From 2f4a09f13945f385a108bb30c139455076340c44 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 5 Nov 2026 23:16:36 +0000 Subject: [PATCH 1/2] test(lab): read EXO ordinal from OGAR's fold, witness coordinates with DR frames The hybrid ordinal-chain lab no longer scans Exchange Online at bind time: it reads the sole Entra->EXO row from ogar_dir_core::Output::entra_mailbox. The lab-local value Stamp is replaced by lance_graph_dt64::dr::FrameStore: a bound coordinate carries the owner-issued Frame and every read checks it, so a foreign store or a re-seal at equal revision numbers is refused. New falsifiers: every row against the independent oracle, foreign frame and re-seal, a unique match turned ambiguous after a source change, missing backsync, and zero heap allocations on the hot read and fold path. CI now runs clippy on the lab as well. Requires the paired OGAR change (Output::entra_mailbox). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01XAqKMMJzKZrYnckXRC8x2U --- .github/workflows/dir-sim-persist.yml | 2 + .../tests/ordinal_chain_lab.rs | 325 ++++++++++++++---- 2 files changed, 260 insertions(+), 67 deletions(-) diff --git a/.github/workflows/dir-sim-persist.yml b/.github/workflows/dir-sim-persist.yml index 8788c384f..2d27e20a5 100644 --- a/.github/workflows/dir-sim-persist.yml +++ b/.github/workflows/dir-sim-persist.yml @@ -84,5 +84,7 @@ jobs: run: cargo clippy --manifest-path crates/lance-graph-dir-sim-lance/Cargo.toml --all-targets -- -D warnings - name: test run: cargo test --manifest-path crates/lance-graph-dir-sim-lance/Cargo.toml + - name: hybrid ordinal-chain lab clippy (excluded dir-sim crate) + run: cargo clippy --manifest-path crates/lance-graph-dir-sim/Cargo.toml --test ordinal_chain_lab -- -D warnings - name: hybrid ordinal-chain lab (excluded dir-sim crate) run: cargo test --manifest-path crates/lance-graph-dir-sim/Cargo.toml --test ordinal_chain_lab diff --git a/crates/lance-graph-dir-sim/tests/ordinal_chain_lab.rs b/crates/lance-graph-dir-sim/tests/ordinal_chain_lab.rs index 89bec8669..5f082aff5 100644 --- a/crates/lance-graph-dir-sim/tests/ordinal_chain_lab.rs +++ b/crates/lance-graph-dir-sim/tests/ordinal_chain_lab.rs @@ -4,30 +4,68 @@ //! snapshot-local ordinals once, then reads two unrelated source-property //! lanes through the same tiny descriptor. No joined-row/PSCustomObject store. //! +//! Coordinate lifetime is witnessed by the existing DT64 DR `FrameStore`: +//! a bound coordinate carries the owner-issued `Frame` it was bound under +//! (source / relation-map / coordinate revisions), and every read checks it. +//! A frame cannot be built from numbers, so two snapshots that happen to share +//! revision numbers never alias. +//! //! Not proved here: a production DR MapTable-to-SoA layout witness, a general //! FACET STRIDE GUID join, an admitted arbitrary cross-table Gather, or full //! historic data replay. See the companion PR description. -#![forbid(unsafe_code)] +#![deny(unsafe_code)] use lance_graph_contract::class_view::WideFieldMask; use lance_graph_contract::set_rules::{Population, Truth}; +use lance_graph_dt64::dr::{Frame, FrameRefusal, FrameRevisions, FrameStore}; use lance_graph_dt64::{ - BindStore, ClassSchema, Extent, MethodBinding, MethodId, MethodRef, Refusal, SchemaRev, - SigRev, ValueDemand, + BindStore, ClassSchema, Extent, MethodBinding, MethodId, MethodRef, Refusal, SchemaRev, SigRev, + ValueDemand, }; use