# Recorded fetch to indirect-control dependency

Register-source CMOV can pass body projection only through the complete byte-bound dead-destination-frame exception documented in [STATE_PROJECTION](STATE_PROJECTION.md). It preserves flags and all raw provenance. Live conditional results, memory-source forms and RIP-relative data remain outside this exception. A successfully projected body can still be partial when saved status is unknown; no recorded flag value is injected to make it pass.

`ig5_profile` has a separate read-only recovery mode:

```json
{"recovery":{"flow":{"roles_ref":{"id":"ROLE_REPORT_UUID","sha256":"EXACT_ROLE_REPORT_SHA"},"target":"C:/explicit/existing/same-sha-target.exe"}}}
```

The role report must be a committed `vm-address-roles` report in the configured analysis-data store. Its hash is checked against committed metadata and the exact stable bytes. Its candidate flags remain hypotheses. All original debug-trace reports/blobs, target identity, run/thread/pause/GPR/flags continuity and the complete supplied recording are revalidated. max_instructions retains 50000 default / 100000 explicit. This mode cannot mix other recovery/profile modes, accept a decoder override, or accept caller proof objects.

The earliest retained changing-address narrow-load candidate selects the source stop. A data worker retains every following stop up to 128 groups / 128 distinct PC+byte sites, while validating the rest of the input too. Missing/coalesced intermediate state, rejected decoding and an absent indirect control within this budget are explicit refusals. The pinned disassembly-only job identifies the first indirect JMP/CALL/RET. No manually supplied handler address is needed.

The caller supplies an existing raw AMD64 PE. Its SHA must equal the recording target. Every selected opcode must map uniquely to byte-identical executable file data using the actual recorded runtime base and the file's own preferred base. Missing/quarantined files are not restored; loaded-image metadata is not substituted for a raw file, and runtime PCs are not guessed into file coordinates. The checked file snapshot becomes an immutable analysis blob; a change to the original path cannot change the later stages.

Using that snapshot, the original owned two-slot Java route derives a complete selected-path projection and an independent first-instruction projection. Both retain all 16 initial/final GPRs, coherent initial/final byte memory and all ordered stores. The two views share only their explicit initial-state meanings for structural signature comparison; their states are not composed. All source byte/pcode bindings and full reports remain available. The flow deadline is at most 60 s across stages; each child retains the original single-process Job / 2 GiB / shared 50 s limits and same-nonce cleanup ACK plus actual root exit. The union of selected instruction sites is at most 128; decoded/projected logical instructions stay within 1024. This route never invokes blocked headless or native SLEIGH.

The classifier locates the first projection's unique narrow LOAD in the full projection by a canonical structural signature, independent of node numbering. It checks whether that load reaches the terminal target and whether it influences another load's address on the way. Unrelated nearby reads are classified as absent from the target expression. All memory writes and ordinary program ambiguity remain visible. Expression previews use topological bounded strings (2048 characters each) with explicit truncation flags, avoiding exponential expansion of shared DAGs.

The default is a **structural SSA dependency**, not semantic nonconstancy. For example, an unoptimized `x XOR x` index can still contain an input structurally. Ordinary switch tables and return trampolines can also have a positive graph. Without the explicit assessment below, semanticNonconstancyProved stays false. vmRoleProved, instructionSemanticsProved and businessAccepted always stay false. Full CPU flags, code/data coherence, phases/epochs, alternate inputs, ISA/program recovery and complete business/path coverage remain separate obligations. No recorded value is substituted into the symbolic source expression.

## Optional paired ordinary-state assessment

Add `"semantic_check":true` to the same flow object. Only an actual Boolean is accepted; no caller SMT, proof objects, decoder selection, extra target execution or budget increases are introduced. The default dependency schema remains unchanged. The opt-in report uses `ig5-fetch-control-assessed-v1` and links the full semantic assessment, query/model blobs and independent replay.

