Alias Resolution as Navigational Traversal

Mechanism

Each candidate alias is a discovery anchor in its own right, with its own lineage and its own admissibility surface. Resolution begins when two anchors observe sufficient evidence that they may denote the same referent. Evidence may originate from a query that produced both as overlapping responses, from a structural similarity computed across their lineages, or from an explicit identity assertion delivered by a source whose claims are admissible for that purpose. The candidate pair enters a pending-merge relation, which is itself recorded as a lineage edge between them so the consideration is itself auditable.

The bounded local exchange follows. Each candidate transmits a digest of its current state, its provenance summary, and its admissibility envelope. The receiving candidate evaluates the digest against the collision policy. Where the digests are consistent, where neither anchor has a tamper indicator above the resolution-allowed ceiling, where both admissibility envelopes permit merging at the requested resolution, and where the rate limiter has not exhausted the merge budget for the originating source, the exchange progresses. Where any precondition fails, the exchange is recorded and dropped without merge.

Canonicalisation, when the exchange progresses, produces a single canonical anchor. The collision policy determines which side of the pair becomes canonical: prior-anchor wins by default, but policies may select the higher-integrity anchor, the higher-recall anchor, or a freshly minted anchor that subsumes both. The non-canonical side becomes a redirect, retaining its identifier so prior references continue to resolve, but pointing structurally at the canonical record. Lineage from both originals is preserved; the canonical anchor accumulates lineage edges from each merged predecessor.

Rate limiting is applied at multiple scopes. A per-source budget caps how many merges a single source may induce within a window, blocking a flood of confected aliases from one origin. A per-pair budget caps how many times the same pair may attempt merge after a refusal, preventing pathological retry loops. A substrate-wide budget caps total merge throughput, preserving capacity for navigation traffic during periods of high resolution activity. Exhausted budgets cause the exchange to be deferred, not lost: the candidate pair remains in pending-merge until budget is restored.

The bounded character of the exchange is essential to the mechanism's resistance against adversarial conditions. Because the exchange is local in the sense that only the two candidate anchors and a small consultation surface are involved, an adversary cannot induce global state changes by contributing evidence to a single point. Because the exchange is bounded in volume by the rate limiter, an adversary cannot induce indefinite work by contributing evidence at high rates. Because the exchange is auditable through its lineage edge, even refused exchanges leave a record that downstream investigators can examine to understand patterns of attempted alias coercion. These three properties together convert what would otherwise be an unbounded merge surface into a metered, observable, and bounded operation.

Conflict, where the digests disagree on a feature that the policy treats as identity-determining, halts the exchange and records a collision event. Repeated collisions on the same pair invoke a stronger policy: human attestation, escalation to an operator, or transition of one of the anchors into review. The substrate does not silently choose between conflicting evidence; it surfaces the conflict and lets governance resolve it.

Operating Parameters

The mechanism is parameterised by the evidence threshold required to enter pending-merge, the digest format used in the exchange, the collision-policy table mapping conflict patterns to actions, the per-source and per-pair and substrate-wide rate budgets, the canonicalisation rule, and the redirect retention policy. Lower evidence thresholds produce a more aggressive resolver that risks false merges; higher thresholds produce a conservative resolver that risks duplicate persistence. Digest format trades fidelity against transport cost: richer digests detect subtler conflicts at higher bandwidth.

Collision-policy entries map specific conflict patterns to outcomes such as defer, escalate, refuse, or merge-with-side-effect. Rate budgets are typically calendar-aligned for human auditability and may be overridden per source where a known-clean source is permitted higher throughput. Canonicalisation rules and redirect retention determine the long-term shape of the substrate: aggressive canonicalisation reduces working set size, generous redirect retention preserves backward-compatibility with prior references.

Alternative Embodiments

The exchange may be synchronous, with both candidates blocking until a verdict is reached, or asynchronous, with the originating side enqueuing a request and proceeding while the verdict materialises. Synchronous exchange produces simpler reasoning at the cost of latency; asynchronous exchange scales better at the cost of intermediate states that must be reconciled when verdicts return.

Digests may be cryptographic hashes of canonical state, structured summaries amenable to semantic comparison, vector embeddings supporting approximate equivalence tests, or hybrids that pair an exact hash with a coarse semantic vector. Canonicalisation may produce a fresh anchor that subsumes the originals, may promote one of the originals, or may maintain both with a binding record asserting their equivalence without physically merging them. Redirects may be permanent, time-limited, or evicted on access decay.