lance_graph_mask_risc::{ execute_into, Foreign, LaneRef, Out, Planes as QueryPlanes, Scratch, Value, }; use lance_graph_quack::{lower, Agg, Col, Filter, Mask, Query}; use ogar_dir_core::correspond::{ - fold, fold_aligned, state, AdStatus, IdColumn, Index, Lanes, Output, Planes, Rows, - Ruler, NO_ROW, + fold, fold_aligned, state, AdStatus, IdColumn, Index, Lanes, Output, Planes, Rows, Ruler, + NO_ROW, }; use ogar_dir_core::identity::Encoding; use ogar_dir_core::label::LabelPattern; use ogar_dir_core::Guid128; +/// Counts heap allocations made by the current thread, so the hot-path test +/// is not disturbed by tests running in parallel. +struct CountingAlloc; + +thread_local! { + static ALLOCATIONS: std::cell::Cell = const { std::cell::Cell::new(0) }; +} + +#[allow(unsafe_code)] +// SAFETY: delegates every call to the system allocator unchanged. +unsafe impl std::alloc::GlobalAlloc for CountingAlloc { + unsafe fn alloc(&self, layout: std::alloc::Layout) -> *mut u8 { + let _ = ALLOCATIONS.try_with(|c| c.set(c.get() + 1)); + unsafe { std::alloc::System.alloc(layout) } + } + unsafe fn dealloc(&self, ptr: *mut u8, layout: std::alloc::Layout) { + unsafe { std::alloc::System.dealloc(ptr, layout) } + } + unsafe fn realloc(&self, ptr: *mut u8, layout: std::alloc::Layout, size: usize) -> *mut u8 { + let _ = ALLOCATIONS.try_with(|c| c.set(c.get() + 1)); + unsafe { std::alloc::System.realloc(ptr, layout, size) } + } +} + +#[global_allocator] +static GLOBAL: CountingAlloc = CountingAlloc; + +fn allocations() -> u64 { + ALLOCATIONS.with(|c| c.get()) +} + fn id(x: u128) -> Guid128 { Guid128(x.to_be_bytes()) } @@ -68,16 +106,23 @@ fn snapshot() -> Lanes { } } -/// This revision pair is a deliberately explicit *lab* witness, NOT a new -/// production receipt or DR-owned layout identity. -#[derive(Clone, Copy, Debug, PartialEq, Eq)] -struct Stamp { - source: u64, - layout: u64, +/// Revisions of the snapshot the lab binds against: `source` = the +/// observation, `relation_map` = the OGAR correspondence run over it, +/// `coordinates` = the row order of the borrowed lanes. +fn revisions(source: u64, relation_map: u64, coordinates: u64) -> FrameRevisions { + FrameRevisions { + source, + relation_map, + coordinates, + } } #[derive(Clone, Copy, Debug, PartialEq, Eq)] enum ReadError { + /// The owner no longer issues the frame the coordinate was bound under. + StaleFrame(FrameRefusal), + /// The frame is current but the lanes do not hold the bound identities: + /// the owner forgot to advance. Defence in depth, not the witness. StaleCoordinate, MissingProperty, } @@ -91,7 +136,7 @@ enum Family { /// A conceptual chained-coordinate result, not a new canonical object type. /// Each ordinal is valid only for its owning population/scope/layout. -#[derive(Clone, Copy, Debug, PartialEq, Eq)] +#[derive(Clone, Debug)] struct BoundCoordinates { ad: usize, entra: usize, @@ -100,7 +145,7 @@ struct BoundCoordinates { ad_id: Guid128, entra_id: Guid128, exo_id: Guid128, - stamp: Stamp, + frame: Frame, } impl BoundCoordinates { @@ -110,12 +155,12 @@ impl BoundCoordinates { fn read( &self, l: &Lanes, - current: Stamp, + frames: &FrameStore, family: Family, values: &[i32], ) -> Result { - if current != self.stamp - || l.ad.owner.get(self.ad) != Some(&self.ad_id) + frames.check(&self.frame).map_err(ReadError::StaleFrame)?; + if l.ad.owner.get(self.ad) != Some(&self.ad_id) || l.entra.owner.get(self.entra) != Some(&self.entra_id) || l.exo.owner.get(self.exo) != Some(&self.exo_id) || l.ad.scope.get(self.ad) != Some(&self.scope) @@ -153,11 +198,10 @@ impl Prepared { Self { out, planes } } - /// Resolve once at the cold boundary. OGAR already provides AD→Entra - /// ordinals. The current Output has no public Entra→EXO row-ordinal lane, - /// so this lab alone performs a unique EXO lookup at BIND time. It does - /// not repeat that lookup for each property read. - fn bind(&self, l: &Lanes, ad: usize, stamp: Stamp) -> Option { + /// Resolve once at the cold boundary. Every ordinal comes from OGAR's + /// fold: AD→Entra from `ad_target`/`ad_back`, Entra→EXO from + /// `entra_mailbox`. The lab performs no lookup of its own. + fn bind(&self, l: &Lanes, ad: usize, frames: &FrameStore) -> Option { let status = AdStatus::of(*self.out.ad.get(ad)?); if status != AdStatus::Confirmed { return None; @@ -177,18 +221,10 @@ impl Prepared { return None; } let cloud_id = *l.entra.owner.get(entra)?; - // COLD only: use the same scope and 128-bit external ID as OGAR. - // This supplementary scan is an integration-seam diagnostic, not a - // canonical side index, nor proof of a SIMD-STRIDE join. - let mut candidates = (0..l.exo.len()).filter(|&row| { - l.exo.scope[row] == scope - && l.exo_external.state[row] == state::PRESENT - && l.exo_external.id[row] == cloud_id - }); - let exo = candidates.next()?; - if candidates.next().is_some() { - return None; - } + let exo = match *self.out.entra_mailbox.get(entra)? { + NO_ROW => return None, + x => x as usize, + }; Some(BoundCoordinates { ad, entra, @@ -197,7 +233,7 @@ impl Prepared { ad_id: l.ad.owner[ad], entra_id: cloud_id, exo_id: l.exo.owner[exo], - stamp, + frame: frames.seal(), }) } } @@ -208,9 +244,7 @@ fn oracle(l: &Lanes, ad: usize) -> Option<(usize, usize)> { let scope = *l.ad.scope.get(ad)?; let anchor = *l.ad_anchor.id.get(ad)?; let backsync = *l.ad_backsync.id.get(ad)?; - if l.ad_anchor.state[ad] != state::PRESENT - || l.ad_backsync.state[ad] != state::PRESENT - { + if l.ad_anchor.state[ad] != state::PRESENT || l.ad_backsync.state[ad] != state::PRESENT { return None; } let mut matching = (0..l.entra.len()).filter(|&j| { @@ -230,10 +264,8 @@ fn oracle(l: &Lanes, ad: usize) -> Option<(usize, usize)> { if (0..l.ad.len()).any(|i| { i != ad && l.ad.scope[i] == scope - && ((l.ad_anchor.state[i] == state::PRESENT - && l.ad_anchor.id[i] == anchor) - || (l.ad_backsync.state[i] == state::PRESENT - && l.ad_backsync.id[i] == backsync)) + && ((l.ad_anchor.state[i] == state::PRESENT && l.ad_anchor.id[i] == anchor) + || (l.ad_backsync.state[i] == state::PRESENT && l.ad_backsync.id[i] == backsync)) }) { return None; } @@ -246,11 +278,6 @@ fn oracle(l: &Lanes, ad: usize) -> Option<(usize, usize)> { mailbox.next().is_none().then_some((entra, exo)) } -const S0: Stamp = Stamp { - source: 1, - layout: 1, -}; - #[test] fn backsync_label_is_decoded_to_128_bit_cloud_identity_once() { let cloud = id(30); @@ -269,75 +296,162 @@ fn backsync_label_is_decoded_to_128_bit_cloud_identity_once() { #[test] fn a_single_bound_coordinate_serves_many_late_properties() { let l = snapshot(); + let frames = FrameStore::new(revisions(1, 1, 1)); let prepared = Prepared::new(&l); - let r = prepared.bind(&l, 0, S0).expect("confirmed AD→Entra→EXO"); + let r = prepared + .bind(&l, 0, &frames) + .expect("confirmed AD→Entra→EXO"); assert_eq!