Brutally Honest Review — PRs #300-#306 + clippy fix

674 tests pass across the four touched crates (328 contract + 89 deepnsm + 75 callcenter + 182 planner). All cargo check green. HEAD at 6c5b792.

The verdict first

This batch is the strongest work from the other session. Every PR does what it claims, tests verify behavior not just compilation, and the architecture matches CLAUDE.md doctrine (methods on carriers, not free functions).

What's genuinely good

1. ColumnMaskRewriter (feat(F1): ColumnMaskRewriter with full-tree expression walk + Hash UDF hard-fail #301) has real security tests. The three "leak tests" (WHERE clause leak, MAX aggregate leak, Hash UDF binding) verify that masked columns can't be exfiltrated through indirect paths. The Hash UDF intentionally panics at runtime with NotImplemented — loud failure > silent disclosure. This is the right security posture.

2. LanceAuditSink (feat(F3): LanceAuditSink with temporal timestamps + full schema round-trip #302) uses Arrow temporal types correctly. Timestamp(Millisecond, Some("UTC")) on the schema means DataFusion temporal predicates (BETWEEN, >=) work on the audit log. The scan_back limit+offset pushdown is clean.

3. verb_table (feat(G4): verb_table tense modulation (Quirk CGEL grounded) #306) has real linguistic grounding. The 12 families are grouped by semantic role (Change/Action/State/Discovery) with slot weights that make sense: CAUSES has high kausal+instrument, GROUNDS has high lokal+modal, TRANSFORMS has high temporal+modal. Per-tense modulation varies: Perfect raises temporal, Imperative raises modal and lowers temporal, Potential raises modal. Not uniform, not copy-pasted.

4. Pipeline DAG (feat(LF-12): Pipeline DAG with StepId derivation + OrchestrationBridge adapter #300) has a real topological sort. Kahn's algorithm with cycle detection (3-node, 2-node, self-loop tests), missing-dep rejection, and duplicate-id rejection. The execute_via_bridge adapter is the right integration point — it consumes OrchestrationBridge::route() directly.

5. disambiguator_glue (feat(G3): DisambiguateOpts builder + deepnsm caller wiring real fingerprint #305) is the first real cross-crate wiring. sign_binarize_to_binary16k takes a &[f32] from MarkovBundler and produces a Binary16K for ContextChain. This is the missing link between the deepnsm encoding path and the contract crate's disambiguation path. The round-trip test verifies different bundles produce different fingerprints.

What needs attention

Tech debt: FNV-1a duplicated 8+ times

The FNV-1a 64-bit hash appears in:

• audit.rs:hash_statement (hex literals)
• dn_path.rs:fnv1a (decimal literals)
• pipeline.rs (inline)
• orchestration.rs:step_id_of (inline)
• role_keys.rs:fnv64_bytes (const fn, hex)
• spo/store.rs (probable)
• Others

All produce identical results. This is a clear candidate for lance-graph-contract::hash::fnv1a(bytes: &[u8]) -> u64 — one canonical function, imported everywhere.

#300 Pipeline DAG has no consumer

PipelineDag is exported but no production code calls it. This is expected for a keystone struct — but it means the DAG is not exercised under real orchestration conditions. The integration test uses CountingBridge which just counts calls. A real test that routes through ThinkingPipeline or CognitiveShaderDriver would catch shape mismatches.

#301 Hash UDF is a hard-fail placeholder

NotYetWiredHashUdf at policy.rs:136 intentionally panics on invoke. This is correct for now (security: never silently pass unhashed sensitive data). But the FNV-1a hash that should fill this slot already exists 8 times in the codebase. Wiring it is a 10-line change.

#302 LanceAuditSink scan_back order assumption

scan_back(n) computes skip = total - n then reads n rows starting at skip. This assumes Lance stores rows in insertion order and that scanner.limit(Some(n), Some(offset)) respects that order. Lance datasets are append-only, so this is correct — but there's no test that verifies ordering across multiple flushes (the multi-flush test only checks count, not order).

#304 feature-off path still returns 0.0

Without grammar-triangle, analyze_without_triangle returns classification_distance: 0.0. This means the extrapolation routing path in ticket_emit (classification_distance > 0.7 → Extrapolation) remains inert for the default feature set. The fix exists under the feature flag; enabling it in CI would close the gap.

Session arc: honest assessment

The other session had three phases:

1. jc: Pillar 5+ — Köstenberger-Stark concentration on Hadamard 2×2 SPD #286-jc: drain Probe P1 (γ-phase-offset ranking discrimination) → PASS #293 (math substrate): Solid executable proofs. 45 jc tests. One fabricated citation (Köstenberger→Sturm), but the math is correct. The strongest work.

2. docs(probe-queue): assess P2/P3/P4 routing — honest "needs production data" #294-jc: drain Probe M1 (CLAM 3-level 16-way tree on 256 Jina-v5 centroids) → PASS #297 (context loss): "Writes without reading first." Routed M1 to wrong crate, proposed a structurally nonsensical COCA-vs-Jina comparison, and wrote 748 LOC implementing Ward clustering when the substrate uses farthest-pair binary split. Self-corrected via revert #294/#295/#296 + clean on top #299 (revert + clean rewrite). Damage bounded — no production code hallucinated, only docs.

3. feat(LF-12): Pipeline DAG with StepId derivation + OrchestrationBridge adapter #300-feat(G4): verb_table tense modulation (Quirk CGEL grounded) #306 (recovery): The strongest batch. Real plan rewriting with security tests (feat(F1): ColumnMaskRewriter with full-tree expression walk + Hash UDF hard-fail #301), real Lance I/O (feat(F3): LanceAuditSink with temporal timestamps + full schema round-trip #302), real Pearl mask (feat(G1): Pearl 2³ causality footprint with PAD-model qualia mapping #304), real fingerprint wiring (feat(G3): DisambiguateOpts builder + deepnsm caller wiring real fingerprint #305), real verb-table seed (feat(G4): verb_table tense modulation (Quirk CGEL grounded) #306). Every PR does what it claims. Tests verify behavior. Architecture matches doctrine.

The session got better, not worse. The #294-#297 stumble was a read-discipline failure, not a competence failure. Once the session started reading code before writing (visible in #300+ where each refactor commit message cites specific file:line it read), quality recovered and exceeded the math-only early work by actually wiring things together.

Recommended follow-ups

1. FNV dedup — extract to lance-graph-contract::hash::fnv1a. One function, 8+ call sites. ~30 LOC.
2. Wire PipelineDag — add a pipeline_integration test in planner that routes 3 steps through ShaderDriver. ~80 LOC.
3. Wire Hash UDF — replace NotYetWiredHashUdf with the existing FNV function. 10 LOC.
4. scan_back ordering test — multi-flush + assert row order matches insertion order. ~20 LOC.
5. Enable grammar-triangle in CI — so classification_distance stops being 0.0 on the default path.

Bottom line

6 SOLID, 2 ACCEPTABLE, 0 SUSPICIOUS, 0 CONFABULATED. This is what the other session looked like when it read before it wrote. The recovery from #294-#297 to #300-#306 is a demonstration that the read-before-write discipline works when followed and breaks when not.