Shared Pre-Codegen Orchestration

Goal

Fix the discovered LEAK:algorithmic-duplication in pre-codegen orchestration. The canonical function already exists and already ships: oric::realization::program::realize_arc_program (compiler/oric/src/realization/program.rs:244) runs the AIMS calculus once and closes the artifact at the sole ExecutableProgram::validate edge (program.rs:287). The deliverable is therefore NOT “extract a function”: it is collapse the three surviving hand-written assemblers onto that one entry, reconcile the five semantic divergences between them, and pin the result with realized_program_parity — mirroring the oric::arc_lowering precedent (compiler/oric/src/arc_lowering.rs:1-4, “Shared ARC IR lowering for canonical functions across AOT and JIT paths”) one level up.

Verified baseline

Verified against live source; the historical baseline this section was authored against is corrected here.

The three assemblers (the live duplication)

Each independently hand-assembles the identical sequence TypeRegistry::from_typed_exports + register_resolved_collection_burdens -> compute_module_repr_plan(ModuleReprInput{..}) -> collect_user_drop_bindings -> roots -> find_map(is_main) -> realize_arc_program(ArcProgramRealizationInput{..}). All three live inside oric. SSOT-18 fires at 2+ sites, so C is a site: a collapse that unifies only A and B leaves a fourth shape and does not close the finding.

The five divergences the collapse must reconcile

roots and has_analysis_only_functions change the realized artifact’s CONTENT; narrowing_policy and verify_arc change WHO reads the environment. A parity assertion over function count alone passes over all five.

Corrections to the prior baseline

Terrain shape

The terrain is a Y, not a line: three producers converge on one validator (ori_repr::executable::program_freeze::validate, program_freeze.rs:15), then fan back out to LLVM AOT emission, LLVM JIT emission, and ori_vm::compile (ori_vm/src/compile/mod.rs:45). This section owns the upper Y only.

Implementation sketch

1. Write realized_program_parity FIRST. It does not exist anywhere in the tree today; at least one negative pin must FAIL before the collapse on at least one of the five divergences.
2. Parameterize the EXISTING realize_arc_program / ArcProgramRealizationInput (program.rs:244 / :54). Do NOT author a new realize_shared_program beside it (LEAK:reuse-bypass, SSOT-36).
3. Carry the reconciled divergences as ONE explicit, named policy value on the shared input, not five loose booleans and options (PARAM_SPRAWL:domain-fragment / :pass-thru-tunnel; the struct already carries 10 fields).
4. Hoist every environment read out of the assemblers to the three drivers. ORI_VERIFY_ARC currently has four readers under two spellings — pipeline.rs:438, llvm_backend/compile.rs:259, test_support.rs:228 (all via crate::debug_flags::ORI_VERIFY_ARC) and ori_llvm/src/evaluator/compile.rs:42, which hardcodes the literal string and re-reads it DOWNSTREAM of an artifact already built under a verify_arc field, so the two can disagree (LEAK:scattered-knowledge, SPEC-63, PHASE-24).
5. Collapse A, B, and C onto the parameterized entry, deleting each assembler’s independent hand-orchestration.
6. Keep realization strictly ABOVE the backend trait: CodegenInput carries &ExecutableProgram; the backend trait never grows a realization method. No concrete executor callback, backend handle, or placement/header/opcode/ABI vocabulary enters this function (PHASE-62, SSOT-19, PHASE-54).
7. Re-run realized_program_parity green post-collapse.

Boundary and exclusions

• Emission axis is OUT of scope. emit_realized_program / emit_all_functions (pipeline.rs:327,377) vs OwnedLLVMEvaluator::compile_all_functions (ori_llvm/src/evaluator/compile.rs:141) repeat 14 identical projection steps and are a CONFIRMED SIBLING_DIVERGENCE (jaccard 0.2727). That axis is owned by sibling section s-90024726. Cite and route it; never absorb it.
• emit_aims_state::realize_closed_contracts (oric/src/commands/emit_aims_state/mod.rs:223) stays out of the unified path. It deliberately realizes a degraded clone (TypeRegistry::default(), default boundaries, empty externals) for the read-only ori emit-aims-state projection; unifying it changes either that shipped diagnostic’s output or the production contracts (SOUNDNESS:summary-underapproximation, FLOW-52).
• compile_module_with_tests’s wide signature (ori_llvm/src/evaluator/compile.rs:74-78) stays as-is. Its own #[expect(clippy::too_many_arguments)] records the refutation verbatim: a public JIT-only carrier would widen the API without reducing coupling. The 11-arg-to-carrier refactor is a litigated dead end.
• ExecutableProgramParts is not reshaped here (23 fields, ori_repr/src/executable/mod.rs:141); see the cross-plan contract below.
• CallableTarget’s three variants (Function/Runtime/External, mod.rs:131-138) are matched exhaustively; no boolean or subset condition over callable kinds (COVER-14/16/28). bytecode-vm#s-ba8f2041 names this census gap — do not deepen it here.

