docs: session handover + next-architecture proposal (Living Probe Ledger)

[AdaWorldAPI]

What this PR is

Per operator request ("commit your ideas yet, please do and write a PR for epiphanies fan-out and what is new architecture you want to build next"). Two new docs + a CLAUDE.md doc-family wire-in. Docs-only. PII abort-guard CLEAN. No model identifier.

1. .claude/handovers/2026-06-10-canon-arc-session-handover.md — honest attribution

The marathon session that ratified the GUID canon, INTEGRATION-MAP, the probe-first test plan, and the 5+3 apparatus produced contributions from multiple sources. This handover separates them honestly so future sessions inherit the provenance, not just the artifacts.

• §1 — My contributions, attributed (C1–C10): the 5+3 apparatus on disk; theorem-checker rule 0 (born from a real bits-vs-hex unit failure); the TWO-ALGEBRA rule formalization + WHP-4 CI guard; the delegation-lineage correction (Self/Lieberman 1986 prototype-chain, not OTP route-up); J1–J3 falsification joints with explicit kill conditions; the probe-first wave structure incl. the prerequisite-probe rule (Codex caught my F13 loophole); the HILBERT-L4 execution receipt (the session's one probe actually run); D-LOSSCHAN as the survivor entry; cross-PR resolution wording; the honest fence list in INTEGRATION-MAP §7.
• §2 — The operator's epiphanies (theirs, attributed): every load-bearing architectural decision was the operator's. Listed for the record so the canon's provenance is clear (hex-counted GUID, key-of-key-value, 3×4 uniform, centroid tile reading, codebook-as-prefix scoping, deterministic phase, bipolar Walsh-Hadamard, the "correct the operator at any time" mandate, the 5+3 suggestion itself).
• §3 — Six failure modes I exhibited and how each got caught — bits-vs-hex (operator), wrapper-reshapes-canon (operator), synthesis-without-grounding (my own regrounding), reframe-B-was-the-same-error-as-A (cross-domain savant), population-model-error-on-shape_hash (G-pass), quorum-loophole-on-F13 (Codex). The pattern: I generate internally-consistent structure faster than it can touch ground; the apparatus is the counterweight.
• §4 — What's now true on main across OGAR, lance-graph, ndarray.
• §5 — Standing offer for execution (smallest first): WHP-4 CI guard → PHASE-1+WHP-1a/1b probes → Class traversal API → PrefixShapeTable scaffold → the Living Probe Ledger.

2. docs/PROBE-SUBSTRATE-PROPOSAL.md — the next architecture I want to build

The Living Probe Ledger. Workspace-level system that flips the direction of authority: the probe RESULT is the source of truth; the ledger entry is its shadow. Today the shadow is what we look at; the proposal makes the shadow track the source instead of drifting from it.

Why now

1. The canon is pinned and indexed — GUID layout, key-of-key-value, 3×4, centroid tile, prefix codebook, deterministic phase, bipolar Walsh-Hadamard, all on main, all with graded ledger entries in DISCOVERY-MAP §2.10 and named probes in INTEGRATION-TEST-PLAN.
2. The probe vocabulary is enumerated — F1–F14, J1–J3, WHP-1..4, PHASE-1, PERT-RHO, ROUTE-1, QUORUM-1, PHI-1, PYR-1, CODEBOOK-44, HILBERT-L4 — each with file path, pass criterion, kill condition. Already parseable from the docs as-is.
3. One execution receipt landed today by hand — HILBERT-L4 verified green via cargo test, three docs updated. That's the loop the proposal automates.

Three waves

• Wave A — the parser (~200 LOC). Walks the three docs, parses probe rows, emits typed Vec<Probe> to JSON. Round-trip = canonical test. Closes nothing yet — makes the substrate machine-readable. Gates on operator green-light before Waves B/C.
• Wave B — the runner (GitHub Actions). Runs each probe by declared mechanism; records NotRun/Green/Red per probe to a committed .claude/probe-ledger.json.
• Wave C — the auto-PR-er. State transitions open ledger-edit PRs per the existing append-only convention.

Honest fences

• Parser drift (mitigated by re-parse-on-CI; doc edit that breaks parse = same shape as code edit that breaks a test).
• Not-all-probes-mechanical (declared Mechanical | HumanReview kind; runner opens an issue for HumanReview, not a state change).
• Auto-PR spam (per-probe rate limit: max one state-change PR per probe per week).
• This is governance code, not substrate code. No unsafe, no SIMD, no codec, no doctrine — a tractable contract crate with a fixed scope. The smallest valuable architecture in the workspace, and the easiest to test.

Decision asked

One sentence: green-light Wave A (~200 LOC parser, single new crate crates/probe-ledger) or redirect to a different next architecture.

3. CLAUDE.md doc-family extended (reads 4 and 5)

The proposal and handover join the canonical reading order so future sessions find them via the existing pattern.

Hygiene

Docs-only · PII abort-guard CLEAN · no model identifier (filename, title, and branch name scrubbed pre-commit under the existing firewall-warden charter; the dogfooding worked).

On "epiphanies fan-out"

The new findings of the session (E-WHP-BIPOLAR-1, E-CANON-GUID-1) already landed in lance-graph/.claude/board/EPIPHANIES.md via #482, and the policy/mechanism mirrors are committed in lance-graph #482 + ndarray #215. The fan-out within OGAR is DISCOVERY-MAP §2.10 (already merged via #50) + this PR's handover + proposal. If you want cross-repo handover mirrors (e.g., this attribution doc echoed in lance-graph's .claude/board/), say so and I open follow-up PRs in each.

https://claude.ai/code/session_01PBTGaPCSnnt6u3pjXpbLwY