GitHub

ADR-0048: Exact Per-Ingress Ordered Shared-Join Lineage

Status: accepted; exact per-ingress route proof and schema-1.4 migration implemented, sealed, and independently replayed; encoder policy 1.4 retained

Date: 2026-07-30

Visibility: private NAUX architecture/governance record. This ADR is not public roadmap material.

Related: ADR-0037, ADR-0041, ADR-0044, ADR-0045, ADR-0046, ADR-0047

Supersedes: ADR-0047’s ingress-route admission predicate, target-profile proof policy 1.2.0, schema-1.3 seal as admissible shared-join-realization evidence, and validation claims that depend on exact route rejection

Retains: ADR-0047’s raw fused-branch path ownership, branch-arm cross-tab data model and BranchMix cell values, bounded dense observation, encoder policy 1.4.0, target/plan/code identities, and schema-1.3 hash 6031a26d6207a0e98cd8826d0cf16f7fbde3779278e27f1873e75a16232440c0 as a historical regression vector only

Preserves: target-plan schema, lowering policy, encoder policy 1.4.0, target-plan semantics, ABI, raw code bytes, labels, fixups, benchmark workload, timing harness, Machine IR provenance, Bounds ordering, and every upstream semantic contract

Context

ADR-0047 sealed exact branch-arm counts per ingress, but its observer admitted pre-compare control using a step-wide unordered ancestor set. Activation was selected by the authority tail’s source label without checking its target. While seeking the compare, an arbitrary tail was accepted unless its source was the compare target.

That predicate was sufficient to observe the current unmodified evaluator, but it was not sufficient evidence for future cloning. At target 48, the step-wide ancestor summary contains target 121 because authorities 107 and 117 cross it. Direct authority 38 does not. A consumer could not prove from the schema-1.3 payload that authority 38 skipped 121 or that authority 107 followed every required no-op bridge in order.

Policy 1.5 has never consumed this evidence, so no emitted code, target identity, native artifact, or benchmark result is invalidated. The proof boundary must nevertheless be repaired before any realization work can use it.

Decision drivers

  • Bind route evidence to one exact ingress rather than a step-wide union.
  • Replay every logical tail edge, including zero-instruction bridge blocks.
  • Preserve instruction/tail order through transitive register ancestors.
  • Reject malformed zero-count routes during preflight, not only when executed.
  • Resolve the branch bridge structurally and reject aliased or substituted successors even when one arm is dynamically unobserved.
  • Make activation target, skipped/repeated events, and edge substitution fail closed.
  • Seal route order and ingress association canonically.
  • Keep the accepted policy-1.4 encoder and every executable identity unchanged.

Decision

1. Raw per-ingress ordered lineage

Every composition ingress carries an ordered lineage:

Instruction { label, index }
Tail { source, target }

The first event is the authority tail. The raw planner independently follows the unmodified target CFG from authority_trigger to the current composition target. It records every TailJumpRel32 edge, including empty bridge blocks. An intermediate instruction is admitted only when it is instruction zero of a previously selected register-kind dependency.

Lineage derivation is cycle-safe, charges the existing bounded composition work counter, and requires the set of visited instruction ancestors to equal that ingress’s exact dependency set.

2. Canonical step summary

step.ancestors remains a sorted compatibility summary. It is re-derived as the union of instruction ancestors in all ingress lineages. A missing, spurious, non-register, repeated, or nonzero-index ancestor refuses the entire composition proof.

The summary is not route authority. Consumers use each ingress’s ordered lineage.

3. Independent full-route reconstruction

The target profiler independently reconstructs the full route from the verified target program. It requires the raw lineage to equal the exact prefix, then appends:

Instruction { label: composition_target, index: 0 }
Tail {
    source: composition_target,
    target: exact logical successor,
}

For a fused compare, the final successor must resolve to the exact classifier-owned empty branch-bridge block. Its terminal must be BranchRel32; its then/else successors must equal the canonical ingress arms and must be distinct. This preflight runs for every ingress and every arm, including an ingress or branch arm whose dynamic count is zero.

