contract: mirror OGAR's 0xFFXX hardcoded-behaviour reservation (D-DT64-7 O2)

.claude/board/STATUS_BOARD.md

@@ -8,14 +8,14 @@ Plan: `.claude/plans/d-dt64-7-behaviour-addressing-registration-v1.md`. Docs onl
 | D-DT64-7-1 | `classid_canon_compat(0x0000_F123) == 0x0000` falsifier (F5, legacy ids only), with the twin `0xFFFF_F000 → 0xFFFF` | Queued | none |
 | D-DT64-7-2 | `BindStore` withdrawal with constraints C1–C8, behind an activation | Queued | after L2/L3 |
 | D-DT64-7-3 | compile-time Frozen polyfill table at `0xFFFF :: 0xF000`, registered by DT64, parity test against `R2ILVocabulary`; `ogar-loco` / `ogar-r2il` optional in `lance-graph-r2il` | In part: positional lens shipped (#1899); OGAR still on the path | — |
-| D-DT64-7-4 | DT64 `CapabilityAuthority` for concept `0xFFFF` + host-side composing authority (O8) | Queued | O2 (OGAR owner) |
+| D-DT64-7-4 | DT64 `CapabilityAuthority` for concept `0xFFFF` + host-side composing authority (O8) | Queued | O8 (O2 done: OGAR #365 + contract mirror guard) |
 | D-DT64-7-6 | polyglot alias views (C, Rust, Java, SQL) over one Frozen algebra: words bound by position, names as per-language `ClassView` labels; `prepare`/`run` timed in ns | Queued | D-DT64-7-3, O7 |
 | D-DT64-7-7 | semantic union census of operator sets (ONNX, TF, TFLite, GGML, Burn IR, R2IL, XLOG) after aliasing; decides the `0xF0__` layout and the tensor ranges | Queued | counts recounted from source |
 | D-DT64-7-L4 | production alias views (R2IL, SQL, Quack) from `POLYFILL` | In progress | — |
 | D-DT64-7-L1 | full-classid basis for behaviour lenses (contract `ClassView` accessor) | Queued | after L4 |
 | D-DT64-7-L5 | consumer `ClassView` + immutable basis witness at registration | Queued | after L1 |
 | D-DT64-7-L2 | host composition of DT64 and OGAR authorities + views, with activation checks (L3) | Queued | after L5 |
-| D-DT64-7-5 | the versioned global → local selection table (D-LITHO Q5) | Queued | O5 (DR/DT owner) |
+| D-DT64-7-5 | the versioned global → local selection table, a BindStore plan item (Litho is a mental model, folded into the bind store plan as D-DT64-6 Amendment A) | Queued | O5 (taken by this session) |
 
 ## D-MIST-NATIVE — Mistaber's Kripke holdings over the DR64 relation register (2026-10-30)
 
@@ -91,7 +91,7 @@ Plan: `.claude/plans/d-soc-fence-v1.md`. Plan only; nothing runs yet.
 | D-XLOG-DR64-0 | XLOG RIR (Join / ChainJoin / swapped order) → `bind_dr64` + `Chain` + `compose`; forward∧backward over one 64-slot axis; 2 oracles, 11 refusals, 9 disable runs, cost probe | Shipped (#1857) | lab only |
 | D-XLOG-DR64-1 | arrow 60 vs 58: align or a facts-free `xlog-core` before any in-tree use | Queued | XLOG upstream / owner decision |
 | D-XLOG-DR64-2 | query-bound recursion via native semi-naive deltas; compare with XLOG magic sets | Queued | after D-XLOG-DR64-1 |
-| D-XLOG-DR64-3 | D-LITHO-1: Gate B as explicit register steps; failing bag-multiplicity fixture (2 oracles); count width and per-Y product named as open; same operation as a DTO binding (NodeGuid / ClassView / WideFieldMask / method ref) | In PR | review; lab only |
+| D-XLOG-DR64-3 | D-LITHO-1: Gate B as explicit register steps; failing bag-multiplicity fixture (2 oracles); count width and per-Y product named as open; same operation as a DTO binding (NodeGuid / ClassView / WideFieldMask / method ref) | Shipped (#1864) | lab only |
 
