+- **`class_view::WideFieldMask`** (NEW, additive sibling type; **`FieldMask` is byte-for-byte untouched** — `Copy`/const-fn/u64 semantics intact; the enum-repr-inside-`FieldMask` alternative was evaluated and REJECTED because `ClassProjection::next`/`from_positions` rely on `FieldMask: Copy`). Widens the field-mask ceiling past 64 **without touching the existing type**: `Repr::Small(u64)` (bit-identical to `FieldMask`, allocation-free) promotes once to `Repr::Wide(Box<[u64]>)` at position ≥ 64; bit N = the same logical N3 field across both reprs; lossless `From<FieldMask>`, deliberately NO lossy reverse (a fallible `TryFrom` for the ≤64 case is the named follow-up for RBAC `PermissionSpec::projection`). **Canonical form (V-L P0, found + fixed pre-merge):** `intersect`/`union` trim trailing zero chunks and demote to `Small` when they fit; `PartialEq`/`Eq`/`Hash` are hand-written over a trimmed chunk view, so **semantically equal masks are equal and hash identically regardless of representation** (the adversarial review reproduced `a.intersect(&b) != from_positions(same set)` before merge; regression test pins it). No version split needed (`0x1000→0x1001` reserved as last resort, unused); zero-dep promise held (std only). **Unblocks X7/F14** — `account.move` has 109 declared fields; everything past bit 63 previously dropped silently. Doctrine guard: `FIELD_MASK_CAP = MAX_SIBLINGS_PER_TIER` (256) still caps meaningful masks — a ≥256-field class is an `OGAR-SOC` split signal, NOT a mask-widening use case; `WideFieldMask::full_for(field_count)` is the class-conditioned shape the OGAR bitmask doc always named as the eventual expansion. Verification: contract 829 green (+7 tests: u64-pin, >64 representable, no-alloc small path, cross-tier intersect/union, full_for, lossless promote, canonical-form regression); clippy `-D warnings` clean; consumers (`lance-graph-rbac`, `lance-graph-ontology`, arm-discovery) green with ZERO source changes. Cross-repo: OGAR interim loud-fail guard in `ogar-render-askama` (>64 fields + partial `FieldMask` → `Err` instead of silent drop) ships separately in the criticals wave; OGAR `WideFieldMask` adoption follows as O-2-adjacent work.
0 commit comments