((r.entra, r.exo), oracle(&l, 0).unwrap()); // Three separate source-owned property lanes. No Vec. let ad_department = [6_i32, 7]; let entra_license_count = [25_i32, 40]; let exo_archive_state = [1_i32, 0]; - assert_eq!(r.read(&l, S0, Family::Ad, &ad_department), Ok(6)); + assert_eq!(r.read(&l, &frames, Family::Ad, &ad_department), Ok(6)); assert_eq!( - r.read(&l, S0, Family::Entra, &entra_license_count), + r.read(&l, &frames, Family::Entra, &entra_license_count), Ok(25) ); + assert_eq!(r.read(&l, &frames, Family::Exo, &exo_archive_state), Ok(1)); assert_eq!( - r.read(&l, S0, Family::Exo, &exo_archive_state), - Ok(1) - ); - assert_eq!( - r.read(&l, S0, Family::Exo, &[]), + r.read(&l, &frames, Family::Exo, &[]), Err(ReadError::MissingProperty) ); } +/// Every ordinal of every bindable row equals the independent scan. A +/// non-vacuous fixture: both rows bind, so the comparison is made twice. +#[test] +fn bound_ordinals_equal_the_independent_oracle_for_every_row() { + let l = snapshot(); + let frames = FrameStore::new(revisions(1, 1, 1)); + let prepared = Prepared::new(&l); + let mut bound = 0; + for ad in 0..l.ad.len() { + let got = prepared.bind(&l, ad, &frames).map(|r| (r.entra, r.exo)); + assert_eq!(got, oracle(&l, ad), "AD row {ad}"); + bound += usize::from(got.is_some()); + } + assert_eq!(bound, l.ad.len()); +} + #[test] fn moved_ordinals_refuse_stale_read_then_rebind_to_same_identity() { let l = snapshot(); - let old = Prepared::new(&l).bind(&l, 0, S0).unwrap(); + let mut frames = FrameStore::new(revisions(1, 1, 1)); + let old = Prepared::new(&l).bind(&l, 0, &frames).unwrap(); let mut moved = l.clone(); moved.entra.owner.swap(0, 1); moved.entra.scope.swap(0, 1); moved.entra.at.swap(0, 1); moved.entra_anchor.id.swap(0, 1); moved.entra_anchor.state.swap(0, 1); + + // The owner did not advance: the frame is current, the identity + // cross-check is what refuses. assert_eq!( - old.read(&moved, S0, Family::Entra, &[40, 25]), + old.read(&moved, &frames, Family::Entra, &[40, 25]), Err(ReadError::StaleCoordinate) ); - let newer = Stamp { source: 1, layout: 2 }; - let rebound = Prepared::new(&moved).bind(&moved, 0, newer).unwrap(); + // The owner advances the coordinate revision: the frame refuses first, + // and names what moved. + frames.advance(revisions(1, 1, 2)); + assert_eq!( + old.read(&moved, &frames, Family::Entra, &[40, 25]), + Err(ReadError::StaleFrame(FrameRefusal::CoordinatesChanged)) + ); + let rebound = Prepared::new(&moved).bind(&moved, 0, &frames).unwrap(); assert_eq!(rebound.entra, 1); assert_eq!((rebound.entra, rebound.exo), oracle(&moved, 0).unwrap()); assert_eq!( - rebound.read(&moved, newer, Family::Entra, &[40, 25]), + rebound.read(&moved, &frames, Family::Entra, &[40, 25]), Ok(25) ); +} + +/// The lab's former value stamp aliased two snapshots that shared revision +/// numbers. An owner-issued frame does not: equal numbers, different owner, +/// refused; equal numbers re-sealed by the same owner, refused. +#[test] +fn a_frame_from_another_owner_or_a_reseal_never_aliases() { + let l = snapshot(); + let frames = FrameStore::new(revisions(1, 1, 1)); + let r = Prepared::new(&l).bind(&l, 0, &frames).unwrap(); + + let twin = FrameStore::new(revisions(1, 1, 1)); assert_eq!