Test baseline and pins

• The whole assembler surface is unpinned. test-posture over the three assembler files returns 37 rows, every one direct_tests: 0 and covering_tests: 0 with parser_coverage_status: full. Source-confirmed: oric/src/realization/program/tests.rs covers only rewrite_impl_targets, and realized_program_parity has zero matches tree-wide. A collapse that silently changed roots, narrowing_policy, or has_analysis_only_functions ships green today.
• realized_program_parity MUST assert all five divergences explicitly plus mono-instance inventory equality across the three assemblers. Inventory divergence is the highest-pain defect class in the reference corpora (monomorphization issues at the 98th-100th pain percentile in roc and rust); assembler C’s hardcoded has_analysis_only_functions: false sits in exactly that class. A “same function count” assertion is a ghost test.
• L12 production entry point. Drive the parity test through the REAL entry points — ori build, ori test --backend=llvm, and the VM’s live corpus path. Declaring it satisfied by calling test_support::compile_to_executable is INVERTED-TDD:seam-injected-only-coverage (TEST-14) and LAYER_GAP:production-entry-point.
• The VM reaches the artifact only through pub mod test_support (oric/src/test_support.rs:221 -> assembler C), an always-compiled module whose own doc says “Test support utilities for integration tests”. Extending the seam must not entrench that as the VM’s production producer.
• Mechanical no-fourth-assembler check: callee-set intersection over the unified entry’s callers (scripts/intel-query.sh callees <assembler>), NOT MISSING_ABSTRACTION or similar — both are blind to this axis (see “Declared unknowns”).

Hygiene constraints

The design is constrained on three axes simultaneously.

Additional constraints: DESIGN:temporal-coupling (DESIGN-17) forbids leaving NarrowingPolicy sourced inside the assembler; DESIGN:validate-not-parse (FLOW-27) and DESIGN-08 forbid adding a second optional binding on the JIT side to mirror bind_executable_program’s fail-open Option<_> shape.

Satisfying shape: one entry taking one explicit named policy value plus the existing ArcProgramRealizationInput, every environment read hoisted to the three drivers, and a caller-supplied diagnostic observer for the dump.

Diagnostics and evidence

• dump_arc_phases is invoked at exactly ONE call site (pipeline.rs:340 -> dump_orchestrator::dump_arc, oric/src/dump_orchestrator.rs:71). The JIT path dumps LLVM IR but never the realized ARC artifact, so ORI_DUMP_AFTER_ARC=1 today yields assembler A’s inventory with nothing to diff it against. Parity evidence by dump-diff requires the other paths to reach the same dump.
• Keep the dump at the CALLER of the shared entry and give the shared entry a caller-supplied observer, mirroring realize_closed_program_with_observer (ori_arc/src/pipeline/mod.rs:106), whose contract states the observer “is diagnostic only; it cannot select a different calculus or bypass interprocedural closure.” Moving the env-gated dump INTO realize_arc_program violates PHASE-06 / SPEC-34.
• Per-function contract evidence: ori emit-aims-state <file>.ori. Phase attribution: compiler_repo/diagnostics/bisect-passes.sh --function <fn>.
• Burden-sole caveat (ABSOLUTE, .claude/rules/arc.md §STOP): any RC count quoted while working this section comes from the burden-sole stream (--emit-rc-remarks or diagnostics/rc-stats.sh --rc-remarks, both composing ORI_DISABLE_PREDICATE_STACK_RC=1). A default-path RC count is false-green. This section changes orchestration, not emission: any RC delta is a REGRESSION signal, never an optimization lead.

