[AdaWorldAPI]

Item A of the post-merge review of #1674 (GPT:gpt-ada-01/20261021-pr1674-1682-consolidated-review-01). I took it on the operator's instruction (EXO-50 /038). The original owner is session 019fbZ, and the operator aligns afterwards. This is a lab probe, not production-admitted.

Defects on main, each now refused

A1. Sealed rows were mutable.

• On main: MetadataTable::stage replaced any row, a sealed one included. seal overwrote the existing seal, so a changed row could be resealed.
• Now:
  • Restaging the same receipt (same identity, same live slot) under a sealed key is a no-op. Anything else is refused with AlreadyLanded.
  • An unsealed row (a crash before the seal) accepts only the same receipt; otherwise StagedConflict.
  • Sealing a sealed row that no longer matches its seal is refused with Torn.

A2. A landing was not bound to its commit.

• On main: landed checked only that the data version exists.
• Now: the write path VersionStore::commit_cycle seals the version together with a CommitWitness. It stands in for the coalesced per-cycle LanceCycleWriter commit (EXO-55). The witness holds:
  • the supervisor cycle;
  • every thought coalesced into the version, with its output fold and outcome;
  • a batch fold over all of that.
• stage and landed accept a row only when:
  • a witness exists (NoCommitWitness);
  • its batch fold is intact (WitnessTorn);
  • it names the row's cycle;
  • it lists the receipt's thought (NotInCohort) with the receipt's output and outcome (ContributionMismatch).
• Two thoughts in one version both land.
• MetadataTable::incomplete(store, data) lists committed thoughts that have no sealed row, i.e. a data write without its metadata write.

A3. Malformed inputs panicked.

• On main: unequal sources/targets (public fields) panicked, and modulus == 0 divided by zero.
• Now: ProgramInputs::try_new plus checks in run, stage, seal and landed return MalformedInputs or ZeroModulus. A malformed staged row cannot be sealed.

captured_in. The seal now covers it, so provenance is integrity-protected. It stays outside identity; test 10 is unchanged.

Evidence

• Tests: tests/receipt.rs goes from 10 to 14 tests. Test 9 now lands its data through commit_cycle, because a plain seal carries no witness.
• New tests:
  • a_sealed_landing_cannot_be_replaced_or_resealed
  • a_landing_needs_the_write_paths_commit_witness (covers all five falsifiers from the directive)
  • a_committed_thought_without_a_sealed_row_is_incomplete
  • malformed_inputs_refuse_without_panicking
• Disable runs. Seven, each turning exactly its target test red (13/14 pass):
  • stage overwrites
  • seal overwrites
  • the cohort check is dropped
  • incomplete returns nothing
  • run is unchecked
  • stage is unchecked
  • the seal omits captured_in
• Gates: the full probe suite passes (9 + 14 + 10 + 7 tests). Clippy --all-targets -D warnings (Rust 1.99.0) and fmt are clean.
• Board: a correction section is appended to entries/2026-10-21-d-tgb-4-receipt-replay.md. The entries index is unchanged.

Not claimed

• Atomicity between the data and metadata writes. A crash between them is detected by incomplete, not prevented.
• The real writer. The witness is not wired into LanceCycleWriter.
• The contract. No type moves into lance-graph-contract; that is D-TGB-7's admission decision.
• Proof strength. The folds remain witnesses, not cryptographic proofs.
• EXO-58 stays Done.

Merge is attended: I will not merge this PR.

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T22:08:34.483206Z	28faacb	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8033f232-2ca2-4197-bcfb-7bc17e9dde4b

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 28faacb858

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".