ADR-0047: Bounded Per-Ingress Fused-Compare Branch-Arm Cross-Tabs

Status: accepted; exact ingress-route admission and schema-1.3 proof authority superseded by ADR-0048; branch-arm data model retained; encoder policy 1.4 retained

Date: 2026-07-30

Visibility: private NAUX architecture/governance record. This ADR is not public roadmap material.

Related: ADR-0037, ADR-0041, ADR-0044, ADR-0045, ADR-0046

Preserves: target-plan schema, lowering policy, encoder policy 1.4.0, target-plan semantics, ABI, raw code bytes, labels, fixups, benchmark workload, timing harness, Machine IR provenance, Bounds ordering, and every upstream semantic contract

Context

ADR-0046 gives each prospective shared target deterministic transitive ownership and a unique ingress execution authority. That authority is enough to count an unconditional cloned instruction, but it is not enough to weight a cloned fused-compare else jump. Aggregate counts at the logical branch block do not say which cloned ingress selected then or else.

Future realization therefore needs a bounded cross-tab:

ingress authority × branch arm

This decision adds the missing observation and seal. It still does not authorize policy-1.5 code emission.

Decision drivers

Correlate an outcome with the exact fused compare rather than a nearby label.
Preserve the upstream authority through deterministic register ancestors.
Keep memory bounded by composition size rather than dynamic trace length.
Detect reactivation, unrelated control, incomplete phases, and dangling authority.
Require every ingress row to conserve its exact execution count.
Attach branch cells directly to existing composition ingresses.
Preflight raw branch paths before the multi-billion-step profile.
Preserve all policy-1.4 code identities on profiling refusal.

Decision

1. Raw fused-branch path metadata

Every composed FusedCompare step carries the classifier-owned logical path:

compare target
empty branch-bridge label
then successor
else successor

Every register step carries no branch path. Mismatched kind/path metadata fails before evaluation.

The branch bridge matters: target-plan evaluation emits the branch event at the empty callee block, not at the compare target. Correlating on the compare label alone would silently attribute zero or unrelated outcomes.

2. Exact phase machine

One globally unique compare authority may be active at a time. Its accepted event sequence is:

Tail(authority)
→ zero or more deterministic ancestor/no-op transfers
→ Instruction(compare_target, 0)
→ Tail(compare_target, branch_bridge)
→ BranchThen/BranchElse(branch_bridge, exact successor)
→ inactive

An ancestor instruction is accepted only when its label is in the step’s sorted transitive ancestor set and the ancestor is a previously selected register target.

The observer fails closed on:

authority reactivation before consumption;
an instruction outside the declared ancestor/target path;
compare transfer before its instruction;
a wrong branch bridge or successor;
an extra tail after the compare bridge;
an unrelated branch while authority is active;
a known composed branch without authority;
Return or Bounds with pending authority;
authority left active when profile construction begins.

3. Dense bounded state

The observer allocates:

label → optional authority activation
label → optional compare step
label → known branch-bridge bit
one active phase
then/else counters for each composed compare ingress

There is no dynamic event trace. Counter storage is bounded by verified target labels plus at most 64 composition replicas. Every increment is checked.

4. Cross-tab conservation

Each composition ingress now carries:

branch_arm_counts = None

for a register step, or:

branch_arm_counts = Some {
    then_executions,
    else_executions,
}

for a fused compare.

For every fused ingress:

then_executions + else_executions == ingress executions

For every fused step:

sum(all ingress arms)
== target block entries
== target instruction-0 executions
== target tail executions

The proof deliberately does not equate a row subset with aggregate counts at a potentially shared branch bridge. Correlation is established by the exact phase machine and target conservation instead.

5. Canonical profile migration

The target-profile schema becomes 1.3.0 and its proof policy becomes 1.2.0. The Gate B weighted wrapper uses the same versions. Encoder policy remains 1.4.0.

Each composition ingress canonical encoding appends:

0                                  # no branch arms

or:

1
then_executions
else_executions

The accepted schema-1.3 identity is:

6031a26d6207a0e98cd8826d0cf16f7fbde3779278e27f1873e75a16232440c0

ADR-0046’s 7f35655e4891bdecbe029369374dc806feb8e50d7f781836bf9f438b10be14ac remains the historical schema-1.2 identity. The two-evaluation regenerative release replay completed successfully in 276.73 seconds.

6. Realization remains closed

This cross-tab supplies the missing count authority for prospective cloned compare instructions, conditional branches, and else jumps. Policy 1.5 still requires:

a separate prospective realization structure, not mutation of policy-1.4 EmissionPlan;
exact semantic-event and execution-authority fields on every cloned atom;
deterministic label/fixup ownership and tombstone migration;
exact static-byte and code-growth caps;
all-or-nothing fallback to the already encoded policy-1.4 blob;
adversarial raw-emission tests;
target/native/process/standalone identity migration;
fresh Gate B measurement and claim admission.

Accepted BranchMix matrix

target  authority  executions       then       else
49      39                  0          0          0
49      40                  1          0          1
92      82            735,084    735,084          0
92      86          3,459,219  1,340,447  2,118,772
93      83                  0          0          0
93      87                  1          1          0
48      38                 63          0         63
48      107         2,075,532         32  2,075,500
48      117         2,118,772         32  2,118,740

Target totals:

target  executions       then       else
49               1          0          1
92       4,194,303  2,075,531  2,118,772
93               1          1          0
48       4,194,367         64  4,194,303

These labels and counts are evidence vectors, never optimizer policy.

Validation

Acceptance includes:

raw branch-path equality with the existing fused classifier;
direct and transitive phase-machine success;
missing authority, repeated activation, unrelated control, and dangling terminal refusal;
global compare-authority uniqueness preflight;
per-row and per-target conservation;
Some only for compares and None only for register steps;
complete canonical branch-cell encoding;
a cell mutation that preserves row and column margins still breaking the seal;
unchanged policy-1.4 code and target identities;
explicit ignored release-mode full regenerative replay;
format, Clippy, raw, profile, debug, release, strict, native, process, and standalone gates.

Consequences

Positive

Every prospective compare clone now has exact unconditional and else-jump execution counts.
Hot transitive paths 107 and 117 remain separately attributable through target 121 into target 48.
No trace proportional to runtime work is retained.
The seal detects cell swaps even when aggregate margins are preserved.

Negative

The observer now carries a small control-lineage state machine.
Valid future policies with multiple simultaneous compare authorities would need a broader, separately versioned proof.
The profile seal changes again while encoder bytes deliberately do not.

Risks and mitigations

Wrong branch label: raw classifier metadata names the exact bridge.
Outcome leakage between clones: only the active authority row is incremented.
Partial path: every invalid or unfinished phase refuses the profile.
Counter wrap: every cell and conservation sum is checked.
Premature speed claim: this is structural attribution, not timing; Gate B remains open.