feat(hhtl): signal NiblePath depth-exhaustion (is_full/try_child) + record #442 scale-freezes (D-ARM-14 review)

The D-ARM-14 session's review of #442 (merge-worthy verdict) flagged two non-blocking
'name the freeze' items; acting on both:

Flag 1 (the strong one) — NiblePath::child() saturated SILENTLY past MAX_DEPTH=16, so two
distinct deep P279 chains truncated at 16 would collide on one path (is_ancestor_of/basin
treat them as one). Same no-silent-aliasing class as the root()/FieldMask fixes. Added
is_full() (the depth_exhausted flag) + try_child() -> Option (returns None instead of
saturating), so the deferred 115M loader DETECTS the ceiling and switches to a ref instead
of colliding. child() stays the saturating convenience, now documented to gate on is_full().

Flag 2 + minors — recorded as TD-WIKI-SCALE (TECH_DEBT, append-only): StructuralSignature u32
birthday ceiling (~77k shape-families — a #441 contract decision to widen to u64, WITH the
deferred loader, not unilaterally here); signature() per-call Vec alloc; dolce_category_id
default-ENDURANT-on-unknown. All fine at curated/Odoo scale; bite only at the 115M load.
signature() doc now cites the u32 freeze.

503 contract + 246 ontology lib green; clippy -D warnings + fmt clean. Firewall preserved;
the proposer-side dolce_id alignment remains the D-ARM-14 session's lane.

https://claude.ai/code/session_01R9AWgFa65uPnLyS2my2d2R

Author: claude

.claude/board/TECH_DEBT.md

@@ -13,6 +13,32 @@
 ---
 
 
+### TD-WIKI-SCALE (D-WIKI-HHTL / #442) — three scale-freezes the N4 falsifier inherits
+
+**Status: Open.** Surfaced by the D-ARM-14 session's review of #442 (the hub-side
+Wikidata-HHTL arc). All three are FINE at the curated-corpus + Odoo scale this PR
+ships; they bite only at the deferred 115M streaming load:
+
+1. **`StructuralSignature` u32 birthday ceiling (~77k).** `wikidata_hhtl::WikidataClass::signature()`
+   and Odoo's `class_signature` both return `StructuralSignature(u32)` (#441's type). ~50% collision
+   probability near ~77k distinct shape-families → two genuinely different shapes alias to one family
+   (a correctness MERGE, not a perf nit) at Wikidata scale. **Pay by:** widen `StructuralSignature`
+   to `u64` — a #441 contract decision (touches the Odoo signature path too); land it WITH the
+   deferred load slice, not unilaterally in #442.
+2. **`NiblePath` MAX_DEPTH=16 ceiling — now SIGNALED, not silent.** `child()` saturates silently past
+   depth 16; real P279 chains run deeper, so two distinct deep classes truncated at 16 would collide on
+   one path. #442 adds `is_full()` + `try_child() -> Option` so the deferred loader DETECTS the ceiling
+   and switches to a ref (the bit-budget escape) instead of colliding. **Pay by:** the deferred loader
+   gates every descent on `is_full()`/`try_child()`; the ref-escape store is its own slice.
+3. **`signature()` allocates+sorts a `Vec` per call; `dolce_category_id()` defaults `ENDURANT` on
+   unknown class_id** (silent default vs signaling absence — mirrors `RegistryClassView`). Both fine
+   for the fixture. **Pay by:** at load scale hash the property-set without a per-call alloc
+   (pre-sorted columnar input); decide whether unknown-class DOLCE should be `Option`-signaled (a #441
+   `ClassView` trait decision).
+
+Cross-ref: #442, #441 (StructuralSignature/ClassView), the D-ARM-14 review, `wikidata-hhtl-load.md`,
+FINDING D-CLS↔D-ARM-14 (EPIPHANIES).
+
 ### TD-ARM-CARRIER-FORK (D-ARM-13 / streaming-arm-nars-discovery-v1)
 
