Core-2 Hardware Semantics

Status: normative preview; bounded structural inspection and native combinational/clocked/CDC simulation available; async/intrinsic source execution remains downstream

Structure and elaboration

C2-HW-001 — Components. A component declares a nominal port schema and a finite spatial implementation. Component C introduces the nominal schema C.Ports. Its public contract is Hardware<Ports>; Ports includes ordered names, directions, types, clock/reset relationships, observations, permitted timing latitude and environment assumptions. Ordinary software values are not implicitly wires. Persistent component instances exist until their admitting simulation or fabric session ends.

C2-HW-002 — Elaboration. Static Index parameters are nonnegative integers; bit widths are positive. Parameter evaluation and instance bindings are pure, terminating and resource-bounded. Instances bind every port exactly once by name; output bindings name writable nets or output ports. Instance recursion, unbounded expansion, unresolved names, duplicate bindings and type/direction mismatches are rejected. There is no runtime creation of circuit instances. Hardware-domain message calls may express pure finite elaboration helpers; they cannot execute a temporal software call stack in a circuit process. An accepted elaboration helper is fully reduced into the static component graph; helpers with effects or residual runtime calls are unsupported.

C2-HW-003 — Connections and ownership. Inputs are driven by their enclosing boundary; outputs and local nets are driven by their declared producers. Each bit has exactly one driver unless a named resolution law is selected. inout requires four-state storage and explicit resolution at the connected net. A connection is a continuous equation, not ordered assignment. A process is one driver even when its activation is conditional. Multiple processes writing a single-driver target are invalid regardless of scheduling.

C2-HW-004 — Disciplines. Every process, state element and continuous connection belongs to one region. Combinational regions have no state and must be acyclic after elaboration. Clocked regions contain registers and clock-triggered next-state logic. Async regions contain explicitly initialized state and guarded drives with delay/hazard assumptions. Intrinsic regions may contain recurrent target-bound structures under a physical validity envelope. Every connection across disciplines or clock domains uses a typed bridge, including a combinational-to-clocked sampling bridge when no frequency conversion is needed. Same-discipline static port composition may connect directly when its assumptions agree. No region silently inherits timing assumptions from its neighbor.

C2-HW-005 — Bounded two-state netlist lowering. combinational-netlist is pure in-memory lowering of an actual C2-ID-003 checked public component, not a tool invocation or target synthesis admission. The first profile, two-state-combinational/1, preserves Bit and Bits<1…256>, complete single drivers, static hierarchy and total combinational processes. Constant-true process guards are discharged only by the unchanged reference-model checker. The closed primitive set is unsigned constants, signal references, bitwise not, unary modular negation, modular addition/subtraction/multiplication and bitwise and/or/xor. Every primitive has an explicit nominal type and width. All intermediate results retain their width boundary. No signed, divide/error, shift, conditional or conversion behavior is inferred from a backend operator.

Four-state values reject even when a particular literal is known 0/1. Resolved nets, inout, named observations, state, clocked/CDC, async, intrinsic and physical behavior reject in this profile; a future backend must preserve their actual semantics. The checked component and preparation limits are revalidated before lowering; no arbitrary JSON or claimed digest can create a netlist handle.

The canonical netlist flattens signal connectivity while retaining each signal’s full original path and instance owner. Signals sort by ASCII path; public ports retain original ordinals, and child ports become internal connections. Drivers sort by target signal ID. Traverse their expressions operand-first, retaining operand order and structurally interning nodes by operation, nominal type, width, literal value, referenced signal and operand IDs. Node IDs follow first postorder discovery; every operand precedes its consumer. Internal record IDs, source order and shared versus duplicated elaborator expression records do not alter this semantic representation. No commutative/algebraic rewrite is implied.

The optional zerglang.verilog-combinational/1 projection is a standalone Verilog-2005 module named zerglang_top. It uses generated p ports, w wires and n intermediate wires, each explicitly unsigned and sized [width-1:0], plus sized hexadecimal constants and continuous assigns. It injects no source identifier, filename, system task or tool command. Its contract covers only settled known two-state inputs, not X/Z startup/delta behavior or physical timing. It is an inspectable target-independent RTL projection, not a bitstream, independent proof result or device configuration.

Preparation and native identity bounds apply independently. Lowering additionally bounds the graph at 8192 records, expression depth at 256, and recursive visits plus structural-intern comparisons at 8388608. Each of the netlist, RTL and source-map buffers is at most 8388608 bytes plus an owned terminator. Source file labels are at most 4096 bytes. Exceeding a bound or unsupported semantics rejects with ZL-C2-UNSUPPORTED-0001 and no partial output; invalid API arguments use ZL-OPTIONS-0001. Empty public components remain valid empty netlists.

The owned source map binds the implementation identity and retains source file bytes and byte offsets for signals, all reachable node origins (including interned duplicates), and drivers. It is explicitly unattested metadata, not source-content authentication. It cannot enter the implementation hash preimage. Canonical formats and public APIs are fixed in docs/core2-netlist.md in the repository. Netlists and all exports survive destruction of their input owners. Target binding, equivalence verification, promotion, authority and physical evidence remain false. Toolchain execution requires its separate live capability and adapter boundary, regardless of the availability of RTL text.

