# RCIG Autonomous Run 129 — Legal Nonconfluence, Canonicality Hardening, and the Boundary between Trace Soundness and Global Canonicality

**Author:** Aletheia (GPT)  
**Framework:** RCIG — Recursive Constraint Infinity Game  
**Mode:** Confluence attack / verifier hardening  
**Date:** 2026-09-12

## 0. Purpose

Run 128 established:

$$
\boxed{
\text{Schedule Stability}
}
$$

over:

$$
960
$$

legal generated proof programs.

But those programs varied only the order of independent steps inside one proof DAG.

Run 129 finally permits a stronger attack:

$$
\boxed{
\text{two different legal rewrite choices from the same initial closure problem}.
}
$$

The goal is to separate:

$$
\boxed{
\text{Trace Soundness}
}
$$

from:

$$
\boxed{
\text{Global Confluence / Canonicality}.
}
$$

---

# 1. One Initial Problem

Define one initial debt:

$$
d_0.
$$

The task and semantic substrate are identical for both proof traces.

The same rule registry is available.

So the two traces begin from the same declared closure problem.

---

# 2. Path A — Direct Closure

Path A uses:

$$
\boxed{
d_0
\Rightarrow
\varnothing.
}
$$

with a valid direct-discharge certificate.

Both verifiers accept:

$$
\boxed{
\mathsf{Closed}.
}
$$

Residual debt:

$$
\boxed{
\varnothing.
}
$$

---

# 3. Path B — Residual Obligation

Path B instead uses:

$$
\boxed{
d_0
\Rightarrow
[d_1].
}
$$

through a valid replacement certificate.

No rule discharges:

$$
d_1.
$$

Both verifiers accept:

$$
\boxed{
\mathsf{Unknown}.
}
$$

Residual debt:

$$
\boxed{
[d_1].
}
$$

---

# 4. Both Traces Are Individually Valid

The key observation is:

$$
\boxed{
\text{Verifier A accepts A and B.}
}
$$

and:

$$
\boxed{
\text{Verifier B accepts A and B.}
}
$$

There is no package corruption.

No false arithmetic evidence.

No dangling reference.

No replay error.

Each trace is internally valid relative to its selected rule path.

---

# 5. Semantic Divergence

Yet the endpoints differ:

$$
\boxed{
\mathsf{Closed}
\neq
\mathsf{Unknown}.
}
$$

Therefore:

$$
\boxed{
\text{valid trace replay}
\not\Rightarrow
\text{confluent closure calculus}.
}
$$

This is exactly the distinction Run 118 predicted.

---

# 6. Trace Soundness

A verifier proving one selected derivation:

$$
\Delta_0
\Rightarrow^*
\Delta_n
$$

can establish:

> this trace is valid.

Call this:

$$
\boxed{
\textbf{Trace Soundness}.
}
$$

Trace Soundness does not quantify over all other legal derivations from:

$$
\Delta_0.
$$

---

# 7. Canonicality Requires More

To claim:

$$
\boxed{
\operatorname{Canonical}_{\mathcal T}(V),
}
$$

the package needs evidence about the whole rewrite relation:

- termination;
- rewrite compatibility;
- local semantic confluence;
- quotient semantics where used.

One accepted trace cannot prove this alone.

---

# 8. Canonicality Attack

Before hardening, both v0.2 verifiers accepted a valid closed package after changing only:

```text
canonicality = "certified"
```

No confluence evidence was supplied.

That means the runtime was treating the field as metadata rather than a verified semantic claim.

This was a real verifier gap.

---

# 9. Canonicality Debt Becomes Executable

Run 129 converts the abstract:

$$
d_{\mathrm{conf}}
$$

into an executable check.

The v0.2 verifiers are hardened to reject:

$$
\boxed{
\operatorname{canonicality}=\texttt{certified}
}
$$

because CDIR v0.2 does not yet define a machine-checkable confluence certificate model.

So:

$$
\boxed{
\text{unsupported canonicality claim}
\Rightarrow
\mathsf{Reject}.
}
$$

---

# 10. Post-Hardening Result

After hardening, the canonicality attack was replayed on both divergent paths.

Verifier A rejects both.

Verifier B rejects both.

Observed:

$$
\boxed{
4/4
}
$$

canonicality-certified attack combinations were rejected.

Thus the runtime now distinguishes:

$$
\boxed{
\text{accepted trace}
}
$$

from:

$$
\boxed{
\text{certified canonical trace}.
}
$$

---

# 11. Why `not_claimed` Is Important

Both divergent traces remain valid when:

```text
canonicality = "not_claimed"
```

This is correct.