( - rebound.read(&moved, S0, Family::Entra, &[40, 25]), - Err(ReadError::StaleCoordinate) + r.read(&l, &twin, Family::Ad, &[6, 7]), + Err(ReadError::StaleFrame(FrameRefusal::ForeignFrame)) + ); + + let mut frames = frames; + frames.advance(revisions(1, 1, 1)); + assert_eq!( + r.read(&l, &frames, Family::Ad, &[6, 7]), + Err(ReadError::StaleFrame(FrameRefusal::FrameResealed)) + ); +} + +/// A source change that makes a unique correspondence ambiguous: the old +/// coordinate is refused by its frame, and rebinding refuses rather than +/// picking the first mailbox. +#[test] +fn a_unique_match_turned_ambiguous_is_refused_not_reused() { + let l = snapshot(); + let mut frames = FrameStore::new(revisions(1, 1, 1)); + let old = Prepared::new(&l).bind(&l, 0, &frames).unwrap(); + + let mut next = l.clone(); + next.exo.owner.push(id(42)); + next.exo.scope.push(0); + next.exo.at.push(1_100); + next.exo_external.id.push(id(30)); + next.exo_external.state.push(state::PRESENT); + frames.advance(revisions(2, 2, 1)); + + assert_eq!( + old.read(&next, &frames, Family::Exo, &[1, 0, 1]), + Err(ReadError::StaleFrame(FrameRefusal::SourceChanged)) + ); + assert!(Prepared::new(&next).bind(&next, 0, &frames).is_none()); + assert_eq!(oracle(&next, 0), None); + // The other identity is untouched by the new mailbox and still binds. + assert_eq!( + Prepared::new(&next) + .bind(&next, 1, &frames) + .map(|r| (r.entra, r.exo)), + oracle(&next, 1) ); } #[test] fn duplicate_cloud_mailbox_and_foreign_scope_never_choose_first() { + let frames = FrameStore::new(revisions(1, 1, 1)); let mut l = snapshot(); l.exo.owner.push(id(42)); l.exo.scope.push(0); l.exo.at.push(1_100); l.exo_external.id.push(id(30)); l.exo_external.state.push(state::PRESENT); - assert!(Prepared::new(&l).bind(&l, 0, S0).is_none()); + assert!(Prepared::new(&l).bind(&l, 0, &frames).is_none()); // Same raw Entra ID in another tenant is NOT a match. let mut l = snapshot(); l.exo.scope[0] = 1; - assert!(Prepared::new(&l).bind(&l, 0, S0).is_none()); + assert!(Prepared::new(&l).bind(&l, 0, &frames).is_none()); let mut l = snapshot(); l.entra_anchor.id[0] = id(999); // contradicts AD source anchor - assert!(Prepared::new(&l).bind(&l, 0, S0).is_none()); + assert!(Prepared::new(&l).bind(&l, 0, &frames).is_none()); + + // Missing backsync: the anchor alone is not a confirmed hybrid identity. + // The status says so explicitly; the bind refuses; the oracle agrees. + let mut l = snapshot(); + l.ad_backsync.state[0] = state::ABSENT; + let p = Prepared::new(&l); + assert_ne!(AdStatus::of(p.out.ad[0]), AdStatus::Confirmed); + assert!(p.bind(&l, 0, &frames).is_none()); + assert_eq!(oracle(&l, 0), None); } #[test] @@ -383,7 +497,8 @@ fn dt64_method_pointer_is_not_a_coordinate_or_an_excel_value() { )); let derived = class + 1; - dt.register_derived(class, derived, schema, vec![changed]).unwrap(); + dt.register_derived(class, derived, schema, vec![changed]) + .unwrap(); let after = dt.route(0, derived).unwrap(); assert_eq!(dt.routed_at(before, 0).unwrap(), Some(class)); assert_eq!(dt.routed_at(after, 0).unwrap(), Some(derived)); @@ -392,8 +507,15 @@ fn dt64_method_pointer_is_not_a_coordinate_or_an_excel_value() { #[test] fn existing_quack_mask_risc_fold_uses_borrowed_property_lane() { let l = snapshot(); - assert_eq!