feat(message_graph): literal-100% residue — dichotomy wave

Port the last audit-missing fn name-preserving: _mg_core, the facade
loader-probe twin (_cs_core law — RUNE_MG_CORE=python pins the Python
fallback to None; any other value resolves the in-process kernel,
whose load-failure arm cannot fire). Truth +4 probe cases (python/
auto/other/unset pins, resolved projection frozen from the live
oracle); existing 68-case groups byte-stable. Battery 13/13 green
incl. battery_probe; RUNE_MG_CORE=auto parity pass byte-identical
against the built .so; clippy -D warnings clean; adjacent pytest 9/9
BOTH pins. Fn coverage 12/13 -> 13/13.

scripts/gen_message_graph_truth.py

@@ -71,7 +71,7 @@ mg._now = lambda: CLOCK  # noqa: E731  (the oracle's clock, pinned)
 TMP = Path(tempfile.mkdtemp(prefix="mg_truth_"))
 
 GROUPS = ("load", "save", "add", "tool_call", "tool_result", "revise",
-          "branch", "lineage", "history", "migrate_flat", "cue")
+          "branch", "lineage", "history", "migrate_flat", "cue", "probe")
 groups: dict[str, list] = {g: [] for g in GROUPS}
 
 
@@ -633,10 +633,37 @@ runner = unittest.TextTestRunner(verbosity=0)
 if not runner.run(suite).wasSuccessful():
     raise AssertionError("oracle regression: test_message_graph.py failed")
 
+# ══ probe: the _mg_core facade-resolution law ════════════════════════════
+# The oracle probe is pure env logic (no delegation): "python" -> None,
+# anything else (incl. unset) -> the loader module when built. Frozen as a
+# resolved projection (the module handle itself is not JSON-able); the
+# kernel twin mirrors the same lattice.
+def _probe_case(name, pin):
+    old = os.environ.get("RUNE_MG_CORE")
+    if pin is None:
+        os.environ.pop("RUNE_MG_CORE", None)
+    else:
+        os.environ["RUNE_MG_CORE"] = pin
+    try:
+        core = mg._mg_core()
+        resolved = core is not None
+    finally:
+        if old is None:
+            os.environ.pop("RUNE_MG_CORE", None)
+        else:
+            os.environ["RUNE_MG_CORE"] = old
+    case("probe", name, {"pin": pin}, {"resolved": resolved})
+
+
+_probe_case("pin-python", "python")
+_probe_case("pin-auto", "auto")
+_probe_case("pin-other-resolves", "rust")
+_probe_case("pin-unset-defaults-auto", None)
+
 # ══ write ════════════════════════════════════════════════════════════════
 truth = {
     "frozen": "message_graph load/save/add/tool_call/tool_result/revise/"
-              "branch/lineage/history/migrate_flat/cue",
+              "branch/lineage/history/migrate_flat/cue/probe",
     "oracle": "src/rune/message_graph.py",
     "note": "Graph wire: {nodes: {id: node} insertion-ordered, order: [ids]}. "
             "Nondeterminism seams (uuid4 hex id, _now timestamp) are facade "

src/rust/message_graph/src/branch_battery.rs

@@ -264,6 +264,23 @@ fn battery_cue() {
     assert_eq!(run_group("cue"), 7);
 }
 
+#[test]
+fn battery_probe() {
+    let cs = cases("probe");
+    assert_eq!(cs.len(), 4, "probe group carries the 4 pin cases");
+    for c in &cs {
+        let pin = c["input"]["pin"].as_str();
+        let got = crate::_mg_core(pin);
+        let want = c["expected"]["resolved"].as_bool().unwrap_or(false);
+        assert_eq!(
+            got.is_some(),
+            want,
+            "probe case {} diverged (pin={pin:?})",
+            c["name"].as_str().unwrap_or("")
+        );
+    }
+}
+
 #[test]
 fn battery_total_is_68() {
     let total: usize = [

src/rust/message_graph/src/frozen_mg_truth.json

@@ -1,5 +1,5 @@
 {
- "frozen": "message_graph load/save/add/tool_call/tool_result/revise/branch/lineage/history/migrate_flat/cue",
+ "frozen": "message_graph load/save/add/tool_call/tool_result/revise/branch/lineage/history/migrate_flat/cue/probe",
  "oracle": "src/rune/message_graph.py",
  "note": "Graph wire: {nodes: {id: node} insertion-ordered, order: [ids]}. Nondeterminism seams (uuid4 hex id, _now timestamp) are facade arguments — frozen CLOCK and sequential deadbeefNNNN ids replay verbatim. save() builds the doc in the kernel; the file write (mkdir + json.dumps indent=2) and tool_call's json.dumps content stay in the facade (serialization isomorphism).",
  "load": [
@@ -3170,5 +3170,43 @@
     "result": "branched from ccc00000"
    }
   }
+ ],
+ "probe": [
+  {
+   "name": "pin-python",
+   "input": {
+    "pin": "python"
+   },
+   "expected": {
+    "resolved": false
+   }
+  },
+  {
+   "name": "pin-auto",
+   "input": {
+    "pin": "auto"
+   },
+   "expected": {
+    "resolved": true
+   }
+  },
+  {
+   "name": "pin-other-resolves",
+   "input": {
+    "pin": "rust"
+   },
+   "expected": {
+    "resolved": true
+   }
+  },
+  {
+   "name": "pin-unset-defaults-auto",
+   "input": {
+    "pin": null
+   },
+   "expected": {
+    "resolved": true
+   }
+  }
  ]
 }

src/rust/message_graph/src/lib.rs

@@ -621,6 +621,25 @@ fn require_str<'a>(arg: &'a Value, key: &str) -> Result<&'a str, MgErr> {
     opt_str(arg, key).ok_or_else(|| arg_err(format!("arg.{key} required")))
 }
 
+// ── core probe (facade `_mg_core` mirror, _cs_core law) ──────────────────
+
+/// The resolved in-process message-graph core. Twin of the oracle's
+/// loader MODULE handle (`_mg_core` returns the mg_loader module, never
+/// the raw CDLL — MgCore is that handle's shape in the reunited crate).
+#[derive(Debug, Clone, Copy)]
+pub struct MgCore;
+
+/// The Rust message-graph core probe (name-preserving port of `_mg_core`).
+/// RUNE_MG_CORE=python pins the Python fallback → None; every other value
+/// resolves the core. The oracle's load-failure branch can't fire here —
+/// in-process is always loaded.
+pub fn _mg_core(pin: Option<&str>) -> Option<MgCore> {
+    match pin {
+        Some("python") => None,
+        _ => Some(MgCore),
+    }
+}
+
 // ── FFI (doc-envelope law) ──────────────────────────────────────────────
 
 fn read_arg(ptr: *const c_char) -> Result<Value, MgErr> {