DEV-1750: lift time_shift × cross-model guard + shifted-CTE fragment join discovery

DECISIONS.md

@@ -117,3 +117,4 @@ implementation detail. Include issue refs when known.
 - 2026-08-11 — Deletion, sweep, docs: P-J states 2+3 executed (DEV-1749, PR 6 of 6, closing the DEV-1742 consolidation). Every mechanism PRs 1–5 + DEV-1763 left production-unreferenced (P-J state 1) is now **deleted** together with its pinning tests (state 3), after confirming the desired behaviour is pinned by tests on the new code. Removed from `generator.py`: the five legacy per-path `ValueKey` renderers and the three arithmetic composer shims (`render_value_key` / `render_arithmetic` are the sole paths, P-G); the first/last host-base ranked machinery — `_build_first_last_base_select`, `_build_ranked_subquery_from_planned`, `_has_first_last_aggregate`, the rn-suffix + filtered-rn/match maps and raw-filter-leak fallback in `_build_agg`, `FirstLastRenderState` and its `first_last_state` threading, and the production-dead `is_first_or_last` arm of `_render_cross_model_cte` (first/last is a `RankedAggregatePlan` CTE since DEV-1748, P-C); the Mode-A model-filter qualify chain (`_render_model_filter_sql`, `_qualify_mode_a_sql_filter`, `_render_mode_a_predicate`, `_filter_join_paths`, `_expand_degenerate_derived_root`, `_column_ref_is_derived`, `_predicate_references_derived`) plus the dead `FilterPhase.text_columns` field — the Mode-A door (`ScopeFrame.enter_predicate`, DEV-1745) is the one door, P-A; the four legacy ORDER BY resolvers (`_build_combined_order_by_sql`, `_resolve_combined_order_term`, `_planned_order_by_sql`, `_apply_order_limit_from_planned`) superseded by `resolve_order_term`; `_null_safe_join_pair_sql` (string round-trip superseded by `render/joins.py`, P-I); `_build_transform_sql`+`_SELF_JOIN_TRANSFORMS`, `_build_outer_wrap`+`_strip_trailing_pagination` (planned outer-wrap delegates to `SqlDialect.emit_outer_wrap`, P-H), and `_cte_name_from_alias` (superseded by `naming.cte_name_from_alias`, P-F). Removed from `cross_model_planner.py`: the formula-text re-rooting island (`_local_agg_formula`, `_render_ref_formula`, `_scalar_formula_literal`, `_reroot_ref`, `_host_ref_path`, `_REROOT_BIND_ERRORS`) and two further dead helpers (`_classify_subplan_filters`, `_filter_ref_paths`) — cross-model re-rooting is typed keys end to end (`reroot_aggregate_key` / `reroot_value_key`), no text round-trip, P-E. **B12 (ratified):** `_build_agg`'s dispatch now reads the single `AGG_REGISTRY` classification table (DEV-1744) — `_AGG_FUNCTION_MAP` (with its dead `COUNT_DISTINCT`/`MEDIAN` string values), the second inline class map, and the generator-local stat-name frozenset are gone; the two-phase resolution order (own-inner builders → shared inner + filter wrap → distinct/median/simple) is preserved byte-for-byte, SQL-identical. **Consolidations landed:** transform-op registries single-sourced (`RANK_FAMILY_TRANSFORMS`, `TIME_TRANSFORMS` from `core/formula.py`), the cube identifier regex re-pointed at `core/refs.IDENTIFIER_RE`; the `_bare_column_refs` regex kept for its remaining validation role only. **Deferred to DEV-1777** (pure refactors, no SQL change, carry regression risk needing their own byte-identity checks): step-CTE emission extraction, the throwaway-`ScopeFrame` consolidation + `_resolve_explicit_time_col` dead-branch removal, and the positional-index couplings. The remaining bare-identifier divergences (`schema_drift`, `.isidentifier()` sites) went to DEV-1771. `docs/architecture/sql-generation.md` was rewritten as the P-A – P-J principles document. Every deleted symbol's docstring/comment references were swept to present-tense truth across 16 files. No emitted SQL changed; the full non-integration suite is green (3 xfails, all ticketed — DEV-1752 / DEV-1729 / DEV-1445 — retained per the F18 inventory).
