contract: signed Register128 readings (32×i4, 16×i8) with a per-family law

[AdaWorldAPI]

This PR adds signed readings to the existing Register0/Register1 rails. It has three layers:

• Carrier: the rails themselves.
• Carving: how the bytes were written, declared by the slab.
• Law: what the signed values mean. The law has two authorities, and they must agree.

There is no layout change: the rails, NodeRow and ENVELOPE_LAYOUT_VERSION are unchanged.

Commits:

• 14831543: contract and tests.
• b98d4573: board.
• ed4459ee: merge of main after planner: fix moore_tenant_isa_equivalence for the strict ISA (main build break) #1409 (only the generated board index conflicted; it was regenerated).
• 96304b88: law authority, after the Codex P2 finding.
• 4c8dc638: board.

Carving and recorded law (declared by the slab)

tag	SlabReading	values	layout
2, 3, 4	RegisterI4x32(law)	32 × i4, -8..=7	dim 2k = low nibble of byte k (the atoms::I4x32 layout)
5, 6, 7	RegisterI8x16(law)	16 × i8, -128..=127	dim k = byte k

Within each triple, the tag order is RelativeOffset, AxisPosition, Support. to_tag is the inverse of from_tag. The recorded law is the law the writer actually wrote with.

Law

RegisterLaw has three variants:

• RelativeOffset: a window address (-3 = three positions back). It is not a strength, and anything outside the window goes through a basin or graph edge.
• AxisPosition: a position on a declared semantic axis. It never changes is_a.
• Support: + supports, 0 is unresolved, - falsifies.

The binder chooses no law:

• The Activation declares the law per concept (with_register_laws / register_law_for). It fails closed with NoRegisterLawFor.
• ResolvedReading::bind_signed_register(&activation, rails) takes no law. It refuses RegisterLawMismatch when the slab's recorded law differs from the concept's law, so a writer and a reader of one population always hold the same law.

Every read_*/write_* on SignedRegisterLanes also takes the law the caller expects. It refuses, in order, an absent rail, a different carving and a different law. An i4 outside -8..=7 is refused, never saturated. A refused write leaves the row unchanged.

The unsigned word reading stays separate:

• bind_register128 (4 × u32 words) is unchanged and refuses the signed carvings.
• bind_signed_register refuses Register128, Facet96 and undeclared slabs.

EpistemicState5 gets no law; it stays on CE64 bits 59..63.

atoms::I4x32 gains from_bytes/as_bytes. Activation::new is unchanged.

Inventory (in the board entry)

The only resident 24×i4 lane on main is CausalWitness (tenant 14, Facet96 read as G24N4). The others are:

• Evidence (Support): probe only.
• Taxonomy axes (AxisPosition): fixture only.
• EpisodicBasin: references, not i4.

This PR does not move CausalWitness.

Tests and disable runs

disable	red
law check on access removed	a_different_law_is_refused_and_writes_nothing
carving check removed	a_different_carving_is_refused
rail check removed	signed_writes_stay_inside_their_rail
i4 range check removed	an_out_of_range_i4_is_refused_before_writing
binding accepts Register128 as i4	signed_rails_need_a_signed_carving_and_an_agreeing_law
binding swaps the carvings	same
binding skips the schema check	same
law mismatch check removed	same
concept law ignored (slab law used)	same
to_tag shifts the I8x16 tags	an_unsupported_physical_reading_fails_closed
from_tag drops the law	same

Local results:

• lance-graph-contract lib: 1458 passed.
• jc register128_bounded_stats: 2 passed.
• lance-graph-ogar: builds.
• clippy -D warnings and fmt: clean.

Open

• No authority populates with_register_laws yet, so in production every concept refuses to bind signed registers. That is fail-closed.
• Whether a family gets its own lane or only a reading waits for a measurement: 32×i4 vs 16×i8 on KJV anaphora and the mammal fixture.
• There is no production reader or writer.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EFw2WdKr1oxvaKCJC2ua2R

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 087df5ee-2c0a-4774-aad5-7920f267d11c

📥 Commits

Reviewing files that changed from the base of the PR and between 08e1626 and ed4459e.