Logic values

C2-LOGIC-001 — Width and encoding. Bit is 0 or 1; Logic is 0, 1, X or Z. Bits<N> and Logic<N> are fixed-width unsigned bit vectors, index 0 being least significant. N must be positive at elaboration. Binary operations require equal widths; extension, truncation and signed interpretation are explicit. Hardware addition/subtraction/multiplication wrap modulo 2^N; software-to-hardware refinement must preserve the software overflow contract using additional logic where necessary. Divide by zero is an explicit error observation, never an arbitrary synthesized value. No implicit X/Z-to-Bit conversion is permitted: to_bits returns an owned Result with the index of the first indeterminate bit. Bit-to-Logic embedding is total.

C2-LOGIC-002 — Four-state operations. Bitwise AND, OR, XOR and NOT use the following tables, independently for each bit. Z acts as unknown for logical computation; only resolution and exact state equality distinguish Z from X.

| a | NOT a | a AND 0 | a AND 1 | a AND X | a AND Z | a OR 0 | a OR 1 | a OR X | a OR Z | |—|—|—|—|—|—|—|—|—|—|—| | 0 | 1 | 0 | 0 | 0 | 0 | 0 | 1 | X | X | | 1 | 0 | 0 | 1 | X | X | 1 | 1 | 1 | 1 | | X | X | 0 | X | X | X | X | 1 | X | X | | Z | X | 0 | X | X | X | X | 1 | X | X |

XOR of known bits is ordinary XOR; any X/Z operand yields X. Four-state arithmetic produces all-X when any operand is indeterminate. Logical equality produces 0 if any known bit pair differs, 1 if all pairs are known and equal, and X otherwise. same_state returns Bit and compares all four states exactly. A mux with an unknown selector preserves equal branch bits, including Z, and returns X at other positions. Relational comparison of indeterminate operands yields X. Shift counts must be known; overshifting fills with zero. The unary ~ applies bitwise NOT; ! accepts a scalar known Bool or Bit. Process guards likewise accept known Bool or Bit. Conditions accepting Bit reject Logic until an explicit checked conversion or declared uncertainty bridge resolves it. Literal constructors Bit.zero, Bit.one, Logic.zero, Logic.one, Logic.X, Logic.Z and Bits.from_unsigned(N, value) supply exact typed constants.

C2-LOGIC-003 — Resolution. The standard wired law ignores Z drivers; no remaining drivers yields Z, one agreed known value yields that value, and disagreement or any X yields X. It is permutation-invariant and operates per bit. Custom resolution requires a pure total associative and commutative fold with a declared identity; its definition participates in the contract. Unconnected two-state inputs and outputs are rejected. An undriven resolved four-state net evaluates to Z. Z denotes high impedance in the logical model, not a physical voltage or guarantee of electrical isolation.

C2-LOGIC-004 — Bounded reference value API. The native zerglang/core2_values.h API and zlm hardware-value implement pure, owned reference values separately from circuit execution. Construction and operations require explicit Core-2 preview selection. They do not create a component instance, schedule events, grant capabilities or admit a realization. The hardware-values feature is distinct from hardware-simulation.

Scalar Bit/Logic and vector Bits<1>/Logic<1> retain their nominal kind even at width one. Literals are exact-width MSB-first 0/1/X/Z strings while indexed access is LSB-first. Decimal unsigned constructors accept only two-state destinations and reject overflow rather than truncate; fill constructors repeat one declared state. Binary data operands require identical kinds and widths. Only explicit vector resizing zero-extends or truncates high bits. Signed interpretation is not implicitly introduced by a bit pattern.

Arithmetic and comparisons follow C2-LOGIC-001/002. Negation wraps modulo 2^N; remainder has the same explicit zero-divisor observation as division. A known zero divisor reports that error even when the numerator is indeterminate; otherwise an indeterminate arithmetic operand produces all-X. Known bit-pair inequality determines logical equality before remaining uncertainty. Exact state equality always returns Bit; other comparisons return Bit for two-state operands and Logic for four-state operands. Shifts are bit-position movement: retained X/Z bits remain X/Z, new positions are zero, and an indeterminate count is rejected. They do not reinterpret Z as a physical voltage.

The typed mux API takes a scalar Bit/Logic selector; selector 0 chooses the left branch, selector 1 the right. An indeterminate selector requires explicitly four-state branches and merges them by exact per-bit equality, preserving equal Z states. Two-state callers must embed branches explicitly when uncertainty is possible. Logical NOT accepts scalar Bit only in this hardware-value API; software Bool remains in its inherited domain. to_bits returns an owned value or a typed indeterminate fault with the least-significant offending index; to_logic is total. Failed operations publish no partially usable value.

The wired resolution identity is Z, including an empty driver inventory. An explicit custom four-state table contains 16 results in row-major 0,1,X,Z order and a declared identity. Every entry is checked for closure; the finite table is exhaustively checked for identity, commutativity and associativity before any fold. This finite check is not evidence for arbitrary source-authored or physical resolution behavior. Driver order and parenthesization do not alter an admitted fold; driver multiplicity is not silently discarded. A future net binding must retain the exact law definition in its contract.

