fix(ogar): PR #564 codex P2 — one contract source + build-time parity fuse

codex P2 #1 (contract source unification): lance-graph + symbiont path-dep
lance-graph-contract; lance-graph-ogar git-dep'd it, so when composed Cargo
sees two distinct crates and OgarClassView impls the git ClassView, unusable
where the engine expects the path one. Fix: path-dep ../lance-graph-contract
(the canonical in-repo copy) + a [patch."…/lance-graph"] that folds
ogar-class-view's transitive git contract onto the SAME path copy = one source.
Documented the cargo limitation: an in-repo workspace root (symbiont) adding
this crate MUST repeat the patch ([patch] only applies at the workspace root).

codex P2 #2 (parity guard only ran in tests): the drift fuse was #[cfg(test)]
only, so a downstream cargo build never ran it — the "fails the build on drift"
claim was false for normal builds. Fix: added parity::COUNT_FUSE, a compile-time
const assert (mirror::CODEBOOK.len() == ogar_vocab::class_ids::ALL.len()) that
fires in ANY build (cargo build included) on add/remove drift; kept the runtime
assert_codebook_parity for the full id/domain bijection (tested + callable at
startup); corrected the docs to state both depths precisely (no overclaim).

Re-verified: cargo test --manifest-path crates/lance-graph-ogar/Cargo.toml 3/3
(the ogar_class_view_implements_contract_class_view test compiling proves
one-source unification), clippy -D warnings + fmt clean, no "patch not used".

Board: AGENT_LOG (cont.15).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CcpLeEC3XK8Eye53GKBVvi

Author: claude

.claude/board/AGENT_LOG.md

@@ -1,3 +1,11 @@
+## 2026-06-20 (cont.¹⁵) — PR #564 codex P2 fixes (contract-source unification + build-time parity fuse)
+
+**Main thread (Opus), autoattended.** Two codex P2 review comments on #564, both correct, both fixed:
+1. **One contract source at the integration boundary** (Cargo.toml): `lance-graph` + `symbiont` path-dep `lance-graph-contract`; `lance-graph-ogar` git-dep'd it → two distinct crates when composed → `OgarClassView` would impl the git `ClassView`, not the path one. Fix: `lance-graph-ogar` now **path-deps** `../lance-graph-contract` (the canonical in-repo copy) + a `[patch."…/lance-graph"] lance-graph-contract = { path = … }` folds ogar-class-view's transitive git contract onto the SAME path copy = ONE source. Documented the cargo limitation: an in-repo workspace root (symbiont) adding this crate MUST repeat the patch (`[patch]` only applies at the root).
+2. **Parity guard only ran under `#[cfg(test)]`** (lib.rs) → a downstream `cargo build` never executed it, contradicting the "fails the build on drift" claim. Fix: added a **compile-time length fuse** `parity::COUNT_FUSE` (`const _ = assert!(mirror::CODEBOOK.len() == ogar_vocab::class_ids::ALL.len())`) that fires in ANY build (cargo build included) on add/remove drift; kept the runtime `assert_codebook_parity` (full id/domain bijection, tested + callable at startup); corrected the docs to state both depths precisely (no overclaim).
+
+Re-verified: `cargo test --manifest-path crates/lance-graph-ogar/Cargo.toml` 3/3 (the `ogar_class_view_implements_contract_class_view` test compiling PROVES one-source unification), clippy `-D warnings` + fmt clean, no "patch not used". Both threads replied + resolved. Pushed to #564.
+
 ## 2026-06-20 (cont.¹⁴) — zero-copy SoA read contract (`node_rows_from_le_bytes`) — the surrealdb "second brain" primitive
 
 **Main thread (Opus), autoattended.** Operator: "create a contract … that ensures LE contract to the lance-graph SoA view → zero-copy symbiont; surrealdb becomes a second brain inside lance-graph." Brutal feasibility pass against real code on both sides (see EPIPHANY `E-SURREALDB-SECOND-BRAIN-IS-ZERO-COPY-IFF-FIXEDSIZEBINARY`):