📒 Files selected for processing (7)

• .claude/board/LATEST_STATE.md
• .claude/board/entries/2026-10-08-register128-signed-readings.md
• .claude/board/entries/README.md
• .claude/v3/soa_layout/tenants.md
• crates/lance-graph-contract/src/atoms.rs
• crates/lance-graph-contract/src/hotplug.rs
• crates/lance-graph-contract/src/register128.rs

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

---

📝 Walkthrough

Walkthrough

The change adds signed i4 and i8 readings for Register128 rails. It adds slab declarations, law-checked binding, and validated read and write methods. Tests cover encoding, refusal cases, and rail isolation. Documentation records the contract and its current scope.

Changes

Signed Register128 readings

Layer / File(s)	Summary
Signed lane representation and access crates/lance-graph-contract/src/atoms.rs, crates/lance-graph-contract/src/register128.rs	I4x32 gains packed-byte conversion methods. Signed lane types support i4 and i8 reads and writes, validate rail, carving, and law, and update the selected rail counter on successful writes. Tests cover encoding, refusal cases, unchanged rows on rejected writes, and rail isolation.
Slab declarations and signed binding crates/lance-graph-contract/src/hotplug.rs, crates/lance-graph-contract/src/register128.rs, .claude/v3/soa_layout/tenants.md, .claude/board/*	Slab tags 2 and 3 map to signed i4 and i8 readings. bind_signed_register checks the declared carving and available rails, then carries the supplied law into the bound lanes. Tests and board documentation describe the binding behavior and contract.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant ResolvedReading
  participant SignedRegisterLanes
  participant NodeRow
  ResolvedReading->>SignedRegisterLanes: bind_signed_register(rails, law)
  SignedRegisterLanes->>NodeRow: read or write the selected rail
  NodeRow-->>SignedRegisterLanes: return rail bytes or updated row

Loading

Suggested reviewers: claude

Merge Risk: ⚪ Minimal · up to ed445

This adds signed Register128 readings without changing existing storage layout or the unsigned reading path. Refused writes leave rows unchanged. No merge-blocking risk was found.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 93.10% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 29 functions across 3 files. (4 skipped: 4 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: signed Register128 readings with 32×i4 and 16×i8 carvings and per-family laws.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{A rabbit packs the nibble tight,
Then checks the law before the write.
Two rails hold signed values in line,
No other bytes cross the boundary line.
The burrow thumps: the tests all shine.}

_{Comment @coderabbitai help to get the list of available commands.}

[AdaWorldAPI]

member-tests was red on b98d4573 because crates/lance-graph-planner/tests/moore_tenant_isa_equivalence.rs does not compile:

error[E0609]: no field `0` on type `Result<CausalEdge64, IsaFault>`

This PR does not touch that file. main itself (a76d9ab5) is broken: #1408 merged before its test was adapted to the Result-returning forward from #1407. The fix is open as #1409. I ported the same commit here as 32a7ddf0, and it becomes a no-op once #1409 merges. Locally the test passes after the port (2/2).

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-08T11:00:43.625601Z	32a7ddf	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 32a7ddf096

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[AdaWorldAPI]

member-tests was cancelled on 4c8dc638. It hit the job's timeout-minutes: 30 (.github/workflows/rust-test.yml:338) during the hydrate step. Every step before that passed.

This is not caused by this PR. main at 08e1626f (run 37766947128) was cancelled the same way, at the same step:

step	this PR	main
shader-driver tests	~15 min	~17 min
benches compile	~3 min	~3 min
hydrate	cut off at the 30-minute limit	cut off at the 30-minute limit

All other checks on this head are green (test, test-with-coverage, clippy, format, linux-build and the board checks).

No fix exists yet. Two possible fixes, both outside this PR's scope:

• raise member-tests' timeout-minutes (e.g. to 45);
• split the shader-driver tests into their own job, since they take about half of the budget.

---

Generated by Claude Code