fix(callcenter): widen OwlIdentity slot u8 -> u16, preserve full registry IDs in audit

Per chatgpt-codex-connector P1 review on PR #364: owl_from_schema_ptr
truncated SchemaPtr::entity_type_id (u16) to 8 bits, so distinct
authorized entities whose registry IDs differ by 256 collided in the
audit log. RegistryState::append allocates IDs globally as rows.len()+1
u16, not per-namespace u8 slots, so the truncation was reachable on
otherwise-valid hydrated registries.

User decision (sprint-5-roadmap OQ): widen now, not defer to sprint 5.

Contract-level change rippling through three call sites:

* OwlIdentity: 2-byte packed u16 -> named fields { family: OgitFamily,
  slot: u16 }. raw() removed; replaced by to_canonical_bytes() -> [u8; 3]
  returning the deterministic on-wire form [family, slot_lo, slot_hi].
  new()/is_slot() now take slot: u16. UNKNOWN literal updated.

* owl_from_schema_ptr: drop the & 0xFF truncation; entity_type_id flows
  through full-width.

* UnifiedAuditEvent::canonical_bytes: grows 25 -> 26 bytes. owl now
  occupies [13..16); op/decision/role_hash offsets shifted by 1. Wire
  format is breaking for any persisted audit log — none exist outside
  test fixtures at this commit, so no migration is needed in tree.
  Cross-language emitters (Rust / C#) get the new layout via
  OwlIdentity::to_canonical_bytes.

* OgitFamilyTable: [Option<FamilyEntry>; 256] dense array -> sparse
  HashMap<u16, FamilyEntry>. Lookups stay O(1); resident set scales
  with occupied-slot count, not the u16 keyspace. set()/clear() now
  take slot: u16. The doc comments' '256-slot' framing is replaced
  by 'sparse map'.

Tests:
* slot_keyspace_distinguishes_high_ids — locks the new invariant by
  asserting slot 7 and slot 7+256 stay distinct (would alias under
  the old layout).
* canonical_bytes_round_trips_field_order — updated to the 26-byte
  layout and to_canonical_bytes() projection.

97/97 callcenter lib tests pass.

Refs: PR #364 review threads (P1 priority); sprint-5 roadmap OQ
'PR-D5 compat shim vs coordinated cutover' — resolved as cutover
(no compat shim because no on-disk audit log exists yet outside
test fixtures).

Author: claude

crates/lance-graph-callcenter/src/family_table.rs

@@ -1,24 +1,30 @@
 //! Per-family codebook table — inline label + schema + verbs per OGIT slot
 //! (per `.claude/plans/super-domain-rbac-tenancy-v1.md` §3.3 / D-SDR-3).
 //!
-//! Each OGIT family (basin) carries its own `OgitFamilyTable` — a 256-slot
-//! dense array indexed by `OwlIdentity::slot()`. Each occupied slot holds
-//! the label URI, schema kind (Entity / Edge / Attribute), OWL property
-//! characteristics, DOLCE upper marker, axiom blob, dcterms:source
-//! provenance, and outgoing-verb slot list **inline** — no sidecar table,
-//! no join, one cache-line per slot.
+//! Each OGIT family (basin) carries its own `OgitFamilyTable` — a sparse
+//! map indexed by `OwlIdentity::slot()` (u16, full registry width). Each
+//! occupied slot holds the label URI, schema kind (Entity / Edge /
+//! Attribute), OWL property characteristics, DOLCE upper marker, axiom
+//! blob, dcterms:source provenance, and outgoing-verb slot list
+//! **inline** — no sidecar table, no join, one cache-line per slot.
 //!
 //! Per the spec's brutal-honest correction (§16.5 + §17.4): inline storage
 //! is the Foundry-parity-shaped surface; the earlier sidecar sketch was
 //! Neo4j-shaped and rejected.
 //!
+//! The original D-SDR-3 sketch used `[Option<FamilyEntry>; 256]`; PR #364
+//! review surfaced that registry IDs allocate globally as u16, so a dense
+//! 256-slot table would alias slot collisions across distinct entities.
+//! The dense array is therefore replaced by a `HashMap<u16, FamilyEntry>`
+//! preserving O(1) lookup while honoring the full slot domain.
+//!
 //! ## Hot path
 //!
 //! ```text
-//! caller's OwlIdentity (u16)
+//! caller's OwlIdentity (family u8 + slot u16)
 //!     │
 //!     ▼ table.lookup(owl)
-//! &FamilyEntry  ← one array index (`entries[owl.slot()]`)
+//! &FamilyEntry  ← one hash probe (`entries.get(&owl.slot())`)
 //!     │
 //!     ├─ label_uri:     &'static str    (display / audit)
 //!     ├─ kind:          SchemaKind      (Entity / Edge / Attribute)
@@ -33,6 +39,8 @@
 //! hydration is D-SDR-3b (lance-graph-ontology side). `PerFamilyCodebook` is
 //! a placeholder for the per-family CAM-PQ centroids (D-SDR-3c).
 