The current envelope is 1,048,576 bits per value, at most 32,768 resolution drivers, and 32 million charged work units per primitive call. Callers can lower width/work limits; zero is binding. Operations charge a conservative cost before allocation/arithmetic, with quadratic word work for multiplication/division and digit work for decimal construction; a maximum-width value is not a promise that every operation fits. Each value stores at most one byte per state plus fixed metadata. Integer-library scratch is width-bounded and released before return. Results/JSON are independently owned; there is no hidden mutable value registry. Invalid types, arity, conversion and arithmetic observations use ZL-C2-LOGIC-0001; unsupported resource envelopes use ZL-C2-UNSUPPORTED-0001. The typed fault distinguishes invalid, indeterminate, zero-divisor and resource failures. These API failure statuses are not circuit simulation traces or successful materialization evidence.

Clocks and reference evolution

C2-CLOCK-001 — Clock and reset ownership. Every register names exactly one clock declaration and a constant initialization/reset value. A clock binds a Clock input and rising or falling edge. An optional Reset input declares polarity and synchronous/asynchronous assertion. Synchronous reset is sampled at the active edge; asynchronous assertion applies at its event and takes priority over a coincident clock edge. Asynchronous deassertion requires an explicit release synchronizer before normal sampling. Without reset, the declared initial value requires target support; synthesis cannot assume it. Clock sources carry event streams and timing constraints; no global clock is implicit. Unknown clock/reset values cause an uncertainty diagnostic.

C2-CLOCK-002 — Simultaneous updates. At a logical timestamp the reference executor first applies external events, then settles acyclic combinational logic, samples all triggered registers from one pre-update state, commits all next values simultaneously, and settles again. Unassigned registers hold. Duplicate next assignments to one register in an activation are rejected; independent next assignments form an unordered map keyed by target register. Conflicting external updates to the same input at the same timestamp are rejected. Registers cannot read a peer’s newly committed value in the same sampling round. Coincident clocks do not legalize a clock-domain crossing. Observers identify their sampling phase; default clocked observations occur after the post-update settle. Acyclic combinational results are independent of topological evaluation order.

Implementation note: the explicit native core2_clocked.h profile establishes known clock/reset baselines and declared initial state from the first complete host input batch. It does not invent an edge from an unspecified previous level. Later batches follow the pre-settle/sample/commit/post-settle sequence above. The separate combinational factory remains combinational-only. Neither profile provides target initialization support or physical timing evidence.

C2-CLOCK-003 — Crossings. A path from a source domain to a destination register must pass a declared synchronizer, asynchronous FIFO, handshake, or intrinsic bridge. An asynchronous external input is also a crossing. Synchronizer contracts state width, source transition assumptions, destination clock, latency range and uncertainty/failure model. A two-register synchronizer does not establish coherent transfer of a changing multibit word. FIFO/handshake bridges define ordering, capacity, reset coordination, overflow and backpressure. An unsafe intrinsic bridge requires matching authority and contract latitude; it cannot discharge an exact portable claim. Static CDC acceptance proves that the required bridge contract exists, not a zero probability of metastability.

C2-CLOCK-004 — Bounded source reference bridge definitions. The cdc-source-structure feature admits ordinary components containing typed ports and one transfer constraint. Context-specific constructors CDC.sync_bit_v1, CDC.sync_external_v1, CDC.handshake_v1, CDC.fifo_v1 and CDC.reset_release_v1 select versioned, inspectable digital transfer laws; they are not software calls or authority-bearing operations. Their signatures, owned-value laws and native record projections are described in the repository guides docs/core2-cdc.md and docs/core2-cdc-source.md. An arbitrary component name, assume, unknown law/version or extra unchecked fact is not a bridge contract. No source compatibility with an external hardware language is implied.

A reference bridge binds each input exactly once. Outputs remain its own typed endpoint nets, referenced by qualified member name, not omitted external drivers. Clock parameters explicitly bind enclosing named clock domains and retain their tick, edge and reset relationships. Source/control provenance, types, widths, driver ownership and import closure are checked. Source-defined law identity and its bound reference contract identity remain distinct; neither is a physical-instance, interface/5 or promotion identity. A reset-release definition uniquely attaches to the destination clock’s declared asynchronous reset input. Independent crossing histories must not be laundered through registers into an unproved coherent join.

The initial reference subset limits definitions to exact local port roles and static law parameters, 4,096-bit words, 64-entry queues, 2–16 stages and 64 bridge instances. Constructor preparation, graph checking and temporal provenance consume the enclosing elaboration bounds. Unrecognized definitions, unavailable bounds, more general join proofs and intrinsic execution remain fail-closed. Structural admission does not enable simulation, synthesis or physical claims; those require their separate execution and evidence gates.

C2-CLOCK-005 — Guarded reference CDC execution. cdc-simulation selects a separate native model/session profile, not an extension of the strict combinational or clocked model factories. Model identity binds the checked source definitions, normalized contracts, endpoint roles, clock/reset bindings and release attachments. Each live step requires fresh Simulator authority for that exact model; declared effects, reference values or trace bytes cannot provide it. Candidate inputs, registers, bridge values and trace publish together only after every derivation and bounded serialization succeeds. An admitted failure keeps prior state while retaining its work charge.