 ## D-DRDT — DR = HHTL16 Cartesian direct routing, DT = ClassId binding store (2026-10-28)
 

.claude/plans/d-dt64-7-behaviour-addressing-registration-v1.md

@@ -209,10 +209,10 @@ Each constraint is a test that fires plus a twin that stays silent, on non-trivi
 | # | question | owner |
 |---|---|---|
 | O1 | ~~Seat ownership for left `0xF###`~~ — answered for `0xFFFF` by D13'' (lance-graph owns it, DT64 registers). Open remainder: do left sides `0xF000 ..= 0xFFFE` ever hold anything? | operator |
-| O2 | OGAR reserves concept `0xFFFF` (at least; domain `0xFF` if preferred) for lance-graph behaviour, never minted in `ogar-vocab`, with a mirror test that fails if a codebook row lands there. | OGAR owner |
+| O2 | OGAR reserves concept `0xFFFF` (at least; domain `0xFF` if preferred) for lance-graph behaviour, never minted in `ogar-vocab`, with a mirror test that fails if a codebook row lands there. | DONE: domain `0xFF` reserved (OGAR #365); contract mirror `HARDCODED_BEHAVIOUR` + guard test |
 | O3 | F5 for legacy `0x0000_XXXX` ids: exclude them, or retire the heuristic. No longer gates this plan (§1a). | operator |
 | O4 | Right-side `0xF###` selection: does one value name one stored selection over the existing 256-position basis, or one position in a wider basis (which widens `WideFieldMask` and `AlgebraRef.word` past `u8`)? D7' points to the first. | operator |
-| O5 | D-LITHO Q5: which lance-graph table versions the global → local selection, and its row shape (WORKING-MODEL: versions = frame revisions, one row per local position, read through a ClassView, selected by a `WideFieldMask`; it also holds the stored selections of D7'). | DR/DT owner |
+| O5 | (Litho is a mental model; this is a BindStore plan item, D-DT64-6 Amendment A) Which lance-graph table versions the global → local selection, and its row shape (WORKING-MODEL: versions = frame revisions, one row per local position, read through a ClassView, selected by a `WideFieldMask`; it also holds the stored selections of D7'). | DR/DT owner |
 | O6 | Whether `recursive::trace` (#1896) stays as a semi-naive test oracle or is removed; either way it is documented as not the traceroute. | operator |
 | O7 | The concern ranges inside `0xF###` (§1a table): confirm the digit-per-concern split and the order. Per §1b, languages that only rename the shared algebra become alias views; which of SQL, Gremlin and XLOG keep a range? Does full TensorFlow share TFLite's range, or take its own? | **DECIDED §1d** |
 | O9 | Behaviour-lens basis key (L1): keep the left-half key (256 words per left side; a large operator set takes several left sides), or key behaviour lenses by the full classid (a contract `ClassView` change). | **DECIDED §1d** |

crates/lance-graph-contract/src/ogar_codebook.rs

@@ -574,6 +574,17 @@ pub const fn classid_concept(classid: u32) -> u16 {
     classid_canon(classid)
 }
 
+/// The left half of every lance-graph hardcoded behaviour classid
+/// (`0xFFFF :: 0xF###`, D-DT64-7). Mirror of OGAR
+/// `ogar_vocab::HARDCODED_BEHAVIOUR`: the `0xFFXX` block is reserved there
+/// (OGAR #365) and no [`CODEBOOK`] row may land in it. lance-graph-dt64 is
+/// the registration authority for behaviour lenses under it; the codebook
+/// is never asked.
+pub const HARDCODED_BEHAVIOUR: u16 = 0xFFFF;
+
+/// The reserved high byte of [`HARDCODED_BEHAVIOUR`].
+pub const HARDCODED_BEHAVIOUR_DOMAIN: u16 = HARDCODED_BEHAVIOUR >> 8;
+
 /// The curated `(canonical_concept, u16)` codebook — wire-compatible mirror of
 /// OGAR `ogar_vocab::CODEBOOK`. Ids are stable forever (once shipped, never
 /// re-assigned); domain-encoded `0xDDCC`. Carries the two domains the contract
@@ -904,6 +915,28 @@ mod tests {
     }
 
     use super::*;
+
+    /// The `0xFFXX` block is lance-graph's hardcoded behaviour
+    /// (`0xFFFF :: 0xF###`, D-DT64-7). OGAR reserves it (OGAR #365); the
+    /// mirror must never carry a concept there either, or a behaviour lens
+    /// and a minted concept would share a left half.
+    #[test]
+    fn no_mirrored_row_lands_in_the_hardcoded_behaviour_block() {
+        assert_eq!(HARDCODED_BEHAVIOUR, 0xFFFF);
+        assert_eq!(HARDCODED_BEHAVIOUR_DOMAIN, 0xFF);
+        for (name, id) in CODEBOOK {
+            assert_ne!(
+                id >> 8,
+                HARDCODED_BEHAVIOUR_DOMAIN,
+                "{name} ({id:#06x}) landed in the reserved 0xFFXX block"
+            );
+        }
+        assert_eq!(canonical_concept_id("hardcoded_behaviour"), None);
+        assert_eq!(
+            canonical_concept_domain(HARDCODED_BEHAVIOUR),
+            ConceptDomain::Unassigned
+        );
+    }
     use crate::NodeGuid;
 
     #[test]

crates/lance-graph-r2il/src/polyfill.rs

@@ -33,7 +33,7 @@ use crate::{
 };
 
 /// The left side of every hardcoded behaviour classid.
-pub const HARDCODED: u16 = 0xFFFF;
+pub const HARDCODED: u16 = lance_graph_contract::ogar_codebook::HARDCODED_BEHAVIOUR;
 
 /// The relational / mask-risc polyfill lens, `0xFFFF :: 0xF000`.
 pub const POLYFILL_LENS: u32 = compose_classid(HARDCODED, 0xF000);