# The kernel leads every frame — reinterpreted for cache-monotone streams (delta-encoded kernel)

> **Forward-amendment mark (2026-07-16).** The accepted-and-implemented ADR-0040
> (*clock-honest wakes: deliberation consumes tape time*) **reinterprets the kernel-leads
> invariant for a moving clock** — the kernel still leads every Frame, but a Frame now
> lands at its clock-honest return time (`vantageTs + measuredMs + bufferMs`) rather than
> at a free wake time. The lead/absent-not-hidden guarantee below is unchanged; its clock
> semantics are the ones ADR-0040 makes honest.

The SAFETY/CONTROL **kernel** leads every Frame, non-configurable and fail-closed
(built in code, prepended outside any pane/View selection; a lead guard throws if it is
ever not the first block; every one of its 8 fixed-order sections is always present, an
empty section rendered as an explicit `none`/`UNKNOWN` — **absent-not-hidden**). That is
the invariant. This ADR reconciles it with the **cache-monotone** streaming discipline
(ADR-0008) so the kernel stops being the single biggest re-emitted line-item on every
wake — **without** weakening the safety guarantee.

## The tension

Measured on the real cl100k tokenizer over a realistic multi-wake session
(`tests/harness.efficiency.test.ts`): the full 8-section kernel is **~46% of each WAKE
delta**, and only **~22% of its lines MOVE** wake-to-wake — so **~78% of the kernel is a
byte-stable skeleton re-emitted in full every wake**. Because deltas are append-only the
skeleton is paid once then cached, but it is still the largest single item in each wake's
*genuinely-fresh* cost. The naive fix — drop unchanged sections — is **forbidden**: it
breaks absent-not-hidden, the honesty guards, and the frame invariants. A section that is
silently omitted is indistinguishable from a section that is genuinely gone.

## The resolution — a delta-encoded kernel with a composed-completeness guard

The invariant is **reinterpreted, not relaxed**:

> Every frame makes the **complete current kernel** available to the reader — as a full
> block in a **keyframe**, or as **`cached-skeleton + delta`** in a cache-monotone stream —
> and a **fail-closed composed-completeness guard** verifies the composition reconstructs
> the full kernel **byte-identically**.

Concretely:

- A **keyframe** carries the COMPLETE kernel, unchanged. Keyframes are: the OPEN briefing;
  **and every frame under `stateless-redraw`** (or any policy where the reader holds NO
  prior context). Self-complete frames stay self-complete — a keyframe has no composition
  dependency and can be read in isolation. The correctness gate is explicit: delta-encoding
  is used **only** under the streaming (`conversation` / `conversation-cached`) policies,
  where the reader provably holds the prior full kernel in cached context; `stateless-redraw`
  always gets a full kernel.

- A **delta frame** (a WAKE frame in a cache-monotone stream) carries ONLY the kernel
  **fields that MOVED** since the prior frame. The byte-stable skeleton (the lead banner,
  the 8 section labels, and every unchanged field value) is NOT re-emitted — it lives in the
  reader's cached prefix. The delta LEADS with its own sentinel (`KERNEL DELTA (unlisted
  fields unchanged)`), which the lead guard accepts alongside the full lead sentinel: the
  kernel still leads every frame.

- The kernel is built once as an ordered list of **anchored cells** — each segment either
  byte-stable *skeleton* or a *field* value under a stable anchor (`budget.remaining_R`,
  `data-health.SPXW.stale_s`, `engine-log.fired`, …). The full render is the concatenation
  of every cell (so the legacy kernel bytes are unchanged — the frame goldens/tests hold);
  the delta is the same cells filtered to the moved fields. **One source of truth**, so a
  delta can never carry a section the full render omits, or vice versa.

- **Composed-completeness (fail-closed).** Before a delta is ever emitted the renderer
  COMPOSES it against the prior kernel and asserts the result is byte-identical to the full
  current-kernel render; any mismatch (a moved field dropped, an encoding bug) **throws**,
  exactly as the lead guard does. A delta that references an anchor absent from the cached
  skeleton — a moved field that could never land in the reader's cache — likewise throws. A
  **structural** change (a section/list changed shape: a position added, the engine log went
  empty↔non-empty) is not delta-encoded at all: the encoder returns "re-keyframe" and the
  wake carries a full kernel. A structural change honestly re-keyframes rather than risk a
  lossy delta.

- **Absent-not-hidden survives the delta.** A field that MOVED to UNKNOWN is
  present-and-marked in the delta (`wake.deadline UNKNOWN`) — the reader must SEE the
  degrade, never infer it from silence. A field merely unchanged is absent from the moved-set
  and held in cache. **Omitted-because-unchanged is never confused with
  omitted-because-unknown**: a still-UNKNOWN field is not re-marked (the reader keeps the
  cached UNKNOWN); only a *transition* to UNKNOWN is transmitted.

## Consequences

- **The KV-cache win.** Measured (cl100k): the delta re-emits **~0.38 of the full 8-section
  kernel per wake** — a **~62% cut** of each wake's fresh kernel tokens — while composing
  byte-identically to the full kernel. On the billed-token table the append-only cached
  policy improves against every baseline (e.g. cached-vs-conversation ≈ 0.34×). The economics
  are pinned as executable assertions; the semantics are held by the frame + honesty tests.

- **The determinism line is untouched.** Delta-encoding is a **rendering/transport** concern
  above the determinism line (ADR-0013). Only the returned turn crosses into the graded path,
  so `recordedAgent` replays byte-identically regardless of whether a wake was framed as a
  keyframe or a delta; the graded Bus is unchanged.

- **Rejected alternative — a shallow field-drop.** Emitting fewer sections and trusting the
  reader to remember is exactly the honesty failure the kernel exists to prevent. The
  composed-completeness guard is what makes the delta safe: it is not "trust the cache," it is
  "prove the cache + delta reconstruct the whole kernel, or fail closed."

Reconciles the kernel-leads invariant (and the nine Frame-envelope invariants, kestrel-4gl)
with ADR-0008's cache-monotone discipline. Extends, does not supersede, ADR-0008/0009/0013.