+use std::collections::HashMap;
+
 use crate::super_domain::DolceMarker;
 use crate::unified_bridge::{OgitFamily, OwlIdentity};
 
@@ -191,33 +199,35 @@ pub struct PerFamilyCodebook;
 // ═══════════════════════════════════════════════════════════════════════════
 
 /// One table per OGIT family. Lives in static memory after hydration —
-/// 256-slot dense array, slot index IS `OwlIdentity::slot()`. Each slot
-/// holds a `FamilyEntry` (label + schema + verbs inline) or `None`.
+/// sparse `HashMap<u16, FamilyEntry>` keyed by `OwlIdentity::slot()`.
+/// Each occupied slot holds a `FamilyEntry` (label + schema + verbs
+/// inline).
 ///
-/// Typical size: ~50-200 KB per family depending on slot occupancy + axiom
-/// blob sizes. With ~75 active basins on a hydrated registry, the resident
-/// set is ~5-15 MB. Lookups are O(1) array index (sub-microsecond).
+/// Typical size scales with occupied-slot count, not the u16 keyspace:
+/// ~50-200 KB per family depending on entry count + axiom blob sizes.
+/// With ~75 active basins on a hydrated registry, the resident set is
+/// ~5-15 MB. Lookups are O(1) hash probes (sub-microsecond).
 pub struct OgitFamilyTable
 {
     pub family: OgitFamily,
-    pub entries: [Option<FamilyEntry>; 256],
+    pub entries: HashMap<u16, FamilyEntry>,
     pub codebook: PerFamilyCodebook,
 }
 
 impl OgitFamilyTable
 {
     /// Construct an empty table for the given family. Hydration populates
-    /// `entries[i]` as TTL classes / properties are discovered.
+    /// `entries` as TTL classes / properties are discovered.
     pub fn empty(family: OgitFamily) -> Self
     {
         Self {
             family,
-            entries: [None; 256],
+            entries: HashMap::new(),
             codebook: PerFamilyCodebook,
         }
     }
 
-    /// Hot-path lookup: O(1) array index. Sub-microsecond.
+    /// Hot-path lookup: O(1) hash probe. Sub-microsecond.
     ///
     /// `debug_assert`s that the `OwlIdentity` belongs to this family — in
     /// release builds the assertion is elided, so callers MUST ensure the
@@ -232,7 +242,7 @@ impl OgitFamilyTable
             owl.family().raw(),
             self.family.raw(),
         );
-        self.entries[owl.slot() as usize].as_ref()
+        self.entries.get(&owl.slot())
     }
 
     /// Resolve to the canonical label URI for a slot, e.g.
@@ -270,27 +280,27 @@ impl OgitFamilyTable
 
     /// Insert / overwrite a slot. Used by hydration; runtime code stays
     /// read-only against `&OgitFamilyTable`.
-    pub fn set(&mut self, slot: u8, entry: FamilyEntry)
+    pub fn set(&mut self, slot: u16, entry: FamilyEntry)
     {
-        self.entries[slot as usize] = Some(entry);
+        self.entries.insert(slot, entry);
     }
 
     /// Drop a slot's entry. Used by retraction during re-hydration.
-    pub fn clear(&mut self, slot: u8)
+    pub fn clear(&mut self, slot: u16)
     {
-        self.entries[slot as usize] = None;
+        self.entries.remove(&slot);
     }
 
-    /// Number of occupied slots in this table. O(256) scan; not a hot path.
+    /// Number of occupied slots in this table. O(1).
     pub fn len(&self) -> usize
     {
-        self.entries.iter().filter(|e| e.is_some()).count()
+        self.entries.len()
     }
 
     /// True when no slots are occupied.
     pub fn is_empty(&self) -> bool
     {
-        self.entries.iter().all(|e| e.is_none())
+        self.entries.is_empty()
     }
 }
 
