-2** | Query procedures: select, truth threshold, choice by confidence, support count | Shipped #1525 `08635ed` (`crates/lance-graph-nal`: NodeGuid key, byte apertures; 7 oracle tests, 7 disable runs red; 19–248 ns at 1,048,576 rows); support count and argmax not built | equal to a row-at-a-time oracle; one-pattern threshold disable red; no new opcode |
 | **D-NALP-3** | Revision as `GroupCrossPowerSumsI32` over stored `w`/`f` | Queued | equal to exact integer revision; OpenNARS revision points; duplicate evidence counts once |
 | **D-NALP-4** | Per-row truth law into a lane: `MapPairU8` vs fixed-point multiply-high | Queued | insufficiency proof; per-row parity with `isa::truth`, error in codes; one shape also serves SQL nullable arithmetic |
 | **D-NALP-5** | Deduction / induction / abduction / analogy over populations | Queued (after D-NALP-4) | equals pairwise scalar rule; abduction direction test red for the reversed statement |

.claude/board/entries/2026-10-13-production-targets-v4.md

@@ -0,0 +1,73 @@
+# 2026-10-13 — Production builds target x86-64-v4 (D-PROD-V4)
+
+**Status:** DONE (build targets); the CI test tier and probe guards are OPEN.
+
+**DECISION:** everything shipped from this tree builds for x86-64-v4: the
+Dockerfiles, the thinking-engine images and the wheel. There is no v3
+production variant.
+
+**BASIS:** production always runs on v4. Measured exposure: Railway hosts
+about 95% v4, Claude Code sessions about 70% v4. A v3 build ships the arm
+production never runs, and a timing measured on it is not evidence for
+production.
+
+**SCOPE:**
+
+| site | before | after |
+|---|---|---|
+| `Dockerfile` | `RUSTFLAGS -C target-cpu=x86-64-v3` | `native` (fallback; the build host's CPU) |
+| `Dockerfile.avx512` (canonical deploy) | `x86-64-v4` | `sapphirerapids` (Railway hosts are Sapphire Rapids, Emerald Rapids or newer, per the maintainer) |
+| `Dockerfile.hhtld`, `crates/cognitive-stack/Dockerfile`, `crates/symbiont/Dockerfile` | `cp config-v3.toml config.toml` | `cp config-v4.toml config.toml` (x86_64 only; arm64 untouched) |
+| `crates/thinking-engine/Dockerfile`, `Dockerfile.railway` | `CARGO_TARGET_X86_64_…_RUSTFLAGS x86-64-v3` | `x86-64-v4` |
+| `python/Makefile` (`make publish`) | `x86-64-v3` on x86_64 hosts | `x86-64-v4` |
+| new `.cargo/config-v4.toml` | — | `-Ctarget-cpu=x86-64-v4`, mirrors ndarray's file without `-Dwarnings` |
+
+**Measured:** `cargo --config .cargo/config-v4.toml` JOINS with
+`.cargo/config.toml`'s `native` (rustc receives `-Ctarget-cpu=native
+-Ctarget-cpu=x86-64-v4`). The later flag wins: the cfg equals v4 alone
+(23 target features), not native (32 on this Cascade Lake host). The
+Dockerfiles copy the file over `config.toml`, so they never join.
+
+**Debug 0 in CI (reported by the maintainer, not re-measured here):** a
+build without debug info drops from 16-19 GB to 3.5 GB of disk and from
+22-42 to 4-9 minutes. With `--target`, RUSTFLAGS no longer reaches build
+scripts and proc-macros (measured: a build script compiled with
+`-C debuginfo=2`), so the v4 job also sets `CARGO_PROFILE_DEV_DEBUG=0` and
+`CARGO_PROFILE_TEST_DEBUG=0`.
+
+**Build scripts:** the three images that copy `config-v4.toml` build with
+`--target <host triple>` (codex P1 on #1529). Without it the cfg-keyed v4
+flags also reach build scripts and proc-macros, which run on the build host
+(measured on a scratch crate: the build script compiled with
+`target-cpu=x86-64-v4`; with `--target`, with none).
+
+**Safety:** on a host without AVX-512, ndarray's startup `cpu_guard` names
+the missing features and exits before `main`; the binary does not die with
+SIGILL mid-run. That holds only for binaries that link ndarray.
+
+**OPEN:**
+- `build.yml` gains `linux-build-v4`, a two-entry matrix (`x86-64-v4`,
+  `sapphirerapids`): it compiles and links lance-graph's tests for each tier
+  with `--target`, so build scripts stay at the host baseline, and runs
+  nothing (most GitHub runners are v3). Both tiers are compiled in CI but
+  never executed there. ndarray gets the same pair in AdaWorldAPI/ndarray#361.
+- `build.yml`, `rust-test.yml` and `style.yml` still RUN tests on a v3 pin
+  instead of per-runner `native` (the #1526 resolver).
+- Probes and examples do not yet refuse to report timings off v4.
+- `Dockerfile.avx512` builds `sapphirerapids`; its build stage runs the
+  tests, so that arm executes on the Railway build host and nowhere else.
+- Plain `Dockerfile` builds `native` (maintainer's decision). It tunes to the
+  build host; if the run host lacks a compiled-in feature, ndarray's startup
+  `cpu_guard` stops the binary before `main`, and ndarray#360 warns at build
+  time about enabled features the guard has no row for.
+- `Dockerfile` and `Dockerfile.avx512` could not resolve dependencies: they
+  provided neither sibling the workspace path-deps (ndarray, OGAR) and did not
+  copy the workspace member `tools/dto-class-check`. Both now clone ndarray and
+  OGAR at their default branches (`master`, `main`) to `/ndarray` and `/OGAR`
+  and copy `tools/`. Checked in a Docker-shaped layout: every member and path
+  dependency resolves (cargo reached locking 879 packages; only `--offline`
+  stopped the download). `Dockerfile.hhtld`'s fallback fetched ndarray's
+  `main` branch, which does not exist; it now fetches `master`.
+- Not verified with `docker build` here.
+
+**REVISIT WHEN:** a production host without AVX-512 appears.