crates/lance-graph-ogar/Cargo.toml

@@ -15,17 +15,31 @@
 #   ogar-adapter-surrealql          = emit(Class) -> SurrealQL DDL (the DO arm)
 #
 # Auto-activation = Cargo presence: a build graph that pulls THIS crate gets the
-# real OGAR Class/ClassView/codebook + the parity-guard (lib.rs) that fails the
-# build if `lance_graph_contract::ogar_codebook`'s lean mirror ever drifts from
-# `ogar_vocab::CODEBOOK`. A build WITHOUT this crate uses the contract's zero-dep
-# mirror + the bare ClassView trait (headless OGAR app, or a self-supplied impl).
-# OGAR never depends on the lance-graph ENGINE — only on the zero-dep contract.
+# real OGAR Class/ClassView/codebook + the parity-guard (lib.rs): a COMPILE-TIME
+# length fuse (`const _` assert that the mirror and `ogar_vocab::class_ids::ALL`
+# have equal count — fires in ANY build, `cargo build` included) plus a runtime
+# `parity::assert_codebook_parity()` for the full id/domain bijection (call it at
+# consumer startup; also asserted by this crate's tests = the CI gate). A build
+# WITHOUT this crate uses the contract's zero-dep mirror + the bare ClassView
+# trait. OGAR never depends on the lance-graph ENGINE — only the zero-dep contract.
 #
-# ONE contract source: this crate AND ogar-class-view both resolve
-# `lance-graph-contract` to git `AdaWorldAPI/lance-graph#main` (which carries
-# `ogar_codebook` since PR #563) — so `OgarClassView`'s `impl ClassView` is for
-# the SAME contract the parity-guard checks. No [patch] needed (the symbiont
-# pattern: align on one source rather than redirect).
+# ── ONE contract source (codex P2, PR #564) ──
+# The canonical `lance-graph-contract` in-repo is the PATH copy (`crates/
+# lance-graph-contract`) — what `lance-graph` and `symbiont` already path-dep.
+# `ogar-class-view` (in the OGAR repo) hard-codes a `git` dep on
+# `AdaWorldAPI/lance-graph#main` for ITS standalone build; Cargo treats path and
+# git as DISTINCT crates even at the same version, so `OgarClassView` would impl a
+# DIFFERENT `ClassView` than the engine expects. The `[patch]` below redirects
+# that transitive git contract onto the SAME path copy, so this crate's standalone
+# build has exactly one contract source = the path copy.
+#
+# CONSUMER REQUIREMENT (cargo limitation): `[patch]` only applies in the WORKSPACE
+# ROOT. When an in-repo workspace root (e.g. `crates/symbiont`) adds
+# `lance-graph-ogar`, THIS crate's `[patch]` is ignored — that root MUST repeat:
+#   [patch."https://github.com/AdaWorldAPI/lance-graph"]
+#   lance-graph-contract = { path = "../lance-graph-contract" }
+# to unify ogar-class-view's transitive git contract onto its path copy. Without
+# it the OgarClassView `impl ClassView` won't typecheck against the engine's.
 #
 # Build/verify:  cargo test --manifest-path crates/lance-graph-ogar/Cargo.toml
 # Full DO arm :  cargo test --manifest-path crates/lance-graph-ogar/Cargo.toml \
@@ -53,9 +67,10 @@ serde = ["ogar-vocab/serde", "ogar-adapter-surrealql/serde"]
 
 [dependencies]
 # Contract surface (zero-dep): ClassView / ObjectView / ClassId / NodeGuid + the
-# ogar_codebook wire-compat mirror the parity-guard checks. git main == the SAME
-# source ogar-class-view git-deps, so there is exactly ONE lance-graph-contract.
-lance-graph-contract = { git = "https://github.com/AdaWorldAPI/lance-graph", branch = "main" }
+# ogar_codebook wire-compat mirror the parity-guard checks. PATH copy = the
+# canonical in-repo source (same as lance-graph / symbiont); the [patch] below
+# folds ogar-class-view's transitive git contract onto it = ONE source.
+lance-graph-contract = { path = "../lance-graph-contract" }
 
 # ── OGAR Active-Record forks: git deps @ main (the canonical superset; matches
 #    symbiont's pins so they resolve to ONE source in the golden image) ──
@@ -65,3 +80,12 @@ ogar-ontology = { git = "https://github.com/AdaWorldAPI/OGAR", branch = "main" }
 # default features only = the light emit() DDL formatter (no surrealdb tree);
 # the parser half is opt-in via this crate's `surrealql-parser` feature.
 ogar-adapter-surrealql = { git = "https://github.com/AdaWorldAPI/OGAR", branch = "main" }
+
+# Fold ogar-class-view's transitive `lance-graph-contract` (git
+# AdaWorldAPI/lance-graph#main) onto the SAME path copy this crate uses, so there
+# is exactly ONE contract crate and `OgarClassView`'s `impl ClassView` is for it
+# (codex P2, PR #564). Applies in THIS crate's standalone build (its own
+# [workspace] root); an in-repo workspace root that adds this crate must repeat
+# the patch (see the CONSUMER REQUIREMENT note in the header).
+[patch."https://github.com/AdaWorldAPI/lance-graph"]
+lance-graph-contract = { path = "../lance-graph-contract" }