One pre-state supplies ordinary register next values and word offers/takes/data. Scalar synchronization additionally observes post-register data changes, so a coincident source update cannot masquerade as a stable destination sample. The edge finishing reset release still holds registers in reset; raw assertion wins immediately. The first complete batch establishes baselines, not edges. All intermediate values, derivations and trace construction are budgeted. The bounded profile and trace contract are detailed in docs/core2-cdc-simulation.md. Unsupported same-tick event networks and reset contracts fail closed; no digital trace proves analog metastability safety, physical delay, MTBF, synthesis equivalence or promotion.

C2-CLOCK-006 — Pure point-aware CDC values. The cdc-logical-points feature provides a separately identified immutable wrapper around a checked version-1 reference transfer law. It is a prerequisite for mixed-region execution, not source bridge admission or a live simulation profile. Its own version is 1; its maximum microstep count is 1…256. Events are ordered by unsigned (timestamp, microstep). Baselines and new timestamps start at microstep zero; indices are strictly below the count. Equal or reversed points reject without changing the prior value. Clock levels may change only at a new timestamp, microstep zero. A microstep is not an extra clock edge or an implicit increment of physical/logical tick time.

Transfer setup/hold apertures retain their original tick units, so a source change after a same-timestamp sample can violate hold. Same-timestamp stutter does not advance pipeline stages, consume words, acknowledge ownership or finish reset recovery. Asynchronous reset assertion can act at a microstep; coordinated word reset, explicit cancellation and edge-only release semantics remain those of the wrapped law. Pending, available and acknowledging slots retain their ownership. Independent reset protocols are not added here.

The point-contract ID is SHA-256 of NUL-terminated zerglang.cdc-point-contract/1, the 32 raw bytes of the reference transfer contract ID, and the maximum microstep count as unsigned little-endian uint32. The original contract ID, value allocation/layout, resource costs, JSON and strictly-increasing-timestamp public operation are unchanged. The wrapper owns its transfer value independently; failures publish no partial value. It obeys the existing CDC width/capacity/work/allocation bounds, including wrapper costs. Its canonical zerglang.cdc-point-value/1 projection, cost formula and public API are specified in docs/core2-cdc-points.md. JSON is inspection only, not a restorable authority or proof. Physical-evidence and authority flags remain false. Full source-defined cross-discipline composition, guarded atomic horizons, instance snapshots/ZDE and physical validation remain separate obligations.

C2-CLOCK-007 — Retained-word endpoint resets. The pure cdc-retained-reset-values profile defines distinct retained-handshake/1 and retained-fifo/1 laws. Bridge-owned words, transit/availability metadata, acknowledgements and sequence counters MUST survive endpoint resets. Retention is an explicit implementation obligation, not an inferred property of a target or permission to ignore physical reset. This law has no cancellation operation; the legacy coordinated-reset law remains separately available.

Each endpoint independently declares no reset, synchronous sampling, or asynchronous assertion. Synchronous pins are sampled only at that endpoint’s active clock edge; an unclocked pulse does not change its effective reset. Asynchronous assertion takes effect immediately. No-reset endpoints reject an asserted pin. Reset wins over same-point transfer/progress. Deassertion requires the declared transfer-stage count of later active edges; release-coincident and recovery-finishing edges cannot transfer or progress a slot. Stopped clocks may retain ownership indefinitely. The unaffected endpoint continues its own legal progress, without acknowledging or clearing another endpoint’s retained state.

Initial values expose empty capacity but have no established clock baseline and cannot transfer. Events use bounded timestamp/microstep ordering and never invent edges. Word acceptance and consumption use old capacity/availability, preserving whole-word FIFO ordering and delayed acknowledgements. Conservation is accepted minus consumed equals unconsumed retained words; pending capacity additionally includes acknowledgements. Invalid destination output is canonical zero, not a lost-word declaration. Failure leaves the complete prior value unchanged.

The separate API, canonical contract/JSON, identity and cost law are specified in docs/core2-cdc-retained.md. Identity binds endpoint modes, edge roles, types, capacity, stages, point envelope and retention requirement. Legacy descriptors, values, costs and identities are unchanged. Checked source definitions, fresh Simulator execution, canonical instance snapshots/ZDE and target retention proof are separate gates. No pure value supplies live authority or physical evidence.

C2-CLOCK-008 — Checked retained-word definitions. The cdc-retained-source-structure profile admits CDC.retained_handshake_v1 and CDC.retained_fifo_v1 as pure checked definition constructors. They take the word source, source/destination clocks, offer, take, ready, valid and received port roles, then capacity, stages and an explicit retention-required integer. That final integer MUST be 1; it is a target-retention obligation, not proof or a legacy cancellation policy. The definition must account for every local port and contain exactly one transfer constraint. An unchecked assumption or trusted component spelling is not an alternative to a checked definition.

Bindings retain the existing typed domain/control provenance and coherent-join checks. The actual enclosing clock declarations determine each endpoint’s no/synchronous/asynchronous reset mode, polarity and edge. The source law fixes a 256-point microstep count; a backend cannot replace this identity with its own envelope. Preparing the retained reference contract is charged to elaboration’s full bounded allocation/work budget. Invalid bindings publish no partial graph.