.claude/board/entries/README.md

@@ -25,10 +25,11 @@ index row, (3) no duplicate entry id. Checks 1 and 2 are deliberately
 opposite directions; the stranding this convention prevents shows up in
 exactly one of them, never both.
 
-325 entries, 2026-08-06 .. 2026-10-12.
+326 entries, 2026-08-06 .. 2026-10-13.
 
 | date | entry id | finding | file |
 |---|---|---|---|
+| 2026-10-13 | `D-PROD-V4` |  | [2026-10-13-production-targets-v4.md](2026-10-13-production-targets-v4.md) |
 | 2026-10-12 | `D-SAG-1` |  | [2026-10-12-software-awareness-graph.md](2026-10-12-software-awareness-graph.md) |
 | 2026-10-12 | `D-CMR-RESET` | method layer was a second algebra beside the folds and slower than a row loop (430–480 µs vs 283 µs); moved to backup, rebuild as bindings over existing folds | [2026-10-12-session-reset-inventory.md](2026-10-12-session-reset-inventory.md) |
 | 2026-10-12 | `D-SAG-5-0` | Post-#1509 SAG self-querying, provenance and limited attention with NARS/Hyperon/PLN comparisons; research prompt and high-signal falsifiers | [2026-10-12-sag-reflexive-cognition-research.md](2026-10-12-sag-reflexive-cognition-research.md) |

.github/workflows/build.yml

@@ -83,3 +83,70 @@ jobs:
         run: cargo test --manifest-path crates/lance-graph/Cargo.toml
       - name: Check benchmarks
         run: cargo check --manifest-path crates/lance-graph/Cargo.toml --benches
+
+  # Production runs x86-64-v4, but GitHub's runners are mostly v3, so the v4
+  # arm cannot be executed here. This job compiles and links it without
+  # running anything.
+  #
+  # `--target` is load-bearing: without it RUSTFLAGS also reaches build
+  # scripts and proc-macros, which DO run on this host, so a v3 runner could
+  # die with SIGILL in the middle of the build. With an explicit target,
+  # RUSTFLAGS applies only to target artifacts (measured: the build script
+  # compiles with no target-cpu, the crate with x86-64-v4).
+  #
+  # Two tiers: x86-64-v4 (the floor production runs on) and sapphirerapids
+  # (Dockerfile.avx512, the canonical deploy; Railway hosts are Sapphire
+  # Rapids, Emerald Rapids or newer). Both compile, neither runs.
+  linux-build-v4:
+    name: linux-build-v4 (${{ matrix.cpu }})
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        cpu: [x86-64-v4, sapphirerapids]
+    env:
+      RUSTFLAGS: "-C debuginfo=0 -C target-cpu=${{ matrix.cpu }}"
+      # Runner disk makes debug 0 mandatory. With `--target`, RUSTFLAGS no
+      # longer reaches build scripts and proc-macros, so their debug level
+      # comes from the profile; these pin it to 0 for every artifact.
+      CARGO_PROFILE_DEV_DEBUG: "0"
+      CARGO_PROFILE_TEST_DEBUG: "0"
+      CARGO_INCREMENTAL: "0"
+    defaults:
+      run:
+        working-directory: lance-graph
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: lance-graph
+      - name: Checkout AdaWorldAPI/ndarray (sibling dependency)
+        uses: actions/checkout@v4
+        with:
+          repository: AdaWorldAPI/ndarray
+          path: ndarray
+      - uses: actions/checkout@v4
+        with:
+          repository: AdaWorldAPI/OGAR
+          path: OGAR
+      - name: Setup rust toolchain (pinned by rust-toolchain.toml)
+        run: rustup show
+      - name: Setup mold linker
+        uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: "lance-graph-deps-${{ matrix.cpu }}"
+          workspaces: |
+            lance-graph/crates/lance-graph
+      - name: Install dependencies
+        run: |
+          sudo apt update
+          sudo apt install -y protobuf-compiler
+      - name: Check the target really is AVX-512
+        run: |
+          rustc --print cfg -C target-cpu=${{ matrix.cpu }} | grep -qx 'target_feature="avx512f"'
+          echo "Built for ${{ matrix.cpu }} (not run). Runner CPU: $(grep -m1 'model name' /proc/cpuinfo | cut -d: -f2)" >> "$GITHUB_STEP_SUMMARY"
+      - name: Build tests for ${{ matrix.cpu }} (no run)
+        run: cargo test --manifest-path crates/lance-graph/Cargo.toml --target x86_64-unknown-linux-gnu --no-run
+      - name: Check benchmarks for ${{ matrix.cpu }}
+        run: cargo check --manifest-path crates/lance-graph/Cargo.toml --target x86_64-unknown-linux-gnu --benches