Two ordinary IR states share all 16 initial GPRs and every independent opaque input. The second initial byte memory is exactly a little-endian store into the first state's source LOAD address. That address must be independent of RAM and opaque outputs. Both worlds retain the complete typed source DAG, all 16 final GPRs, initial/final memory, target and all ordered STORE roots. LOADs are not cut or made free, and memory aliasing remains coherent.

For each of at most four source-indexed target LOADs, the fixed checker first establishes satisfiable source-variation premises, then asks whether its address can change. Other LOAD values in the index expression are coupled. It separately checks satisfiability of target premises before asking whether the target can also change, coupling other target LOAD values as listed. UNSAT has only that query's stated scope; unsatisfiable premises are not treated as invariance. `unknown`, unsupported operations (including unused definitions), exhausted budgets and invalid witnesses remain unverified. More than four candidates leaves explicit incomplete candidate coverage.

The pinned Z3 DLL runs only in the existing owned single-process Job. Each query retains 2 seconds / 512 MiB, at most 128 queries, 1 MiB/query, 2048 encoded forms, 8192 tokens and depth 128. Query/model files plus result share 4 MiB; the entire flow still shares 60 seconds and the original two slots. Exact attempted queries and failed model results are retained. No old proof helper, runtime pins or approval gates are changed.

Every accepted SAT query supplies a finite initial-memory/GPR/opaque witness. An independent BigInt data worker replays both states, checks the exact source-byte mutation and listed LOAD couplings, and evaluates all ordinary final-state/memory/STORE roots. Missing RAM, bad identities, tampered roots or uncovered SAT queries refuse acceptance. At most 256 initial-memory byte observations and 4096 memory visits are allowed per paired witness; the original 64 MiB / 15 s data-worker limits apply.

`semanticNonconstancyProved:true` is accepted only with a replayed target-change witness and an adjacent `semanticNonconstancyScope`. It means existence of paired selected-path **ordinary IR** states with source-byte, indexed-address and target variation. It does not establish exclusive mediation through that indexed read, native reachability, code/data coherence, CPU semantics, VM roles or business recovery. Solver witnesses are hypothetical ordinary states, not new native recordings or input/path coverage. Ordinary switch/return ambiguity remains.

Regression: `test:flow-semantics` covers bounded model parsing, unknown/error preservation, conditional model reads and public Boolean validation. `scripts/test_flow_semantics_runtime.mjs --plugin-root ROOT --evidence FRESH_DIRECTORY` explicitly exercises the owned pinned solver on synthetic IR: positive, canceled index, canceled target, unrelated target, unsupported unused node, plus witness/provenance tampering. The genuine offline pipeline accepts `--semantic-check`; source, installed and actual configured-model evidence must be recorded separately.

## Diverse source-target pair pages

Set `sample_strategy:"distinct-source-targets"` in `recovery.recurrences`, with optional `pair_offset:0` (0..255), to select the first complete occurrence for each of eight distinct observed source/target pairs in first-appearance order. Later pages use `nextPairOffset`. Default `first4-last4` keeps the existing full report shape and committed historical references; it accepts no pair offset. No caller addresses, target paths, scripts, proof objects or opaque values are introduced. `handlers` recomputes and preserves the strategy of its committed recurrence source.

The inventory computes only the source address from a pure initial-GPR subgraph of the original typed DAG and matches exact-width native read observations. It does not infer a value from RAX or the target, use later bytes, fill missing RAM or evaluate a whole instruction path per inventory row. Missing/conflicting reads, RAM/opaque-dependent addresses and unsupported source definitions remain unobserved. Every original window and descriptor match is still scanned. At most 256 source/target pairs are tracked; unindexed occurrences and lower-bound status remain explicit. The full list is in the hash-bound report; public previews contain at most the selected eight pairs and state their completeness.

Only selected paths receive ordinary final-state/ordered-STORE checks; a first failed instance is retained rather than replaced with a later success. Existing eight-path/128-site/1024-logical, 256 KiB snapshot and 4096 memory-visit limits, 64 MiB/15 s data worker, 60 s request and all native/solver budgets remain unchanged. Different observed pairs are candidates, not recovered opcodes, VM instances, phase or business coverage. New tests: `test:flow-pairs`; the independent raw parser in `verify_vm_flow_recurrences.py` checks both strategies. Real historical data, source/installed SDK and actual configured-model acceptance remain separate.

