GitHub

ADR-0046: Bounded Transitive Shared-Join Composition

Status: accepted; composition proof and sealed replay implemented, encoder policy 1.4 retained

Date: 2026-07-30

Visibility: private NAUX architecture/governance record. This ADR is not public roadmap material.

Related: ADR-0037, ADR-0041, ADR-0044, ADR-0045

Preserves: target schema, lowering policy, encoder policy 1.4.0, target-plan semantics, ABI, raw code bytes, labels, fixups, benchmark workload, timing harness, Machine IR provenance, Bounds ordering, and every upstream semantic contract

Context

ADR-0045 proves five shared one-operation joins independently. Independent proof is insufficient for simultaneous realization: target 121 feeds target 48. Cloning target 121 into its two incoming roots replaces one physical predecessor of target 48 with two. A planner that applies both independent records without rebuilding the physical graph would double-own a logical body, miscount dynamic executions, or leave a live transfer into a tombstone.

The overlap must be resolved before an encoder policy can consume any shared target. This decision adds proof metadata only. It does not authorize policy 1.5 emission.

Decision drivers

  • Reconstruct the exact post-policy-1.4 physical graph after every selection.
  • Give each shared logical body one canonical composition owner.
  • Prove every physical predecessor before a target may be selected.
  • Preserve a unique dynamic-count authority as upstream clones expand.
  • Reject cycles, back-edges, incomplete schedules, stale generations, and partial composition evidence.
  • Bound targets, replicas, predecessors, and planner work independently.
  • Leave policy-1.4 bytes unchanged on every composition refusal.
  • Seal the complete prospective plan without treating it as performance evidence.

Decision

1. Independent opportunity and composition are separate evidence

The policy-1.4 raw realization retains the five independent opportunities from ADR-0045. A second record describes whether all independent opportunities can coexist:

complete
ordered composition steps
total prospective body replicas

complete = false requires zero steps and zero replicas. No consumer may use partial composition evidence.

Composition failure is caught with unwrap_or_default() at the metadata boundary. It cannot make a valid policy-1.4 optimized encoding fall back to ordinary bytes.

2. Smallest-ready topological selection

Candidate dependencies are reconstructed from independent physical ingresses. The planner repeatedly chooses the smallest label whose candidate dependencies have already been selected. Absence of a ready target is a dependency cycle and refuses the whole composition.

After each transactional selection the planner:

  1. combines policy-1.4 consumed labels with already selected shared targets;
  2. rebuilds physical predecessors and tail ingresses;
  3. requires two through eight physical predecessors;
  4. requires every predecessor to be the root of exactly one proven tail;
  5. extends every root across the same supported one-operation target;
  6. commits all extensions together;
  7. rebuilds the graph again and rejects any live edge into any selected target.

A candidate is refused if it is the entry, is already consumed, or already owns a policy-1.4 chain. This avoids cloning only the first operation of a larger owned chain.

3. Transitive ownership lineage

Each composed ingress carries:

physical root
pre-composition authority trigger
current ingress frame-access count

The authority trigger is preserved as deterministic one-operation targets are cloned downstream. For target 121, roots 106 and 116 retain Tail authorities 107 and 117. When both paths subsequently enter target 48, they must not both use aggregate Tail(121) as their count. The preserved authorities partition their dynamic executions exactly.

Authorities and roots must each be unique within one target. Reusing the same authority at sequential targets is valid: it represents distinct target-body executions on the same path.

Each step records the canonically sorted transitive ancestors whose selected clones feed at least one current ingress. The target block-entry count must equal the checked sum of all ingress-authority counts.

4. Typed state and transactional extension

Composition reuses the ADR-0045 typed register-bank proof:

  • one current GPR generation may coexist with one current XMM generation;
  • producing a value invalidates only the previous generation in that bank;
  • retaining an overwritten same-bank generation refuses the extension;
  • every substituted value and final tail schedule remains exactly typed;
  • all extensions are staged before any planner state is committed.

