GitHub

ADR-0045: Sealed Weighted Target Profile and Shared-Join Selection

Status: accepted; profiling boundary implemented and next optimization class selected

Date: 2026-07-30

Visibility: private NAUX architecture/governance record. This ADR is not public roadmap material.

Related: ADR-0037, ADR-0041, ADR-0042, ADR-0043, ADR-0044

Preserves: target schema, lowering policy, encoder policy 1.4.0, target-plan semantics, ABI, raw code bytes, benchmark workload, timing harness, Machine IR provenance, Bounds ordering, and every upstream semantic contract

Context

ADR-0044 accepted encoder policy 1.4.0 after correctness migration and a reproducible local directional improvement. Gate B nevertheless remains open: all three local ratios are above 2.0x, and at least one variance admission check failed in every observation.

Choosing another optimization from static code size or intuition would repeat the error rejected by ADR-0043. The next decision needs a deterministic view of the exact policy-1.4 realization under the unchanged frozen Gate B workload, without instrumenting the timed standalone executable.

Two distinct quantities must not be conflated:

  • canonical target-plan execution counts describe semantic work;
  • emitted template byte spans describe the raw policy realization.

Neither quantity is a hardware-cycle measurement. Their product is useful for ranking structural costs, but cannot admit a performance claim.

Decision drivers

  • Observe the canonical target evaluator without changing ordinary evaluation.
  • Count only events that have passed the evaluator’s existing validation and work-budget checks.
  • Reuse the exact raw encoder decision and fallback path rather than reconstructing optimizer policy in a profiler.
  • Bound memory by target size, not dynamic trace length.
  • Detect every counter overflow and incomplete byte realization.
  • Bind the result to source, workload, target-plan, target-code, and encoder policy identities.
  • Keep profiling outside the Gate B timing window.
  • Select the next optimizer from measured hot structure while making no cycle or speed claim.

Decision

1. Observer seam

The canonical target-plan evaluator now has one internal generic observer seam. The ordinary public evaluator uses a no-op observer and retains its existing hard limit:

X64_TARGET_MAX_PLAN_EVAL_WORK = 100,000,000

The observer receives only successfully executed entry, instruction, terminator, selected-edge, tail-arity, tail-word, and Bounds events. It cannot change a target value, logical frame, control target, effect trace, or step charge. Any observer failure aborts profiling; it cannot turn an invalid or partial observation into evidence.

The frozen Gate B profile requires more work than the ordinary public evaluator admits. Profiling therefore has a separate fixed ceiling:

X64_TARGET_MAX_PROFILE_EVAL_WORK = 2,600,000,000

This does not widen the ordinary evaluator or any artifact limit.

2. Dense deterministic counters

The profiler stores counters indexed by verified canonical label and instruction index. It does not retain a dynamic event trace. All additions, multiplications, arity conversions, and aggregate counts are checked.

The profiler validates the evaluator step equation from its independently accumulated event classes. A missing entry, multiple outcomes, unpartitioned branch count, invalid label/index, or step disagreement fails closed.

3. Exact realization atoms

The raw encoder now records a complete ordered partition of its selected code blob into realization atoms. Every atom binds:

logical execution event
template class
start byte offset
end byte offset

The atoms are produced inside the same ordinary-first, optimized-second, fail-closed encoding path that emits the actual bytes. They therefore follow the selected policy rather than a duplicate model. Fallback carries the ordinary realization; successful policy 1.4 emission carries the optimized realization.

The encoder refuses a realization with a gap, overlap, reversed span, or incomplete code-byte coverage. Profiling also re-encodes the verified program and requires exact label, fixup, and code equality before using the atoms.

4. Weighted structural proxy

For each realization atom:

weighted_template_bytes = emitted_template_bytes * canonical_event_count

Totals are grouped by event site and template class. This is an exact, deterministic structural proxy for the frozen target and workload. It is not:

  • decoded x86 instruction count;
  • CPU cycles, latency, throughput, cache behavior, or branch cost;
  • a benchmark observation;
  • proof that removing a weighted byte improves wall-clock runtime.

Only the unchanged ADR-0041 sampler can evaluate Gate B performance.

5. Sealed Gate B profile

The Gate B wrapper regenerates the frozen workload and source-bound lighthouse target, checks its expected result and empty effect trace, embeds the complete generic profile, and hashes a domain-separated canonical encoding.