`scripts/test_flow_pair_sampling_runtime.mjs --plugin-root ROOT --source-flow REPORT --sha256 SHA --recording-artifacts ORIGINAL_ROOT --pair-offset 0 --evidence FRESH_DIRECTORY` is an explicit data-only committed-flow acceptance; `--expected-pairs N` optionally binds a fixture expectation. It requires a nonempty ordinary-consistent selected page, verifies the full report SHA, and checks that no lifter was created. It reads no PE and runs no native analysis/debug job. Use original report/blobs and original per-request input limits; research ledgers spanning separate batches are not single-request whole-execution certificates.

## Recorded handler bodies

`ig5_profile` also accepts a separate `recovery.handlers` object with `recurrences_ref:{id,sha256}`, an explicit existing same-SHA raw PE `target`, and optional original `max_instructions`. No caller addresses, opcode labels, code, proofs or opaque values are accepted. The host rechecks the committed recurrence/flow/full/prefix/window reports, reloads every original recording and recomputes the recurrence before selecting bodies automatically. Each selected dispatch occurrence extends from its observed target through the next exact fetch head. The next fetch may be a partial recorded suffix; changed/coalesced heads, missing states, repeated PCs or absent boundaries remain unverified.

At most eight bodies retain 128 groups and 256 KiB each. Unique executable raw-byte mappings and a fixed immutable PE snapshot precede pinned disassembly and Java opaque-status full-state projection. Distinct decoding sites and projected instructions together retain the original 128-site / 1024 logical budget, original two owned slots, 2 GiB / 50 s single-child Jobs, same-nonce ACK plus actual root exit, and 60 s overall deadline. Pure selection/assessment workers retain 64 MiB / 15 s and queue four. No target is executed, database opened/modified or blocked component retried.

The finite checker preserves every GPR, complete typed DAG, byte-memory chain and ordered STORE, including overwritten writes. Only exact E9/EB and terminal short/near Jcc control PCs are compared in recorded coordinates. Original runtime GPR/data/RAM and preferred-coordinate source constants remain unchanged. CALL, PC-bearing data, unmodeled FS/GS data, unsupported ordinary instructions and intermediate conditional control are refused. Both conditional successors remain in the full projection; only the observed successor is numerically checked.

Missing/conflicting initial RAM or known-state mismatches refuse consistency. An unknown saved-status value remains unknown in its GPR and STORE roots. Bytes first read after unknown writes are neither checked as known nor seeded into initial RAM. Such a body is `partially-consistent-unknown-preserved`, with exact matched/unknown inventories, rather than fully consistent. No observed flag/register is inserted as an opaque input. Known saved-status overlays remain in the original DAG; full architectural status is not verified. Ordinary root consistency does not establish CPU/fault/write completeness, role/ISA, phase/SMC epoch, new native input coverage or full business semantics.

Regression: `test:vm-handlers` exercises aliasing, true/false conditional successors, unknown status, missing/conflicting RAM, relocation refusals, dead definitions, omitted stores, whole-input boundary scans, cancellation and output tampering. `scripts/test_vm_handlers_runtime.mjs` explicitly checks the genuine historical 3.11 Ultra recording through the real Java route. `scripts/verify_vm_handlers.py` independently reparses the raw recording, validates whole typed DAGs and numerically compares all known roots without assigning unknown values or reading the PE. The old proof helpers/pins are unchanged; its isolated validator view checks the exact equal-width ones-complement identity for INT_NEGATE. Source, installation/SDK and configured-model results remain separate. These records do not qualify exact VMP3.8 or establish complete business recovery.

The equal-width `INT_NEGATE` evaluator implements bitwise ones complement, distinct from arithmetic negation, following the [Ghidra p-code operation reference](https://ghidra.re/ghidra_docs/languages/html/pcodedescription.html).

## Recorded recurrences and ordinary final-state consistency

The following recurrence mode is data-only. The separate handler mode below additionally reads a same-SHA raw PE and runs owned static Java projection.

