Compiler, source publication and consistency

Design synthesis, 7 October 2026. This chapter incorporates the supplied Astra report. Its models and acceptance tests describe intended architecture; they do not certify current implementation. The report inventoried 140 public routes and compared substantive sections of 51 documents. Repository source and current qualification receipts determine what ships.

Architecture thesis and invariants · Nodes, ports and hyperedge vocabulary · Composition and execution semantics · Compiler, source publication and consistency · Shadow, evidence and region releases · Authoring and industry precedents · Cross-runtime systems and worked scenarios · Impact, design obligations and qualification

9. Compiler, incremental analysis and runtime lowering

The compiler should turn semantic regions into execution images with explicit legality and type/effect interfaces. Local pure calls can become direct calls; static regions can be fused; reactive renderers can keep host-native fast paths. The graph remains their identity and contract authority rather than their per-call interpreter.

MLIR is a precedent for extensible operations, dialect interfaces and legality-driven lowering. It is neither a graph database nor an automatic proof of semantic equivalence. For each Reaktor profile, define observations and require the compiled result to refine the reference behavior under the relevant environment assumptions. A reference interpreter and differential corpus are a practical first semantic oracle. [MLIR — Interfaces] [MLIR — Dialect conversion]

Effects, protocol phases and ownership must survive lowering—not only primitive type layouts. A JVM exception, canceled coroutine, rejected remote request and dropped native callback have different possible outcomes. Unsupported target/lifetime combinations should fail generation or admission instead of becoming latent runtime failures.

One dependency-tracked analysis service can support queries, build invalidation, deployment planning and evidence freshness. Differential Dataflow and build-system calculus supply relevant precedents. Negative facts and opaque dependencies must remain conservative; an optimized cache is not correct merely because it computes quickly. [FFI / Switchboard] [Koka — Types and effect handlers] [McSherry et al. — Differential Dataflow] [Mokhov, Mitchell & Peyton Jones — Build Systems à la Carte]

10. Transactions and distributed consistency

Start with immutable snapshot readers and one commit serialization point per authority domain. A candidate records its exact base; commit checks the base and current authorization, validates transition obligations, durably records the revision and intent, then publishes the new root. Receipts handle a lost reply without duplicating the logical mutation.

Whole-head comparison is deliberately conservative. Two candidates can write different edge records and still violate an exclusive-port invariant. Finer concurrency requires read and predicate conflict tracking, not merely intersecting write sets. Invariant-confluence theory explains why some merge operations can avoid coordination while others cannot. [SQLite — Isolation] [PostgreSQL — Transaction isolation] [Bailis et al. — Coordination Avoidance in Database Systems]

Use an existing qualified storage authority before inventing a bespoke transactional database. The hot graph can still have compact columns, incidence indexes and copy-on-write directories. Work and storage primitives deserve reuse and conformance tests, but a local keyed mutex, a retained inspection window or a process-local Flow must not be mistaken for distributed conditional writes or a complete durable journal. [Durable work] [Stable foundations] [Mutable memory and publication]

Separate graph commit, application-data commit, activation and external realization. An outbox for a domain mutation belongs in the same authority transaction as that mutation. Source artifacts may need staged publication rather than shared ACID. Deployment needs recoverable intents, fencing and state migration; returning to an older program creates a new activation epoch.

Abort, semantic revert, application restore, simulation rewind and external compensation are different commands. Keeping that distinction in the type system prevents a rollback button from promising an impossible undo. [Data transactions] [Kubernetes — Controllers] [Erlang/OTP — Release handling]

Blueprint as a distributed-system language

Compile one feature into a linked set of runtime artifacts and operational obligations—not unrelated source files.

Vector diagram · click a marked item to inspect

Reaktor design decision

Make the complete distributed program bundle the compilation target. Existing host languages implement algorithms and opaque regions; graph-owned behavior supports higher-level composition.

Boundary / caveat

No single physical VM spans the network. Target-specific failures, schedulers, persistence and memory limits remain observable semantics.

Qualification test. Compile the same declared feature for a supported local fixture and a remote service profile; check protocol/effect observations, not just matching payload schemas.

Official context and precedents: Reaktor Visual Language / Blueprints Reaktor Living Graph Reaktor FFI / Switchboard

Lowering is an obligation to preserve meaning

A backend is valid because of what it preserves, not because it accepts the syntax.

Law / model / proof obligation: Obs(run(compile(P), E)) refines Obs(semantics(P, E)) for the supported profile and assumptions.

Reaktor design decision

Define one semantic oracle for portable behavior; qualify generated target paths with differential tests, bounded models and stronger proofs where useful. MLIR-style interfaces let generic passes ask about effects and regions.

What this does not establish

Whole-program equivalence is not decidable in general. Unknown operations remain opaque; successful type conversion does not establish every runtime property.

Falsifiable acceptance test. Compile a behavior with cancellation and borrowed buffers to two targets; compare terminal outcomes and lifetime violations, not merely return values.

Theory, precedent and Reaktor context: MLIR — Dialect conversion MLIR — Interfaces Formal methods and evidence The Living Graph

One dependency system can serve many tools

Queries, compiler plans and evidence should not each invent incomplete invalidation rules.

