diff --git a/crates/ogar-ad/src/lib.rs b/crates/ogar-ad/src/lib.rs
index 0322b783..29f1caa2 100644
--- a/crates/ogar-ad/src/lib.rs
+++ b/crates/ogar-ad/src/lib.rs
@@ -17,20 +17,22 @@
 pub mod ldif;
 
 use ogar_dir_core::dn::Dn;
+use ogar_dir_core::label::{self, CloudLabel};
 use ogar_dir_core::record::{FLAG_DN_UNENCODED, FLAG_NON_OU_CONTAINER};
 use ogar_dir_core::{
     AttrDef, AttrKind, DirRecord, Guid128, OuDictionary, SchemaFamily, SchemaId, ValuePool,
 };
 
 /// Encoder schema version understood by this crate.
-pub const SCHEMA_VERSION: u16 = 1;
+pub const SCHEMA_VERSION: u16 = 3;
 /// This crate's schema id.
 pub const SCHEMA: SchemaId = SchemaId {
     family: SchemaFamily::AdDs,
     version: SCHEMA_VERSION,
 };
 
-/// The embedded AD attribute table, v1.
+/// The embedded AD attribute table. Append-only: each entry carries the
+/// schema version that introduced it (`since`); the name is kept from v1.
 ///
 /// Selection: the attributes needed to (a) name an account in every form AD
 /// and Exchange use (`sAMAccountName`, `userPrincipalName`, `mail`,
@@ -38,8 +40,22 @@ pub const SCHEMA: SchemaId = SchemaId {
 /// (`objectClass`, `objectSid`, `userAccountControl`), (c) say where it is
 /// (`distinguishedName`) and (d) date it (`whenCreated`, `whenChanged`), plus
 /// the display triplet. Group membership (`memberOf`/`member`) is a relation
-/// and becomes edges later, never an inline list. Further Exchange attributes
-/// (`msExch*`) are deferred until a consumer needs them.
+/// and becomes edges later, never an inline list.
+///
+/// v2 adds the Exchange recipient triplet, raw, for the hybrid recipient
+/// model (`ogar-dir-sim::exchange`): `msExchRemoteRecipientType` (flags,
+/// numeric), `msExchRecipientDisplayType` (signed, numeric, bit-cast like
+/// every signed LDAP integer here) and `msExchRecipientTypeDetails` (64-bit,
+/// so kept as its LDAP decimal text in a pooled slot). Other `msExch*`
+/// attributes stay out until a consumer needs them.
+///
+/// v3 adds the hybrid identity anchors as 128-bit ids in inline guid slots,
+/// never as text: `mS-DS-ConsistencyGuid` (16 mixed-endian bytes, the source
+/// anchor whose base64 is the cloud `ImmutableId`) and
+/// `msDS-ExternalDirectoryObjectId` (written back by Entra Connect as
+/// `User_<cloud object id>`). The `User_` / `Group_` label is stripped on the
+/// way in — it must match the object's kind — and added back on the way out
+/// from the kind ([`external_directory_object_id`]); it is never stored.
 pub const SCHEMA_V1: &[AttrDef] = &[
     AttrDef {
         name: "distinguishedName",
@@ -131,6 +147,36 @@ pub const SCHEMA_V1: &[AttrDef] = &[
         kind: AttrKind::U32,
         since: 1,
     },
+    AttrDef {
+        name: "msExchRemoteRecipientType",
+        slot: 1,
+        kind: AttrKind::U32,
+        since: 2,
+    },
+    AttrDef {
+        name: "msExchRecipientDisplayType",
+        slot: 2,
+        kind: AttrKind::U32,
+        since: 2,
+    },
+    AttrDef {
+        name: "msExchRecipientTypeDetails",
+        slot: 14,
+        kind: AttrKind::Str,
+        since: 2,
+    },
+    AttrDef {
+        name: "mS-DS-ConsistencyGuid",
+        slot: 0,
+        kind: AttrKind::Guid,
+        since: 3,
+    },
+    AttrDef {
+        name: "msDS-ExternalDirectoryObjectId",
+        slot: 1,
+        kind: AttrKind::Guid,
+        since: 3,
+    },
 ];
 
 /// AD object kinds (family-scoped codes in `object_kind`).
@@ -152,6 +198,20 @@ pub enum AdKind {
 }
 
 impl AdKind {
+    /// From the record's `object_kind` code.
+    pub fn from_code(code: u16) -> Option<Self> {
+        [
+            Self::Other,
+            Self::User,
+            Self::Group,
+            Self::Computer,
+            Self::Contact,
+            Self::OrganizationalUnit,
+        ]
+        .into_iter()
+        .find(|k| *k as u16 == code)
+    }
+
     /// From `objectClass` values; most specific class wins.
     pub fn from_object_class<S: AsRef<str>>(classes: &[S]) -> Self {
         let has = |c: &str| classes.iter().any(|x| x.as_ref().eq_ignore_ascii_case(c));
@@ -202,6 +262,9 @@ pub enum AdError {
     MultipleValues(&'static str),
     /// A numeric attribute did not parse.
     BadNumber(&'static str),
+    /// A 128-bit id attribute was not a non-nil id in its source spelling
+    /// (16 raw bytes; `<Label>_<guid>` whose label matches the object kind).
+    BadId(&'static str),
     /// Pool or slot failure.
     Storage(String),
 }
@@ -223,6 +286,51 @@ pub struct Encoded {
     pub ignored: Vec<String>,
 }
 
+/// The label an object of this kind carries in
+/// `msDS-ExternalDirectoryObjectId`, if any.
+pub fn cloud_label(kind: AdKind) -> Option<CloudLabel> {
+    match kind {
+        AdKind::User => Some(CloudLabel::User),
+        AdKind::Group => Some(CloudLabel::Group),
+        _ => None,
+    }
+}
+
+/// Inbound: a 128-bit id attribute's source spelling → the id.
+fn decode_id(name: &str, raw: &[u8], kind: u16) -> Option<Guid128> {
+    let g = match name {
+        "mS-DS-ConsistencyGuid" => Guid128::from_ms_bytes(raw).ok()?,
+        "msDS-ExternalDirectoryObjectId" => {
+            // The kind's own template: a User_ id on a group does not match.
+            let label = cloud_label(AdKind::from_code(kind)?)?;
+            label.pattern().strip(std::str::from_utf8(raw).ok()?)?
+        }
+        _ => return None,
+    };
+    (!g.is_nil()).then_some(g)
+}
+
+fn guid_slot(name: &str) -> usize {
+    SCHEMA_V1
+        .iter()
+        .find(|d| d.name == name && d.kind == AttrKind::Guid)
+        .expect("a guid attribute of SCHEMA_V1")
+        .slot as usize
+}
+
+/// Outbound: `msDS-ExternalDirectoryObjectId` as AD spells it — the stored
+/// id with the label of the record's kind added back.
+pub fn external_directory_object_id(rec: &DirRecord) -> Option<String> {
+    let g = rec.guid(guid_slot("msDS-ExternalDirectoryObjectId"))?;
+    let label = cloud_label(AdKind::from_code(rec.object_kind())?)?;
+    Some(label::render(label, g))
+}
+
+/// Outbound: `mS-DS-ConsistencyGuid` as AD stores it (16 mixed-endian bytes).
+pub fn consistency_guid(rec: &DirRecord) -> Option<[u8; 16]> {
+    Some(rec.guid(guid_slot("mS-DS-ConsistencyGuid"))?.to_ms_bytes())
+}
+
 fn identity_or_dn(name: &str) -> bool {
     name.eq_ignore_ascii_case("objectGUID") || name.eq_ignore_ascii_case("dn")
 }
@@ -279,6 +387,13 @@ pub fn encode(
                 let r = pool.push_multi(&vals).map_err(|e| st(&e))?;
                 rec.set_str(def.slot as usize, r).map_err(|e| st(&e))?;
             }
+            AttrKind::Guid => {
+                let [v] = vals.as_slice() else {
+                    return Err(AdError::MultipleValues(def.name));
+                };
+                let g = decode_id(def.name, v, kind).ok_or(AdError::BadId(def.name))?;
+                rec.set_guid(def.slot as usize, g).map_err(|e| st(&e))?;
+            }
             AttrKind::U32 | AttrKind::Bool => {
                 let [v] = vals.as_slice() else {
                     return Err(AdError::MultipleValues(def.name));
diff --git a/crates/ogar-ad/tests/main.rs b/crates/ogar-ad/tests/main.rs
index 7160beb6..9d62113e 100644
--- a/crates/ogar-ad/tests/main.rs
+++ b/crates/ogar-ad/tests/main.rs
@@ -225,3 +225,112 @@ fn ldifde_changetype_add_is_accepted_other_changetypes_refused() {
         );
     }
 }
+
+// v2: the Exchange recipient triplet of a remote shared mailbox, as the
+// on-premises directory holds it. The display type is signed (bit-cast into
+// its u32 slot); the 64-bit type details stay their LDAP decimal text.
+#[test]
+fn exchange_recipient_attributes_are_kept_raw() {
+    let text = "dn: CN=Team,OU=Shared,DC=example,DC=test\nobjectGUID:: 4AQlP4lP0xGaDAMF6CwzAQ==\nobjectClass: user\nuserAccountControl: 514\nmsExchRemoteRecipientType: 100\nmsExchRecipientDisplayType: -2147483642\nmsExchRecipientTypeDetails: 34359738368\ntargetAddress: SMTP:team@tenant.mail.onmicrosoft.com\n";
+    let e = &ldif::parse(text).unwrap()[0];
+    let (mut dict, mut pool) = (OuDictionary::new(), ValuePool::new());
+    let enc = encode(e, domain(), &mut dict, &mut pool, 1).unwrap();
+    assert!(enc.ignored.is_empty(), "{:?}", enc.ignored);
+    let r = enc.record;
+    let num = |n: &str| SCHEMA_V1.iter().find(|d| d.name == n).unwrap().slot as usize;
+    assert_eq!(r.num(num("msExchRemoteRecipientType")), Some(100));
+    assert_eq!(
+        r.num(num("msExchRecipientDisplayType")).map(|n| n as i32),
+        Some(-2_147_483_642)
+    );
+    assert_eq!(
+        pool.get(r.str_ref(slot("msExchRecipientTypeDetails")).unwrap())
+            .unwrap(),
+        b"34359738368"
+    );
+    // The account is disabled: a shared mailbox is a disabled account.
+    assert_eq!(r.num(0), Some(514));
+}
+
+const CLOUD_ID: &str = "0b5c3a1e-7d2f-4c88-9e10-3f6a2b4c5d6e";
+
+fn hybrid_pool(
+    class: &str,
+    external: &str,
+) -> (Result<ogar_ad::Encoded, ogar_ad::AdError>, ValuePool) {
+    let text = format!(
+        "dn: CN=X,OU=Staff,DC=example,DC=test\nobjectGUID:: 4AQlP4lP0xGaDAMF6CwzAQ==\nobjectClass: {class}\nmS-DS-ConsistencyGuid:: 4AQlP4lP0xGaDAMF6CwzAQ==\nmsDS-ExternalDirectoryObjectId: {external}\n"
+    );
+    let e = &ldif::parse(&text).unwrap()[0];
+    let (mut dict, mut pool) = (OuDictionary::new(), ValuePool::new());
+    (encode(e, domain(), &mut dict, &mut pool, 1), pool)
+}
+fn hybrid(class: &str, external: &str) -> Result<ogar_ad::Encoded, ogar_ad::AdError> {
+    hybrid_pool(class, external).0
+}
+
+// In: the label is stripped and both anchors are 128-bit ids in guid slots —
+// no string slot holds them. Out: AD's spelling comes back exactly.
+#[test]
+fn hybrid_identity_anchors_are_ids_not_strings() {
+    let (enc, pool) = hybrid_pool("user", &format!("User_{CLOUD_ID}"));
+    let enc = enc.unwrap();
+    assert!(enc.ignored.is_empty(), "{:?}", enc.ignored);
+    let r = enc.record;
+    // Entra Connect seeds the anchor from objectGUID by default.
+    assert_eq!(r.guid(slot("mS-DS-ConsistencyGuid")), Some(r.node_guid()));
+    assert_eq!(
+        r.guid(slot("msDS-ExternalDirectoryObjectId")),
+        Some(Guid128::parse(CLOUD_ID).unwrap())
+    );
+    // Neither id is pooled: no string slot holds the label, the id text or
+    // the anchor's bytes (only the DN and objectClass are pooled here).
+    let anchor = ogar_dir_core::base64::decode("4AQlP4lP0xGaDAMF6CwzAQ==").unwrap();
+    let pooled: Vec<&[u8]> = (0..32)
+        .filter_map(|s| r.str_ref(s))
+        .map(|sr| pool.get(sr).unwrap())
+        .collect();
+    assert!(!pooled.is_empty());
+    for v in pooled {
+        let has = |n: &[u8]| v.windows(n.len()).any(|w| w == n);
+        assert!(!has(b"User_") && !has(CLOUD_ID.as_bytes()) && !has(&anchor));
+    }
+    // Out.
+    assert_eq!(
+        ogar_ad::external_directory_object_id(&r),
+        Some(format!("User_{CLOUD_ID}"))
+    );
+    assert_eq!(
+        ogar_ad::consistency_guid(&r).map(|b| b.to_vec()),
+        ogar_dir_core::base64::decode("4AQlP4lP0xGaDAMF6CwzAQ==")
+    );
+    // A group carries Group_, and gets it back.
+    let g = hybrid("group", &format!("Group_{CLOUD_ID}"))
+        .unwrap()
+        .record;
+    assert_eq!(
+        ogar_ad::external_directory_object_id(&g),
+        Some(format!("Group_{CLOUD_ID}"))
+    );
+}
+
+// The label must match the object kind, and the id must be one: otherwise
+// the entry is refused, never half-written and never stored as text.
+#[test]
+fn a_wrong_or_missing_label_is_refused() {
+    use ogar_ad::AdError::BadId;
+    let bad = BadId("msDS-ExternalDirectoryObjectId");
+    for (class, value) in [
+        ("user", format!("Group_{CLOUD_ID}")),
+        ("group", format!("User_{CLOUD_ID}")),
+        ("user", CLOUD_ID.to_string()),
+        ("user", format!("user_{CLOUD_ID}")),
+        ("contact", format!("User_{CLOUD_ID}")),
+        (
+            "user",
+            "User_00000000-0000-0000-0000-000000000000".to_string(),
+        ),
+    ] {
+        assert_eq!(hybrid(class, &value).unwrap_err(), bad, "{class} {value}");
+    }
+}
diff --git a/crates/ogar-az/src/lib.rs b/crates/ogar-az/src/lib.rs
index 60523e30..2d76368e 100644
--- a/crates/ogar-az/src/lib.rs
+++ b/crates/ogar-az/src/lib.rs
@@ -270,6 +270,14 @@ pub fn encode_user(
                 rec.set_num(def.slot as usize, b as u32)
                     .map_err(|e| st(&e))?;
             }
+            AttrKind::Guid => {
+                // Graph spells a 128-bit id as the bare GUID.
+                let g = v
+                    .as_str()
+                    .and_then(|s| Guid128::parse(s).ok())
+                    .ok_or_else(bad)?;
+                rec.set_guid(def.slot as usize, g).map_err(|e| st(&e))?;
+            }
             AttrKind::U32 => {
                 let n = v
                     .as_u64()
diff --git a/crates/ogar-dir-core/src/base64.rs b/crates/ogar-dir-core/src/base64.rs
index 6bc1e92d..c8c5654c 100644
--- a/crates/ogar-dir-core/src/base64.rs
+++ b/crates/ogar-dir-core/src/base64.rs
@@ -1,5 +1,6 @@
-//! Minimal standard-alphabet base64 decoder (LDIF `::` values and Graph
-//! `onPremisesImmutableId`). Decode only; padding optional; whitespace rejected.
+//! Minimal standard-alphabet base64 (LDIF `::` values and Graph
+//! `onPremisesImmutableId`). Decode: padding optional, whitespace rejected.
+//! Encode: always padded, the form Graph and Entra Connect print.
 