(Prepared::new(&l).bind(&l, 0, S0).map(|r| r.entra), Some(0)); - assert_eq!(Prepared::new(&l).bind(&l, 1, S0).map(|r| r.entra), Some(1)); + let frames = FrameStore::new(revisions(1, 1, 1)); + assert_eq!( + Prepared::new(&l).bind(&l, 0, &frames).map(|r| r.entra), + Some(0) + ); + assert_eq!( + Prepared::new(&l).bind(&l, 1, &frames).map(|r| r.entra), + Some(1) + ); let values = [25_i32, 40]; let live = [0b11_u64]; // one resident, source-owned mask plane @@ -415,3 +537,72 @@ fn existing_quack_mask_risc_fold_uses_borrowed_property_lane() { let independent_scalar: i64 = values.iter().map(|&v| i64::from(v)).sum(); assert_eq!(result, Value::SumI64(independent_scalar)); } + +/// Execution evidence. Cold (index, fold, ruler, bind) and hot (reads, typed +/// fold) are timed separately; the hot side performs zero heap allocations on +/// this thread, i.e. no per-row joined object is built. Timings are reported, +/// not gated: the fixture is two rows. +#[test] +fn hot_reads_and_fold_allocate_nothing() { + use std::time::Instant; + let l = snapshot(); + let frames = FrameStore::new(revisions(1, 1, 1)); + + let t = Instant::now(); + let prepared = Prepared::new(&l); + let r = prepared.bind(&l, 0, &frames).unwrap(); + let cold = t.elapsed(); + + let ad_department = [6_i32, 7]; + let entra_license_count = [25_i32, 40]; + let exo_archive_state = [1_i32, 0]; + let live = [0b11_u64]; + let masks: [&[u64]; 1] = [&live]; + let lanes = [LaneRef::I32(&entra_license_count)]; + let inputs = QueryPlanes { + n_rows: entra_license_count.len(), + masks: &masks, + lanes: &lanes, + }; + let query = Query { + filter: Filter::plane(Mask(0)), + agg: Agg::SumI32(Col(0)), + }; + let p = lower(&query).unwrap(); + let mut scratch = Scratch::for_program(&p, entra_license_count.len()).unwrap(); + + const N: u32 = 10_000; + let before = allocations(); + let t = Instant::now(); + let mut acc = 0_i64; + for _ in 0..N { + acc += i64::from(r.read(&l, &frames, Family::Ad, &ad_department).unwrap()); + acc += i64::from( + r.read(&l, &frames, Family::Entra, &entra_license_count) + .unwrap(), + ); + acc += i64::from( + r.read(&l, &frames, Family::Exo, &exo_archive_state) + .unwrap(), + ); + } + let reads = t.elapsed(); + let t = Instant::now(); + let mut folded = Value::SumI64(0); + for _ in 0..N { + folded = execute_into(&p, &inputs, &Foreign::NONE, &mut scratch, Out::None).unwrap(); + } + let fold_time = t.elapsed(); + let hot_allocations = allocations() - before; + + assert_eq!(acc, i64::from(N) * (6 + 25 + 1)); + assert_eq!(folded, Value::SumI64(65)); + assert_eq!(hot_allocations, 0, "the hot path allocated"); + eprintln!( + "cold prepare+bind {} ns | read {} ns/property | fold {} ns/call | hot allocations {}", + cold.as_nanos(), + reads.as_nanos() / u128::from(3 * N), + fold_time.as_nanos() / u128::from(N), + hot_allocations + ); +} From 46e366a91f786b51c8fa53b36f841821003ac85e Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 5 Nov 2026 23:17:34 +0000 Subject: [PATCH 2/2] board: hybrid ordinal-chain lab v2 entry Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01XAqKMMJzKZrYnckXRC8x2U --- .../2026-11-05-hybrid-ordinal-chain-lab-v2.md | 21 +++++++++++++++++++ .claude/board/entries/README.md | 3 ++- 2 files changed, 23 insertions(+), 1 deletion(-) create mode 100644 .claude/board/entries/2026-11-05-hybrid-ordinal-chain-lab-v2.md