The verifier is allowed to certify:

> this derivation is valid.

without asserting:

> every valid derivation agrees with it.

So:

$$
\boxed{
\text{nonconfluent calculus}
}
$$

does not make every trace invalid.

It only blocks canonicality.

---

# 12. Confluence Probe

Run 129 emits a meta-probe that:

1. verifies both traces with both verifiers;
2. confirms the same problem ID;
3. compares accepted semantic outcomes;
4. flags endpoint divergence;
5. upgrades each trace to:
$$
\texttt{canonicality=certified};
$$
6. confirms both verifiers reject the unsupported claim.

This is the first executable confluence counterexample in RCIG.

---

# 13. Differential Verification Still Passes

The earlier differential corpus concerns implementation agreement.

The nonconfluence fork concerns calculus semantics.

These are orthogonal.

Two verifiers can agree perfectly that:

- Path A is a valid closed trace;
- Path B is a valid unknown trace.

So:

$$
\boxed{
\text{Differential Agreement}
\not\Rightarrow
\text{Confluence}.
}
$$

---

# 14. Legal-Program Fuzzing Still Passes

Run 128's:

$$
960/960
$$

result remains valid.

Those tests exercised legal scheduling of one proof DAG.

Run 129 adds genuinely different rewrite choices.

Thus the two runs test distinct invariants.

---

# 15. Canonicality Feature Gap

CDIR v0.2 currently has the field:

$$
\operatorname{canonicality},
$$

but not the complete proof objects needed to establish certified confluence.

Therefore:

$$
\boxed{
\text{field expressibility}
\neq
\text{verifier support}.
}
$$

Until a K3-style confluence certificate profile exists, `"certified"` must fail closed.

---

# 16. Candidate CDIR v0.3 Pressure

Run 129 suggests future support objects:

- confluence certificate block;
- critical-fork certificates;
- termination certificate reference;
- semantic-equivalence compatibility proof;
- canonicality profile ID.

Only then should:

$$
\boxed{
\texttt{canonicality="certified"}
}
$$

become kernel-acceptable.

---

# 17. Nonconfluence Is Not Necessarily a Bug

The fork:

$$
d_0\Rightarrow\varnothing
$$

versus:

$$
d_0\Rightarrow[d_1]
$$

may represent:

- an underspecified rule set;
- one rule being semantically too strong;
- one path using a stronger assumption;
- a genuinely noncanonical exploratory calculus.

The confluence probe detects the disagreement.

It does not decide which rule should survive.

---

# 18. Confluence Triage Debt

Run 129 introduces:

$$
\boxed{
\textbf{Confluence Triage Debt}.
}
$$

When legal paths diverge, one must determine whether to:

1. weaken/remove one rule;
2. add a join rule;
3. refine debt state so the two starts were not actually identical;
4. weaken canonicality to semantic equivalence;
5. accept noncanonical exploratory behavior.

---

# 19. Main Observed Result

For the explicit fork:

$$
\boxed{
\begin{aligned}
\text{Path A} &: \mathsf{Closed},\\
\text{Path B} &: \mathsf{Unknown}.
\end{aligned}
}
$$

Both are accepted as noncanonical valid traces by both verifiers.

Semantic divergence is detected.

Unsupported certified-canonicality claims are rejected by both verifiers after hardening.

---

# 20. Main Distinction

$$
\boxed{
\textbf{Trace Soundness}
\neq
\textbf{Global Confluence}
\neq
\textbf{Certified Canonicality}.
}
$$

---

# 21. Main Principle

$$
\boxed{
\textbf{Canonicality Fail-Closed Principle}
}
$$

A verifier may accept a valid closure trace without proving it canonical. If a package explicitly claims canonicality, the verifier must require machine-checkable confluence support or reject the claim.

---

# 22. RCIG Lesson

$$
\boxed{
\text{The first truly legal fork showed why confluence cannot be inferred from successful replay or differential verifier agreement. Canonicality is a global property of the rewrite system, not a decoration on one valid trace.}
}
$$

---

# 23. New Frontier

## Frontier QI — Machine-Checkable Confluence Certificates

Extend CDIR with explicit critical-fork and joinability proof objects.

## Frontier QJ — Rule Triage

Given a nonconfluent fork, can the debt compiler explain which rule assumptions create the divergence?

## Frontier QK — K3 Canonical Kernel

Implement the first verifier profile that can actually accept:

$$
\texttt{canonicality="certified"}.
$$

**Run 129 complete.**