 /// Decode standard base64 (`A-Z a-z 0-9 + /`, optional `=` padding).
 /// Returns `None` on any invalid character or impossible length.
@@ -30,8 +31,50 @@ pub fn decode(s: &str) -> Option<Vec<u8>> {
     Some(out)
 }
 
+const ALPHABET: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+/// Encode as standard, padded base64.
+pub fn encode(bytes: &[u8]) -> String {
+    let mut out = String::with_capacity(bytes.len().div_ceil(3) * 4);
+    for chunk in bytes.chunks(3) {
+        let n = chunk.len();
+        let b = [
+            chunk[0],
+            *chunk.get(1).unwrap_or(&0),
+            *chunk.get(2).unwrap_or(&0),
+        ];
+        let v = u32::from(b[0]) << 16 | u32::from(b[1]) << 8 | u32::from(b[2]);
+        for i in 0..4 {
+            if i <= n {
+                out.push(ALPHABET[(v >> (18 - 6 * i) & 63) as usize] as char);
+            } else {
+                out.push('=');
+            }
+        }
+    }
+    out
+}
+
 #[cfg(test)]
 mod tests {
+    #[test]
+    fn encodes_rfc4648_vectors_and_round_trips() {
+        for (dec, enc) in [
+            ("", ""),
+            ("f", "Zg=="),
+            ("fo", "Zm8="),
+            ("foo", "Zm9v"),
+            ("foob", "Zm9vYg=="),
+            ("fooba", "Zm9vYmE="),
+            ("foobar", "Zm9vYmFy"),
+        ] {
+            assert_eq!(super::encode(dec.as_bytes()), enc);
+            assert_eq!(super::decode(enc).unwrap(), dec.as_bytes());
+        }
+        let all: Vec<u8> = (0..=255).collect();
+        assert_eq!(super::decode(&super::encode(&all)).unwrap(), all);
+    }
+
     #[test]
     fn decodes_rfc4648_vectors() {
         for (enc, dec) in [
diff --git a/crates/ogar-dir-core/src/label.rs b/crates/ogar-dir-core/src/label.rs
new file mode 100644
index 00000000..84512ef9
--- /dev/null
+++ b/crates/ogar-dir-core/src/label.rs
@@ -0,0 +1,131 @@
+//! The label Entra Connect writes around a cloud object id in AD's
+//! `msDS-ExternalDirectoryObjectId` (`User_<guid>`, `Group_<guid>`).
+//!
+//! The Entra (formerly MSOL) `ObjectId`, Exchange Online's
+//! `ExternalDirectoryObjectId` and AD's `msDS-ExternalDirectoryObjectId` are
+//! one 128-bit id; only AD's copy carries the label. So the id is stored as a
+//! [`Guid128`] and the label is stripped on the way in and added on the way
+//! out — never kept as text.
+//!
+//! A label is a template, [`LabelPattern`]: `"User_{0}"`, where `{0}` is the
+//! id. Stripping matches the text around `{0}`; rendering substitutes the id
+//! into it. A new kind of object is a new template, not new code. This is the
+//! one definition; the encoders and the simulation vocabulary all use it.
+
+use crate::guid::Guid128;
+
+/// A label template with exactly one `{0}`, the id's place.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub struct LabelPattern(pub &'static str);
+
+impl LabelPattern {
+    /// The text before and after `{0}`. `None` unless the template has
+    /// exactly one `{0}`.
+    fn parts(self) -> Option<(&'static str, &'static str)> {
+        let (pre, post) = self.0.split_once("{0}")?;
+        (!post.contains("{0}")).then_some((pre, post))
+    }
+
+    /// Strip the label: the id inside, if `s` is exactly this template
+    /// around a non-nil id in its canonical spelling (lower-case hex, no
+    /// braces), so that rendering it gives `s` back.
+    pub fn strip(self, s: &str) -> Option<Guid128> {
+        let (pre, post) = self.parts()?;
+        let id = Guid128::parse(s.strip_prefix(pre)?.strip_suffix(post)?).ok()?;
+        (!id.is_nil() && self.render(id) == s).then_some(id)
+    }
+
+    /// Add the label: the template with `{0}` replaced by the id.
+    pub fn render(self, id: Guid128) -> String {
+        self.0.replacen("{0}", &id.to_string(), 1)
+    }
+}
+
+/// The labels Entra Connect writes, by name.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub enum CloudLabel {
+    /// `User_{0}`.
+    User,
+    /// `Group_{0}` (group writeback).
+    Group,
+}
+
+impl CloudLabel {
+    /// Every label.
+    pub const ALL: [Self; 2] = [Self::User, Self::Group];
+
+    /// Its template.
+    pub const fn pattern(self) -> LabelPattern {
+        match self {
+            Self::User => LabelPattern("User_{0}"),
+            Self::Group => LabelPattern("Group_{0}"),
+        }
+    }
+}
+
+/// Strip whichever label `s` carries: `User_<guid>` → `(User, guid)`.
+pub fn strip(s: &str) -> Option<(CloudLabel, Guid128)> {
+    CloudLabel::ALL
+        .into_iter()
+        .find_map(|l| l.pattern().strip(s).map(|g| (l, g)))
+}
+
+/// Add a label: `(User, guid)` → `User_<guid>`.
+pub fn render(label: CloudLabel, id: Guid128) -> String {
+    label.pattern().render(id)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const ID: &str = "0b5c3a1e-7d2f-4c88-9e10-3f6a2b4c5d6e";
+
+    #[test]
+    fn strip_and_render_are_inverse() {
+        let g = Guid128::parse(ID).unwrap();
+        for label in CloudLabel::ALL {
+            let text = render(label, g);
+            assert_eq!(strip(&text), Some((label, g)));
+        }
+        assert_eq!(render(CloudLabel::User, g), format!("User_{ID}"));
+    }
+
+    #[test]
+    fn a_template_places_the_id_anywhere() {
+        // Not tied to a prefix: any text around {0} works the same way.
+        let g = Guid128::parse(ID).unwrap();
+        for t in ["Device_{0}", "{0}@cloud", "x{0}y", "{0}"] {
+            let p = LabelPattern(t);
+            assert_eq!(p.strip(&p.render(g)), Some(g), "{t}");
+        }
+        assert_eq!(LabelPattern("{0}@cloud").render(g), format!("{ID}@cloud"));
+        assert_eq!(
+            LabelPattern("{0}@cloud").strip(&format!("{ID}@clouds")),
+            None
+        );
+        // A template without exactly one {0} matches nothing.
+        for t in ["User_", "{0}{0}"] {
+            assert_eq!(LabelPattern(t).strip(&format!("User_{ID}")), None, "{t}");
+        }
+        // Even when the text would render back: a second {0} is refused, not
+        // left as a literal.
+        let two = LabelPattern("{0}x{0}");
+        assert_eq!(two.strip(&format!("{ID}x{{0}}")), None);
+    }
+
+    #[test]
+    fn anything_that_does_not_render_back_is_refused() {
+        for bad in [
+            ID.to_string(),
+            format!("user_{ID}"),
+            format!("Device_{ID}"),
+            format!("User_{}", ID.to_uppercase()),
+            format!("User_{{{ID}}}"),
+            "User_00000000-0000-0000-0000-000000000000".to_string(),
+            format!("User_{ID} "),
+        ] {
+            assert_eq!(strip(&bad), None, "{bad}");
+        }
+    }
+}
diff --git a/crates/ogar-dir-core/src/lib.rs b/crates/ogar-dir-core/src/lib.rs
index a960fba5..b6a9d833 100644
--- a/crates/ogar-dir-core/src/lib.rs
+++ b/crates/ogar-dir-core/src/lib.rs
@@ -32,6 +32,7 @@ pub mod dn128;
 pub mod edge;
 pub mod guid;
 pub mod hhtl;
+pub mod label;
 pub mod pool;
 pub mod record;
 pub mod schema;
@@ -41,6 +42,7 @@ pub use dn128::{DN_CHILDREN, DN_LEVELS, DirectoryScope, Dn128, Dn128Error};
 pub use edge::{DirEdge, EdgeEvidence, EdgeKind};
 pub use guid::{Guid128, GuidParseError};
 pub use hhtl::{HhtlError, OU_LEVELS, OuDictionary, OuHhtl};
+pub use label::{CloudLabel, LabelPattern};
 pub use pool::{PoolError, StrRef, ValuePool};
-pub use record::{ABI_MAJOR, ABI_MINOR, DirRecord, RECORD_BYTES, RecordError};
-pub use schema::{AttrDef, AttrKind, SchemaFamily, SchemaId};
+pub use record::{ABI_MAJOR, ABI_MINOR, DirRecord, GUID_SLOTS, RECORD_BYTES, RecordError};
+pub use schema::{AttrDef, AttrKind, SchemaFamily, SchemaId, SlotSpace};
diff --git a/crates/ogar-dir-core/src/record.rs b/crates/ogar-dir-core/src/record.rs
index 35c27cc7..e3584513 100644
--- a/crates/ogar-dir-core/src/record.rs
+++ b/crates/ogar-dir-core/src/record.rs
@@ -20,12 +20,22 @@
 //! 0x050..0x060  ou_hhtl          [16]  WHERE 8 × u16 LE, root first
 //! 0x060..0x068  observed_at_ms   i64   WHEN  unix ms the observation was taken (0 = unknown)
 //! 0x068..0x070  presence         u64   bit s = pooled slot s present (0..32);
-//!                                       bit 32+n = numeric slot n present (n < 4)
+//!                                       bit 32+n = numeric slot n present (n < 4);
+//!                                       bit 36+g = guid slot g present (g < 4)
 //! 0x070..0x080  num              4×u32 numeric slots (meaning per schema)
 //! 0x080..0x180  str_refs         32×(u32 off, u32 len) into the batch ValuePool
-//! 0x180..0x200  reserved         [128] zero; writers MUST zero, readers MUST ignore
+//! 0x180..0x1C0  guids            4×[16] 128-bit id slots, textual byte order (minor 1)
+//! 0x1C0..0x200  reserved         [64] zero; writers MUST zero, readers MUST ignore
 //! ```
 //!
+//! A 128-bit id attribute (`mS-DS-ConsistencyGuid`,
+//! `msDS-ExternalDirectoryObjectId`) lives inline in a guid slot, not as
+//! pooled text: it compares as 16 bytes, with no string in the hot path. The
+//! encoder converts the source spelling on the way in and renders it on the
+//! way out. Minor 1 gave the first 64 reserved bytes this meaning; a minor-0
+//! record has them zero with the presence bits clear, so it reads as "no id
+//! present".
+//!
 //! GUIDs are stored in textual byte order (see [`crate::guid`]). Strings never
 //! live in the record; an absent slot has its presence bit clear (a present
 //! empty string is distinguishable from absence).
@@ -44,13 +54,15 @@ pub const RECORD_BYTES: usize = 512;
 /// Layout major: bump only when an existing offset changes meaning.
 pub const ABI_MAJOR: u16 = 1;
 /// Layout minor: bump when reserved bytes gain meaning (additive).
-pub const ABI_MINOR: u16 = 0;
+pub const ABI_MINOR: u16 = 1;
 /// Magic.
 pub const MAGIC: [u8; 4] = *b"OGDR";
 /// Pooled slot count.
 pub const STR_SLOTS: usize = 32;
 /// Numeric slot count.
 pub const NUM_SLOTS: usize = 4;
+/// 128-bit id slot count.
+pub const GUID_SLOTS: usize = 4;
 