Law / model / proof obligation: Δinputs → affected derivations; unknown dependency coverage widens invalidation conservatively.

Reaktor design decision

Use indexed relational facts, tracked queries and fixed-point analyses as shared infrastructure. Visitors remain useful for custom passes, but not every analysis should be a full DFS.

What this does not establish

Cache invalidation over negative predicates and recursive queries requires care. A hash of an output is not proof that all its inputs were declared. Incrementality is optional until its cost wins.

Falsifiable acceptance test. Invalidate bindings, a compatibility result and its evidence when the contract changes; retain the unrelated theme derivation.

Theory, precedent and Reaktor context: Module execution plan Graph visitors McSherry et al. — Differential Dataflow Mokhov, Mitchell & Peyton Jones — Build Systems à la Carte

Portability should adapt without hiding degradation

Capability selection was already in the docs; it must survive the graph redesign.

Law / model / proof obligation: Eligible = {o | satisfies(o, requirements, context) ∧ authorized(o)}; preferences apply only within Eligible.

Reaktor design decision

Use multidimensional offers for privacy, accuracy, cost, latency, affinity and availability. Record the selected offer and fallback reason. Re-selection needs hysteresis, qualification and a state-transfer or session-pinning rule.

What this does not establish

“Full” does not dominate “Basic” across every dimension. Scalar tier labels may remain in a UI, but not as the complete compatibility or authority contract.

Falsifiable acceptance test. Remove private-input and network constraints in the toy: the cloud offer becomes eligible. Add either back and it cannot be chosen by a quality score alone.

Theory, precedent and Reaktor context: Capability selection Reaktor plan and roadmap Formal methods and evidence

Placement is constrained graph partitioning

The graph can expose the cost of a boundary before a feature becomes operationally expensive.

Law / model / proof obligation: Minimize boundary cost subject to residency, authority, capacity, affinity and protocol feasibility.

Reaktor design decision

Use graph cuts and measured interaction weights to propose placements, co-location and batching. Produce explanations for rejected placements and retain the accepted profile in the release manifest.

What this does not establish

Hypergraph partitioning with multiple resource and policy constraints is not generally a trivial min-cut. Use heuristics or bounded optimization and report the objective, not an unproved global optimum.

Falsifiable acceptance test. A cheaper remote inference offer must lose to a valid local offer when raw data is prohibited from leaving the device.

Theory, precedent and Reaktor context: Capability selection Reaktor plan and roadmap Tidemark data layer Live session topology Fong & Spivak — Seven Sketches in Compositionality

A lens explains round trips; it does not create cross-store ACID

Source authority and graph authority must not drift during edits or crashes.

Law / model / proof obligation: PutGet and GetPut are laws for a chosen source/view model; unsupported edits are explicit errors or proposals.

Reaktor design decision

Use projections and source-aware edits where the source owns a region; directly transact graph-owned programs. Publish immutable source/artifact candidates using recoverable phases when the authorities differ.

What this does not establish

A filesystem, Git repository and graph database do not become one atomic store because their IDs are linked. Formatting, generated code and opaque bodies require a declared equivalence or preservation policy.

Falsifiable acceptance test. Crash after source materialization and before graph promotion. Recovery must not activate mismatched code while claiming one tested candidate.

Theory, precedent and Reaktor context: Source ownership Visual language Foster et al. — Combinators for Bidirectional Tree Transformations DevOps integration

A graph transaction protects invariants, not just records

Start with a serialized commit authority rather than premature optimistic multi-writer complexity.

Law / model / proof obligation: Commit(candidate) requires candidate.base = currentHead, current authority, and valid transition obligations.

Reaktor design decision

Readers pin immutable snapshots. Writers prepare candidates privately. A short commit validates and durably publishes one revision plus intent and receipt; recovery returns the same result for a repeated operation ID.

What this does not establish

Whole-domain conflict detection sacrifices concurrency. Finer validation requires predicate/read dependencies and a defined serializability contract. Remote effects are outside this atomic boundary.

Falsifiable acceptance test. Two candidates add different provider records to the same exclusive port. The second stale commit is rejected even though write sets differ.

Theory, precedent and Reaktor context: Stable foundations Data transactions SQLite — Isolation PostgreSQL — Transaction isolation Bailis et al. — Coordination Avoidance in Database Systems

One global graph does not imply one global instant

Definition snapshots, workload checkpoints and runtime observations have different consistency scopes.

Law / model / proof obligation: If receive ∈ cut, then its causally preceding send must also be in a consistent cut.

Reaktor design decision

Carry revision vectors, checkpoints, authority domains and capture coverage into maps and Shadow fixtures. A global operation can coordinate a consistent snapshot when its actual providers support the needed protocol.

What this does not establish

Physical timestamps do not by themselves establish causal order or atomic multi-store snapshots. A partially observed system needs explicit unknowns.

Falsifiable acceptance test. Reject a fixture that contains a reply or durable effect without the causally required input/state boundary.

Theory, precedent and Reaktor context: Lamport — Distributed clocks, snapshots and temporal specifications Shadow workspaces Operational graph evidence