fix(contract): FieldMask out-of-range positions ignored, not folded (Codex P2 #441)

from_positions/with/has used & 63, which ALIASED an out-of-range position onto a valid
bit (pos 64 -> bit 0) — silently corrupting the presence contract for a >64-field class
(the N3 'old masks misread' failure class). Now positions >= MAX_FIELDS(64) are ignored
(from_positions/with no-op; has -> false), preserving the no-panic property without
misrepresenting presence. Teeth-test: pos 64 does NOT alias to bit 0, in-range bit 0
unaffected. 497 contract lib green; clippy+fmt clean.

https://claude.ai/code/session_01R9AWgFa65uPnLyS2my2d2R

Author: claude

crates/lance-graph-contract/src/class_view.rs

@@ -75,27 +75,40 @@ impl FieldMask {
     /// Maximum addressable field positions in one `u64` mask.
     pub const MAX_FIELDS: u32 = 64;
 
-    /// Build a mask from the populated field positions.
+    /// Build a mask from the populated field positions. Positions `>= MAX_FIELDS`
+    /// (64) are **ignored** — NOT folded onto a valid bit. Folding (`& 63`) would
+    /// alias position 64 onto bit 0 and silently corrupt the presence contract for
+    /// an oversized class shape (Codex P2 on #441); ignoring keeps the no-panic
+    /// property without misrepresenting which fields are present.
     pub const fn from_positions(positions: &[u8]) -> Self {
         let mut bits = 0u64;
         let mut i = 0;
         while i < positions.len() {
-            bits |= 1u64 << (positions[i] as u64 & 63);
+            if (positions[i] as u32) < Self::MAX_FIELDS {
+                bits |= 1u64 << positions[i];
+            }
             i += 1;
         }
         Self(bits)
     }
 
-    /// Set field position `n` as populated.
+    /// Set field position `n` as populated. `n >= MAX_FIELDS` (64) is a no-op
+    /// (NOT folded — see [`from_positions`](FieldMask::from_positions)).
     #[inline]
     pub const fn with(self, n: u8) -> Self {
-        Self(self.0 | (1u64 << (n as u64 & 63)))
+        if (n as u32) < Self::MAX_FIELDS {
+            Self(self.0 | (1u64 << n))
+        } else {
+            self
+        }
     }
 
-    /// Is field position `n` populated? (presence — C2)
+    /// Is field position `n` populated? (presence — C2). `n >= MAX_FIELDS` (64) is
+    /// always `false` — an out-of-range field is never "present" (NOT folded onto
+    /// a valid bit).
     #[inline]
     pub const fn has(self, n: u8) -> bool {
-        self.0 & (1u64 << (n as u64 & 63)) != 0
+        (n as u32) < Self::MAX_FIELDS && self.0 & (1u64 << n) != 0
     }
 
     /// Number of populated fields.
@@ -260,6 +273,29 @@ mod tests {
             FieldMask::EMPTY.with(1).with(1),
             FieldMask::from_positions(&[1])
         );
+
+        // Out-of-range positions are IGNORED, never folded onto a valid bit
+        // (Codex P2 #441): position 64 must NOT alias to bit 0.
+        assert_eq!(
+            FieldMask::from_positions(&[64]),
+            FieldMask::EMPTY,
+            "position 64 must be ignored, not aliased to bit 0"
+        );
+        assert!(
+            !FieldMask::EMPTY.with(64).has(0),
+            "with(64) must not set bit 0"
+        );
+        assert!(
+            !FieldMask::from_positions(&[0]).has(64),
+            "has(64) must be false, not bit-0 aliased"
+        );
+        // In-range bit 0 unaffected by the out-of-range guard.
+        assert!(FieldMask::from_positions(&[0, 64]).has(0));
+        assert_eq!(
+            FieldMask::from_positions(&[0, 64]).count(),
+            1,
+            "only the in-range bit 0 is set"
+        );
     }
 
     #[test]