 /// Offsets (public so a non-Rust reader can be generated from them).
 pub mod off {
@@ -72,7 +84,8 @@ pub mod off {
     pub const PRESENCE: usize = 0x068;
     pub const NUM: usize = 0x070;
     pub const STR_REFS: usize = 0x080;
-    pub const RESERVED: usize = 0x180;
+    pub const GUIDS: usize = 0x180;
+    pub const RESERVED: usize = 0x1C0;
     pub const END: usize = 0x200;
 }
 
@@ -86,7 +99,9 @@ pub const FLAG_DN_UNENCODED: u16 = 1 << 2;
 
 // Layout lock.
 const _: () = assert!(off::END == RECORD_BYTES);
-const _: () = assert!(off::STR_REFS + STR_SLOTS * 8 == off::RESERVED);
+const _: () = assert!(off::STR_REFS + STR_SLOTS * 8 == off::GUIDS);
+const _: () = assert!(off::GUIDS + GUID_SLOTS * 16 == off::RESERVED);
+const _: () = assert!(STR_SLOTS + NUM_SLOTS + GUID_SLOTS <= 64);
 const _: () = assert!(off::NUM + NUM_SLOTS * 4 == off::STR_REFS);
 const _: () = assert!(off::VALUE + 480 == RECORD_BYTES);
 const _: () = assert!(core::mem::size_of::<DirRecord>() == RECORD_BYTES);
@@ -310,6 +325,25 @@ impl DirRecord {
         ))
     }
 
+    /// Set a 128-bit id slot.
+    pub fn set_guid(&mut self, slot: usize, g: Guid128) -> Result<(), RecordError> {
+        if slot >= GUID_SLOTS {
+            return Err(RecordError::Slot(slot));
+        }
+        let o = off::GUIDS + slot * 16;
+        self.bytes[o..o + 16].copy_from_slice(&g.0);
+        self.set_presence_bit(STR_SLOTS + NUM_SLOTS + slot);
+        Ok(())
+    }
+
+    /// Read a 128-bit id slot.
+    pub fn guid(&self, slot: usize) -> Option<Guid128> {
+        if slot >= GUID_SLOTS || self.presence() & (1 << (STR_SLOTS + NUM_SLOTS + slot)) == 0 {
+            return None;
+        }
+        Some(self.guid_at(off::GUIDS + slot * 16))
+    }
+
     /// Reserved bytes are zero (writer obligation).
     pub fn reserved_is_zero(&self) -> bool {
         self.bytes[off::CANONICAL_KEY..off::VALUE]
diff --git a/crates/ogar-dir-core/src/schema.rs b/crates/ogar-dir-core/src/schema.rs
index 356e9ac2..a828d655 100644
--- a/crates/ogar-dir-core/src/schema.rs
+++ b/crates/ogar-dir-core/src/schema.rs
@@ -59,12 +59,35 @@ pub enum AttrKind {
     U32,
     /// Boolean (0/1), numeric slot. Absence (presence bit clear) = unknown/null.
     Bool,
+    /// A 128-bit id, inline guid slot (textual byte order). The encoder
+    /// converts the source spelling (raw mixed-endian bytes, a labeled
+    /// `User_<guid>`) on the way in; nothing about it is stored as text.
+    Guid,
+}
+
+/// Which slot space an attribute occupies.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum SlotSpace {
+    /// The 32 pooled slots.
+    Pooled,
+    /// The 4 numeric slots.
+    Numeric,
+    /// The 4 inline 128-bit id slots.
+    Guid,
 }
 
 impl AttrKind {
     /// True for pool-backed kinds (string slot space), false for numeric.
     pub fn is_pooled(self) -> bool {
-        matches!(self, Self::Str | Self::Bytes | Self::MultiStr)
+        self.space() == SlotSpace::Pooled
+    }
+    /// The slot space this kind occupies.
+    pub fn space(self) -> SlotSpace {
+        match self {
+            Self::Str | Self::Bytes | Self::MultiStr => SlotSpace::Pooled,
+            Self::U32 | Self::Bool => SlotSpace::Numeric,
+            Self::Guid => SlotSpace::Guid,
+        }
     }
 }
 
