[AdaWorldAPI]

Summary

Follow-up to merged #1962. Requires AdaWorldAPI/OGAR#371 (Output::entra_mailbox). This PR's CI checks out OGAR main, so it stays red until #371 merges.

• No second correspondence. The lab used to scan Exchange Online at bind time to find the Entra→EXO row. It now reads that row from OGAR's fold output. Every ordinal the lab binds comes from OGAR.
• An existing lifetime witness replaces the lab stamp. The lab-local value Stamp is gone. A bound coordinate now carries a lance_graph_dt64::dr::Frame, issued by a FrameStore (revisions: source, relation_map, coordinates), and every read calls FrameStore::check. A frame cannot be built from numbers, so a foreign store or a re-seal at equal revisions is refused; the old value stamp treated those as the same coordinate. The identity cross-check stays as a second line of defence, for an owner that forgets to advance.
• New falsifiers:
  • every row is compared against the independent oracle;
  • a frame from another store, and a re-seal at equal revisions, are refused;
  • a unique match that turns ambiguous after a source change: the old coordinate is refused (SourceChanged) and rebinding refuses instead of choosing the first mailbox;
  • a missing backsync gets an explicit status and a refusal;
  • a thread-local counting allocator shows 0 heap allocations on the hot read path and the hot fold path.
• CI now runs clippy on the lab as well; before this PR it was tested but not linted.

Measured (release, two-row fixture; reported, not gated)

part	cost
cold prepare (Index + fold + Ruler + Planes) + bind	~12 µs
warm property read (frame check + 8 identity checks)	~27 ns
Quack → mask-RISC SumI32 over a borrowed lane	~122 ns per call
heap allocations, hot path	0

Disable runs (each committed first, then broken, then restored)

guard removed	result
frame check	3 tests red
identity cross-check	the "owner forgot to advance" test red
hot-path allocation introduced	allocation test red
cloud plane alone, or entra_mailbox == NO_ROW refusal alone	green: each refuses an ambiguous mailbox on its own
both ambiguity guards	2 tests red

Not proved here

• Property reads index borrowed lanes by bound ordinal in test code. This is not an admitted cross-table Gather; the gather ban, ADMISSION B and OP-14 are unchanged.
• The coordinate does not carry its DT64 class route (RouteVersion). FrameStore and BindStore run on separate clocks in this lab.
• Frame revision numbers are supplied by the caller, not derived from a source receipt or a DR MapTable layout digest.

---

Generated by Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[AdaWorldAPI]

Exchange dir-sim fidelity is red with E0609: no field entra_mailbox on type ogar_dir_core::correspond::Output (ordinal_chain_lab.rs:224).

This is the paired-change dependency this PR states, not a defect in this PR. The job checks out OGAR main, and the field lands in AdaWorldAPI/OGAR#371. Locally, against the OGAR branch, the lab compiles and passes 10/10, and clippy (-D warnings) and fmt are clean.

A re-run cannot go green before #371 merges, so I have not re-run the job. Once #371 is on OGAR main, I'll re-run this check and the dir-sim persist job.

---

Generated by Claude Code