# Cubie Topology Representation - Architectural Decision Document

Author of analysis: Claude Opus 4.8 (adaptive extended thinking)
Date: 2026-05-28 17:19
Walltime: 192.3s | Tokens in/out: 15786/13987 | Cost: $1.2858

---

## Final architectural decision document

# Cubie Trust-Admission Topology — Architectural Decision Document

**Scope:** finalization of the topology data representation across performance, formal-proof, deployment-class, and compliance axes.
**Status:** proposed — supersedes nothing; extends ADR-0001 (layout freeze) and ADR-0011 (proof-corpus-as-live-check precedent) by *addition only*.
**Proof band reserved:** `CUB-MATH-TOPO-2000`..`2099` per ADR-0011 supersession-by-add discipline.

---

## Executive summary — where the four axes pull apart (read this first)

The honest finding: **no single representation wins all four axes.** Two genuine conflicts exist, and I resolve both *against* the dimension that looks locally cleanest:

1. **Ternary-everywhere vs. pacemaker/datacenter.** Unifying the hot path on `Ternary`/`TopologyStateU128` is cleanest for compliance and recursion (FLUID/Void survive). But it doubles cycle cost (two `u64` popcounts + add) — which is *invisible* on Xeon AVX-512 (`VPTERNLOGQ` does it in 1 cycle) but **brutal on Cortex-M0+**, where `u128` is software-emulated and the 54-iter expansion loop in `Ternary::from_binary` is a real instruction budget against the <100 KB ceiling. Constant-time discipline on Sapphire Rapids also disfavors data-dependent two-limb paths. → **Resolved: ternary is canonical *storage*; bitboard is a derived *hot-path projection*, not a second source of truth.**

2. **56-cell expansion vs. the proof corpus.** Inline phantom cells are O(1)-clean for recursion and dual-ledger derivation. But ~1,180 theorems hard-code 54 cells / `(1<<108)-1` / 18-bit faces. Re-baselining `LATTICE_DIM`/`POLYTOPE_DIM` from 54→56 invalidates the Singmaster, seam, and telemetry families wholesale. The append-only contract makes that a four-figure CUB-ID event. → **Resolved against 56-cell. Use the 20 already-unused high bits (108..127) of the ternary `u128`, which every existing theorem already masks off via `TOPOLOGY_MASK`.**

Everything below follows from those two resolutions.

---

## Q1 — Unify on ternary, or keep dual representation?

**Decision: keep dual, but redefine the relationship.** `TopologyStateU128` (the ternary 108-bit word stored in `CubeFlit64::manifold[0..2]`) is the **single source of truth**. The 54-bit bitboard is a **memoized, proof-certified projection** (`TopologyStateU128::to_bitboard_u64`), not a parallel truth. This ratifies PR #87 / Option C and tightens it.

Why not full ternary-everywhere:
- `is_solved` / L2 admit-gate equality wants 1-cycle on the canonical path. On Xeon that's `VPTERNLOGQ`+`KORTEST` either way, but on M0+ the second `u64` limb is a measurable hit.
- Constant-time requirement on the datacenter tier favors the branch-free single-`u64` XOR-against-`SOLVED` over the two-limb compare-and-`AND`.

Why not pure bitboard:
- It collapses FLUID/FAIL/Void — fatal to **Concern 1(c)** (parent must distinguish child FLUID from child FAIL) and to **Concern 2** selective disclosure semantics.

**The contract that makes dual safe** (the cognitive-cost mitigation): the bitboard is only ever produced through `to_bitboard_u64`, never hand-rolled. We pin this with a new theorem family (Q4) proving:

> `to_bitboard_u64(t)` = high-bit-per-cell projection, and `is_solved_after_snap(t.to_u128())` ⟺ `popcount(to_bitboard_u64(t)) == 54 ∧ no cell is FLUID/Void`.