@@ -74,7 +97,7 @@ pub struct AttrDef {
     /// Source-native attribute name, exactly as the source spells it
     /// (`sAMAccountName`, `onPremisesDistinguishedName`).
     pub name: &'static str,
-    /// Slot index within its slot space (pooled 0..32, numeric 0..4).
+    /// Slot index within its slot space (pooled 0..32, numeric 0..4, guid 0..4).
     pub slot: u8,
     /// Storage kind.
     pub kind: AttrKind,
@@ -86,10 +109,10 @@ pub struct AttrDef {
 /// name used twice, `since` ≥ 1. Returns the first problem found.
 pub fn validate(attrs: &[AttrDef]) -> Result<(), String> {
     for (i, a) in attrs.iter().enumerate() {
-        let limit = if a.kind.is_pooled() {
-            crate::record::STR_SLOTS
-        } else {
-            crate::record::NUM_SLOTS
+        let limit = match a.kind.space() {
+            SlotSpace::Pooled => crate::record::STR_SLOTS,
+            SlotSpace::Numeric => crate::record::NUM_SLOTS,
+            SlotSpace::Guid => crate::record::GUID_SLOTS,
         };
         if a.slot as usize >= limit {
             return Err(format!("{}: slot {} out of range", a.name, a.slot));
@@ -101,7 +124,7 @@ pub fn validate(attrs: &[AttrDef]) -> Result<(), String> {
             if b.name == a.name {
                 return Err(format!("{}: duplicate name", a.name));
             }
-            if b.slot == a.slot && b.kind.is_pooled() == a.kind.is_pooled() {
+            if b.slot == a.slot && b.kind.space() == a.kind.space() {
                 return Err(format!("{} and {}: same slot {}", b.name, a.name, a.slot));
             }
         }
diff --git a/crates/ogar-dir-core/tests/main.rs b/crates/ogar-dir-core/tests/main.rs
index 327d99f0..5a07ba89 100644
--- a/crates/ogar-dir-core/tests/main.rs
+++ b/crates/ogar-dir-core/tests/main.rs
@@ -222,3 +222,53 @@ fn edge_record_round_trips_and_keeps_endpoints_distinct() {
     assert_eq!(DirEdge::from_bytes(&b), Some(e));
     assert_ne!(e.src.1, e.dst.1);
 }
+
+// ABI minor 1: four inline 128-bit id slots. A value round-trips through the
+// record bytes, each slot is independent of the others and of the pooled and
+// numeric slots, and a minor-0 record (zero bytes, presence clear) reads as
+// "no id".
+#[test]
+fn guid_slots_are_inline_and_additive() {
+    let id = g("0b5c3a1e-7d2f-4c88-9e10-3f6a2b4c5d6e");
+    let mut r = DirRecord::new(SCHEMA_AD1, 1, Guid128::NIL, Guid128::NIL, 0);
+    assert_eq!(r.abi(), (ABI_MAJOR, 1));
+    assert!((0..GUID_SLOTS).all(|s| r.guid(s).is_none()));
+    r.set_guid(1, id).unwrap();
+    assert_eq!(
+        r.set_guid(GUID_SLOTS, id),
+        Err(RecordError::Slot(GUID_SLOTS))
+    );
+    let back = DirRecord::from_bytes(r.as_bytes()).unwrap();
+    assert_eq!(back.guid(1), Some(id));
+    assert_eq!(back.guid(0), None);
+    assert!((0..32).all(|s| back.str_ref(s).is_none()));
+    assert!((0..4).all(|s| back.num(s).is_none()));
+    assert!(back.reserved_is_zero());
+    assert_eq!(&back.as_bytes()[off::GUIDS + 16..off::GUIDS + 32], &id.0);
+    // A minor-0 writer left these bytes zero and the presence bits clear.
+    let mut old = *DirRecord::new(SCHEMA_AD1, 1, Guid128::NIL, Guid128::NIL, 0).as_bytes();
+    old[off::ABI_MINOR] = 0;
+    let old = DirRecord::from_bytes(&old).unwrap();
+    assert!((0..GUID_SLOTS).all(|s| old.guid(s).is_none()));
+}
+
+#[test]
+fn schema_validation_knows_the_guid_space() {
+    let def = |name, slot, kind| AttrDef {
+        name,
+        slot,
+        kind,
+        since: 1,
+    };
+    // A guid slot may share an index with a pooled and a numeric slot.
+    assert!(
+        schema::validate(&[
+            def("a", 0, AttrKind::Str),
+            def("b", 0, AttrKind::U32),
+            def("c", 0, AttrKind::Guid),
+        ])
+        .is_ok()
+    );
+    assert!(schema::validate(&[def("a", 1, AttrKind::Guid), def("b", 1, AttrKind::Guid)]).is_err());
+    assert!(schema::validate(&[def("a", GUID_SLOTS as u8, AttrKind::Guid)]).is_err());
+}
diff --git a/crates/ogar-dir-sim/src/change.rs b/crates/ogar-dir-sim/src/change.rs
index 80cab398..2bb7b2f9 100644
--- a/crates/ogar-dir-sim/src/change.rs
+++ b/crates/ogar-dir-sim/src/change.rs
@@ -20,6 +20,7 @@
 //! through simulation, the desired version, reconciliation and the plan. They
 //! are not snapshot ordinals.
 
+use crate::exchange::Recipient;
 use ogar_dir_core::{Dn128, Guid128};
 
 /// Stable identity of one exact raw attribute value (case and spacing kept).
@@ -62,6 +63,10 @@ pub struct NodeState {
     /// Hierarchy location (numeric, within the store's directory scope;
     /// never a DN), if known.
     pub dn: Option<Dn128>,
+    /// Exchange recipient role (`msExch*` + `targetAddress`); `None` = not
+    /// read by the source (unknown), which is different from
+    /// [`Recipient::NotMailEnabled`].
+    pub recipient: Option<Recipient>,
 }
 
 /// The one definition of "active" across sources (V4, decided 2026-10-07):
@@ -119,9 +124,9 @@ pub enum Attribute {
 /// 2. `DeleteNode` — frees its UPN / SMTP before anything claims them;
 /// 3. `SetAttribute` — renames away from (or into) addresses only after
 ///    deletes freed them and before creates take them;
-/// 4. `SetActive`, `SetLocation` — properties of a node that exists before
-///    and after; neither frees nor claims a value, so no other change
-///    depends on them;
+/// 4. `SetActive`, `SetLocation`, `SetRecipient` — properties of a node
+///    that exists before and after; none frees or claims a value, so no
+///    other change depends on them;
 /// 5. `CreateNode` — after every address it needs is free;
 /// 6. `AddMembership` — once both endpoints exist.
 ///
@@ -196,6 +201,17 @@ pub enum Change {
         /// New location.
         to: Option<Dn128>,
     },
+    /// Compare-and-set of the Exchange recipient role. A plan can actuate it
+    /// only where one lifecycle step joins `from` and `to`
+    /// ([`RemoteMailboxOp::between`](crate::RemoteMailboxOp::between)).
+    SetRecipient {
+        /// Object.
+        node: Guid128,
+        /// Role the change expects to replace (as observed).
+        from: Option<Recipient>,
+        /// New role.
+        to: Option<Recipient>,
+    },
     /// A node that did not exist comes into existence.
     CreateNode {
         /// Identity.
@@ -270,6 +286,12 @@ impl NodeState {
                 }
                 next.dn = *to;
             }
+            Change::SetRecipient { from, to, .. } => {
+                if self.recipient != *from {
+                    return Err(Refusal::Stale);
+                }
+                next.recipient = *to;
+            }
             Change::RemoveMembership { .. }
             | Change::DeleteNode { .. }
             | Change::CreateNode { .. }
@@ -339,6 +361,7 @@ mod tests {
             upn: Some(ValueId(1)),
             primary_smtp: Some(ValueId(2)),
             dn,
+            recipient: None,
         }
     }
     fn dn(l: &[u8]) -> Option<Dn128> {
@@ -381,6 +404,7 @@ mod tests {
             upn: None,
             primary_smtp: None,
             dn: None,
+            recipient: None,
         };
         for (from, to) in [(Some(true), Some(false)), (Some(true), Some(true))] {
             assert_eq!(
@@ -474,6 +498,30 @@ mod tests {
         }
     }
 
