The reconciler fan-in blind spot: a declared sink reconciles GREEN with zero producers

Date: 2026-06-01 · By: Operations (Process Engineer)
Topic: reconciler-fan-in-blind-spot
Status: active

Append-only, dated, one topic per entry. Captured first (inbox); a “Next time” bullet is promoted into SOP-078 + the Operations charter risk register, and a CI complement is proposed (see Promotion).

What we learned

The Handoff Register reconciler (scripts/handoff-reconcile.mjs) treats a fan-in sink as always-satisfied, so a sink can read GREEN with zero producers — a real dropped-handoff failure the gate is supposed to catch.

What a fan-in sink is. A consumer declares an input with a placeholder producer for a trigger — e.g. the Archivist’s approved document ← from <authoring agent/unit> · "artifact approved". The reconciler records this as a sink keyed owner|trigger (scripts/handoff-reconcile.mjs:249-252). The sink “absorbs” every producer that emits that trigger to that consumer, so a shared trigger into the sink is not flagged as OVERLAP (spec §3.1.1 R1).
The blind spot, exactly. When the reconciler matches an output to a sink it checks only sinks.has(\${consumer.id}|${e.trigger}`) (scripts/handoff-reconcile.mjs:320) — a set-membership test. When it walks **inputs**, a placeholder-producer input is skipped as "a declared sink, not dangling" (scripts/handoff-reconcile.mjs:351). **Neither path asserts the sink has ≥1 producer.** So a sink whose producers all vanish — renamed, deleted, or never authored — stays GREEN. The exact failing case: an Interface Contract declares X ← from <…> · “T”(a sink) but **no** block anywhere emits→ X · “T”. The reconciler reports the sink as clean and the headline metric reads GREEN — 0 unmatched edges`, even though nobody is feeding the sink.
Why a point-to-point edge does not have this hole. A named-consumer input (← from Archivist · "manifest verified", the SRE seam) is matched against a real producer output (scripts/handoff-reconcile.mjs:371-379); if the producer is absent and authored, it reads GAP — dangling dependency. The hole is specific to the placeholder (<…>) sink form, which is the very form that makes fan-in convenient.
The dead end to avoid. The tempting “fix” is to rebuild the reconciler to require every sink to have a producer. That is the wrong move right now: it risks regressing the Wave-1 partial-register semantics (R1–R5) that let a partial register reconcile clean for a wave’s edges (a not-yet-authored producer is correctly pending, not a gap). A sink with zero producers because its producers are in a later wave is legitimate; a sink with zero producers after all its waves have landed is the defect. The reconciler alone cannot tell those apart mid-rollout, so the right instrument is a separate, Phase-2 CI complement — not a change to the gate’s per-wave logic.

Why it matters

The whole program’s “done” leans on one number — 0 unmatched edges (master plan §10) — as proof of seamless handoffs. If a sink can be GREEN while orphaned, the headline metric over-reports integrity: it proves “no mismatched edges” but not “every declared sink is actually fed.” Q&R flagged exactly this. GREEN is necessary, not sufficient; treating it as sufficient is how a real dropped handoff ships behind a green gate.

Next time

Read GREEN as necessary, not sufficient — at Phase-2 close, separately confirm every declared fan-in sink has ≥1 matched producer in the fully-authored register.
Do not rebuild the reconciler to enforce this per-wave; it would break the legitimate pending-producer case (R3). Add a complement instead.
Proposed CI complement (Phase 2): a check that, over the full register, asserts each declared sink (owner|trigger with a placeholder producer) has ≥1 matched producer edge; emit WARN while waves are partial and FAIL once all of a sink’s producer waves have landed. Wire it via SOP-079 (do not edit .github/ this wave — propose it).

Promotion

Promoted to: docs/sop/SOP-078-handoff-reconciliation.md (Guardrails — “GREEN is necessary, not sufficient; the fan-in blind spot”) and docs/units/operations/charter.md (Risks, OR-1). The CI complement is proposed, not yet built — tracked as a Phase-0 recommendation (R1) and a cross-cutting flag to Q&R.
Supersedes / superseded by: none. (Builds on the reconciler semantics in interface-contract-spec.md §3.1.1; this entry adds the zero-producer hazard those rules do not close.)