So the hot path runs on the projection; the cold path (Belnap classify, denial cert, ledger) reads the ternary truth. **Both are facts about the same stored word.**

| Axis | Verdict |
|---|---|
| Performance | bitboard hot path keeps 16.57 ns / 1-cycle equality |
| Proof | ternary stays the spec-corpus form (`belnap::classify_topology_failure` etc.) — zero spec rewrite |
| Deployment | M0+ never materializes ternary on hot path; Xeon does both for free |
| Compliance | ternary truth available for disclosure/recursion |

---

## Q2 — Expand 54→56, or use manifold flag bits?

**Decision: neither as stated. Use bits 108..127 of the ternary `u128` (the 20 already-unused bits) for the metadata sidecar, with overflow to `manifold[3]`.**

Rationale — the 56-cell option fails the proof axis catastrophically and gains nothing for pacemaker:
- `LATTICE_DIM = 54`, `POLYTOPE_DIM = 54`, `TOPOLOGY_MASK = (1<<108)-1`, `FACE_ALL_PASS = 0x2_AAAA`, `SOLVED_STATE_U128` (six 18-bit faces) are baked into the Singmaster pre-gate (CUB-1213/1214/1215/1216), seam-validity (CUB-1937..1944), and telemetry (CUB-1382/1432) families. Moving to 56 cells / 112 bits re-bases all of them. Append-only means *supersede every one by add* — order ~1,180 new CUB-IDs.

The 20 free high bits give us the phantom-cell benefit at zero geometric-theorem cost, because **`TOPOLOGY_MASK` already excludes them.** `is_solved_after_snap` does `(state ^ SOLVED_STATE_U128) & TOPOLOGY_MASK == 0` — it cannot observe bits ≥108. So the L2 equality "masks them out" *by construction*, satisfying Concern 3's masking requirement with no code change to the comparator.

**Metadata layout (bits 108..127, 20 bits):**

| Field | Bits | Width | Purpose |
|---|---|---|---|
| `recursion_depth` | 108..111 | 4 | nested admission depth, 0..15 (Concern 1, recursion proof) |
| `billing_class` | 112..115 | 4 | CUaaS SLA tier (Concern 2 billing) |
| `consent_version` | 116..123 | 8 | GDPR Art 30 / consent-log schema version |
| `disclosure_flags` | 124..127 | 4 | BBS+ selective-disclosure policy selector |

Parent-linkage cryptographic hash does **not** fit in 20 bits → it lives in `manifold[3]` (`flags_hi`), bound under `auth_hash`.

**The XOR-rotation isolation trade-off (stated honestly):** these high bits are *not* rotated by `epoch_rotation::rotate_topology` (which masks to 108 bits, CUB-1207e), so they don't get the topology XOR-rotation algebra's isolation. They instead get **HMAC integrity** by being inside the `auth_hash`/`capability_hmac` coverage. That's a deliberate downgrade: metadata wants *integrity + determinism*, not *rotation entropy*. We add a theorem (CUB-MATH-TOPO-2003) that metadata bits are rotation-invariant, so epoch rotation provably does not corrupt them.

---

## Q3 — Per-tier cycle budgets

Operations: **L2 equality** (`state ^ SOLVED & MASK == 0`), **bloom probe**, **HMAC fast-path**, **epoch derotation** (`rotate_topology` inverse, CUB-1207e).

| Op | Xeon SPR (AVX-512/AMX) | Cortex-A53 (NEON) | Cortex-M0+ (no SIMD) |
|---|---|---|---|
| **L2 equality (bitboard projection)** | **1 cyc** `XOR`+`TEST` on hot L1 line | 1–2 cyc (64-bit ALU; NEON not needed) | 1 cyc (single `u64`) ✅ this is why bitboard projection wins M0 |
| **L2 equality (full ternary, if forced)** | 1 cyc `VPTERNLOGQ`+`KORTESTQ` | 3–5 cyc (two NEON `D`-reg cmp+`AND`) | 10–20 cyc (software `u128`, two-limb) |
| **Bloom probe** | 1–2 cyc (`VPGATHERDD` / `kand`) | 4–6 cyc (scalar 2-hash) | 12–18 cyc (scalar mul-shift hash) |
| **HMAC fast-path** | ~SHA-NI: 4–6 cyc/block amortized | NEON SHA2 ext if present, else ~50+ cyc/block | **strip** (see Q6) — software SHA256 ≈ 600+ cyc/block, off hot path |
| **Epoch derotation** | 1–2 cyc (`VPROLQ`/`VPSHUFB`) | 3–5 cyc | 8–14 cyc (masked rotate over `u64`) |