@@ -397,6 +407,23 @@ mod tests
         assert_eq!(t.len(), 5);
     }
 
+    #[test]
+    fn slot_keyspace_distinguishes_high_ids()
+    {
+        // PR #364 review: registry IDs allocate globally as u16, so slots
+        // that differ by 256 used to alias under the old u8 truncation.
+        // Lock that two slots in the upper half of the keyspace stay
+        // distinct after the widening.
+        let mut t = OgitFamilyTable::empty(TEST_FAMILY);
+        t.set(7, FamilyEntry::plain_entity("ogit.Test:Low"));
+        t.set(7 + 256, FamilyEntry::plain_entity("ogit.Test:High"));
+        let low = t.lookup(OwlIdentity::new(TEST_FAMILY, 7));
+        let high = t.lookup(OwlIdentity::new(TEST_FAMILY, 7 + 256));
+        assert_eq!(low.unwrap().label_uri, "ogit.Test:Low");
+        assert_eq!(high.unwrap().label_uri, "ogit.Test:High");
+        assert_eq!(t.len(), 2);
+    }
+
     #[test]
     #[should_panic(expected = "does not match table family")]
     fn lookup_panics_on_wrong_family_in_debug()

crates/lance-graph-callcenter/src/super_domain.rs

@@ -12,10 +12,11 @@
 //!     1 byte; RBAC trust boundary + compliance regime + activation routing
 //!
 //! Level 2 — OGIT BASIN                           (per-codebook unit)
-//!     1 byte (high byte of OwlIdentity); see `unified_bridge::OgitFamily`
+//!     1 byte (`OwlIdentity::family`); see `unified_bridge::OgitFamily`
 //!
 //! Level 3 — WITHIN-BASIN SLOT                    (the row identity)
-//!     1 byte (low byte of OwlIdentity)
+//!     2 bytes (`OwlIdentity::slot`, widened from u8 after PR #364
+//!     review — registry IDs are globally u16)
 //! ```
 //!
 //! D-SDR-2 scope: type system + `FAMILY_TO_SUPER_DOMAIN` reverse-lookup.

crates/lance-graph-callcenter/src/unified_audit.rs

@@ -155,8 +155,10 @@ pub struct UnifiedAuditEvent
     /// Super domain the OGIT basin belongs to (looked up via
     /// `FAMILY_TO_SUPER_DOMAIN` at emit time).
     pub super_domain: SuperDomain,
-    /// 2-byte OwlIdentity = `(family, slot)` — the per-row identity that
-    /// was authorized.
+    /// 3-byte OwlIdentity = `(family u8, slot u16)` — the per-row
+    /// identity that was authorized. Slot is full-width since PR #364
+    /// review surfaced that registry IDs are globally u16 and would
+    /// alias under the prior u8 truncation.
     pub owl: OwlIdentity,
     /// Read / Write / Act.
     pub op: AuthOp,
@@ -177,16 +179,16 @@ impl UnifiedAuditEvent
     /// Field order is fixed; little-endian for all integers; no padding.
     /// **`merkle_root` is excluded** — it's the OUTPUT of the chain, not
     /// an input.
-    pub fn canonical_bytes(&self) -> [u8; 8 + 4 + 1 + 2 + 1 + 1 + 8]
+    pub fn canonical_bytes(&self) -> [u8; 8 + 4 + 1 + 3 + 1 + 1 + 8]
     {
-        let mut out = [0u8; 25];
+        let mut out = [0u8; 26];
         out[0..8].copy_from_slice(&self.ts_unix_ms.to_le_bytes());
         out[8..12].copy_from_slice(&self.tenant.raw().to_le_bytes());
         out[12] = self.super_domain.raw();
-        out[13..15].copy_from_slice(&self.owl.raw().to_le_bytes());
-        out[15] = self.op.as_u8();
-        out[16] = self.decision.as_u8();
-        out[17..25].copy_from_slice(&self.actor_role_hash.to_le_bytes());
+        out[13..16].copy_from_slice(&self.owl.to_canonical_bytes());
+        out[16] = self.op.as_u8();
+        out[17] = self.decision.as_u8();
+        out[18..26].copy_from_slice(&self.actor_role_hash.to_le_bytes());
         out
     }
 }
@@ -455,9 +457,9 @@ mod tests
         assert_eq!(&bytes[0..8], &ev.ts_unix_ms.to_le_bytes());
         assert_eq!(&bytes[8..12], &ev.tenant.raw().to_le_bytes());
         assert_eq!(bytes[12], ev.super_domain.raw());
-        assert_eq!(&bytes[13..15], &ev.owl.raw().to_le_bytes());
-        assert_eq!(bytes[15], ev.op.as_u8());
-        assert_eq!(bytes[16], ev.decision.as_u8());
-        assert_eq!(&bytes[17..25], &ev.actor_role_hash.to_le_bytes());
+        assert_eq!(&bytes[13..16], &ev.owl.to_canonical_bytes());
+        assert_eq!(bytes[16], ev.op.as_u8());
+        assert_eq!(bytes[17], ev.decision.as_u8());
+        assert_eq!(&bytes[18..26], &ev.actor_role_hash.to_le_bytes());
     }
 }

crates/lance-graph-callcenter/src/unified_bridge.rs

@@ -99,55 +99,73 @@ impl OgitFamily
 // OwlIdentity — Level-3 per-row identity (§3.2)
 // ═══════════════════════════════════════════════════════════════════════════
 