+    // The recipient role is compare-and-set like every other property, and
+    // unknown (`None`) is distinct from "not mail-enabled".
+    #[test]
+    fn set_recipient_is_compare_and_set() {
+        use crate::exchange::Recipient;
+        let mut s = user(None, None);
+        s.recipient = Some(Recipient::NotMailEnabled);
+        let to = Some(Recipient::OnPremisesMailbox {
+            archive: crate::exchange::ArchiveState::None,
+        });
+        let ok = Change::SetRecipient {
+            node: N,
+            from: Some(Recipient::NotMailEnabled),
+            to,
+        };
+        assert_eq!(s.apply(&ok).map(|n| n.recipient), Ok(to));
+        let unknown = Change::SetRecipient {
+            node: N,
+            from: None,
+            to,
+        };
+        assert_eq!(s.apply(&unknown), Err(Refusal::Stale));
+    }
+
     // The sorted order places the two new property changes after renames
     // and before creates.
     #[test]
diff --git a/crates/ogar-dir-sim/src/exchange.rs b/crates/ogar-dir-sim/src/exchange.rs
new file mode 100644
index 00000000..5a283907
--- /dev/null
+++ b/crates/ogar-dir-sim/src/exchange.rs
@@ -0,0 +1,748 @@
+//! Exchange hybrid recipients, as the on-premises directory records them.
+//!
+//! Three attributes say what an object is to Exchange:
+//!
+//! * `msExchRemoteRecipientType` — flags for an Exchange Online (remote)
+//!   mailbox seen from on-premises: provision / migrated / deprovision of the
+//!   mailbox, provision / deprovision of the archive, room / equipment
+//!   (both = shared);
+//! * `msExchRecipientDisplayType` — a signed display class;
+//! * `msExchRecipientTypeDetails` — a 64-bit type code.
+//!
+//! plus `targetAddress`, which for a remote mailbox is its routing address
+//! (`alias@tenant.mail.onmicrosoft.com`).
+//!
+//! The decode accepts exactly the combinations the hybrid lifecycle
+//! produces (the 26 `msExchRemoteRecipientType` values of
+//! `jahube/PShell RemoteMailbox-Archive/Enable-Remotemailbox.PS1`, plus 97 =
+//! 64 + 32 + 1, the provisioned shared mailbox that `New-RemoteMailbox
+//! -Shared` writes and the script's table does not list; with the type and
+//! display codes that go with them). Anything else is kept raw as
+//! [`Recipient::Other`] and never guessed into a nearby state.
+//!
+//! **The enabled flag is not part of this.** A shared, room or equipment
+//! mailbox is a disabled account by design and is still a recipient.
+
+use crate::change::ValueId;
+
+/// `msExchRemoteRecipientType` flag bits.
+pub mod flag {
+    /// ProvisionMailbox — a remote mailbox created in Exchange Online.
+    pub const PROVISION_MAILBOX: u32 = 1;
+    /// ProvisionArchive.
+    pub const PROVISION_ARCHIVE: u32 = 2;
+    /// Migrated — the mailbox was moved to Exchange Online.
+    pub const MIGRATED: u32 = 4;
+    /// DeprovisionMailbox.
+    pub const DEPROVISION_MAILBOX: u32 = 8;
+    /// DeprovisionArchive.
+    pub const DEPROVISION_ARCHIVE: u32 = 16;
+    /// RoomMailbox.
+    pub const ROOM: u32 = 32;
+    /// EquipmentMailbox.
+    pub const EQUIPMENT: u32 = 64;
+    /// SharedMailbox (room and equipment bits together).
+    pub const SHARED: u32 = ROOM | EQUIPMENT;
+}
+
+/// `msExchRecipientTypeDetails` values this vocabulary decodes.
+pub mod type_details {
+    /// On-premises user mailbox.
+    pub const USER_MAILBOX: u64 = 1;
+    /// RemoteUserMailbox.
+    pub const REMOTE_USER_MAILBOX: u64 = 2_147_483_648;
+    /// RemoteRoomMailbox.
+    pub const REMOTE_ROOM_MAILBOX: u64 = 8_589_934_592;
+    /// RemoteEquipmentMailbox.
+    pub const REMOTE_EQUIPMENT_MAILBOX: u64 = 17_179_869_184;
+    /// RemoteSharedMailbox.
+    pub const REMOTE_SHARED_MAILBOX: u64 = 34_359_738_368;
+}
+
+/// `msExchRecipientDisplayType` values this vocabulary decodes.
+pub mod display_type {
+    /// On-premises (ACL-able) mailbox user.
+    pub const MAILBOX_USER: i32 = 1_073_741_824;
+    /// Synced remote user (and shared) mailbox.
+    pub const REMOTE_USER_MAILBOX: i32 = -2_147_483_642;
+    /// Synced remote room mailbox.
+    pub const REMOTE_ROOM_MAILBOX: i32 = -2_147_481_850;
+    /// Synced remote equipment mailbox.
+    pub const REMOTE_EQUIPMENT_MAILBOX: i32 = -2_147_481_594;
+}
+
+/// The four recipient attributes as stored. `None` = attribute absent.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct RecipientAttributes {
+    /// `msExchRemoteRecipientType`.
+    pub remote_recipient_type: Option<u32>,
+    /// `msExchRecipientDisplayType`.
+    pub display_type: Option<i32>,
+    /// `msExchRecipientTypeDetails`.
+    pub type_details: Option<u64>,
+    /// `targetAddress` (the address, without its `SMTP:` prefix).
+    pub target_address: Option<ValueId>,
+}
+
+/// What a remote mailbox is.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum RemoteKind {
+    /// A user's mailbox.
+    User,
+    /// A room.
+    Room,
+    /// Equipment.
+    Equipment,
+    /// A shared mailbox.
+    Shared,
+}
+
+/// Where the remote mailbox is in its lifecycle.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum MailboxState {
+    /// Created directly in Exchange Online (`Enable-RemoteMailbox`).
+    Provisioned,
+    /// Moved from on-premises to Exchange Online.
+    Migrated,
+    /// Removed (`Disable-RemoteMailbox`); the object is no longer a mail
+    /// recipient, the flags tell the sync to remove the cloud mailbox.
+    Deprovisioned,
+}
+
+/// The archive.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum ArchiveState {
+    /// No archive was ever provisioned.
+    None,
+    /// An Exchange Online archive.
+    Provisioned,
+    /// The archive was removed.
+    Deprovisioned,
+}
+
+/// A remote mailbox state that the hybrid lifecycle can produce. Built only
+/// through [`RemoteMailbox::new`], so an unreachable combination cannot be
+/// represented.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct RemoteMailbox {
+    kind: RemoteKind,
+    mailbox: MailboxState,
+    archive: ArchiveState,
+    routing: Option<ValueId>,
+}
+
+/// One object's role in Exchange.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum Recipient {
+    /// No recipient attribute at all.
+    NotMailEnabled,
+    /// A mailbox hosted on-premises, with its Exchange Online archive state
+    /// (`msExchRemoteRecipientType` 2 / 16, or absent).
+    OnPremisesMailbox {
+        /// Archive.
+        archive: ArchiveState,
+    },
+    /// A remote (Exchange Online) mailbox.
+    RemoteMailbox(RemoteMailbox),
+    /// Any other combination — a mail user, contact, group, or a value this
+    /// vocabulary does not decode. Kept raw.
+    Other(RecipientAttributes),
+}
+
+/// The `msExchRemoteRecipientType` values the lifecycle produces. A remote
+/// mailbox state is valid iff its code is listed; codes 2 and 16 belong to
+/// an on-premises mailbox with a remote archive. Shared is room + equipment
+/// (96): 97 provisioned, 100 migrated.
+pub const REMOTE_RECIPIENT_TYPES: [u32; 27] = [
+    1, 2, 3, 4, 6, 8, 10, 16, 17, 20, 24, // user
+    33, 35, 36, 38, 49, 52, // room
+    65, 67, 68, 70, 81, 84, // equipment
+    97, 100, 102, 116, // shared
+];
+
+fn archive_bits(a: ArchiveState) -> u32 {
+    match a {
+        ArchiveState::None => 0,
+        ArchiveState::Provisioned => flag::PROVISION_ARCHIVE,
+        ArchiveState::Deprovisioned => flag::DEPROVISION_ARCHIVE,
+    }
+}
+
+impl RemoteMailbox {
+    /// A remote mailbox, if the lifecycle can produce it. A provisioned or
+    /// migrated mailbox carries its routing address; a deprovisioned one
+    /// has none (the attributes are removed with it).
+    pub fn new(
+        kind: RemoteKind,
+        mailbox: MailboxState,
+        archive: ArchiveState,
+        routing: Option<ValueId>,
+    ) -> Option<Self> {
+        let m = Self {
+            kind,
+            mailbox,
+            archive,
+            routing,
+        };
+        let routed = mailbox != MailboxState::Deprovisioned;
+        (REMOTE_RECIPIENT_TYPES.contains(&m.code()) && routing.is_some() == routed).then_some(m)
+    }
+    /// Kind.
+    pub fn kind(&self) -> RemoteKind {
+        self.kind
+    }
+    /// Mailbox state.
+    pub fn mailbox(&self) -> MailboxState {
+        self.mailbox
+    }
+    /// Archive state.
+    pub fn archive(&self) -> ArchiveState {
+        self.archive
+    }
+    /// Routing address (`targetAddress`).
+    pub fn routing(&self) -> Option<ValueId> {
+        self.routing
+    }
+    /// `msExchRemoteRecipientType`.
+    pub fn code(&self) -> u32 {
+        let mailbox = match self.mailbox {
+            MailboxState::Provisioned => flag::PROVISION_MAILBOX,
+            MailboxState::Migrated => flag::MIGRATED,
+            MailboxState::Deprovisioned => flag::DEPROVISION_MAILBOX,
+        };
+        let kind = match self.kind {
+            RemoteKind::User => 0,
+            RemoteKind::Room => flag::ROOM,
+            RemoteKind::Equipment => flag::EQUIPMENT,
+            RemoteKind::Shared => flag::SHARED,
+        };
+        mailbox | archive_bits(self.archive) | kind
+    }
+    /// `(display type, type details)` while the mailbox exists; none once it
+    /// is deprovisioned.
+    fn types(&self) -> Option<(i32, u64)> {
+        if self.mailbox == MailboxState::Deprovisioned {
+            return None;
+        }
+        Some(match self.kind {
+            RemoteKind::User => (
+                display_type::REMOTE_USER_MAILBOX,
+                type_details::REMOTE_USER_MAILBOX,
+            ),
+            RemoteKind::Room => (
+                display_type::REMOTE_ROOM_MAILBOX,
+                type_details::REMOTE_ROOM_MAILBOX,
+            ),
+            RemoteKind::Equipment => (
+                display_type::REMOTE_EQUIPMENT_MAILBOX,
+                type_details::REMOTE_EQUIPMENT_MAILBOX,
+            ),
+            RemoteKind::Shared => (
+                display_type::REMOTE_USER_MAILBOX,
+                type_details::REMOTE_SHARED_MAILBOX,
+            ),
+        })
+    }
+    fn decode_code(code: u32) -> Option<(RemoteKind, MailboxState, ArchiveState)> {
+        if !REMOTE_RECIPIENT_TYPES.contains(&code) {
+            return None;
+        }
+        let kind = match code & flag::SHARED {
+            0 => RemoteKind::User,
+            flag::ROOM => RemoteKind::Room,
+            flag::EQUIPMENT => RemoteKind::Equipment,
+            _ => RemoteKind::Shared,
+        };
+        let mailbox = if code & flag::PROVISION_MAILBOX != 0 {
+            MailboxState::Provisioned
+        } else if code & flag::MIGRATED != 0 {
+            MailboxState::Migrated
+        } else if code & flag::DEPROVISION_MAILBOX != 0 {
+            MailboxState::Deprovisioned
+        } else {
+            return None; // 2 / 16: an on-premises mailbox, not a remote one
+        };
+        let archive = if code & flag::PROVISION_ARCHIVE != 0 {
+            ArchiveState::Provisioned
+        } else if code & flag::DEPROVISION_ARCHIVE != 0 {
+            ArchiveState::Deprovisioned
+        } else {
+            ArchiveState::None
+        };
+        Some((kind, mailbox, archive))
+    }
+}
+
+impl Recipient {
+    /// Decode stored attributes. Strict: a decoded state re-encodes to
+    /// exactly `a`; everything else is [`Recipient::Other`].
+    pub fn from_attributes(a: RecipientAttributes) -> Self {
+        let decoded = Self::decode(a);
+        match decoded {
+            Some(r) if r.attributes() == a => r,
+            _ => Self::Other(a),
+        }
+    }
+    fn decode(a: RecipientAttributes) -> Option<Self> {
+        if a == RecipientAttributes::default() {
+            return Some(Self::NotMailEnabled);
+        }
+        if a.type_details == Some(type_details::USER_MAILBOX) {
+            let archive = match a.remote_recipient_type {
+                None => ArchiveState::None,
+                Some(flag::PROVISION_ARCHIVE) => ArchiveState::Provisioned,
+                Some(flag::DEPROVISION_ARCHIVE) => ArchiveState::Deprovisioned,
+                Some(_) => return None,
+            };
+            return Some(Self::OnPremisesMailbox { archive });
+        }
+        let (kind, mailbox, archive) = RemoteMailbox::decode_code(a.remote_recipient_type?)?;
+        RemoteMailbox::new(kind, mailbox, archive, a.target_address).map(Self::RemoteMailbox)
+    }
+    /// The stored attributes of this recipient.
+    pub fn attributes(&self) -> RecipientAttributes {
+        match self {
+            Self::NotMailEnabled => RecipientAttributes::default(),
+            Self::OnPremisesMailbox { archive } => RecipientAttributes {
+                remote_recipient_type: (*archive != ArchiveState::None)
+                    .then(|| archive_bits(*archive)),
+                display_type: Some(display_type::MAILBOX_USER),
+                type_details: Some(type_details::USER_MAILBOX),
+                target_address: None,
+            },
+            Self::RemoteMailbox(m) => {
+                let types = m.types();
+                RecipientAttributes {
+                    remote_recipient_type: Some(m.code()),
+                    display_type: types.map(|t| t.0),
+                    type_details: types.map(|t| t.1),
+                    target_address: m.routing,
+                }
+            }
+            Self::Other(a) => *a,
+        }
+    }
+    /// Whether Exchange treats the object as a recipient that owns its
+    /// addresses. A deprovisioned remote mailbox and a non-mail-enabled
+    /// object do not; everything else (including [`Recipient::Other`]) does.
+    pub fn is_recipient(&self) -> bool {
+        match self {
+            Self::NotMailEnabled => false,
+            Self::RemoteMailbox(m) => m.mailbox != MailboxState::Deprovisioned,
+            Self::OnPremisesMailbox { .. } | Self::Other(_) => true,
+        }
+    }
+}
+
+/// One step of the hybrid remote-mailbox lifecycle (semantic; the actuator
+/// maps it to its own commands).
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum RemoteMailboxOp {
+    /// `Enable-RemoteMailbox [-Room | -Equipment] -RemoteRoutingAddress`:
+    /// a non-mail-enabled user gets a provisioned remote mailbox.
+    Enable {
+        /// User, room or equipment (there is no shared variant of enable).
+        kind: RemoteKind,
+        /// Routing address.
+        routing: ValueId,
+    },
+    /// `Enable-RemoteMailbox -Archive` (remote mailbox) or
+    /// `Enable-Mailbox -RemoteArchive` (on-premises mailbox).
+    EnableArchive,
+    /// `Disable-RemoteMailbox -Archive` / `Disable-Mailbox -RemoteArchive`.
+    DisableArchive,
+    /// A completed move of an on-premises mailbox to Exchange Online.
+    CompleteMove {
+        /// Routing address of the moved mailbox.
+        routing: ValueId,
+    },
+    /// `Set-RemoteMailbox -Type`: change what the remote mailbox is.
+    SetType(RemoteKind),
+    /// `Disable-RemoteMailbox`.
+    Disable,
+}
+
+/// Why a lifecycle step does not apply.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum LifecycleRefusal {
+    /// The step does not start from this state.
+    NotApplicable,
+    /// The step would reach a state the lifecycle does not produce.
+    NotInTable,
+}
+
+impl RemoteMailboxOp {
+    /// The state after this step.
+    ///
+    /// # Errors
+    ///
+    /// [`LifecycleRefusal`].
+    pub fn apply(self, from: &Recipient) -> Result<Recipient, LifecycleRefusal> {
+        use LifecycleRefusal::{NotApplicable, NotInTable};
+        let remote = |kind, mailbox, archive, routing| {
+            RemoteMailbox::new(kind, mailbox, archive, routing)
+                .map(Recipient::RemoteMailbox)
+                .ok_or(NotInTable)
+        };
+        let live = |m: &RemoteMailbox| m.mailbox != MailboxState::Deprovisioned;
+        match (self, from) {
+            (Self::Enable { kind, routing }, Recipient::NotMailEnabled) => remote(
+                kind,
+                MailboxState::Provisioned,
+                ArchiveState::None,
+                Some(routing),
+            ),
+            (Self::EnableArchive, Recipient::RemoteMailbox(m))
+                if live(m) && m.archive != ArchiveState::Provisioned =>
+            {
+                remote(m.kind, m.mailbox, ArchiveState::Provisioned, m.routing)
+            }
+            (Self::EnableArchive, Recipient::OnPremisesMailbox { archive })
+                if *archive != ArchiveState::Provisioned =>
+            {
+                Ok(Recipient::OnPremisesMailbox {
+                    archive: ArchiveState::Provisioned,
+                })
+            }
+            (Self::DisableArchive, Recipient::RemoteMailbox(m))
+                if live(m) && m.archive == ArchiveState::Provisioned =>
+            {
+                remote(m.kind, m.mailbox, ArchiveState::Deprovisioned, m.routing)
+            }
+            (
+                Self::DisableArchive,
+                Recipient::OnPremisesMailbox {
+                    archive: ArchiveState::Provisioned,
+                },
+            ) => Ok(Recipient::OnPremisesMailbox {
+                archive: ArchiveState::Deprovisioned,
+            }),
+            (Self::CompleteMove { routing }, Recipient::OnPremisesMailbox { archive }) => remote(
+                RemoteKind::User,
+                MailboxState::Migrated,
+                *archive,
+                Some(routing),
+            ),
+            (Self::SetType(kind), Recipient::RemoteMailbox(m)) if live(m) && m.kind != kind => {
+                remote(kind, m.mailbox, m.archive, m.routing)
+            }
+            (Self::Disable, Recipient::RemoteMailbox(m)) if live(m) => {
+                remote(m.kind, MailboxState::Deprovisioned, m.archive, None)
+            }
+            _ => Err(NotApplicable),
+        }
+    }
+
+    /// The one step that takes `from` to `to`, if exactly one does.
+    pub fn between(from: &Recipient, to: &Recipient) -> Option<Self> {
+        let routing = match to {
+            Recipient::RemoteMailbox(m) => m.routing,
+            _ => None,
+        };
+        let mut hits = Self::candidates(routing)
+            .into_iter()
+            .filter(|op| op.apply(from).as_ref() == Ok(to));
+        let first = hits.next()?;
+        hits.next().is_none().then_some(first)
+    }
+
+    /// Every op that could produce a recipient routed at `routing`.
+    fn candidates(routing: Option<ValueId>) -> Vec<Self> {
+        let kinds = [
+            RemoteKind::User,
+            RemoteKind::Room,
+            RemoteKind::Equipment,
+            RemoteKind::Shared,
+        ];
+        let mut c = vec![Self::EnableArchive, Self::DisableArchive, Self::Disable];
+        c.extend(kinds.map(Self::SetType));
+        if let Some(routing) = routing {
+            c.extend(kinds.map(|kind| Self::Enable { kind, routing }));
+            c.push(Self::CompleteMove { routing });
+        }
+        c
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const R: ValueId = ValueId(42);
+
+    fn attrs(rrt: Option<u32>, display: Option<i32>, details: Option<u64>) -> RecipientAttributes {
+        RecipientAttributes {
+            remote_recipient_type: rrt,
+            display_type: display,
+            type_details: details,
+            target_address: None,
+        }
+    }
+
+    // Every code 0..=255: exactly the 27 listed codes decode to a lifecycle
+    // state (with the type codes and routing address that belong to them);
+    // every other code stays raw. Each decoded state re-encodes to its code.
+    #[test]
+    fn exactly_the_27_listed_remote_recipient_types_decode() {
+        let mut decoded = Vec::new();
+        for code in 0..=255u32 {
+            let mut hit = None;
+            for kind in [
+                RemoteKind::User,
+                RemoteKind::Room,
+                RemoteKind::Equipment,
+                RemoteKind::Shared,
+            ] {
+                for mailbox in [
+                    MailboxState::Provisioned,
+                    MailboxState::Migrated,
+                    MailboxState::Deprovisioned,
+                ] {
+                    for archive in [
+                        ArchiveState::None,
+                        ArchiveState::Provisioned,
+                        ArchiveState::Deprovisioned,
+                    ] {
+                        let routing = (mailbox != MailboxState::Deprovisioned).then_some(R);
+                        if let Some(m) = RemoteMailbox::new(kind, mailbox, archive, routing)
+                            && m.code() == code
+                        {
+                            let r = Recipient::RemoteMailbox(m);
+                            assert_eq!(Recipient::from_attributes(r.attributes()), r);
+                            hit = Some(code);
+                        }
+                    }
+                }
+            }
+            for archive in [ArchiveState::Provisioned, ArchiveState::Deprovisioned] {
+                let r = Recipient::OnPremisesMailbox { archive };
+                if r.attributes().remote_recipient_type == Some(code) {
+                    assert_eq!(Recipient::from_attributes(r.attributes()), r);
+                    hit = Some(code);
+                }
+            }
+            decoded.extend(hit);
+        }
+        assert_eq!(decoded, REMOTE_RECIPIENT_TYPES.to_vec());
+    }
+
+    // The script's own example: Enable-RemoteMailbox then -Archive gives
+    // msExchRemoteRecipientType 3, DisplayType -2147483642, TypeDetails
+    // 2147483648.
+    #[test]
+    fn enable_then_archive_matches_the_script() {
+        let r = RemoteMailboxOp::Enable {
+            kind: RemoteKind::User,
+            routing: R,
+        }
+        .apply(&Recipient::NotMailEnabled)
+        .unwrap();
+        let r = RemoteMailboxOp::EnableArchive.apply(&r).unwrap();
+        assert_eq!(
+            r.attributes(),
+            RecipientAttributes {
+                remote_recipient_type: Some(3),
+                display_type: Some(-2_147_483_642),
+                type_details: Some(2_147_483_648),
+                target_address: Some(R),
+            }
+        );
+    }
+
+    // A walk through the table's transitions, each landing on the listed
+    // code.
+    #[test]
+    fn lifecycle_transitions_land_on_listed_codes() {
+        let code = |r: &Recipient| r.attributes().remote_recipient_type;
+        let room = RemoteMailboxOp::Enable {
+            kind: RemoteKind::Room,
+            routing: R,
+        }
+        .apply(&Recipient::NotMailEnabled)
+        .unwrap();
+        assert_eq!(code(&room), Some(33));
+        let room = RemoteMailboxOp::EnableArchive.apply(&room).unwrap();
+        assert_eq!(code(&room), Some(35));
+        assert_eq!(
+            code(&RemoteMailboxOp::DisableArchive.apply(&room).unwrap()),
+            Some(49)
+        );
+
+        let onprem = Recipient::OnPremisesMailbox {
+            archive: ArchiveState::None,
+        };
+        let archived = RemoteMailboxOp::EnableArchive.apply(&onprem).unwrap();
+        assert_eq!(code(&archived), Some(2));
+        let moved = RemoteMailboxOp::CompleteMove { routing: R }
+            .apply(&archived)
+            .unwrap();
+        assert_eq!(code(&moved), Some(6));
+        let shared = RemoteMailboxOp::SetType(RemoteKind::Shared)
+            .apply(&moved)
+            .unwrap();
+        assert_eq!(code(&shared), Some(102));
+        assert_eq!(
+            shared.attributes().type_details,
+            Some(type_details::REMOTE_SHARED_MAILBOX)
+        );
+
+        let user = RemoteMailboxOp::Enable {
+            kind: RemoteKind::User,
+            routing: R,
+        }
+        .apply(&Recipient::NotMailEnabled)
+        .unwrap();
+        let gone = RemoteMailboxOp::Disable.apply(&user).unwrap();
+        assert_eq!(code(&gone), Some(8));
+        assert_eq!(gone.attributes().type_details, None);
+        assert_eq!(gone.attributes().target_address, None);
+        assert!(!gone.is_recipient());
+    }
+
+    // Steps outside the table are refused, never approximated.
+    #[test]
+    fn steps_outside_the_table_are_refused() {
+        use LifecycleRefusal::{NotApplicable, NotInTable};
+        let enable = |kind| RemoteMailboxOp::Enable { kind, routing: R };
+        // A provisioned shared mailbox is 97 = 64 + 32 + 1; archiving it
+        // gives 99, which no lifecycle writes.
+        let shared = enable(RemoteKind::Shared)
+            .apply(&Recipient::NotMailEnabled)
+            .unwrap();
+        assert_eq!(shared.attributes().remote_recipient_type, Some(97));
+        assert_eq!(
+            RemoteMailboxOp::EnableArchive.apply(&shared),
+            Err(NotInTable)
+        );
+        let room = enable(RemoteKind::Room)
+            .apply(&Recipient::NotMailEnabled)
+            .unwrap();
+        // A provisioned room may become shared (33 -> 97); an archived one
+        // may not (35 -> 99 is not listed).
+        assert!(
+            RemoteMailboxOp::SetType(RemoteKind::Shared)
+                .apply(&room)
+                .is_ok()
+        );
+        let archived_room = RemoteMailboxOp::EnableArchive.apply(&room).unwrap();
+        assert_eq!(
+            RemoteMailboxOp::SetType(RemoteKind::Shared).apply(&archived_room),
+            Err(NotInTable)
+        );
+        // Disable is listed for user mailboxes only.
+        assert_eq!(RemoteMailboxOp::Disable.apply(&room), Err(NotInTable));
+        // Enable twice; enable on an on-premises mailbox; archive twice.
+        assert_eq!(enable(RemoteKind::User).apply(&room), Err(NotApplicable));
+        assert_eq!(
+            enable(RemoteKind::User).apply(&Recipient::OnPremisesMailbox {
+                archive: ArchiveState::None
+            }),
+            Err(NotApplicable)
+        );
+        let archived = RemoteMailboxOp::EnableArchive.apply(&room).unwrap();
+        assert_eq!(
+            RemoteMailboxOp::EnableArchive.apply(&archived),
+            Err(NotApplicable)
+        );
+        // Nothing applies to a raw recipient.
+        let raw = Recipient::Other(attrs(None, Some(6), Some(128)));
+        assert_eq!(RemoteMailboxOp::Disable.apply(&raw), Err(NotApplicable));
+    }
+
+    // Decode is strict: a listed code with the wrong type codes, a remote
+    // mailbox without its routing address, or an unlisted code stays raw.
+    #[test]
+    fn inconsistent_attributes_stay_raw() {
+        let mut a = attrs(Some(1), Some(-2_147_483_642), Some(2_147_483_648));
+        assert!(matches!(Recipient::from_attributes(a), Recipient::Other(_)));
+        a.target_address = Some(R);
+        assert!(matches!(
+            Recipient::from_attributes(a),
+            Recipient::RemoteMailbox(_)
+        ));
+        a.type_details = Some(type_details::REMOTE_SHARED_MAILBOX);
+        assert_eq!(Recipient::from_attributes(a), Recipient::Other(a));
+        let unlisted = attrs(Some(5), None, None);
+        assert_eq!(
+            Recipient::from_attributes(unlisted),
+            Recipient::Other(unlisted)
+        );
+        // A mail user (128) is a recipient this vocabulary keeps raw.
+        let mail_user = attrs(None, Some(6), Some(128));
+        assert!(Recipient::from_attributes(mail_user).is_recipient());
+        assert_eq!(
+            Recipient::from_attributes(RecipientAttributes::default()),
+            Recipient::NotMailEnabled
+        );
+    }
+
+    // `between` names the one step joining two states, and nothing when no
+    // single step does.
+    #[test]
+    fn no_two_ops_reach_the_same_recipient() {
+        // Walk every recipient reachable from "not mail-enabled" or an
+        // on-premises mailbox, and check that each (from, to) pair has at
+        // most one op. `between` relies on this; an op added later that
+        // breaks it fails here instead of silently returning None.
+        let mut seen = vec![Recipient::NotMailEnabled];
+        seen.extend(
+            [
+                ArchiveState::None,
+                ArchiveState::Provisioned,
+                ArchiveState::Deprovisioned,
+            ]
+            .map(|archive| Recipient::OnPremisesMailbox { archive }),
+        );
+        let mut i = 0;
+        while i < seen.len() {
+            let from = seen[i];
+            let mut reached: Vec<Recipient> = Vec::new();
+            for op in RemoteMailboxOp::candidates(Some(R)) {
+                if let Ok(to) = op.apply(&from) {
+                    assert!(!reached.contains(&to), "{from:?} -> {to:?} twice");
+                    reached.push(to);
+                    if !seen.contains(&to) {
+                        seen.push(to);
+                    }
+                }
+            }
+            i += 1;
+        }
+        // Every listed code is reachable: the remote ones as remote
+        // mailboxes, 2 and 16 as on-premises mailboxes with a cloud archive.
+        let mut codes: Vec<u32> = seen
+            .iter()
+            .filter_map(|r| r.attributes().remote_recipient_type)
+            .collect();
+        codes.sort_unstable();
+        codes.dedup();
+        assert_eq!(codes, REMOTE_RECIPIENT_TYPES.to_vec());
+    }
+
+    #[test]
+    fn between_finds_the_single_step() {
+        let user = RemoteMailboxOp::Enable {
+            kind: RemoteKind::User,
+            routing: R,
+        }
+        .apply(&Recipient::NotMailEnabled)
+        .unwrap();
+        assert_eq!(
+            RemoteMailboxOp::between(&Recipient::NotMailEnabled, &user),
+            Some(RemoteMailboxOp::Enable {
+                kind: RemoteKind::User,
+                routing: R
+            })
+        );
+        let archived = RemoteMailboxOp::EnableArchive.apply(&user).unwrap();
+        assert_eq!(
+            RemoteMailboxOp::between(&user, &archived),
+            Some(RemoteMailboxOp::EnableArchive)
+        );
+        // Two steps apart: enable and archive at once.
+        assert_eq!(
+            RemoteMailboxOp::between(&Recipient::NotMailEnabled, &archived),
+            None
+        );
+    }
+}
diff --git a/crates/ogar-dir-sim/src/identity.rs b/crates/ogar-dir-sim/src/identity.rs
new file mode 100644
index 00000000..6e5d8e37
--- /dev/null
+++ b/crates/ogar-dir-sim/src/identity.rs
@@ -0,0 +1,154 @@
+//! Hybrid identity: how an on-premises AD object and its Entra / Exchange
+//! Online counterpart name each other.
+//!
+//! | on-premises (AD)                  | cloud                        |
+//! |-----------------------------------|------------------------------|
+//! | `mS-DS-ConsistencyGuid` (16 bytes) | `ImmutableId` = its base64  |
+//! | `msDS-ExternalDirectoryObjectId`  | the cloud object id, `User_`-prefixed |
+//! | `mailNickname`                    | Exchange Online `Alias`      |
+//!
+//! **One cloud object id, three spellings.** The Entra (formerly MSOL)
+//! `ObjectId`, Exchange Online's `ExternalDirectoryObjectId` and AD's
+//! `msDS-ExternalDirectoryObjectId` are the same 128-bit id. The two cloud
+//! spellings are the bare GUID; only AD's backsync copy carries the `User_`
+//! label. So the id is a [`Guid128`] (`ExternalObjectId::object_id`), the
+//! cloud spellings parse with [`Guid128::parse`], and the `User_` text is a
+//! [`CloudLabel`] rendered on egress to AD — never a stored string. All
+//! three compare as ids, not as text. `ogar-ad` already strips the label on
+//! ingest and stores the id in an inline guid slot; the label codec is the
+//! one in [`ogar_dir_core::label`].
+//!
+//! The alias needs no type here: `mailNickname` is ingested raw and is the
+//! Exchange Online `Alias` as-is.
+//!
+//! Decoding is strict, like [`crate::exchange`]: a value that does not
+//! re-render to exactly what was observed is not decoded.
+
+use ogar_dir_core::{Guid128, base64, label};
+
+pub use ogar_dir_core::label::CloudLabel;
+
+/// A decoded `msDS-ExternalDirectoryObjectId`: the cloud object id, plus the
+/// label its text form carries.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub struct ExternalObjectId {
+    /// The object-type label.
+    pub label: CloudLabel,
+    /// The Entra object id.
+    pub object_id: Guid128,
+}
+
+impl ExternalObjectId {
+    /// Decode `User_<guid>` / `Group_<guid>`. `None` for anything that does
+    /// not render back to exactly `s` (unknown label, upper-case hex, braces,
+    /// a nil id); the caller keeps such a value raw.
+    pub fn parse(s: &str) -> Option<Self> {
+        let (label, object_id) = label::strip(s)?;
+        Some(Self { label, object_id })
+    }
+
+    /// The text form, as Entra Connect writes it.
+    pub fn render(&self) -> String {
+        label::render(self.label, self.object_id)
+    }
+}
+
+/// The source anchor: `mS-DS-ConsistencyGuid`, whose base64 is the cloud
+/// `ImmutableId`.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub struct SourceAnchor(pub Guid128);
+
+impl SourceAnchor {
+    /// From the raw attribute value (16 bytes, Microsoft mixed-endian, the
+    /// same order as `objectGUID`). `None` for any other length or a nil id.
+    pub fn from_consistency_guid(raw: &[u8]) -> Option<Self> {
+        let g = Guid128::from_ms_bytes(raw).ok()?;
+        (!g.is_nil()).then_some(Self(g))
+    }
+
+    /// From a cloud `ImmutableId`. Only the padded form this crate renders
+    /// is accepted, so the decode is exact.
+    pub fn from_immutable_id(s: &str) -> Option<Self> {
+        let a = Self::from_consistency_guid(&base64::decode(s)?)?;
+        (a.immutable_id() == s).then_some(a)
+    }
+
+    /// The raw attribute value.
+    pub fn to_consistency_guid(&self) -> [u8; 16] {
+        self.0.to_ms_bytes()
+    }
+
+    /// The cloud `ImmutableId`.
+    pub fn immutable_id(&self) -> String {
+        base64::encode(&self.to_consistency_guid())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const ID: &str = "0b5c3a1e-7d2f-4c88-9e10-3f6a2b4c5d6e";
+
+    #[test]
+    fn the_label_is_rendered_not_stored() {
+        let user = ExternalObjectId::parse(&format!("User_{ID}")).unwrap();
+        assert_eq!(user.label, CloudLabel::User);
+        assert_eq!(user.object_id, Guid128::parse(ID).unwrap());
+        assert_eq!(user.render(), format!("User_{ID}"));
+        let group = ExternalObjectId::parse(&format!("Group_{ID}")).unwrap();
+        // One id, two labels: the id compares equal, the objects do not.
+        assert_eq!(group.object_id, user.object_id);
+        assert_ne!(group, user);
+    }
+
+    #[test]
+    fn the_three_spellings_are_one_id() {
+        // Entra ObjectId and Exchange Online ExternalDirectoryObjectId are the
+        // bare GUID; AD's msDS-ExternalDirectoryObjectId adds the label.
+        let entra = Guid128::parse(ID).unwrap();
+        let exo = Guid128::parse(ID).unwrap();
+        let ad = ExternalObjectId::parse(&format!("User_{ID}")).unwrap();
+        assert_eq!(ad.object_id, entra);
+        assert_eq!(ad.object_id, exo);
+        // The bare cloud spelling is not AD's: it carries no label.
+        assert_eq!(ExternalObjectId::parse(ID), None);
+        assert_eq!(ad.object_id.to_string(), ID);
+    }
+
+    #[test]
+    fn anything_that_does_not_render_back_stays_raw() {
+        for bad in [
+            ID.to_string(),                        // no label
+            format!("user_{ID}"),                  // label case
+            format!("Device_{ID}"),                // unknown label
+            format!("User_{}", ID.to_uppercase()), // hex case
+            format!("User_{{{ID}}}"),              // braces
+            "User_00000000-0000-0000-0000-000000000000".to_string(),
+            format!("User_{ID} "),
+        ] {
+            assert_eq!(ExternalObjectId::parse(&bad), None, "{bad}");
+        }
+    }
+
+    #[test]
+    fn the_immutable_id_is_the_base64_of_the_consistency_guid() {
+        // objectGUID 3f2504e0-4f89-11d3-9a0c-0305e82c3301, as LDAP returns it.
+        let raw = base64::decode("4AQlP4lP0xGaDAMF6CwzAQ==").unwrap();
+        let a = SourceAnchor::from_consistency_guid(&raw).unwrap();
+        assert_eq!(
+            a.0,
+            Guid128::parse("3f2504e0-4f89-11d3-9a0c-0305e82c3301").unwrap()
+        );
+        assert_eq!(a.immutable_id(), "4AQlP4lP0xGaDAMF6CwzAQ==");
+        assert_eq!(a.to_consistency_guid().to_vec(), raw);
+        assert_eq!(SourceAnchor::from_immutable_id(&a.immutable_id()), Some(a));
+        // Not 16 bytes, nil, or unpadded: not an anchor.
+        assert_eq!(SourceAnchor::from_consistency_guid(&raw[..15]), None);
+        assert_eq!(SourceAnchor::from_consistency_guid(&[0; 16]), None);
+        assert_eq!(
+            SourceAnchor::from_immutable_id("4AQlP4lP0xGaDAMF6CwzAQ"),
+            None
+        );
+    }
+}
diff --git a/crates/ogar-dir-sim/src/lib.rs b/crates/ogar-dir-sim/src/lib.rs
index 68049a51..d292365b 100644
--- a/crates/ogar-dir-sim/src/lib.rs
+++ b/crates/ogar-dir-sim/src/lib.rs
@@ -16,6 +16,8 @@
 //! Design: `docs/DIRECTORY-SIMULATION-POC.md`.
 