**1-cycle reality check (per your note):** 1 cycle holds *only* for the equality compare against a **hot, cache-resident** `SOLVED` line. The full admit — 192-byte `CubeObjectV1` load (3 cache lines) + projection + bloom + HMAC verify + ledger store — is realistically **~50 cycles on SPR, ~150–250 on M0+**. The "1 cycle" is the equality micro-op, not the admit. Document it as such everywhere; do not let it leak into SLA copy.

---

## Q4 — Minimum proof-corpus migration cost

### Option chosen (20-high-bit metadata + bitboard-as-projection): **NEW theorems only, ZERO supersessions.**

**Stable (unchanged, no new CUB-ID needed):**
- CUB-1207e epoch rotation — operates ≤108 bits, masks high bits.
- CUB-1213/1214/1215/1216 Singmaster pre-gate — 18-bit-face arithmetic untouched.
- CUB-1382/1432 telemetry — wire format frozen.
- CUB-1937..1944 seam-validity — face indices unchanged.
- CUB-1860..1865 OPA event fingerprint — reads existing 5 fields (ADR-0011), metadata fields are *not* among them, so no change.

**New theorems to add (band `CUB-MATH-TOPO-2000+`):**

| CUB-ID | Claim | Kernels |
|---|---|---|
| `CUB-MATH-TOPO-2000` | `to_bitboard_u64` is the deterministic high-bit-per-cell projection; total over all `u128`. | Verus+Coq+Lean |
| `CUB-MATH-TOPO-2001` | Projection-solved equivalence: `is_solved_after_snap(t) ⟺ to_bitboard_u64(t)==SOLVED_BITBOARD ∧ ∀cell. cell∈{PASS}`. | V+C+L |
| `CUB-MATH-TOPO-2002` | `from_bitboard_u64 ∘ to_bitboard_u64` preserves PASS/FAIL; loses (provably) only FLUID/Void — documents the lossy direction. | V+C+L |
| `CUB-MATH-TOPO-2003` | Metadata bits (108..127) are invariant under `rotate_topology` and masked out of L2 equality. | V+C+L |
| `CUB-MATH-TOPO-2004` | Recursion-depth monotone-decrease ⇒ admission nest terminates (Q-recursion proof). | Coq/Lean (well-foundedness) |
| `CUB-MATH-TOPO-2005` | Dual-ledger derivation is a pure function of `(ternary, per-cell key)` — no external state. | V+C+L |
| `CUB-MATH-TOPO-2006` | BBS+ disclosed set = `binary_view` bits; FLUID/Void are *not* derivable from the disclosed commitment (zero-knowledge of internal cells). | Coq + Lean |

**Cost:** ~7 new triple-kernel theorems (~21 kernel artifacts). Compare to **56-cell: ~1,180 supersessions.** Decision is forced by ADR-0011 append-only economics.