4. Exact cursor observer

One active ingress owns one cursor into one full route. The observer accepts only the event at that cursor:

exact activation Tail
→ exact ordered Tail/Instruction events
→ exact compare-to-bridge Tail
→ exact then/else successor
→ inactive

Wrong activation target, skipped, inserted, repeated, reordered, or unrelated events refuse. Branch or terminal events with an unfinished route refuse. Known compare/branch events without an authority refuse.

5. Schema and proof-policy migration

The target-profile and Gate B wrapper schemas become 1.4.0. Their proof policies become 1.3.0. Encoder policy remains 1.4.0.

Each composition ingress canonical encoding now includes:

route event count
ordered route event tags and labels

before executions, structural frame-access weights, and optional branch-arm counts. Route order and association with root/authority_trigger are therefore hash-visible.

The accepted schema-1.4 identity is ee803c9518ef891d033a0d76436667e8ad12d0d742e1d4983813fdd34c579d83. It was regenerated by the final explicit release-mode replay in 305.48 seconds. Schema 1.3 is not reinterpreted under the stronger predicate.

6. Realization remains closed

This repair creates admissible ordered lineage evidence; it does not authorize policy-1.5 emission. A separate prospective realization structure must still prove:

  • exact semantic-event and execution-authority ownership for every cloned atom;
  • deterministic label, tombstone, and fixup ownership;
  • exact static-byte and code-growth caps;
  • all-or-nothing fallback to the accepted policy-1.4 blob;
  • adversarial raw-emission replay;
  • target/native/process/standalone identity migration;
  • fresh Gate B measurement and independent claim admission.

Validation

  1. raw replay of every no-op bridge and register ancestor;
  2. exact BranchMix lineage vectors for authorities 38, 107, and 117;
  3. missing and spurious ancestor refusal;
  4. zero-count ingress route mutation refusal during preflight;
  5. branch-bridge structural resolution and refusal when target 49’s dynamically unobserved then arm is aliased to its else arm;
  6. route swap between ingress rows refusal;
  7. wrong activation edge and skipped/inserted/repeated event refusal;
  8. canonical route encoding and self-resealed route-tamper replay mismatch;
  9. retained branch-cell conservation and self-resealed cell-tamper mismatch;
  10. unchanged policy-1.4 code, plan, native, process, and standalone identities;
  11. explicit release-mode regenerative seal replay;
  12. format, Clippy, raw, profile, debug, release, strict, native, process, and standalone gates.

All acceptance items pass. Focused raw 31/31, profile 4/4, and strict 8/8 tests pass, including self-resealed route and branch-cell tamper rejection. The final explicit release-mode regenerative replay passes 1/1 in 305.48 seconds with 2,526,207,757 evaluator steps, 160,941,817 observer updates, 104 blocks, 107 edges, 3,097 static code bytes, and 2,927,032,491 weighted bytes. Debug and release workspace tests pass; the release core unit set reports 344 passed, zero failed, and one ignored. Strict Clippy with warnings denied, format check, and whitespace diff check all pass on the accepted snapshot. Policy-1.4 executable identities remain unchanged.

Consequences

Positive

  • Each ingress now proves its own exact logical path.
  • No-op bridges are evidence rather than implicit assumptions.
  • An unobserved branch arm cannot hide an aliased or substituted successor.
  • A direct ingress cannot borrow another ingress’s transitive ancestor.
  • Zero-count rows cannot hide malformed route metadata.
  • The public seal binds route order and row association.

Negative

  • The profile payload grows by a bounded route vector per composition ingress.
  • The observer and raw planner duplicate CFG replay deliberately.
  • Schema 1.3 becomes historical immediately after its branch-arm milestone.

Risks and mitigations

  • Route explosion: targets, replicas, labels, and composition work remain hard-capped.
  • Cycle/nontermination: both raw derivation and profile reconstruction use visited-label bounds.
  • Union mistaken for authority: the ADR explicitly retains ancestors only as a checked summary.
  • Premature codegen: encoder policy remains 1.4 and realization stays closed.