-/// 2 bytes. BF16-shaped container (interpreted as named bit-fields, not
-/// literal floating-point semantics).
-/// High 8 bits = `OgitFamily` (the precise heel pointer / "mantissa").
-/// Low  8 bits = within-family slot (the OWL/consumer's own identity).
+/// 3 bytes when serialized: 1-byte `OgitFamily` (the precise heel
+/// pointer / "mantissa") + 2-byte within-family slot (the OWL /
+/// consumer's own identity). Widened from the original 2-byte
+/// (family u8 + slot u8) layout after PR #364 review surfaced that
+/// `RegistryState::append` allocates entity-type IDs globally as `u16`
+/// so any registry with ≥256 entries would alias slot collisions
+/// across distinct authorized entities.
+///
+/// In-memory representation is two named fields (4 bytes with
+/// alignment). On-wire layout in `UnifiedAuditEvent::canonical_bytes`
+/// is the deterministic 3-byte sequence `[family, slot_le_lo,
+/// slot_le_hi]`.
+///
 /// This is what rides on every LanceDB row.
-#[repr(transparent)]
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
-pub struct OwlIdentity(pub u16);
+pub struct OwlIdentity {
+    family: OgitFamily,
+    slot: u16,
+}
 
 impl OwlIdentity
 {
-    pub const UNKNOWN: Self = Self(0);
+    pub const UNKNOWN: Self = Self {
+        family: OgitFamily(0),
+        slot: 0,
+    };
 
     #[inline]
-    pub const fn new(family: OgitFamily, slot: u8) -> Self
+    pub const fn new(family: OgitFamily, slot: u16) -> Self
     {
-        Self(((family.0 as u16) << 8) | slot as u16)
+        Self { family, slot }
     }
 
     #[inline]
     pub const fn family(self) -> OgitFamily
     {
-        OgitFamily((self.0 >> 8) as u8)
+        self.family
     }
 
     #[inline]
-    pub const fn slot(self) -> u8
+    pub const fn slot(self) -> u16
     {
-        (self.0 & 0xFF) as u8
+        self.slot
     }
 
+    /// Deterministic on-wire form: `[family u8, slot_lo u8, slot_hi u8]`.
+    /// Used by `UnifiedAuditEvent::canonical_bytes` so the merkle chain
+    /// hashes a byte-stable representation across Rust / C# emitters.
     #[inline]
-    pub const fn raw(self) -> u16
+    pub const fn to_canonical_bytes(self) -> [u8; 3]
     {
-        self.0
+        let slot = self.slot.to_le_bytes();
+        [self.family.0, slot[0], slot[1]]
     }
 
     /// Bitmask predicate Cypher MATCH lowers to. No string lookup.
     #[inline]
     pub const fn is_family(self, f: OgitFamily) -> bool
     {
-        self.family().0 == f.0
+        self.family.0 == f.0
     }
 
     /// Within-family slot predicate.
     #[inline]
-    pub const fn is_slot(self, s: u8) -> bool
+    pub const fn is_slot(self, s: u16) -> bool
     {
-        self.slot() == s
+        self.slot == s
     }
 }
 
@@ -444,15 +462,13 @@ fn map_decision(
 }
 
 /// Project a `SchemaPtr` (canonical OGIT pointer with 8-bit namespace +
-/// 16-bit entity-type) onto the 2-byte `OwlIdentity` carried in audit
-/// events. The entity-type id is truncated to 8 bits — per the §16
-/// reality check, namespaces with >256 entries (SGO meta) are excluded
-/// from the runtime addressing layer, so the truncation is lossless for
-/// the addressable domain (D-SDR-5 minimum).
+/// 16-bit entity-type) onto the 3-byte `OwlIdentity` carried in audit
+/// events. `entity_type_id` flows through full-width to `slot` — no
+/// truncation, no aliasing across the 256-entity boundary.
 #[inline]
 fn owl_from_schema_ptr(ptr: &SchemaPtr) -> OwlIdentity {
     let family = OgitFamily(ptr.namespace_id().raw());
-    let slot = (ptr.entity_type_id() & 0xFF) as u8;
+    let slot = ptr.entity_type_id();
     OwlIdentity::new(family, slot)
 }