---

## Q5 — Smallest stable Python/JSON surface (FastAPI middleware, non-cryptographer)

Goal: the middleware writer never touches ternary, keys, or BBS+. They call one function, get a verdict plus three opaque receipts.

```python
# cubie_ffi.pyi  — cdylib surface, all bytes are opaque base64 to the caller

class AdmitVerdict(TypedDict):
    allow: bool                  # AdmitResult::Allow == 0x5A5A5A5A
    output_state: int            # u32 reason code (DenyTopology, etc.)
    faces_passed: int            # 0..6  (from AdmitAttestation)
    # NO ternary, NO FLUID/Void exposed at this tier

class AttestationEnvelope(TypedDict):
    schema: str                  # "cubie.attest.v1"
    tee: Literal["tdx","cca","sev-snp","none"]
    quote_b64: str               # ITA v2 composite or local-KBS quote
    topology_commit_b64: str     # BBS+ commitment over full ternary
    disclosed_bits_b64: str      # binary_view (PASS/not-PASS) only

class LedgerReceipt(TypedDict):
    consent_entry_b64: str       # BBS+/ZKP, GDPR Art 30
    billing_entry_b64: str       # OpenBao-sealed CUaaS
    oscal_envelope_b64: str      # SOC2/ISO27001/Annex IV
    receipt_root: str            # deterministic hash binding all three

def admit(request_envelope: bytes) -> tuple[AdmitVerdict, AttestationEnvelope, LedgerReceipt]:
    """request_envelope is exactly 192 bytes (CubeObjectV1). Pure function:
    same bytes -> same verdict + same receipts, bit-for-bit. No clock, no RNG."""

def build_envelope(*, adapter_id: int, sequence_id: int,
                   payload_sha256: bytes, prompt_topology_b64: str) -> bytes:
    """Helper: assemble a 192-byte CubeObjectV1 from gateway context.
    Streaming-compatible: call once per request, before first token."""
```

Stability guarantees to the writer: **only `admit()` and `build_envelope()` are stable.** The three TypedDicts are additive-only (new optional keys, never removed). All cryptography is below the FFI boundary.

---

## Q6 — Bare-metal pacemaker contract (Cortex-M0+, <100 KB, IEC 62304 Class C)

**Minimum-viable admit (MVA) = three checks, all branch-light, all `u64`-domain:**

1. **L2 equality** against `SOLVED_STATE_U128` projected to bitboard — single `u64` XOR+test (1 cyc). This *is* the trust verdict.
2. **Epoch freshness** — `epoch_fresh()` / `expiry_cycle_count()` compare (CUB-1207e derotation, masked rotate, ~10 cyc).
3. **Singmaster parity pre-gate** — `fast_evaluate_parity`: 8× 3-bit field sum mod 3. Cheap (~20 cyc), high deny-power, no tables. **Keep.**

**Stripped on M0+:**
- **HMAC (`capability_hmac`)** — software SHA256 ≈ 600+ cyc/block blows the deterministic-WCET and code-size budget. Replace with **boot-time-provisioned PUF/eFuse equality** (`puf_hash_expected()` compared to `efuse_raw_bits`) — a memcmp, not a keyed MAC. The device's identity is its silicon, not a runtime key. (For ASIL-D ECU tier, HMAC-SHA256 in-tree returns; aws-lc-rs FIPS only on edge/datacenter/TEE tiers.)
- **Belnap `classify_topology_failure`** — cold-path only; the pacemaker emits a *binary* deny, not a 4-valued classification. Belnap stays linked on industrial+.
- **BBS+ / OSCAL / Intel PT** — no ledger on the device; the pacemaker emits a 6-field `AdmitAttestation` (the ADR-0001 struct, 6 fields exactly) that an *upstream* gateway expands into the dual ledger. The device is a verdict source, not a ledger writer.
- **Ternary materialization** — never. M0+ stays in `manifold[0..2]` bitboard projection. `Ternary::from_binary`'s 54-iter loop is *not* called on hot path.

**Code-size estimate:** projection + equality + parity + epoch + PUF memcmp + the frozen `AdmitAttestation` builder ≈ **40–60 KB** with `panic=abort`, `no_std`, no alloc. Comfortably under 100 KB.

---

## Q7 — Datacenter Sapphire Rapids contract

**Realistic per-admit, AVX-512 + AMX-int8 + MOVDIR64B:**

| Stage | Cycles | Note |
|---|---|---|
| `CubeObjectV1` load (192 B = 3 lines) | ~12 | L1-hot; prefetch hides most |
| Projection + L2 equality | 1 | `VPTERNLOGQ`+`KORTESTQ` |
| Bloom / OPA fingerprint (CUB-1860) | 2–3 | 5-xor + 4-rotate, branchless |
| HMAC verify (SHA-NI) | 8–12 | one-block capability |
| Singmaster + seams (CUB-1213.., 1937..) | 4–6 | SIMD lane-parallel |
| Ledger store (`MOVDIR64B`) | ~6 | **64-byte atomic store, bypasses cache → no RFO, no MESI eviction** |
| **Total** | **~35–45 cyc ≈ 11–14 ns @ 3.2 GHz** | beats 16.57 ns |