 pub mod change;
+pub mod exchange;
+pub mod identity;
 pub mod plan;
 pub mod provenance;
 pub mod violation;
@@ -23,6 +25,11 @@ pub mod violation;
 pub use change::{
     Attribute, Change, KeyId, NodeKind, NodeState, Refusal, ValueId, effective_active, normalize,
 };
+pub use exchange::{
+    ArchiveState, LifecycleRefusal, MailboxState, Recipient, RecipientAttributes, RemoteKind,
+    RemoteMailbox, RemoteMailboxOp,
+};
+pub use identity::{CloudLabel, ExternalObjectId, SourceAnchor};
 pub use plan::{ExecutionPlan, Operation, PlanError, PlannedOp, Precondition};
 pub use provenance::{EvidenceRef, Origin, RuleId, TAG_DESIRED, TAG_OBSERVED, Version, VersionId};
 pub use violation::{Endpoint, Violation};
diff --git a/crates/ogar-dir-sim/src/plan.rs b/crates/ogar-dir-sim/src/plan.rs
index cc83d09d..71547e19 100644
--- a/crates/ogar-dir-sim/src/plan.rs
+++ b/crates/ogar-dir-sim/src/plan.rs
@@ -7,6 +7,7 @@
 //! true → execute; changed → re-observe and re-plan).
 