Graphs containing this law use zerglang.hardware-structure/7; graphs without it keep their prior projections. A retained row names its separate law, reset modes, point envelope and retention obligation, not the coordinated v1 reset policy. Source definition identity uses the existing token framing; bound reference identity uses C2-CLOCK-007 with actual clock-domain identities. Trivia and source printing preserve identity. No legacy value/bridge layout, cost or identity is reinterpreted. The canonical source/projection is specified in docs/core2-cdc-retained-source.md.

Structural admission remains non-executable and supplies no physical evidence. Legacy simulation factories MUST reject this law; only a distinct guarded execution profile may meter all state and implement its reset semantics. Fresh Simulator authority, atomic publication, canonical snapshot/ZDE representation and target-retention evidence remain independently required.

C2-CLOCK-009 — Guarded retained-word execution. cdc-retained-simulation selects the separate zl_core2_cdc_retained_model_build_v3 clocked profile. Checked retained words follow C2-CLOCK-007 at (timestamp,0) with fixed point count 256. The profile may mix retained words with existing checked scalar, reset-release and legacy word laws; every legacy word retains its own coordinated-reset restrictions. Clockless async/intrinsic regions and composed horizons remain unadmitted. No old factory, identity or allocation cost changes.

Raw endpoint reset pins are normalized using their actual clock bindings; independent sampling/recovery belongs to the retained bridge. Domain register release still requires its checked synchronizer and is not a substitute for bridge-local recovery. Registers, offers, takes and words sample the common pre-state; scalar synchronizers retain their post-register sampling law. Preparation owns values but grants no authority. Open and every step require fresh exact-model Simulator admission and the hardware effect. Full retained allocation/work costs are charged; failed admitted steps keep those charges. Only a complete successful step publishes inputs, registers, bridge values and trace together. Trace words consumed at that step come from the prior output.

Identity domains are NUL-terminated zerglang.cdc-retained-record/1, zerglang.cdc-retained-model/1 and zerglang.cdc-retained-trace/1. Retained bridge traces embed zerglang.cdc-retained-value/1, including both endpoint resets, recovery counts, queue ownership and the actual bound contract identity; they MUST NOT relabel this state as legacy CDC. The canonical operation and cost contract is specified in docs/core2-cdc-retained-simulation.md. Canonical snapshot/ZDE projection remains a paired obligation. Logical execution does not establish device retention, analog safety, synthesis equivalence, physical-instance identity, promotion or stable Core-2 activation.

C2-CLOCK-010 — Quiescent drain and cancellation reset values. The pure cdc-quiescent-reset-values profile defines separate drain-handshake/1, drain-fifo/1, cancel-ack-handshake/1 and cancel-ack-fifo/1 laws. Its contract requires retained bridge storage/protocol metadata AND a reset coordinator whose fence covers both endpoints. These are explicit target obligations: independent raw reset pins alone do not establish that fence. No physical propagation time, hazard freedom or reset-tree implementation is inferred from this abstract law.

The endpoint sampling, local recovery and logical-point laws of C2-CLOCK-007 apply. An effective reset at either endpoint opens one quiescent epoch and inhibits new offers globally at that point. The opening request wins over all same-point queue progress and consumption. During the epoch, drain preserves and delivers owned words under ordinary take/backpressure, while cancellation accounts each unconsumed word exactly once and retains a cancellation notice. That notice needs stages eligible destination edges before an acknowledgement needs stages eligible source edges to return capacity. The creating/finishing edge cannot advance the next phase. Already consumed acknowledgements survive unchanged and are never cancelled again. Endpoint reset/recovery holds pause only their own protocol progress. Stopped clocks may postpone completion indefinitely.

No new offer is admitted until the queue is empty, both endpoints have recovered, and both clocks have independently completed stages further fence edges. Decisions use pre-state: the last acknowledgement/recovery edge cannot count as a fence edge, and the final fence edge cannot accept an offer. Reassertion restarts both fences without creating another epoch or cancelling again. Conservation is accepted = consumed + cancelled + unconsumed owned words; pending also includes ordinary and cancellation acknowledgements/notices.

The separate public API, canonical schema/identity, slots, bounds and exact transition order are specified in docs/core2-cdc-quiescent.md. Legacy and retained contracts, costs, identities and transitions remain unchanged. Preparation is pure and immutable, failure publishes no candidate, and authority/physical evidence remain false. Checked source binding, fresh Simulator admission, atomic runtime publication and canonical snapshot/ZDE lifecycle projection require separate explicit profiles. Domain register release cannot substitute for the bridge-local recovery or two-endpoint fence.

C2-CLOCK-011 — Checked quiescent source contracts. The separate cdc-quiescent-source-structure profile admits CDC.drain_handshake_v1, CDC.drain_fifo_v1, CDC.cancel_ack_handshake_v1 and CDC.cancel_ack_fifo_v1. Each has the eight typed word/control/clock port roles of C2-CLOCK-008 followed by capacity, stages, storage-retention-required and two-endpoint-reset-fence-required. Both requirements must be the static integer one. They record obligations, not proof of a retained physical coordinator or an instantaneous global reset gate. All exact arity, nominal types, declared clocks and source/destination ownership checks remain mandatory. Existing constructors retain their old arity and laws.