 **Status: Open.** Surfaced by the 3-savant brutal review of D-ARM-13

crates/lance-graph-contract/src/hhtl.rs

@@ -80,10 +80,15 @@ impl NiblePath {
         }
     }
 
-    /// Route one level deeper to child `nibble`. Returns `self` UNCHANGED once
-    /// [`MAX_DEPTH`] is reached (the path is full — deeper addressing needs a ref)
-    /// or `nibble >= FAN_OUT` (out of range — never folded onto a valid child,
-    /// mirroring [`FieldMask`](crate::class_view::FieldMask)'s out-of-range discipline).
+    /// Route one level deeper to child `nibble`. **Saturating:** returns `self`
+    /// UNCHANGED once [`MAX_DEPTH`] is reached or `nibble >= FAN_OUT` (out of range —
+    /// never folded onto a valid child, mirroring
+    /// [`FieldMask`](crate::class_view::FieldMask)'s out-of-range discipline).
+    ///
+    /// At [`MAX_DEPTH`] the silent saturation means two *distinct* deeper paths would
+    /// collide on this address — so a real-scale caller MUST gate on
+    /// [`is_full`](NiblePath::is_full) or use [`try_child`](NiblePath::try_child),
+    /// which signal the ceiling instead of colliding (D-ARM-14 review of #442).
     #[must_use]
     pub const fn child(self, nibble: u8) -> Self {
         if self.depth >= MAX_DEPTH || nibble >= FAN_OUT {
@@ -96,6 +101,33 @@ impl NiblePath {
         }
     }
 
+    /// Has this path reached [`MAX_DEPTH`] — i.e. [`child`](NiblePath::child) can no
+    /// longer descend within the `u64`? When `true`, the bit-budget discipline
+    /// (`wikidata-hhtl-load.md`:71 "grows unbounded → path/ref") says switch to a
+    /// ref for deeper addressing: descending anyway via [`child`] is a SILENT no-op,
+    /// so two distinct deeper classes would collide on this same path. The deferred
+    /// 115M loader gates each descent on this (D-ARM-14 review of #442).
+    #[must_use]
+    pub const fn is_full(self) -> bool {
+        self.depth >= MAX_DEPTH
+    }
+
+    /// Route one level deeper, returning `None` instead of silently saturating when
+    /// the path [`is_full`](NiblePath::is_full) or `nibble >= FAN_OUT`. The explicit
+    /// counterpart to [`child`](NiblePath::child) for callers that must NOT collide
+    /// distinct deep paths (the real-scale loader).
+    #[must_use]
+    pub const fn try_child(self, nibble: u8) -> Option<Self> {
+        if self.depth >= MAX_DEPTH || nibble >= FAN_OUT {
+            None
+        } else {
+            Some(Self {
+                path: (self.path << 4) | (nibble as u64),
+                depth: self.depth + 1,
+            })
+        }
+    }
+
     /// The basin (root) nibble — the DOLCE top facet this path lives under.
     /// `None` for the empty path.
     #[must_use]
@@ -262,4 +294,33 @@ mod tests {
         );
         assert_eq!(bat_mask.count(), 4);
     }
+
+    #[test]
+    fn is_full_and_try_child_signal_depth_exhaustion() {
+        // child() saturates silently at MAX_DEPTH; is_full()/try_child() expose the
+        // ceiling so the deferred loader switches to a ref instead of colliding two
+        // distinct deep paths (D-ARM-14 review of #442).
+        let mut p = NiblePath::root(0x1);
+        assert!(!p.is_full());
+        while !p.is_full() {
+            p = p.try_child(0xF).expect("descends while not full");
+        }
+        assert_eq!(p.depth(), MAX_DEPTH);
+        assert!(p.is_full());
+        assert_eq!(
+            p.try_child(0x2),
+            None,
+            "try_child signals exhaustion, not a silent collision"
+        );
+        assert_eq!(
+            p.child(0x2),
+            p,
+            "child() still saturates (the convenience path)"
+        );
+        assert_eq!(
+            NiblePath::root(0x1).try_child(16),
+            None,
+            "out-of-range nibble is None too"
+        );
+    }
 }

crates/lance-graph-ontology/src/wikidata_hhtl.rs

@@ -92,6 +92,12 @@ impl WikidataClass {
     /// family (classes.md:42, now on Wikidata). Reuses the canonical
     /// [`fnv1a`](lance_graph_contract::hash::fnv1a); truncated to the
     /// [`StructuralSignature`] `u32`.
+    ///
+    /// **Scale freeze (TD-WIKI-SCALE):** `StructuralSignature` is `u32` — ~50%
+    /// birthday-collision near ~77k distinct shape-families. Safe for the curated
+    /// corpus + Odoo; at full Wikidata load scale, widening to `u64` is a #441
+    /// contract decision (flagged by the D-ARM-14 review of #442), to land WITH the
+    /// deferred loader, not unilaterally here.
     #[must_use]
     pub fn signature(&self) -> StructuralSignature {
         let mut props: Vec<&str> = self.properties.to_vec();