[AdaWorldAPI]

This PR adds D-CMR-2: the contract's set_algebra (D-CMR-1, #1644) is now lowered onto mask-risc, in core. It also records your D-CMR-5 ruling of 2026-10-21 (plan and board only).

D-CMR-2: lance_graph::fold::set_lower

SetExpr ──normalize (contract)──► SetPlan = Runs ∩ residual
            │                         │            │
   SortedBasis (attested i32 lane)    │            └─ compiled once → mask-risc Program
   one scan; counted seeks ───────────┘                 run per run via execute_extent

• Split. SetPlan::new(&SetExpr, n_rows, Option<&SortedBasis>) normalizes the expression and then splits it:

  • Comparisons on the attested sorted lane become Runs, at one binary-search seek per boundary. This applies to an expression made only of such comparisons, and to the basis conjuncts of a top-level And.
  • Everything else becomes the residual. A mixed Or stays residual and costs no seeks.

• Three levels (plan §3.4):

  level	when	what runs
  geometry	no residual	Count = Σ(hi−lo); no plane, lane or extent is read
  optics	residual, a measure is wanted	the residual program with a Count terminal, per run (execute_extent)
  etch	the set is wanted	the same program with Keep into Out::Mask; bits outside the runs are cleared

• Costs are reported separately, as ADMISSION B requires:

  • SortedBasis::attest_reads: one scan;
  • SetPlan::seeks: binary searches;
  • Measured::{extents, extent_rows}: the query side.

• Disable arm. SetPlan::unsplit turns geometry off. It has to give the same answers, and it does.

• No new dependency. Core already depends on the contract and mask-risc unconditionally. fold.rs gains one pub mod set_lower.

Tests (cargo test -p lance-graph --lib set_lower: 6 passed)

• Row oracle. 400 random nested expressions run over a sorted basis lane, an unsorted i32 lane, a u32 code lane and two planes, with N = 1000 (not a multiple of 64). Count and set equal the row oracle at every level, and so does unsplit. The test also requires that both levels actually ran and that the runs narrowed the extents.
• Geometry reads nothing. It runs against Planes with no lanes and no masks, reports 0 extents and uses at most 6 seeks.
• Experiment C. A basis range plus an unsorted predicate becomes one run plus a residual, and the extent covers less than half the rows.
• Silence twin. A range on a non-basis lane stays residual and costs no seeks.
• Refusals. An unsorted basis is refused, and so are row-count mismatches in the basis, the planes and the Keep buffer.

Disable runs (each restored afterwards)

probe	red
geometry off (a set with no residual still runs a program)	geometry_reads_no_plane_lane_or_extent
split off (new = unsplit)	geometry, Experiment C, the oracle's anti-vacuity check
basis-lane check off	Experiment C, the silence twin, the oracle
keep does not clear its destination	the oracle (keep)

cargo clippy -p lance-graph --lib --tests -- -D warnings and cargo fmt --check are clean.

Not in this PR

D-CMR-2b. mask-risc's fused paths decline a Pred (fused_ternlog, ir.rs:1012). A residual comparison therefore runs tiled, with per-tile scratch bounded by TILE_WORDS; it never writes a population-sized mask. The scratch-free predicate fold is a mask-risc change. mask-risc also has no counter for rows or words read, so the geometry claim is proven by running against empty planes instead.

D-CMR-5 re-scope (your ruling, 2026-10-21)

The plan row and the STATUS row now read "BLOCKED: lawful design proposed". The design:

• f⁻¹(S) is a co-addressed transposed fold over a version-bound projection of f. The projection is built by a sequential same-table scan with frozen-codebook translation, and can be reused across queries.
• S enters only as a membership plane (Q2 = B, conditionally).
• No seek of f by S's values or by a previous fold (Q1 = C). R1 (rebind / discover) stays option C.

The gate includes valid distinct-source preimages, refusal of bag-sensitive Count/Sum, and refusal on a stale or missing witness. It stays blocked until there is a contract-level codebook witness; no operator is built. The decision is recorded in entries/2026-10-21-d-cmr-5-rescope.md.

Board: STATUS_BOARD (D-CMR-2 In PR, D-CMR-5), LATEST_STATE, entries 2026-10-21-d-cmr-2-lowering.md and 2026-10-21-d-cmr-5-rescope.md, entries index. main is merged in (#1648); only the generated index conflicted.

---

Generated by Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 553cc458-c5b9-4787-95fa-9b256dbca370

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T01:47:59.085973Z	98d97ef	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.