The accepted profile identity is:

e5328a4974b8bc8cf396625d3eef913c22fe015c175708eb9d12427712b494ba

Its fixed envelope includes:

evaluation work steps              2,526,207,757
observer updates                     160,941,817
represented executed blocks                  104
represented executed edges                   107
static target bytes                         3,097
weighted template bytes             2,927,032,491

The full seal test regenerates and then regeneratively replays the complete workload. Because that means two 2.526-billion-work evaluations, it is an explicit ignored release test rather than part of the ordinary fast suite. The accepted invocation completed successfully:

cargo test --release -p naux \
  core::x64_gate_b_profile::tests::frozen_weighted_profile_is_sealed_and_replays \
  --lib --no-default-features -- --ignored --exact --nocapture

6. Measured ranking

The dominant template classes are:

class                       weighted bytes
TailTransfer                 1,799,362,381
FusedCompareInstruction        427,823,394
OrdinaryInstruction            348,127,232
RegisterInstruction            227,359,264
BranchCondition                 75,498,246
BranchElseJump                  48,861,800

Tail transfer accounts for about 61.48% of the weighted-byte proxy. The canonical logical trace executes:

tail transfers                 118,263,305
tail argument values         1,182,632,968
tail argument words          1,309,284,945
branches                        12,583,041
checked array gets               4,194,304
Bounds exits                              0

A separate read-only reconstruction of the policy-1.4 transformed graph found seven remaining one-operation join blocks, all with two reachable predecessors. Their dynamic visits total 16,777,280, with approximately 104.86 million incoming frame-copy accesses. The exact profiler-owned planner then proves five of those seven structural joins:

target  class       executions  exposed ingress frame accesses
48      compare      4,194,367                       25,166,076
49      compare              1                                4
92      compare      4,194,303                       12,582,909
93      compare              1                                3
121     I64 add      4,194,304                       58,720,256
total               12,582,976                       96,469,248

The arithmetic proof keeps at most one current generation in each typed register bank. A GPR-producing instruction invalidates only the old R8 generation, so a live XMM2 generation can cross it; the symmetric rule applies to an XMM-producing instruction. Two generations in the same bank still refuse. The remaining two structural joins are checked array gets and remain outside register-result eligibility. Structural opportunity is not proof eligibility.

The five proofs are independent, not yet a simultaneous realization plan. Target 121 itself feeds target 48, so a policy that selected both without composition would double-own one logical body. Overlap ownership and transitive candidate composition must be decided before encoder policy 1.5.

7. Next optimization class

The next target is bounded edge-local shared-join state residency, starting with a proof and opportunity planner before any encoder-policy change.

The general policy must:

  1. reconstruct predecessors from the same transformed graph as emission;
  2. consider only exact direct edges into supported one-operation joins;
  3. substitute typed incoming values without changing target-plan homes;
  4. preserve simultaneous tail assignment and Bounds order;
  5. retain or clone a join body until every reachable incoming edge is proven;
  6. cap traversal and static code growth;
  7. reject overlapping destinations, cycles, stale register generations, ambiguous ownership, unsupported aggregates, or incomplete schedules;
  8. retain the complete policy-1.4 ordinary encoding on proof or emission failure.

No Gate B label may be hard-coded into the encoder. Labels such as the current hot arithmetic and compare joins are evidence vectors, not policy.

Weighted layout/fallthrough is the supporting successor. Checked-array result residency and certified range facts remain later candidates. Startup micro-optimization, generic multi-operation fusion, and another home-layout guess are not selected by this profile.

Encoder policy remains 1.4.0 until the shared-join proof, adversarial corpus, exact byte migration, downstream correspondence migration, and fresh ADR-0041 measurements all pass.

Verification

The accepted boundary requires:

  1. ordinary evaluation parity with the no-op observer;
  2. positive and invalid-artifact profile tests;
  3. exact evaluator step-accounting checks;
  4. exact raw label/fixup/code replay;
  5. complete contiguous realization-byte coverage;
  6. deterministic profile ordering and checked arithmetic;
  7. locked frozen-profile identity and count vectors;
  8. full release-mode regenerative replay;
  9. no instrumentation inside the standalone Gate B sampler;
  10. no performance claim derived from the structural proxy.

Consequences

Positive

  • The next encoder target is evidence-selected rather than guessed.
  • Logical execution and physical realization remain separately auditable.
  • A bounded dense profile replaces a multi-billion-event trace.
  • Exact encoder fallback behavior is visible to the profiler.
  • The new target directly attacks the remaining dominant frame-state traffic.

Negative

  • A full frozen-profile replay is deliberately expensive.
  • Realization metadata enlarges the raw encoder’s audit surface.
  • Template-byte weighting does not model modern x86 microarchitecture.
  • Shared joins require cloning/ownership proofs that are strictly harder than policy 1.4’s unique-predecessor rule.

Risks and mitigations

  • Profiler perturbs benchmark: profiling uses the canonical evaluator and never the timed standalone process.
  • Duplicate optimizer logic: realization atoms are emitted by the selected encoder path itself.
  • Counter wrap: every counter and weight operation is checked.
  • Partial evidence: a full-profile test is explicit and ignored by default; only its completed release replay can lock a vector.
  • Proxy overclaim: all documents keep Gate B open and reserve performance admission for ADR-0041 timing.
  • Unsafe join omission: policy 1.4 remains authoritative until every incoming edge has a bounded proof and complete downstream migration.