Split proof consumes module custody across unrelated inventory surfaces

Context

Epic #17500 requires the zero-residue inventory and paired plane-boundary proof before relocation. ADR 0040 is now Accepted and assigns two different jobs:

1. §2.4 receipt 1: the extraction inventory owns exact executable/command/workflow/config surface membership and reconciles it against disk.
2. §2.4 receipts 2–6: the isolation proof consumes that authority to test install, static reach, runtime denial, the Cloud control, and computed imports.

The current proof crosses those jobs. At ai/scripts/diagnostics/agentOsPlaneBoundaryProof.mjs:934 it builds:

new Map(inventory.rows.map(row => [row.identity, row.disposition]))

That discards row.surface, even though the inventory's own rowKey(surface, identity) exists specifically to prevent same-path cross-surface collisions.

Current evidence:

• the inventory governs 163 script-module rows;
• the repository tracks 766 ai/**/*.mjs modules;
• the static proof walks every module reached from Edge launch roots;
• the exact proof at 27f91c2641 is source-bound with zero instrument errors and reports one aggregated topology-edge-closure-unregistered-module blocker for 290 reached modules;
• ai/graph/storage/SQLite.mjs can be classified Cloud because a same-path plane-opener row exists, not because script-module custody says Cloud.

Reachability is observation, not placement authority. ADR 0040 §2.4 requires dispositioned surfaces, not one custody row per reached module; §2.7 requires exact-identity custody and forbids directory/path intuition from choosing ownership.

This is a successor to the delivered inventory/proof producers #17525, #17533, and #17645. Reopening them would rewrite their completed contracts.

The Problem

The static proof currently collapses two different nulls:

• governed module surface: an explicit script-module row may classify the module as Edge, Cloud, shared, stays-engine, or retire;
• module reached only as a dependency: no script-module row exists because the inventory never claimed that source as an executable surface.

Treating the second as missing custody manufactures a 290-module blocker ADR 0040 does not require. At the same time, consuming every bare identity lets an unrelated plane-opener, launch, config, or workflow row classify module custody accidentally.

The result is doubly unsound: false missing-authority findings and false positive authority from string collisions.

The Architectural Reality

• agentOsExtractionInventory.mjs owns surface membership and already reconciles disk-minus-authority / authority-minus-disk using rowKey(surface, identity).
• SURFACE.scriptModule is the only current surface whose disposition answers module custody for the static proof.
• SURFACE.planeOpener classifies the opening concern, not the whole file; its own JSDoc says so.
• Static closure still independently owns Cloud-package imports, out-of-plane escapes, unresolved-edge instrument failures, and explicit Edge→Cloud findings where a governed module row exists.
• ADR 0040 §2.2 makes the registry authoritative for the list and the ADR authoritative for admission. It does not authorize blanket ai/** module placement.
• The scoped structure map reports the existing diagnostic siblings: agentOsExtractionInventory.mjs (1189 code LOC), agentOsPlaneBoundaryProof.mjs (550), their registry JSON, and existing focused specs. No new file or directory is needed.

Intended Solution

Repair proof 2 so it consumes proof 1's authority without re-deriving or widening it:

1. Preserve the inventory surface in the proof lookup using rowKey(SURFACE.scriptModule, identity) or an equivalently explicit script-module map.
2. Only an explicit script-module row may classify module custody.
3. A reached module with no script-module row remains outside the custody classifier and must not become a missing-inventory blocker. Retain the set as one aggregated non-blocking reach observation because proof 1's declared-surface residue cannot observe it.
4. A same-path plane-opener, launch, config, workflow, or other inventory row must never classify a module.
5. Keep explicit Cloud script-module findings, Cloud-package imports, plane-root escapes, and unresolved-edge instrument failures intact.
6. Retire the false blocking topology-edge-closure-unregistered-module output. Replace it with the distinct non-blocking topology-edge-closure-reaches-module-without-custody observation without weakening the remaining topology blockers.

Contract Ledger

Acceptance Criteria

• Module custody lookup is surface-aware; only script-module authority can classify a reached module.
• A same-path plane-opener, launch-root, config, workflow, or other inventory row cannot classify module custody.
• A reached ai/** module with no script-module row emits one aggregated topology-edge-closure-reaches-module-without-custody observation with preRelocationBlocker: false; proof 1 remains the sole membership/residue gate.
• An explicit Cloud script-module reached from Edge still emits topology-edge-closure-reaches-cloud-module.
• Cloud-package, plane-root-escape, and unresolved-edge arms retain their current behavior.
• The current paired proof is source-bound with zero instrument errors, zero false unregistered-module blockers, and one exact non-blocking 316-module custody observation; surviving blockers remain exact and successor-owned.
• Focused mutations cover cross-surface collision, ungoverned dependency reach, explicit Cloud module reach, and the retained independent hazard classes.
• Receipts remain deterministic and source-SHA-bound.

Review Correction

Vega's Round-1 falsifier corrected the final over-narrowing: proof 1 reconciles declared surfaces and structurally cannot receive reached modules with no custody row. At exact head a8c1ba5a9f, the clean receipt retains 316 such modules as one sorted, inventory-lineage observation with preRelocationBlocker: false; the blocker census remains 17, non-blockers become 10, and instrument errors remain 0. Context means recorded, not deleted.

Out of Scope

• One placement row per tracked or reached ai/**/*.mjs module.
• Severing Edge→Cloud/store dependencies (#16202 / #17627 lineage).
• Moving files, creating package manifests, or changing workflow/cut dispositions.
• Changing runtime-denial, computed-edge, package-import, or out-of-region contracts.
• Treating reach as placement or shared admission.

Avoided Traps

• Expanding 163 governed script surfaces into a 766-module custody ledger. ADR 0040 requires exact governed surfaces; reach is not authority.
• Making the reached identities disappear with a blanket suppression. The fix is surface-aware classification plus a distinct non-blocking reach observation, while Cloud-package/explicit-Cloud/unresolved controls remain red.
• Letting bare-path collisions stand in for custody. Same string, different surface, different claim.
• Duplicating proof 1 inside proof 2. Membership reconciliation and isolation are separate receipts by design.
• Auto-classifying from current reach. Dual-plane reach includes the violations the split exists to sever.
• A new diagnostic or registry. Existing siblings own the repair.

Decision Record Impact

aligned-with ADR 0040 §§2.2, 2.4, 2.6, and 2.7; aligned-with ADR 0039. No amendment.

ADR successor-risk: adr-aligned — #17707 postdates Accepted ADR 0040 and now implements its surface-membership / proof-set separation. The earlier full-module prescription was narrowed because it exceeded the accepted decision.

Intake Classification

Ticket age: same-day · Bot stale-band: pre-stale (90d + 14d automation), no stale/no-auto-close labels · Independent Epic Review: #17500 comment IC_kwDODSospM8AAAABQHA4IQ · Duplicate/close-link sweep: no competing ticket or PR · Memory Core / Knowledge Base: clear misses · ROI: positive after narrowing.

Related: #17500 · #17525 · #17533 · #17645 · #16202 · #17627 · ADR 0040

Origin Session ID: 0dc1379e-5329-4fba-80ca-f6466822f7c9

Retrieval Hint: query_raw_memories("AgentOS proof bare identity cross-surface collision script-module authority")

— Emmy (GPT-5.6 Sol Ultra, Codex)