This is prospective proof state only. Policy 1.4 retains its original single-generation emission rule and remains byte-identical.

5. Independent hard bounds

The composition proof admits at most:

candidate targets                    16
physical predecessors per target      8
prospective shared body replicas      64
planner work                  32,000,000

Work charges physical-graph scans and cloned chain state. Arithmetic overflow or any exceeded limit refuses the complete composition.

6. Canonical profile migration

The generic target-profile schema becomes 1.2.0. The prospective composition policy becomes 1.1.0. The Gate B weighted wrapper uses the same schema and policy versions.

The seal includes:

  • completeness;
  • topological step order;
  • target kind;
  • sorted transitive ancestors;
  • every root and authority trigger;
  • checked executions and frame-access weights;
  • body-replica and body-execution totals.

The five independent opportunities remain separately encoded. Their totals must not be added to composition totals: they are two views of the same prospective work.

The accepted schema-1.2 identity is:

7f35655e4891bdecbe029369374dc806feb8e50d7f781836bf9f438b10be14ac

ADR-0045’s e5328a4974b8bc8cf396625d3eef913c22fe015c175708eb9d12427712b494ba remains the historical schema-1.1 identity. The full two-evaluation regenerative replay completed in release mode in 245.20 seconds.

7. Realization remains closed

This ADR does not authorize encoder policy 1.5. A future realization needs additional accounting:

  • cloned atoms must distinguish semantic event identity from ingress execution authority;
  • a Tail authority can count unconditional cloned instructions, but it cannot partition each cloned fused-compare else edge;
  • per-ingress branch-outcome cross-tabs, or a layout whose accounting avoids that claim, must be designed first;
  • exact code-growth limits, adversarial emission tests, identity migration, native/process/standalone correspondence, and fresh Gate B measurement still remain mandatory.

Accepted BranchMix vector

The composition structure is:

topological targets        49, 92, 93, 121, 48
replicas per target         2,  2,  2,   2,  3
total body replicas                         11
body executions                     12,582,976
target 48 ancestors                        121
weighted ingress accesses          125,829,376

The hot transitive partition is:

target  root  authority  executions
121     106   107          2,075,532
121     116   117          2,118,772
48      106   107          2,075,532
48      116   117          2,118,772
48      29    38                  63

These labels are sealed evidence vectors and are not hard-coded into optimizer policy.

Validation

Acceptance requires:

  1. deterministic raw-plan composition and exact BranchMix structure;
  2. cycle, live-back-edge, authority, predecessor, and cap refusal coverage;
  3. checked target-entry equality for every composed step;
  4. complete canonical encoding of all composition fields;
  5. mutation-sensitive seal validation;
  6. unchanged policy-1.4 code, plan, semantic, label, and fixup identities;
  7. raw, S7a, S7b, process, standalone, strict, debug, release, format, and Clippy gates;
  8. explicit ignored release-mode full regenerative profile replay.

Consequences

Positive

  • The five measured opportunities now have one deterministic simultaneous ownership proof.
  • Transitive predecessor expansion is explicit rather than label-specific.
  • Dynamic counts remain partitioned after upstream clones.
  • Failed research metadata cannot perturb accepted policy-1.4 output.

Negative

  • The proof surface and sealed profile become larger.
  • Rebuilding the physical graph after each selection costs bounded compile work.
  • Composition proves feasibility, not profitability or native speed.

Risks and mitigations

  • Double ownership: one topological step owns each selected logical target.
  • Tail to tombstone: every post-selection graph rejects live edges into selected targets.
  • Ambiguous count: roots and authority triggers are unique per step and sum to canonical target entries.
  • Partial evidence: incomplete composition exposes no steps or totals.
  • Unbounded cloning: target, predecessor, replica, and work caps are independent.
  • Premature performance claim: encoder policy remains 1.4 and Gate B stays open.