 use crate::change::{Attribute, Change, KeyId, NodeState, ValueId};
+use crate::exchange::{Recipient, RemoteMailboxOp};
 use crate::provenance::VersionId;
 use ogar_dir_core::{Dn128, Guid128};
 use std::collections::{BTreeMap, BTreeSet};
@@ -14,7 +15,8 @@ use std::collections::{BTreeMap, BTreeSet};
 /// A technology-neutral directory operation.
 ///
 /// Variant order is load-bearing and mirrors [`Change`]: removals, deletes,
-/// attribute sets, enable/disable, moves, creates, adds. A sorted plan is therefore a safe
+/// attribute sets, enable/disable, moves, recipient lifecycle steps,
+/// creates, adds. A sorted plan is therefore a safe
 /// execution order (an address is freed before it is claimed; a node's
 /// edges are gone before it is, and it exists before it gains one).
 #[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
@@ -57,6 +59,13 @@ pub enum Operation {
         /// Destination.
         to: Dn128,
     },
+    /// One step of the Exchange hybrid remote-mailbox lifecycle.
+    RemoteMailbox {
+        /// Object.
+        object: Guid128,
+        /// The step.
+        op: RemoteMailboxOp,
+    },
     /// Create `object` with `state`.
     CreateObject {
         /// Object.
@@ -86,6 +95,8 @@ pub enum Precondition {
     EnabledEquals(Option<bool>),
     /// The object must still be at this location (`None`: still unknown).
     LocationEquals(Option<Dn128>),
+    /// The object must still have exactly this recipient role.
+    RecipientEquals(Recipient),
     /// No object with this identity may exist yet.
     ObjectAbsent,
     /// The object must still exist in exactly this state and have no
@@ -105,7 +116,8 @@ pub struct PlannedOp {
 