**Where we beat 16.57 ns:**
- `MOVDIR64B` writes the 64-byte `CubeFlit64`-shaped ledger fragment without read-for-ownership — removes the coherence round-trip that dominated the old store path. **This is the single biggest win.**
- **AMX-int8** for the **8-cube batched Belnap meet** (the HB-18.2 "xmm-register-sized `Ternary`" path): 8 admissions' worth of `resolve_snap` (`state_a & state_b`) as one tile op — amortizes ternary cost to *sub-cycle per cube* on shard-fan-in. This is the *only* place full ternary runs on a hot path, and AMX makes it free.

**SmartNIC (Mt Evans / IPU) headroom split:**
- On the **IPU**, the ~5 ns headroom goes to **XDP/DPDK flow-classification + line-rate (200 Gbps+) batching** — the gate runs inline on the NIC datapath, host CPU never sees denied flows.
- On the **bare-metal host**, headroom goes to **constant-time enforcement** (no data-dependent branch in the comparator) and to **MESI-coherent atomic shard updates** — the host can afford the coherence cost the NIC cannot.

---

## Q8 — OSCAL + EU AI Act Annex IV envelope; selective disclosure without breaking BBS+

**Field classification:**

| Topology data | Annex IV / Art 12 record-keeping? | Disclosure |
|---|---|---|
| `binary_view` bits (PASS / not-PASS per cell) | **YES** — the "decision outcome" record | Disclosed to regulator |
| `faces_passed`, `seams_passed`, `vertices_passed` | **YES** — decision-quality metrics (Art 13 transparency) | Disclosed |
| FLUID cells (0b11) | **NO** — "not-yet-resolved" internal state, not a decision | Internal only |
| Void/TAMPER cells (0b00) | **NO** — fault-detection internal | Internal only |
| Metadata bits 108..127 (`consent_version`, `billing_class`) | `consent_version` YES (GDPR Art 30); `billing_class` NO | Selective |

**Selective disclosure mechanism (the BBS+-safe path):**

1. At admit, commit to the **full 108-bit ternary** under a BBS+ signature (one message per 2-bit cell, plus metadata-field messages).
2. The OSCAL envelope discloses **only the `binary_view` projection** (`to_bitboard_u64`) + the aggregate counters.
3. **CUB-MATH-TOPO-2006** is the load-bearing proof: because `binary_view` maps both PASS→1 *and* FLUID→1, and both FAIL→0 *and* Void→0, the disclosed bit for any cell is **information-theoretically consistent with two ternary values**. A regulator verifying the disclosed bits against the BBS+ commitment **cannot distinguish PASS from FLUID, nor FAIL from Void** — selective disclosure of the binary projection provably *does not leak* the 4-valued internal state. The commitment stays intact (BBS+ unlinkability preserved); the regulator gets a verifiable decision outcome.
4. **Intel PT fragment** (TDX) records the *control-flow* of the admit (which gate fired) — bound to the OSCAL envelope by `receipt_root`, sealed under TDX measurement. It is internal forensic data, not disclosed by default.

This is exactly why bitboard-as-projection (Q1) and the lossy-direction proof (CUB-MATH-TOPO-2002) matter: the *loss* in `to_bitboard_u64` is the *privacy mechanism* for regulator disclosure.

---

# Deliverable Sections

## A. Proof-corpus migration plan & CUB-ID allocation

- **No supersessions.** All foundational families (CUB-1207e, 1213–1216, 1382/1432, 1860–1865, 1937–1944) remain valid because the metadata lives above `TOPOLOGY_MASK` and the hot path uses a *certified projection* of the existing word.
- **Allocate `CUB-MATH-TOPO-2000`..`2006`** (7 triple-kernel theorems, table in Q4) under ADR-0011 append-only.
- **Live-check wiring** (per ADR-0011 precedent): each new theorem gets a runtime `exec_fn` reference — `to_bitboard_u64` (already exists), a metadata-mask assert in `rotate_topology`, and a ledger-derivation reference in admit. Ship behind a `topo_meta_v1` feature flag, default-OFF, flip after bench (≤3 ns regression on 50k workloads, matching the Singmaster/OPA precedent).
- **ABI:** `CubeObjectV1` stays 192 B, `CubeFlit64` stays 64 B. `types.rs.sha256` re-bases as a **deliberate commit** only when the metadata accessors land — accompanied by an **ADR-0012** superseding the relevant clause of ADR-0001, per its own change procedure.