crates/lance-graph-ogar/src/lib.rs

@@ -37,12 +37,20 @@
 //! A build graph that pulls THIS crate (the golden image via `symbiont`, or any
 //! AR-aware consumer — q2, medcare, …) gets the **real** OGAR `Class`/`ClassView`/
 //! codebook (including [`ogar_vocab`]'s full curator-alias normalizer, so OGAR is
-//! never dumbed down) **plus** the [`parity`] guard that fails the build if the
-//! contract's lean `ogar_codebook` mirror ever drifts from OGAR's authoritative
-//! `class_ids::ALL`. One contract source: this crate and `ogar-class-view` both
-//! resolve `lance-graph-contract` to git `AdaWorldAPI/lance-graph#main` (which
-//! carries `ogar_codebook` since PR #563), so the `OgarClassView` `impl ClassView`
-//! is for the SAME contract the guard checks.
+//! never dumbed down) **plus** the [`parity`] guard. The guard fires at two depths
+//! so it cannot be silently bypassed (codex P2, PR #564):
+//! - a **compile-time length fuse** ([`parity`] `const _`) that fails ANY build
+//!   (`cargo build` included) if the mirror and `ogar_vocab::class_ids::ALL` have
+//!   a different concept count — the most common drift (add/remove a concept);
+//! - a **runtime full-bijection** check ([`parity::assert_codebook_parity`]) for
+//!   id + domain agreement, asserted by this crate's tests (the CI gate) and
+//!   callable at consumer startup.
+//!
+//! One contract source: this crate path-deps `lance-graph-contract` (the canonical
+//! in-repo copy) and a `[patch]` folds `ogar-class-view`'s transitive *git*
+//! contract onto the SAME path copy, so the `OgarClassView` `impl ClassView` is for
+//! the contract the guard checks (an in-repo workspace root adding this crate must
+//! repeat that patch — see the manifest CONSUMER REQUIREMENT note).
 //!
 //! # The OGIT ↔ OGAR seam
 //!
@@ -72,13 +80,24 @@ pub use ogar_vocab::Class;
 
 /// Codebook parity-guard — the drift fuse between OGAR's authoritative codebook
 /// (`ogar_vocab::class_ids::ALL`) and the contract's zero-dep wire mirror
-/// (`lance_graph_contract::ogar_codebook::CODEBOOK`). Compiled (and tested) only
-/// when this crate is in the build graph, so any OGAR-present build (the golden
-/// image, AR-aware consumers) fails fast on divergence; OGAR-absent builds carry
-/// the mirror alone and never need the check.
+/// (`lance_graph_contract::ogar_codebook::CODEBOOK`). Two depths so it cannot be
+/// silently bypassed (codex P2, PR #564): a [`COUNT_FUSE`] **compile-time** assert
+/// that fires in ANY build, plus [`assert_codebook_parity`] for the runtime full
+/// id/domain bijection (tested here = CI gate; call at consumer startup too). When
+/// this crate is absent, the contract's mirror stands alone and needs no check.
 pub mod parity {
     use lance_graph_contract::ogar_codebook as mirror;
 
+    /// **Compile-time length fuse.** Fails the build — `cargo build`, not just
+    /// `cargo test` — if the contract mirror and OGAR's authoritative
+    /// `class_ids::ALL` carry a different number of concepts (add/remove drift).
+    /// The full id/domain bijection is the runtime [`assert_codebook_parity`].
+    pub const COUNT_FUSE: () = assert!(
+        mirror::CODEBOOK.len() == ogar_vocab::class_ids::ALL.len(),
+        "ogar_codebook mirror drifted from ogar_vocab::class_ids::ALL (concept count mismatch) — \
+         update lance_graph_contract::ogar_codebook::CODEBOOK to match OGAR",
+    );
+
     /// Whether OGAR's domain for `id` agrees with the contract mirror's. Both
     /// enums are structurally identical (`id >> 8` discriminant); compared by a
     /// total match so a new OGAR domain variant trips this (`#[non_exhaustive]`).