diff --git a/.claude/board/entries/2026-11-05-hybrid-ordinal-chain-lab-v2.md b/.claude/board/entries/2026-11-05-hybrid-ordinal-chain-lab-v2.md new file mode 100644 index 000000000..eaa1d6cf8 --- /dev/null +++ b/.claude/board/entries/2026-11-05-hybrid-ordinal-chain-lab-v2.md @@ -0,0 +1,21 @@ +# Hybrid AD/Entra/EXO ordinal chain lab, v2: no consumer lookup, DR frame witness + +**Date:** 2026-11-05. **Status:** LAB (test-only). Follow-up to merged #1962; requires the paired OGAR change `ogar_dir_core::correspond::Output::entra_mailbox`. + +## What changed + +- OGAR `fold` already decided the sole Exchange Online row per Entra row and discarded it. `Output::entra_mailbox` keeps it (`NO_ROW` for none or several); `Ruler::from_fold` reads it instead of a second merge. Checked against a scalar scan on every `ogar-az` fixture; the duplicate and cross-tenant cases are pinned. The randomized fixture never generates a duplicate mailbox, so only the targeted test catches a first-match regression (disable-verified). +- The lab binds every ordinal from OGAR's output: no bind-time EXO scan remains. +- The lab-local value `Stamp` is replaced by `lance_graph_dt64::dr::FrameStore`/`Frame`. A frame cannot be built from numbers, so a foreign store or a re-seal at equal revisions is refused (the value stamp aliased them). + +## Measured (release, two-row fixture; reported, not gated) + +Cold prepare+bind ~12 µs. Warm read ~27 ns/property (frame check + 8 identity cross-checks). Typed Quack/mask-RISC sum ~122 ns/call. **0 heap allocations** on the hot read + fold path (thread-local counting allocator; disable-verified: a 1-byte allocation turns it red). + +## Disable runs + +Frame check off → 3 tests red. Identity cross-check off → the "owner forgot to advance" test red. Ambiguity: the cloud plane and the `entra_mailbox == NO_ROW` refusal each refuse alone; only both off turns 2 tests red (two independent guards, not a vacuous one). + +## Still open + +Cross-table value-derived reads stay outside the executor; the lab reads property lanes by bound ordinal in test code, not through an admitted Gather. The coordinate does not yet carry its DT64 class route (`RouteVersion`); FrameStore and BindStore run on separate clocks in this lab. The frame's revision numbers are caller-supplied, not derived from a source receipt. diff --git a/.claude/board/entries/README.md b/.claude/board/entries/README.md index 16f155c44..9e172b60e 100644 --- a/.claude/board/entries/README.md +++ b/.claude/board/entries/README.md @@ -25,10 +25,11 @@ index row, (3) no duplicate entry id. Checks 1 and 2 are deliberately opposite directions; the stranding this convention prevents shows up in exactly one of them, never both. -577 entries, 2026-08-06 .. 2026-11-04. +578 entries, 2026-08-06 .. 2026-11-05. | date | entry id | finding | file | |---|---|---|---| +| 2026-11-05 | `hybrid-ordinal-chain-lab-v2` | | [2026-11-05-hybrid-ordinal-chain-lab-v2.md](2026-11-05-hybrid-ordinal-chain-lab-v2.md) | | 2026-11-04 | `D-DRIVER-ZC-0` | | [2026-11-04-d-driver-zc-0-virtual-bus-contract.md](2026-11-04-d-driver-zc-0-virtual-bus-contract.md) | | 2026-11-04 | `D-DRISA-3` | | [2026-11-04-d-drisa-3-alu-semantics.md](2026-11-04-d-drisa-3-alu-semantics.md) | | 2026-11-04 | `D-DRISA-1` | | [2026-11-04-d-drisa-1-register-proof.md](2026-11-04-d-drisa-1-register-proof.md) |