Rate limiters may be token-bucket, leaky-bucket, sliding-log, or learned controllers that adjust budgets based on observed conflict rates. Collision policy may be a static table or a learned function trained on adjudicated past collisions. The mechanism's contract is independent of these implementation choices.

Composition

Alias resolution composes with the lineage subsystem because every consideration, exchange, merge, and refusal is recorded as a lineage edge. It composes with the admissibility gate because the merge precondition includes admissibility envelope compatibility, and because reads against a redirected alias traverse the redirect under the canonical anchor's admissibility. It composes with the integrity-drift mechanism because anchors above the resolution-allowed tamper ceiling are excluded from merge, preventing a tampered anchor from polluting a clean canonical record.

It composes with the privacy envelope where applicable, because a merge that crosses cohort boundaries inherits the more restrictive envelope. At the system boundary, it composes with downstream consumers through stable redirects, so external references survive canonicalisation without breaking. It composes with the discovery scheduler because the scheduler can deprioritise pending-merge work during periods of high navigation traffic, deferring expensive canonicalisations into quieter intervals without losing the pending-merge state.

Composition with revocation is also significant. Where a participant in a pending-merge is revoked before the exchange completes, the exchange terminates without merge and the revocation is recorded as a recognised reason for refusal. Where a participant is revoked after canonicalisation has occurred, the canonical record's lineage retains the revoked predecessor's contribution as a tombstoned edge, so post-revocation reads against the canonical anchor neither expose the revoked material nor lose the audit trail of the merge that brought it in.

Prior-Art Distinction

Conventional alias systems treat resolution as a lookup that bypasses governance applied to other operations. Entity-resolution systems in the database literature merge records by similarity score but typically without rate-limited exchanges, without per-source merge budgets, without lineage-recorded consideration of refused merges, and without cascade-aware composition with integrity and privacy state. The disclosed mechanism unifies alias resolution with the substrate's general traversal governance: every step is admissibility-evaluated, every consideration is lineage-recorded, every merge is rate-limited at multiple scopes, and every conflict is surfaced rather than silently adjudicated.

Failure Modes and Remedies

The mechanism is designed against five failure modes. The first is the alias-flood, in which an adversarial source contributes a large number of confected aliases to coerce merges by sheer volume. The remedy is the per-source rate budget, which caps how many merges any single source may induce within a window irrespective of the apparent strength of its evidence. The second is the retry-pathology, in which a refused candidate pair is repeatedly resubmitted until the substrate accepts. The remedy is the per-pair budget plus refusal-cooldown, which makes each retry more expensive than the last. The third is the silent-merge, in which two anchors are joined without their pre-merge histories being preserved, leaving downstream consumers unable to reason about either original. The remedy is the lineage-preservation rule under canonicalisation: both originals contribute lineage edges to the canonical record, and the redirect remains a navigable identifier rather than being discarded.

The fourth is the conflict-collapse, in which two anchors disagree on an identity-determining feature and the resolver silently picks one. The remedy is the explicit collision policy with escalation paths: a disagreement on a feature flagged as identity-determining halts the exchange and records a collision rather than producing a merge. Repeated collisions invoke human attestation rather than being adjudicated automatically. The fifth is the broken-reference, in which an external consumer holds a reference to an alias that is canonicalised away, and the reference subsequently fails. The remedy is the redirect retention policy, which preserves the alias as a navigable pointer to the canonical record so external references continue to resolve transparently.

A further design consideration is the interaction with eventual consistency. In a substrate with multiple replicas, a merge committed at one replica must propagate to others before global consistency is achieved. The mechanism is designed to tolerate this lag: a redirect installed at the committing replica becomes the source of truth, and reads at lagging replicas that resolve to the pre-merge alias are answered correctly because the redirect, once propagated, points to the same canonical anchor.

Disclosure Scope

This article discloses the bounded local exchange as the resolution primitive, the collision policy table mapping conflict patterns to governed outcomes, the multi-scope rate-limiting structure protecting against flood and retry pathologies, the canonicalisation and redirect mechanism preserving prior references, and the lineage-recorded pending-merge relation that makes consideration itself auditable. Claims may be directed to the exchange protocol, to the multi-scope rate limiter, to the collision policy as a structural component of the substrate, and to the cascade composition with integrity and privacy state. Embodiment choices are listed to broaden rather than narrow the claim surface.