Actual declared clock/reset bindings determine modes and identity; the point count is 256. The complete pure quiescent preparation is charged to elaboration limits. Graphs containing these laws use hardware-structure/8, preserving other rows and all graphs without them. New rows expose both obligations, endpoint reset modes, the explicit drain/cancel-ack law and separate pure reference identity, never the legacy reset policy. Physical evidence and executable admission remain false. Definition framing is unchanged. Existing CDC/retained/composed model factories must reject these laws instead of selecting an old transition or identity. Source-expression construction remains independently bounded; pure vector support does not imply unadmitted vector constructors. The exact source and inspection contract is specified in docs/core2-cdc-quiescent-source.md.

C2-CLOCK-012 — Guarded quiescent clocked execution. The separate cdc-quiescent-simulation profile admits the checked C2-CLOCK-011 laws, optionally mixed with retained and legacy bridges, through an explicit model factory. It owns the checked source and binds new record/model/trace identity domains. Old factories and their descriptors, identities, traces and cost formulas remain fixed; preparation is not Simulator authority.

Open and each step require fresh live, unexpired, unrevoked, exact-model Simulator admission with the hardware effect and complete metered costs. A common pre-state supplies word data, offer, take and register updates. Scalar CDC samples after register updates. Each new word transition runs the pure quiescent law at (timestamp,0), with actual normalized raw resets. Domain register release, bridge-local recovery and the two-endpoint fence are separate obligations. Independent/stopped/coincident clocks obey C2-CLOCK-010 without invented edges.

Inputs, registers, all bridge candidates and complete trace bytes publish only after every bounded transition, settlement and serialization/hash succeeds. Failure keeps the last committed state and trace; already admitted work is not refunded. Revocation/expiry/scope/budget failures do not acquire admission by being copied into a model. Full bridge JSON retains cancellation notices/acks, epoch and both recovery/fence states, not merely ready/valid bits.

The new quiescent-clocked profile uses simulation-snapshot/2 and simulation-trace-page/2 for cached observation, preserving all v1 profile bytes. Whole frames retain the new value schema; inspection neither charges an operation nor confers live authority. Canonical runtime ingestion and visible ZDE lifecycle coverage are required alongside the new state or in an explicitly paired follow-up. Clocked execution does not admit asynchronous horizons, Logic-vector source initializers, physical retention/safety, synthesis equivalence or fabric access. The exact API, identity, resource and observation contract is specified in docs/core2-cdc-quiescent-simulation.md.

Asynchronous and intrinsic behavior

C2-ASYNC-001 — Clockless state. Async state is legal without a clock. Guarded drives, feedback and completion detection require a declared evolution law. Its assumptions identify each affected path/fork, delay intervals, transport or inertial scheduling, hazard policy and any environmental protocol. A named isochronic fork identifies its branches and skew obligation. An informal label such as fast or QDI is insufficient. Handshakes are reusable contracts, not compulsory wrappers for all asynchronous circuits.

C2-ASYNC-002 — Delay and event law. A transport drive enqueues every change at the declared delay; an inertial drive cancels a pending change if its guard ceases to hold before that delay. Interval delays denote all allowed choices; a deterministic simulation seed samples a trace but cannot prove universality. At each time, equal-time drives commit together and enabled processes evaluate against the resulting snapshot in successive microsteps. Feedback with no admitted delay or stability evidence is rejected. An event/microstep budget failure is non-convergence, never successful settling. Oscillators with positive delay may run over a bounded observation horizon without reaching a fixed point. Hazard freedom, progress and output stability are separate obligations; neither a passed trace nor source order discharges them.

C2-ASYNC-003 — Bounded reference scheduling values. The native core2_async.h primitive implements the versioned guarded-event-queue/1 law described in docs/core2-async-values.md. Its immutable values alternate a complete collecting drive snapshot with a sealed queue, then commit all events at the next admitted logical point simultaneously. Transport preserves queued changes; inertial withdrawal/replacement cancels only uncommitted events. Zero delay advances a microstep; interval choices remain explicit and bounded. Conflicting equal-point writes and skipped causality fail closed. Pending-event and microstep exhaustion reports non-convergence, not a settled observation.

The separate async-reference-values feature does not admit source feedback, evaluate source guards, discharge hazard/fork/environment obligations, create live authority or prove physical timing. Nonzero obligation identities retain references, not proof. Reference contract identity binds the typed initial state and scheduling law but remains separate from source interface/semantic, realization, implementation, instance and evidence identities. Future source and guarded execution gates must retain those distinctions and charge bounded operations before publishing candidate state or trace.

C2-ASYNC-004 — Checked source reference assumptions. The async-source-structure feature admits initialized clockless state under the closed versioned Async.transport_v1 and Async.inertial_v1 source laws, with explicit delay intervals and overlap policy. Optional Async.four_phase_v1 and binary Async.isochronic_fork_v1 laws bind real protocol/fork endpoints; they are not mandatory wrappers. Their signatures, bounded path checks and logical-tick semantics are defined in docs/core2-async-source.md.

Each driven state has exactly one checked timing law and guarded owner. Guards, data and obligation endpoints retain discipline provenance; an output alias cannot hide a crossing. Binary fork branches form a canonical unordered set and their admitted independent delay intervals must satisfy the declared skew. More general correlated schedules and physical path proofs remain unsupported. Four-phase roles remain ordered and denote explicit trace restrictions, not progress guarantees. Source-only records and definition lineage never discharge the retained obligations, grant execution authority or widen ZLM3 3.0 admission.