 impl PlannedOp {
     /// Lower one change. `Err(node)` when the change has no operation: its
-    /// target is an unknown flag or location, which no actuator can write.
+    /// target is an unknown flag or location, which no actuator can write,
+    /// or a recipient change that no single lifecycle step performs.
     ///
     /// # Errors
     ///
@@ -126,6 +138,18 @@ impl PlannedOp {
                 },
                 precondition: Precondition::LocationEquals(from),
             },
+            Change::SetRecipient { node, from, to } => {
+                // Unknown on either side, or no single lifecycle step: no
+                // operation.
+                let (Some(from), Some(to)) = (from, to) else {
+                    return Err(node);
+                };
+                let op = RemoteMailboxOp::between(&from, &to).ok_or(node)?;
+                Self {
+                    op: Operation::RemoteMailbox { object: node, op },
+                    precondition: Precondition::RecipientEquals(from),
+                }
+            }
             Change::CreateNode { node, state } => Self {
                 op: Operation::CreateObject {
                     object: node,
@@ -303,8 +327,9 @@ pub enum PlanError {
         node: Guid128,
     },
     /// The desired version changes `node` towards an unknown enabled flag or
-    /// location. "Unknown" is an observation, not an intention: no actuator
-    /// can write it, so no plan is derived.
+    /// location ("unknown" is an observation, not an intention), or changes
+    /// its recipient role by something other than one lifecycle step. No
+    /// actuator can perform it, so no plan is derived.
     NotActuatable {
         /// The observation.
         basis: VersionId,
@@ -356,6 +381,7 @@ mod tests {
             upn: None,
             primary_smtp: None,
             dn: None,
+            recipient: None,
         }
     }
 
@@ -563,6 +589,54 @@ mod tests {
         }
     }
 
+    // A recipient change lowers to the single lifecycle step joining its
+    // two states, preconditioned on the observed role; unknown on either
+    // side, or two steps at once, is not actuatable.
+    #[test]
+    fn a_recipient_change_lowers_to_one_lifecycle_step() {
+        use crate::exchange::{RemoteKind, RemoteMailboxOp as Op};
+        let g = Guid128([6; 16]);
+        let routing = ValueId(42);
+        let enabled = Op::Enable {
+            kind: RemoteKind::User,
+            routing,
+        }
+        .apply(&Recipient::NotMailEnabled)
+        .unwrap();
+        let set = |from, to| Change::SetRecipient { node: g, from, to };
+        let plan = ExecutionPlan::from_diff(
+            VersionId(0),
+            VersionId(1),
+            vec![set(Some(Recipient::NotMailEnabled), Some(enabled))],
+            key,
+        )
+        .unwrap();
+        assert_eq!(
+            plan.ops,
+            vec![PlannedOp {
+                op: Operation::RemoteMailbox {
+                    object: g,
+                    op: Op::Enable {
+                        kind: RemoteKind::User,
+                        routing
+                    }
+                },
+                precondition: Precondition::RecipientEquals(Recipient::NotMailEnabled),
+            }]
+        );
+        let archived = Op::EnableArchive.apply(&enabled).unwrap();
+        for c in [
+            set(Some(Recipient::NotMailEnabled), Some(archived)),
+            set(None, Some(enabled)),
+            set(Some(enabled), None),
+        ] {
+            assert!(matches!(
+                ExecutionPlan::from_diff(VersionId(0), VersionId(1), vec![c], key),
+                Err(PlanError::NotActuatable { node, .. }) if node == g
+            ));
+        }
+    }
+
     #[test]
     fn lowering_carries_the_basis_precondition_and_no_transport() {
         let g = |n| Guid128([n; 16]);
diff --git a/docs/DIRECTORY-SIMULATION-POC.md b/docs/DIRECTORY-SIMULATION-POC.md
index a203def1..be714ca1 100644
--- a/docs/DIRECTORY-SIMULATION-POC.md
+++ b/docs/DIRECTORY-SIMULATION-POC.md
@@ -211,5 +211,47 @@ no-population-intermediate rule.
   separate node from its AD source (`sync_edges` links them as evidence), and
   no observation path merges the two, so today each node carries its one
   source's flag.
+- **V6 — Exchange hybrid recipients (2026-10-07).** What an object is to
+  Exchange comes from `msExchRemoteRecipientType` (flags: provision /
+  migrated / deprovision mailbox, provision / deprovision archive, room,
+  equipment, both = shared), `msExchRecipientDisplayType`,
+  `msExchRecipientTypeDetails` and `targetAddress` — not from the account's
+  enabled flag: a shared, room or equipment mailbox is a disabled account
+  and still a recipient. `ogar-ad` schema v2 ingests the triplet raw (type
+  details as its 64-bit decimal text). `ogar_dir_sim::exchange::Recipient`
+  decodes it strictly: exactly the 27 remote-recipient-type values (the script's 26 plus 97, provisioned shared) the
+  hybrid lifecycle produces (with the display and type codes that go with
+  them, and the routing address while the mailbox exists), an on-premises
+  mailbox with its remote-archive state, not mail-enabled — anything else
+  stays raw (`Other`), never guessed. `RemoteMailboxOp` is the lifecycle:
+  `Enable` (user / room / equipment / shared, with routing address), `EnableArchive`,
+  `DisableArchive`, `CompleteMove`, `SetType`, `Disable`; each step refuses
+  outside the table. `NodeState::recipient` (`None` = not read, distinct
+  from not mail-enabled) changes by compare-and-set (`SetRecipient`); a plan
+  lowers it to the single lifecycle step joining the two roles
+  (`Operation::RemoteMailbox`, precondition `RecipientEquals`), or refuses
+  (`NotActuatable`) when no single step does. **Open:** the `smtp:` routing
+  proxy `Enable-RemoteMailbox` stamps is not added to the proxy relation by
+  the vocabulary; the executor derives ownership of the routing address.
+- **V7 — Hybrid identity.** On-premises and cloud name each other by three
+  attributes: `mS-DS-ConsistencyGuid` (the source anchor; its base64 is the
+  cloud `ImmutableId`), `msDS-ExternalDirectoryObjectId` (Entra Connect
+  backsync, `User_<cloud object id>`) and `mailNickname` (the Exchange Online
+  `Alias`, ingested raw). The Entra (formerly MSOL) `ObjectId`, Exchange
+  Online's `ExternalDirectoryObjectId` and AD's `msDS-ExternalDirectoryObjectId`
+  are one id: the cloud spellings are the bare GUID, only AD's adds `User_`.
+  **Neither id is stored as a string.** `DirRecord` ABI minor 1 gives the
+  first 64 reserved bytes four inline 128-bit id slots (`AttrKind::Guid`);
+  `ogar-ad` schema v3 puts both anchors there. In: the anchor's mixed-endian
+  bytes become a `Guid128`; `User_` / `Group_` is stripped and must match the
+  object kind (else the entry is refused). Out:
+  `ogar_ad::external_directory_object_id` adds the label back from the kind,
+  `ogar_ad::consistency_guid` returns the AD bytes. The label is a template,
+  `LabelPattern("User_{0}")` (`{0}` = the id): strip matches the text around
+  `{0}`, render substitutes into it, a new kind is one more template. It has one
+  definition, `ogar_dir_core::label`, which `ogar_dir_sim::identity`
+  re-exports. **Open:** no executor ingests them
+  yet; matching an on-premises node to its cloud object by these ids is the
+  lance-graph side.
 - **V5 — CI.** CI builds `lance-graph-dir-sim` against the OGAR checkout, so
   it needs this OGAR PR merged first.