Risk concentration

• program_freeze::validate carries hotspot_score 44642 — two orders of magnitude above every other symbol in the terrain. This section changes its CALLERS, never it.
• realize_arc_program is second (265) and carries the highest betweenness of anything this section edits (betweenness 82) — it is the articulation point, so a change there propagates to all three assemblers plus all three consumer crates (oric, ori_llvm, ori_vm).
• Blast radius from co-change (n>=7 shared commits): ori_repr::executable::*, oric::realization::*, and all four codegen_pipeline siblings (finalize.rs, imported_mono.rs, pc2_hooks.rs, borrow_inference.rs). imported_mono.rs and pc2_hooks.rs are named in s-90024726’s work item, so edits here collide with that section’s surface; sequence accordingly.

Cross-plan contract

• Correction handed to bytecode-vm#s-ba8f2041: the seam that plan must extend is realize_arc_program + ArcProgramRealizationInput in oric, not ori_arc::realize_closed_program. Its Cross-Plan Contract names this section a hard prerequisite and must co-design the entry signature; read that section’s census rules, fail-closed diagnostics, and neutral-naming freeze before freezing the signature here.
• Naming fork to freeze. Twelve plan-corpus references across seven plans name realize_closed_program as the seam; ZERO name realize_arc_program. Freeze the correct name in this section before the fork deepens; s-fa5189d2 owns the canon.md / missions.md sync that carries it outward.
• Do not reshape the artifact. enum-layout-ssot#s-0f9158ab (in-progress) is live over ExecutableProgramParts.repr_plan; repr-opt#11 and #12 are in-progress over the same artifact. repr-opt#13 owns ReprEvidence, VmLayoutPlan, CompiledLayoutPlan — none of those three, nor TargetSpec, has any declaration in compiler/ today (ori_codegen/src/lib.rs:11-17 says so in its own doc). Do not invent them here.
• s-fdca8921 (completed) shipped ori_codegen + CodegenBackendChoice and explicitly deferred ExecutableProgram as the CodegenInput payload to “. This section is what unblocks widening it.
• s-522301d7 (boundary-hygiene-lint) would mechanically catch a fourth assembler; s-79743ab2 consumes this seam’s frozen shape.
• Section is bug-clean and blocker-clean: zero open bugs, zero blockers.
• s-90024726’s work item claims codegen_pipeline/mod.rs is 573 lines and over cap — STALE; that split already landed (mod.rs is 14 lines).

Prior art

rustc_codegen_ssa::base::codegen_crate (compiler/rustc_codegen_ssa/src/base.rs:681) is ONE whole-crate driver generic over the backend trait, delegating to rustc_codegen_llvm::codegen_crate (lib.rs:353).

• Adopt its invariant: never two assemblers for one lowering.
• Reject its width. ExtraBackendMethods makes the backend supply allocator shims, module submission, and CGU naming; ori_codegen::CodegenBackend (ori_codegen/src/lib.rs:92) is deliberately narrow — one compile, one associated Artifact. Keep it narrow.
• Reject its partitioning, par_map dispatch, and async module submission — Ori has no requirement for them and importing them is DESIGN:speculative-generality.
• rustc has no JIT path and never faced this AOT/JIT assembler fork: it is prior art for the invariant, not for the fix. Cross-repo similar returns nothing above 0.74 for this shape; do not mine it further.

Declared unknowns and verification discipline

• MISSING_ABSTRACTION and SIBLING_DIVERGENCE are blind to this section’s duplication. Assemblers A/B/C produced zero rows from both detectors. The detector-visible axis (emit_realized_program ~ compile_all_functions) belongs to s-90024726. Use callee-set intersection instead.
• similar is file-local for this terrain and never bridges A<->B. It does place realize_arc_program ~ realize_closed_program at 0.860, which is why the plan corpus keeps naming the wrong altitude.
• The extractor does not resolve crate::/super::-qualified multi-line calls in oric. Every callers query on the seam functions returns zero resolved edges. Verify every caller claim by direct source search, never from a graph callers query.
• Graph staleness at dossier generation: insights_stale, sibling_divergence_stale, co_change_stale, test_topology_stale, ontology_stale all true. Community, hotspot, and co-change figures above are ORDERING signals and LOWER BOUNDS, never absolute claims; spec-diagnostics is substrate-dark for every file in the set.
• Ori has no issue corpus, so all sentiment evidence is reference-repo only.

