lab(D-NFR-6): native operations over the SoaEnvelope borrow — no Table, no frame guard by AdaWorldAPI · Pull Request #1755 · AdaWorldAPI/lance-graph

AdaWorldAPI · 2026-10-23T22:48:37Z

Reworked. The first version of this PR built a Table that held its own FrameStore beside the SoA and checked a frame on each operation. That re-derived ownership that SoaEnvelope already carries: views are &self borrows of the owner, the owner's &mut cannot start while a view is live, and nothing is checked at runtime. The guard protected against a mutation the borrow checker already rules out. That design is withdrawn, together with its follow-up proposal D-NFR-6a (a faster FrameStore::check).

Frame provenance and external authorization are separate questions. Whoever hands out the packet answers them once; they do not justify a per-operation check.

What it is now

Lab crate crates/soa-view-probe (renamed from dr-validated-view-probe), with its own workspace and its own CI workflow soa-view-probe.yml.

part	what
owner	the `Vec<NodeRow>` the mailbox holds; writes only through `&mut`
view	`NodeRowPacket<'_>` from `lance-graph-contract`, unchanged: 512-byte rows, not `Clone`
facet address	`FacetSlot`, one of the 32 16-byte slots, in range by construction
operations	`FacetFold` on the packet. Each method is one ndarray kernel: `eq_u32_strided_to_mask` (classid), `ternary_match_strided16_to_mask` (16-byte facet), `masked_strided_group_sum` (12 × `u8`, never widened); counts use `popcount_batch_u64`

The crate has no bind_dr64, frame, epoch or dispatch, and no dependency on dr-math-binding-probe.

Evidence

Compile-time refusals (compile_fail with the error code checked by rustdoc): writing during a live view (E0502), a view outliving its owner (E0597), a second holder via clone (E0599). The compiling twin: after the write, a new view sees the new bytes.
Runtime: packet = direct ndarray = row-loop oracle at 8 sizes (1–4096), for both classids, across mask, match and sum. The fixture is checked to be non-vacuous, and the facet geometry is pinned.
Disable runs, each red: classid offset +1 (3 tests), payload width 11 (1 test), a one-class fixture (1 test).
Cost (examples/view_cost.rs, 3 runs, reported, not gated). Packet and direct ndarray are equal within noise at 64 / 4096 / 65536 rows, e.g. 4096 rows: classid mask + count 11.1 vs 10.5 µs, payload sum 27.0 vs 26.8 µs. Both arms make 0 allocations. The per-row cost is the strided read itself (one cache line per 512-byte row), the same in both.
Asm: each probe_a_* / probe_b_* pair calls the same ndarray kernels. B is 4–7 instructions longer: n_rows × 512 and register moves. There is no lock, cpuid or lazy initialization.

Plan: .claude/plans/d-nfr-6-soa-borrow-v2.md; v1 is marked superseded, keeping its guard measurements as the record. Board: STATUS_BOARD D-NFR-6 (MEASURED), D-NFR-6a (WITHDRAWN), INTEGRATION_PLANS, entries/2026-10-23-d-nfr-6-soa-borrow.md.

Lab only: no production ABI change and no change to the ClassId/LazyLock contract. Draft; not for autonomous merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

…owed view dr-validated-view-probe: a Table owns the data, the FrameStore and the focus map together; every change takes &mut. validate() runs the existing bind_dr64 once and returns a View<'t> whose count/sum/min/ max/count_gt call ndarray::simd directly, with no guard. Compile-fail doctests (pinned E0502/E0597): no advance, refocus or revoke while a view lives, no view outliving its table, no borrow escaping as 'static. Runtime falsifiers: stale, resealed and foreign frames, refocus and revocation after the borrow, scope from the grant, the shared-revocation escape (SharedView checks one epoch per op), and the typed semantic refusals. Records that bind_dr64 checks the frame, not the bytes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

examples/guard_cost.rs: arms A direct, B prebound, C bind_dr64 per op, C' the #1752 route guard per op, D one validate + view ops, D' shared view, E refused re-validation; the guard taken apart; allocations counted (0 everywhere). FrameStore::check is 25.7-28.3 ns of the 27-28 ns guard, and its cost is refcount traffic (six lock RMWs from Arc::downgrade temporaries), not comparisons. View ops equal direct ndarray within noise; View::sum is a tail call with no lock op. Plan d-nfr-6-validate-once-v1.md answers Q1-Q6 with the source audit; proposals (pointer-compare check, BoundDr64 borrowing its frame) are recorded, not implemented. CI workflow runs fmt, clippy, tests and the cost split (reported, not gated). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

coderabbitai · 2026-10-23T22:48:45Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 810b5c36-089e-421e-b8ea-ec5f59482bd1