## B. Deployment-tier matrix (one byte layout everywhere)

**Invariant:** every tier operates on the *identical* 192-byte `CubeObjectV1` / 64-byte `CubeFlit64`. Topology = `manifold[0..2]` ternary `u128`, metadata in bits 108..127, flags in `manifold[3]`.

| Tier | Target | Code | Hot-path budget | Topology ops | Crypto | Ledger |
|---|---|---|---|---|---|---|
| Pacemaker | M0+/RV32I, no MMU/alloc | <100 KB | ~150–250 cyc full / 1 cyc eq | bitboard projection only | PUF/eFuse memcmp | none (emits `AdmitAttestation`) |
| Industrial ECU | M4F/RV32IMC, heapless | ~1 MB | deterministic WCET | bitboard + Belnap classify | in-tree HMAC-SHA256 | local billing buffer |
| Edge AI | A53/A72 / Atom bare-metal | full static | 3–5 cyc eq | NEON/SSE projection + ternary cold | aws-lc-rs FIPS | OSCAL + consent |
| Datacenter | Xeon SPR | full | ~11–14 ns full | AVX-512 + AMX-int8 batch ternary | SHA-NI | MOVDIR64B all 4 ledgers |
| AI gateway | Python cdylib | 1–10 ms tolerant | gateway-bound | projection via FFI | aws-lc-rs FIPS | JSON attestation + dual receipt |
| Confidential VM | TDX/CCA/SEV-SNP | full | + attestation cost | as datacenter | ITA v2 / local KBS | + Intel PT fragment |

## C. Dual-ledger derivation spec (pure function)

```
derive_ledgers(t: Ternary, k: PerCellKey) -> LedgerBundle
  // pure: no clock, no RNG, no external state.  CUB-MATH-TOPO-2005.

  b        := to_bitboard_u64(t)              // disclosed projection
  meta     := (t.as_u128() >> 108) & 0xFFFFF  // recursion/billing/consent/disclosure
  counters := {faces, seams, vertices} from evaluate_topology_bitboard(b)

  consent_entry  := BBS+_commit(per-cell messages of t, k)         // GDPR Art30
                    .disclose(b ∪ counters ∪ consent_version)      // CUB-..2006
  billing_entry  := OpenBao_seal( (billing_class, counters, seq) ) // CUaaS
  oscal_envelope := OSCAL_assess( b, counters, consent_version )   // Annex IV
  pt_fragment    := TDX ? IntelPT_quote(control_flow_hash) : ∅

  receipt_root   := H(consent_entry ‖ billing_entry ‖ oscal_envelope ‖ pt_fragment)
  return { consent_entry, billing_entry, oscal_envelope, pt_fragment, receipt_root }
```

Determinism: every output is a function of `(t, k)` and the static `SOLVED_STATE_U128`. Same envelope ⇒ byte-identical bundle (OSCAL sealing requirement). Atomicity: the 64-byte fragment is committed via `MOVDIR64B` on the datacenter tier.

## D. Cube-recursion termination proof sketch (CUB-MATH-TOPO-2004)

**Setup.** A nested admission is a tree. Each node carries `recursion_depth d ∈ 0..15` in bits 108..111 of its own ternary word. A parent admitting a child requires `child.depth == parent.depth - 1` and `parent.depth ≥ 1`.