 - 2026-08-12 — Single-source bare-identifier detection narrowed to `schema_drift` only (DEV-1771). Of the three ad-hoc detectors the issue named, only `schema_drift._is_bare_identifier` was re-pointed at the canonical `core/refs.IDENTIFIER_RE` (its char-loop `all(c.isalnum() or c == "_")` accepted non-ASCII in every position; the regex rejects only a non-ASCII *leading* char, since `\w*` still matches Unicode after the ASCII-only lead class). The two `stage_planner` `.isidentifier()` sites (`_saved_model_measure_type`, `_bare_saved_measure_name`) were left as-is: they gate `get_measure(name)` and `ModelMeasure.name` is already ASCII-constrained by `_NAME_PATTERN`, so any string that could match a real measure passes both predicates identically — the flip is observationally a no-op, so no test could fail without it. The two `generator` `.isidentifier()` sites (`_resolve_sql`; the no-bundle branch reached via the `col.name` fallback) were also left as-is: `Column.name`/`Column.sql` are NOT ASCII-constrained, and routing a non-ASCII-leading physical column (e.g. Cyrillic `год`, common in RU/UA schemas) through `_parse()` drops the model-relation qualifier (`m."год"` → bare `год`) — a correctness regression on legitimate input, exactly the issue's "surface and stop" guard. The one shipped behavior change is a drift false-negative: a base column aliasing a bare non-ASCII-leading physical name (`Column(name="year", sql="год")`) reclassifies base→derived, so a dropped physical `год` is no longer flagged by `_diff_sql_table_columns` and is instead scanned as a ref by `_first_dropped_sql_column_ref` (author-accepted; advisory-only, never query correctness). `.match()` (not `fullmatch`) and the retained `.strip()` match the existing `cube`/`dbt`/`osi` reuse sites.
 - 2026-08-16 — Aggregated slot-type and display-format inference share one classifier (DEV-1788, follow-up to DEV-1784's Option A). `aggregated_type` (slot `DataType`) and `_infer_aggregated_format` (response `NumberFormat`) had disagreed on the stat/parametric family: type said `DOUBLE` while format fell through to inherit the source column's format, so `revenue:stddev_samp` was typed `DOUBLE` yet displayed as currency. Both now read a single `classify_aggregation` (`core/enums.py`) returning one of four `AggregationValueClass` buckets, and each function maps the bucket to its own output — no per-name branching survives, so the two axes cannot drift. The four builtin frozensets (`INTEGER_AGGREGATIONS`, `PRESERVING_AGGREGATIONS`, `FLOAT_SOURCE_UNIT_AGGREGATIONS`, `FLOAT_PLAIN_AGGREGATIONS`) partition `BUILTIN_AGGREGATIONS`, pinned by a completeness test; custom/model-defined aggregations hit the `PRESERVING` fallback (inherit type & format), unchanged. **Semantics chosen (Option B, unit-correct):** `avg`/`median`/`weighted_avg`/`percentile`/`stddev*` are `DOUBLE` but keep the source's UNITS, so display format inherits the source (falling back to `FLOAT` when the source has none — keeping type `DOUBLE` and format `FLOAT` coherent for unformatted measures, and confining the change to formatted ones); `corr`/`var*`/`covar*` are dimensionless/squared/product units, so they display as plain `FLOAT` regardless of source. `aggregated_type` is behaviourally unchanged (only restructured). **Net user-visible change, all in `_infer_aggregated_format`:** avg-family of a FORMATTED measure now inherits that format (was `FLOAT`); `corr`/`var*`/`covar*` now `FLOAT` (was inherit); `stddev*`/`percentile` unchanged (already inherited). Drift guard extended to the full four-bucket table and routed through the public callers (`measure_key_type` / `measure_key_format_description`), plus response-metadata assertions for the stat/parametric family.