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

…once-20261023 # Conflicts: # .claude/board/STATUS_BOARD.md # .claude/board/entries/README.md

chatgpt-codex-connector · 2026-10-23T23:00:43Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T23:06:23.590057Z	`bcbcebf`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bcbcebf630

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…once-20261023 # Conflicts: # .claude/board/STATUS_BOARD.md # .claude/board/entries/README.md

…frame guard The previous probe built a Table with its own FrameStore beside the SoA and re-checked a frame on each access. That re-derived ownership the contract already has: a NodeRowPacket is a &self borrow of the owner's rows, the owner's &mut cannot start while it is live, and the packet is not Clone. soa-view-probe: FacetFold on NodeRowPacket, one ndarray kernel per method (eq_u32_strided_to_mask, ternary_match_strided16_to_mask, masked_strided_group_sum over 12 x u8) at the 512-byte row and 16-byte facet stride. compile_fail examples pin E0502/E0597/E0599; runtime tests check packet == direct ndarray == row loop at 8 sizes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

view_cost now counts allocations around the operation loop only (the harness's own timing Vec had shown as 1/1) and reports µs per call and ns per row. Packet equals direct ndarray within noise at 64/4096/65536 rows, 0 allocations in both; asm shows the same kernel calls. D-NFR-6a (a faster FrameStore::check) is withdrawn. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

…t id for superseded v1 entry) D-NFC-0 and D-NFR-0 marked Shipped (#1753). The superseded v1 entry's heading becomes D-NFR-6-v1 so the index has no duplicate D-NFR-6 row. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

… index The generator carries existing rows forward by file, so renaming the heading alone left two D-NFR-6 rows and failed entries_index --check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

… board rows DECISION 2026-10-24, recorded in the plan (§5), the zero-copy law and the warden card: the cache is a cost-justified exception, scoped to foreign-key reads across several ontologies reused by many thoughts and feeding learning into live-generated ONNX. It is disposable, keyed by the full witness, and lapses where DRF-P2 does not measure a whole-run win. Also: INTEGRATION_PLANS entry, STATUS_BOARD D-DRF rows, board entry, #1755 marked merged, main merged in. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

claude added 3 commits October 23, 2026 22:39

lab(D-NFR-6): View is Copy; end its borrow with let _ (clippy)

25a749a

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

Merge remote-tracking branch 'origin/main' into lab/d-nfr-6-validate-…

bcbcebf

…once-20261023 # Conflicts: # .claude/board/STATUS_BOARD.md # .claude/board/entries/README.md

AdaWorldAPI marked this pull request as ready for review October 23, 2026 23:00

chatgpt-codex-connector Bot reviewed Oct 23, 2026

View reviewed changes

Comment thread crates/dr-validated-view-probe/src/lib.rs Outdated

claude added 4 commits October 23, 2026 23:35

Merge remote-tracking branch 'origin/main' into lab/d-nfr-6-validate-…

228e8a5

…once-20261023 # Conflicts: # .claude/board/STATUS_BOARD.md # .claude/board/entries/README.md

lab(D-NFR-6): clippy is_multiple_of

d087613

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

AdaWorldAPI changed the title ~~lab(D-NFR-6): validate a DR binding once, then run native ops without repeated guards~~ lab(D-NFR-6): native operations over the SoaEnvelope borrow — no Table, no frame guard Oct 23, 2026

claude added 3 commits October 24, 2026 00:19

lab(D-NFR-6): state the ordinary-borrowing assumption

497ec39

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

AdaWorldAPI mentioned this pull request Oct 24, 2026

docs(D-DRF-1): immutable DR64 focus leases, foreign-cache amortization and sparse writeback #1756

Open

Merge main into lab/d-nfr-6 (regenerate entries index)

bca2d93

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg

AdaWorldAPI merged commit 2340473 into main Oct 24, 2026
12 of 13 checks passed

Navigation Menu

Repository navigation

lab(D-NFR-6): native operations over the SoaEnvelope borrow — no Table, no frame guard - #1755

lab(D-NFR-6): native operations over the SoaEnvelope borrow — no Table, no frame guard#1755
AdaWorldAPI merged 12 commits into
mainfrom
lab/d-nfr-6-validate-once-20261023

AdaWorldAPI commented Oct 23, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

AdaWorldAPI commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What it is now

Evidence

Uh oh!

coderabbitai Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

AdaWorldAPI commented Oct 23, 2026 •

edited

Loading

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 23, 2026 •

edited

Loading