**Termination (well-founded recursion on ℕ):**
1. The recursion-step relation strictly decreases `d` (child.depth < parent.depth), enforced at admit-time and pinned by CUB-MATH-TOPO-2003 (depth bits are rotation-invariant, so an epoch rotation cannot reset depth).
2. `d` is bounded below by 0 (a 4-bit field, `d=0` ⇒ leaf, no sub-cube admission permitted).
3. `<` on the bounded interval `[0,15]` is well-founded ⇒ no infinite descending chain ⇒ **every admission tree has finite depth ≤15.**

**Envelope-blowup bound (Concern 1a).** Children are *not* nested inside the parent's 192 bytes. The parent's `manifold[3]` holds `H(child_envelope)` (parent-linkage hash). N levels ⇒ N independent 192-byte envelopes linked by hash chain, **O(1) bytes per level, O(N) total — no N-fold blowup.**

**Parent equality stays 1-cycle (Concern 1b).** The parent's L2 equality reads only its own `manifold[0..2]` masked by `TOPOLOGY_MASK`; child state is in separate envelopes. Child existence is invisible to the comparator → still 1 cycle.

**Child FLUID ≠ child FAIL from parent (Concern 1c).** The parent reads the child's *ternary* word (cold path) when classifying delegated outcome — FLUID (0b11) and FAIL (0b01) are distinct cells, preserved exactly because storage is ternary (Q1). Bitboard projection is used only for the parent's *own* hot-path verdict, never to summarize the child.

## E. Three concrete rejected alternatives

1. **Full ternary on the hot path (unify everywhere).** Cleanest semantically; rejected because the two-limb compare-and-`AND` is 10–20 cyc on Cortex-M0+ (software `u128`) and the `Ternary::from_binary` 54-iter expansion threatens the <100 KB / deterministic-WCET budget. Also disfavored by constant-time discipline on SPR. *Mitigated, not adopted:* AMX-int8 makes batched ternary free on Xeon, but that's a shard-fan-in path, not the per-admit hot path.

2. **56-cell expansion (7×8 / 54+2 phantom).** O(1) recursion + ledger inline; rejected because it re-bases `LATTICE_DIM`/`POLYTOPE_DIM`/`TOPOLOGY_MASK`/`FACE_ALL_PASS` and forces ~1,180 append-only supersessions across CUB-1213–1216, 1937–1944, 1382/1432, 1207e. The 20 unused high bits deliver the same capability at 7 new theorems. The only thing 56-cell adds — XOR-rotation isolation for metadata — is unwanted (metadata wants HMAC integrity + determinism, not rotation entropy).

3. **Recursion/metadata in `manifold[2]+manifold[3]` flag bits (your alternative Q2 path).** Viable and more flexible, but rejected as the *primary* home because it scatters topology-semantic metadata outside the topology word, complicating the single-pure-function ledger derivation (Concern 2's "deterministic function of topology") and the CUB-MATH-TOPO-2005 proof (it would have to range over two non-adjacent words). We keep `manifold[3]` strictly for the **parent-linkage hash overflow** (which is genuinely not topology), and put recursion/billing/consent in the topology word's high bits where the derivation proof is clean.

---

## Conflict ledger (explicit, per your instruction)

| Conflict | Axes pulling apart | Resolution |
|---|---|---|
| Ternary cost | compliance/recursion ⟂ pacemaker code-size + datacenter constant-time | ternary = storage truth; bitboard = certified hot-path projection (Q1) |
| 56-cell cleanliness | datacenter/compliance O(1) ⟂ 1,180-theorem proof corpus | reject 56; use masked high bits (Q2) |
| 1-cycle aspiration | SLA optics ⟂ physical reality (192 B load + ledger write) | 1 cyc = *equality micro-op only*; full admit ~50 cyc SPR / ~150–250 M0+ — flagged everywhere (Q3, Q7) |
| HMAC everywhere | datacenter FIPS ⟂ pacemaker WCET/size | tiered crypto: PUF/eFuse on M0+, HMAC on M4F+, FIPS aws-lc-rs on edge+ (Q6) |

The chosen path is the one that survives **all four** binding constraints simultaneously: it adds 7 theorems (not 1,180), fits 40–60 KB on M0+, beats 16.57 ns on SPR via MOVDIR64B + AMX, and makes the lossy bitboard projection *itself* the GDPR/Annex IV selective-disclosure mechanism.