+- 2026-08-18 — `time_shift` / `consecutive_periods` over a cross-model aggregate render; the blanket 7b.15e guard is narrowed (DEV-1750, spun out of DEV-1745, deliberately OUTSIDE the ratified DEV-1742 6-PR chain). **Part 1** wires the Mode-A template-fragment join discovery into the shifted (`time_shift`) CTE through the same one door the host base (`_resolve_agg_inputs_via_scope`) and the `_cm_` CTE (DEV-1745) use: `_emit_time_shift_ctes_for_planned`'s inner-aggregate block now calls `_register_fragment_kwarg_joins` and resolves the aggregate's source (widened to path-bearing via `getattr(source, "path", ())`, Codex F5), positional column args (skipping the DEV-1526 path-bearing `ColumnSqlKey` residual), and column-ref kwargs through `shifted_scope` — so a crossing default param (`amount:wscaled_sum`, `w='customers__regions.weight'`) pulls its `customers`→`regions` join into the shifted CTE's FROM instead of emitting `SUM(orders.amount * customers__regions.weight)` with no join (SQL no database binds). The prior "provably no-ops today" comment is now load-bearing. **Part 2** lifts the guard by giving the cross-model transform chain (`_render_cross_model_transform_chain`) the same three-arm Kahn loop the local chain runs — window batch + `time_shift` + `consecutive_periods` — dispatching the two temporal ops to the SAME per-op emitters (`_emit_time_shift_ctes_for_planned` / `_emit_consecutive_periods_ctes_for_planned`), so Part 1's join discovery serves both chains and the loops cannot drift on discovery. The shared step BODIES — the Kahn-batch split, the window step CTE, the two temporal emitters, the POST-phase arith/scalar materialisation step, and the finalise/outer-wrap tail — are extracted into shared `SQLGenerator` helpers (`_classify_ready_transform_layers`, `_emit_window_batch_step`, `_emit_time_shift_layers`, `_emit_cp_layers`, `_emit_unmaterialised_post_phase_step`, `_finalize_planned_transform_chain`) that both chains call, verbatim → byte-identical emission (a Sonar-duplication down-payment on DEV-1799). The ONLY remaining per-chain difference is the window-vs-temporal dispatch ORDER within a Kahn batch (local: window first; cross-model: temporal first) — unifying that reorders cross-model CTEs and re-blesses golden, so it stays deferred to DEV-1799. `source_model` + `bundle` are threaded in; `_build_shifted_cte_where_parts` carries the 7b.3c frame-bound invariant unchanged. **Guard narrowed, not removed** (`_guard_target_grain_time_shift`, runs before the emitter): the ONE unrenderable shape is a `time_shift` whose inner aggregate is TARGET-GRAIN cross-model — detected by **plan ownership** (its `CrossModelAggregatePlan.cte_root_model is None`; host-rooted isolation sets it to the host name — Codex F1, pinned at the planner level in `test_dev1750_guard_ownership.py`), NOT by formula text — because host-rooted re-aggregation would multiply target rows through the 1:N join. `consecutive_periods` is lifted **entirely**: it reads a materialised alias and never re-aggregates, so it has no target-grain failure mode (executed for the target-grain-inner shape). A `time_shift` over a ranked `first`/`last` aggregate raises a distinct loud 7b.15e (the shifted CTE re-aggregates flatly and cannot reproduce the ROW_NUMBER ranking; the crossing time arg is still registered for Law-1 totality). **Scope boundary (author-ratified):** `change`/`change_pct` render over a **local/host-rooted** inner (the chain's existing outer arithmetic-materialization step handles the subtraction) but over a **cross-model** inner they hit a separate pre-existing `RenderContextMissingFacilityError` in the combined SELECT (arithmetic-over-transform rendered before the transform materialises) — out of scope, tracked as **DEV-1800** and pinned as a loud, specific error. Execution ground truth (SQLite + DuckDB) for shapes a/b, cp, change/change_pct, NULL-dim null-safe survival, `date_range` frame-bound omission, and sibling-protection under a genuine 1:N (`line_items`) fan-out; per-dialect emission (incl. Postgres/T-SQL/BigQuery) pinned in `tests/golden/dev1750_sql_baseline.json`. Full non-integration suite green; no emitted SQL changed for any pre-existing shape.

docs/architecture/cross-model-aggregates.md

@@ -323,9 +323,19 @@ null-safe form retains it.
 - A host-local filter on a **no-dimension** cross-model-agg query is applied
   nowhere (the empty `_base` placeholder doesn't filter; host-local filters are
   excluded from the re-rooted CTE). Semantically ambiguous; rare.
-- `time_shift` / `consecutive_periods` / `change` / `change_pct` over (or
-  alongside) a cross-model aggregate raise `NotImplementedError` — factor the
-  temporal transform into an earlier stage.
+- `time_shift` / `consecutive_periods` (and `change` / `change_pct`, which
+  desugar to `time_shift`) **render** over a **local** or **host-rooted** inner
+  aggregate that coexists with a cross-model aggregate (DEV-1750). The
+  cross-model transform chain gained the same shifted / cp CTE emitters the local
+  chain uses, so a crossing template fragment (`amount:wscaled_sum` with a
+  default `w='customers__regions.weight'`) pulls its join into the shifted CTE.
+  Two shapes stay guarded, loudly: a `time_shift` whose inner aggregate is
+  **target-grain** cross-model (`cte_root_model is None` — host-rooted
+  re-aggregation would multiply target rows through the 1:N join), and a
+  `time_shift` over a **ranked `first`/`last`** aggregate (the shifted CTE
+  re-aggregates flatly and cannot reproduce the ROW_NUMBER ranking).
+  `change` / `change_pct` over a **cross-model** inner aggregate hits a separate
+  combined-arithmetic-over-transform gap (DEV-1800), tracked independently.
 - Cross-model parametric-agg result keys diverge from legacy **by design**:
   `customers.revenue:percentile(p=0.5)` → `…revenue_percentile_p_0_5` where
   legacy dropped the kwarg suffix (`…revenue_percentile`). Legacy's drop was a