Spec references

.claude/rules/impl-hygiene.md SSOT-18 (LEAK:algorithmic-duplication), SSOT-19, SSOT-36 (LEAK:reuse-bypass), PHASE-06, PHASE-24, PHASE-54, PHASE-62, SPEC-34, SPEC-63, TEST-14, COVER-14/16/28, FLOW-27, FLOW-52, DESIGN-08, DESIGN-17; .claude/rules/layer-coverage.md §1 (L12 production entry point); .claude/rules/arc.md §STOP (burden-sole RC evidence); .claude/rules/compiler.md §Architecture (oric::arc_lowering precedent).

Work items

• Extract the shared pre-codegen orchestration into one canonical function; route both the oric AOT driver and ori_llvm’s JIT evaluator through it; delete the JIT path’s independent duplicate; add the realized_program_parity test.
• Write realized_program_parity FIRST (TDD, driven through the real production entry points — ori build, ori test --backend=llvm, and the VM’s live corpus path — never through test_support alone) asserting the five known-divergent inputs (narrowing_policy, externals, roots, verify_arc, has_analysis_only_functions) plus mono-instance inventory equality across all THREE existing assemblers: realize_codegen_program (oric/src/commands/codegen_pipeline/pipeline.rs:109, production AOT), compile_program_inner (oric/src/test/runner/llvm_backend/compile.rs:183, JIT test runner), and realize_local_program (oric/src/realization/program.rs:165, the VM-corpus test-support entry). Then collapse all three assemblers onto the ONE existing canonical entry, oric::realization::program::realize_arc_program (realization/program.rs:244) parameterized via ArcProgramRealizationInput, deleting each assembler’s independent hand-orchestration of TypeRegistry::from_typed_exports -> compute_module_repr_plan -> collect_user_drop_bindings -> parent_roots -> realize_arc_program. Hoist every environment read (ORI_VERIFY_ARC — currently read at 4 sites under 2 spellings, one hardcoding the literal string; NarrowingPolicy — currently computed locally by assembler B via env_disabled() instead of driver-selected) out of the assemblers and onto the shared input, resolved once by each of the three call sites. Re-run realized_program_parity green post-collapse.
• Record explicitly (in this section and as a correction handed back to bytecode-vm#s-ba8f2041’s Cross-Plan Contract) that the seam this section owns and freezes is oric::realization::program::realize_arc_program + ArcProgramRealizationInput, NOT ori_arc::realize_closed_program as that plan currently states — realize_closed_program (ori_arc/src/pipeline/mod.rs:94) returns ArcPipelineBatchOutcome, not ExecutableProgram, and has two non-test callers (realization/program/aims.rs:22, emit_aims_state/mod.rs:234), so it is not the sole producer; the sole ExecutableProgram::validate edge is realize_arc_program (realization/program.rs:287). Twelve plan-corpus references across 7 plans currently name the wrong function while zero name the right one — freeze the correct name here before that fork deepens.
• Record two explicit do-not-unify exclusions so the collapse does not silently widen scope or reopen an already-litigated dead end: (1) do NOT fold emit_aims_state::realize_closed_contracts (oric/src/commands/emit_aims_state/mod.rs:223) into the unified path — it deliberately realizes a degraded artifact (TypeRegistry::default(), empty externals) for the read-only ori emit-aims-state diagnostic, and unifying it would silently change either that diagnostic’s output or the production path’s contracts (SOUNDNESS:summary-underapproximation risk); (2) do NOT restructure compile_module_with_tests’s wide-argument signature (ori_llvm/src/evaluator/compile.rs:74-78) into a shared carrier — its own #[expect(clippy::too_many_arguments)] attribute already records the refutation verbatim: a public JIT-only carrier would widen the API without reducing coupling.
• Explicitly declare the SECOND duplication axis — emit_realized_program/emit_all_functions (pipeline.rs:327,377) vs OwnedLLVMEvaluator::compile_all_functions (ori_llvm/src/evaluator/compile.rs:141), a confirmed SIBLING_DIVERGENCE (jaccard 0.2727, 14 identical projection steps) — OUT of this section’s scope and owned by sibling section s-90024726 (codegen-backend-trait-and-dispatch). This section unifies pre-realize_arc_program orchestration only; do not let the confirmed sibling-divergence pull post-artifact emission-fan-out work into this section.

Intel dossier — pointer and tier disposition

Dossier: shared-pre-codegen-orchestration--s-30e3c9a6.intel.md (this section’s content/intel/ sidecar)

Read that dossier from line 1 through EOF before acting on this section. This block is a pointer and an audit record, never a substitute: not the BLUF, not a summary, not selected tiers.