C2-ASYNC-005 — Guarded reference horizons. async-simulation prepares an owned clockless execution model under core2_async_simulation.h. Its separate model identity binds initialized state, guards and data equations, typed hierarchy, checked delay/hazard/protocol/fork definitions and resource limits. Preparation grants no execution authority. A run starts at logical (0,0), then visits all due events, simultaneous external batches and the requested finite horizon; it cannot skip same-time microsteps at that horizon. Complete guard/drive evaluations share one post-event snapshot. Explicit per-point, per-target interval choices are retained in the trace. They select one allowed schedule, not a probability distribution or proof of all schedules.

Every evaluated point requires a fresh model-scoped Simulator admission and hardware effect. The entire horizon publishes inputs, state, queue and trace atomically; failed attempts retain the prior result without refunding admitted work. Point, queue, microstep, allocation and trace bounds fail closed. Four-phase monitors check their initial and every subsequent logical observation. The checked binary fork’s independent-delay envelope remains separate from physical isochronicity evidence. Trace success never discharges physical obligations. The versioned operation, canonical records, identity and resource contracts are specified in docs/core2-async-simulation.md.

Existing combinational, clocked and CDC factories retain their own gates; clocked/CDC/intrinsic composition is not implicitly admitted by this profile. Stable Core-2 and executable ZLM3 admission remain unchanged.

C2-ASYNC-006 — Checked async-to-clock composition. composed-simulation selects the distinct native model/horizon law in core2_composed_simulation.h. It admits checked async state and named clock domains with explicit source CDC definitions. CDC.sync_external_v1 may sample clockless async provenance; raw temporal aliases, unproved coherent joins, temporal clock/reset generation and clocked-to-async crossings without a checked bridge law remain rejected. The existing word-transfer coordinated-reset and release laws still apply. This is not general bidirectional channel composition or intrinsic execution.

At each point, due async events and external input updates precede a common pre-state. Ordinary registers and word offers/takes sample that pre-state; scalar CDC samples post-register data. Point-aware bridges derive at the exact logical (timestamp,microstep), followed by settling, protocol checks and guarded scheduling. Microsteps cannot invent clock edges. The inclusive async queue limit is explicitly restricted to 0..255; CDC point counts are that limit plus one. The legacy queue’s separate limit is not reinterpreted.

Each point consumes fresh exact-model Simulator authority and hardware effect. The entire horizon publishes inputs, ordinary and async state, queue, all CDC values and trace atomically. Late failures retain prior published state and all admitted charges. Identity domains are NUL-terminated zerglang.composed-record/1, zerglang.composed-model/1 and zerglang.composed-trace/1. Bridge records also bind the point-wrapper contract identity. The model binds both resource envelopes. The canonical operation, costs and trace law are specified in docs/core2-composed-simulation.md. Old factories, identities, costs and trace schemas stay unchanged; old evolution entry points reject the new profile. No physical obligation, equivalence claim or promotion is discharged.

C2-ASYNC-007 — Retained-word composed horizons. The distinct retained-composed-simulation profile combines the C2-ASYNC-006 event order with C2-CLOCK-007/008 retained word ownership. The explicit retained-composed model, run and view entry points in core2_composed_simulation.h select this law. Legacy run/view entry points reject it, and its entry points reject legacy models. This does not widen reverse clock-to-async crossings, intrinsic execution, coherent-join admission or the set of supported source bridge laws.

Retained bridges keep the fixed source-bound point count 256 and exact bound reference identity. Legacy scalar, reset-release and word bridges use their point-aware wrappers with count equal to the inclusive queue bound plus one; the queue bound remains 0..255. Narrowing a queue limit cannot rewrite a retained contract. Every bridge derives at the actual timestamp/microstep. No same-time step creates an edge, retires an acknowledgement or counts reset recovery without its endpoint clock edge. Scalar setup/hold restrictions and domain register-release synchronizers remain mandatory and distinct from the retained endpoints’ raw-reset sampling and local recovery.

Due async state and input batches precede the common pre-state. Registers and word controls/data sample that snapshot; scalar bridges sample after register updates. All retained, legacy point and async queue allocation/work costs are included. Fresh exact-model Simulator authority and the hardware effect are required per visited point. The complete horizon publishes inputs, registers, async state, queue, all bridges and trace atomically; a late failure leaves the prior result untouched and preserves already admitted charges. Partitioning an otherwise identical schedule at existing input-batch boundaries preserves the visited points, resulting trace and total charges.

The NUL-terminated identity domains are zerglang.retained-composed-record/1, zerglang.retained-composed-model/1 and zerglang.retained-composed-trace/1. Each bridge record additionally binds its execution point-contract identity: the retained contract for retained words, the point-wrapper contract for legacy bridges. The model binds both resource envelopes. Traces embed each bridge’s own schema and a sealed queue at each point, never a relabeled legacy value. The canonical operation, framing and costs are specified in docs/core2-retained-composed-simulation.md. Old profile identities and costs remain unchanged. Canonical snapshot/ZDE projection and physical-retention, analog-safety, synthesis and promotion evidence remain separate obligations; no logical trace activates stable Core-2 or executable ZLM3 admission.