After a committed structural or assessed flow, continue with:

```json
{"recovery":{"recurrences":{"flow_ref":{"id":"FLOW_REPORT_UUID","sha256":"EXACT_FLOW_REPORT_SHA"}}}}
```

This is a separate read-only mode of `ig5_profile`. It accepts only the committed report reference and optional `max_instructions`. It verifies committed metadata, stable report bytes and linked full/prefix/window hashes, then reloads and validates every original recording. No PE is read and no native analysis/debug job starts. This request retains 60 s, the original single 64 MiB / 15 s data worker with queue four, 1..256 windows / combined raw+sidecar 16 MiB, and 50000 default / 100000 explicit instruction bounds.

The descriptor contains at most 128 unique runtime PCs with exact recorded bytes and their original preferred-coordinate mapping. Its matcher scans all groups, counting complete paths, diverging code/control paths, coalesced source events, changed bytes at the source PC and an unfinished capture suffix. Input validation continues beyond selected samples and capture limits. It selects the first four and last four complete paths, deduplicated, at most 1024 logical groups. Each path retains at most 256 KiB of snapshots; an oversized selected path stays unverified, while complete descriptor counting continues. Matching all descriptor bytes does not establish ordinary state consistency for every match.

For each selected path, the entire typed ordinary DAG is checked, including unsupported unused definitions and the complete STORE inventory. Initial RAM contains only observed bytes not already covered by an earlier decoded STORE. Conflicting observations or missing bytes refuse consistency; no zero/pattern fill or future observation repairs an unavailable STORE dependency. All ordered decoded STORE address/value/memory definitions are evaluated at their instruction position. Later observations in those locations must equal the coherent overlay and are not misrepresented as initial bytes. The checker compares all 16 final GPRs, the terminal target and the final decoded memory overlay. Each replay retains 4096 memory visits and at most 4096 finite initial bytes. Unknown opaque values are not inferred from observed registers or flags.

The report explicitly separates complete-input structural validation, full descriptor matching and the selected paths' ordinary final-state checks. Intermediate GPR semantics, full flags/CPU behavior, actual write causality/completeness and code/data coherence remain unproved. Source-address input deltas, non-source table inputs and source/target value pairs are observations with unassigned roles; they are not automatically named VIP, context or dispatch. One recorded run does not prove distinct VM instances or independent input coverage. Module/memory epochs stay unknown, and ordinary buffer parsers, jump tables and return trampolines remain competing explanations.

`test:flow-recurrences` covers source corruption beyond selected rows, divergent/code-changing paths, missing/conflicting RAM, post-STORE mismatch, all-GPR comparison, live opaque inputs, unsupported/malformed unused definitions, omitted STOREs, capture quotas, overlapping restarts, cancellation, report/source hashes, committed reference plumbing and host output tampering. The fixtures remain synthetic in temporary test stores; they are never imported as real native evidence. `scripts/test_vm_recurrences_runtime.mjs` explicitly checks genuine historical records against the installed or source package. `scripts/verify_vm_flow_recurrences.py` independently reparses raw recordings and evaluates the original typed IR numerically without JavaScript or missing-byte fill; unsupported native store sidecars refuse that independent audit. Source, installed SDK, genuine data and actual configured-model acceptance are recorded separately.

Regression: `node --test scripts/test_vm_fetch_flow.mjs`. Explicit offline genuine Ultra pipeline: `scripts/test_vm_flow_runtime.mjs`. `scripts/verify_vm_flow_observations.py` independently reparses source recordings and checks numerical final GPR/control/store consistency under recorded initial-read assumptions; bytes first read after a decoded store are not forced into initial memory. This is a recorded-state check, not a universal CPU proof. Synthetic DAG controls, actual pinned disassembly/Java processing, recorded-state consistency, installed SDK and actual configured-model acceptance are distinct evidence levels. The current genuine Ultra evidence belongs to the existing official 3.11 Demo fixture, not a qualified exact 3.8 sample. The quarantined Enigma file is not opened by these tests.