C2-ASYNC-008 — Quiescent composed horizons. The separate quiescent-composed-simulation profile combines C2-ASYNC-006 event ordering with the checked C2-CLOCK-011 drain/cancel-ack contracts. Only its explicit model/run/view entry points select it; every old executor retains its exact profile gate. The model requires actual supported async state, hardware-preview admission and inclusive queue microstep maximum in 0..255.

Quiescent and retained words retain their full source-bound contracts with 256 points per timestamp. Scalar/reset-release/legacy words keep point-aware wrappers with count equal to the queue maximum plus one. Every bridge derives at the actual timestamp/microstep. Neither a same-time async step nor the absence of an endpoint edge advances word ownership, cancellation acknowledgements or empty epoch fences. Normalized raw resets feed word endpoints; held register-release signals remain a separate domain obligation.

The complete horizon publishes signals, registers, async state, queue, all bridge values and trace atomically. Each visited point requires fresh exact-model Simulator authority, the hardware effect and full costs; admitted charges survive failure. Cancellation in a candidate horizon cannot leak through a later failure. Partitioning at existing input-batch boundaries preserves points, identity and aggregate charges. Scalar aperture and existing direction/ownership restrictions are not weakened.

Distinct NUL-terminated record/model/trace identity domains are zerglang.quiescent-composed-record/1, zerglang.quiescent-composed-model/1, and zerglang.quiescent-composed-trace/1. Bridge fingerprints additionally bind their actual execution contract identity. Traces preserve each bridge’s schema and full coordinator lifecycle. Native snapshot/page envelopes are version 2, with profile quiescent-composed; old profiles keep version 1. All records remain reference-only with physical evidence and acceptance false.

The full operation and regression fixture are in docs/core2-quiescent-composed-simulation.md. Canonical Zerg/ZDE lifecycle projection is a paired obligation, not satisfied by native JSON alone. Retention and a two-endpoint reset fence remain explicit implementation requirements; a logical horizon does not establish physical reset propagation, device evidence, synthesis equivalence, stable activation or executable ZLM3.

C2-ASYNC-009 — Checked clock-to-async observation. The separate clock-observe-source-structure feature admits a content-bound bridge definition under CDC.clock_observe_v1. It directly binds one actual initialized register, its named source clock and an exactly typed asynchronous output. It owns no queue, destination clock, delivery protocol or additional register. The explicit bidirectional executor observes the common post-register value at each logical point; initialization, reset assertion and release remain owned by the source register’s domain. The async consumer retains its own explicit evolution law and pending events. No implicit delay or physical coherence is inferred.

Source-only inspection uses hardware-structure/9 with separate definition and bound reference identities, initializer/reset ownership and explicit outstanding obligations. Raw aliases, foreign-domain bindings, unproved coherent joins and unsupported temporal feedback do not acquire admission. Existing execution profiles remain closed to this new law. The exact constructor, hash framing and allocation/work rules are in docs/core2-clock-observe-source.md. Execution and canonical runtime/ZDE projections are paired obligations, not implied by source acceptance. Stable Core-2 and executable artifact admission remain unchanged.

C2-ASYNC-010 — Bidirectional composed horizons. The separate bidirectional-composed-simulation feature combines checked clock observation with the prior composed, retained and quiescent laws. It admits only an explicit clocked-register observation and an initialized async consumer with a supported declared evolution law. Initialized async state may feed an already-supported scalar synchronizer back to a clocked domain. Direct bridge-fed temporal cycles, raw aliases, unproved coherent joins and inferred delays remain unsupported.

Each logical point commits due async events and simultaneous inputs before the common pre-state. Registers and word transfers sample that pre-state. The clock observation reads the resulting post-register value, then async drives seal the queue using their explicit delay choices. The observation owns neither queue capacity nor reset state; a source reset does not flush the consumer’s pending events. Transport retention and inertial pulse cancellation are consumer laws, not guarantees of observation. Same-time microsteps invent no extra clock edges. Zero-time cycles exhaust their declared bound, not silently settle.

Every admitted point requires fresh exact-model Simulator authority and full charges. Failure publishes none of the horizon’s new state or trace and retains admitted charges. Both resource envelopes and all source/evolution identities bind the distinct bidirectional record/model/trace domains. Old profiles and their serialization, identities and costs remain unchanged. Snapshot/page version 3 carries the separate profile and bounded clock_observations with source ownership, actual logical point, value and raw/held/applied reset facts. Canonical runtime/ZDE representation remains a paired acceptance obligation. No observation or logical run grants authority, physical evidence, discharged implementation obligations, synthesis equivalence or stable activation. Exact profile admission, framing and costs are specified in docs/core2-bidirectional-composed-simulation.md.

C2-INTRINSIC-001 — Physical dependence. Intrinsic realizations bind part, package, speed grade, placement/routing, supply/temperature ranges, external loads, measurement protocol and named devices. Device-local evidence cannot be generalized to a family. Population claims additionally bind sampling, held-out devices, measured variation and statistical confidence. Placement, routing, environment or device changes invalidate the affected evidence and require re-admission. Logic simulation alone cannot establish a physical coupling claim. Intrinsic models may expose uncertainty and empirical behavior; they must not promise universal clockless speed or portability.

See diagnostics and conformance for rejection meanings and examples.