verify_buffers.py and native_extensions.py don't check that a warp's operator carries old to new #4571

Claim being reviewed

The literal native replays in research/kappa-causal-continuation/buffer-borrowing/verify_buffers.py and research/kappa-rebuild/complex/native_extensions.py, at main f626db5. I ran everything at f9f85c1; f626db5 only touches docs/. The warp spec is the docstring of research/gmx-t74-borrow43-handoff/new/code/borrow/bw_emit.py: ['warp', r, op, f0, f1] moves register r from frame f0 to frame f1, with G(f0) = f1 for op > 0.

Finding

Both replays check the frame a warp starts from, then set the role's frame to new. Nothing ties new to old or to the operator:

verify_buffers.py
165        elif kind == "warp":
166            _, role, operator, old, new = event
167            role = tuple(role)
168            need(current[role] == old, "Warp entrance frame")
169            rows[role] = warp(rows[role], operator, backward)
170            current[role] = new

native_extensions.py
116        elif kind == 'warp':
117            _, r, op, old, new = event; target = tuple(r); touched = target
118            N.need(current[target] == old, 'Warp input frame')
119            rows[target] = v.warp(rows[target], op, backward); current[target] = new

new is only compared with the next event on that role, so a wrong new just has to agree with what follows. research/kappa-rebuild/complex/rebuild_native.py:208-211 has the same pattern. The emitter does check it: research/gmx-t74-borrow43-handoff/new/code/borrow/bw_transport.py:305 and :335 ("warp G does not carry the frame").

A small example: role L273 has two consecutive warps (events 3 and 4) going frame 0 → 0 → 0. Changing two integers so they go 0 → 1 → 0 (frame 1 has dimension 9) is accepted in both directions by verify_buffers.replay and native_extensions.literal_replay, with the same paid profile as the shipped word. In a minimal tree, with this word in research/kappa-native-resume/native-source/rebased-core/converted/THREE-base-NATIVE-WORD.json.gz and its pin updated in research/kappa-causal-continuation/buffer-borrowing/SOURCES.json, the unmodified verify_buffers.py prints PASS_NATIVE_ARBITRARY_DIRTY_BUFFER_REPLAY. Without the new pin it stops at Changed retained source.

Where this matters:

• Conditional kappa = 0.00302015 (+0.6304% over #4447): joint helper boundaries #4470 can't reach it. Its PATCH.json only changes helper entrances, exits and scalar contact frames, and the warp frames come from the pinned base word.
• A package that ships its own native word and re-derives its paid profile from the replay, as native_joint.run does, could. Deleting a paid climb and letting the next warp change the frame dimension passes the replay and saves one rank-1 paid call. Only the comparison with the shipped NATIVE.json.gz rejects it, and a package author regenerates that file.
• I didn't try to turn this into a lower κ.

Reproduction or proposed correction

The canonical both verifiers already load (rebased-core/converted/THREE-base-CANONICAL.json.gz, read at verify_buffers.py:333) has the operator of every warp in warps[*].G_columns, with from_frame and to_frame (72 entries). Checking span(G(frames[old])) == span(frames[new]) on each warp event, with old and new swapped when op < 0, passes the honest word in both directions. It rejects the 0 → 1 → 0 change, the deleted climb, and a move of a warp's input to another frame of the same dimension, which a dimension check alone would miss. #4424's research/complex-cover-lift-audit/native_warps.py already reads this table, but it checks the canonical's warp classes, not the warp events of a replayed word. #3929 checks the operator when it compiles a frame change, inside its own package.

verify_buffers.py is pinned by hash in many packages and CONTRIBUTING asks to keep frozen predecessors unchanged, so I'm not proposing an edit to it. Would you rather have this check as a separate audit package, or in the package-side replay (native_joint.run) for packages that ship their own word?

import sys, copy
sys.dont_write_bytecode = True
root = sys.argv[1]
sys.path.insert(0, root + '/research/joint-helper-lattice')
import native_joint as J
c, programs, *_ = J.construct()
full = next(i for i, f in enumerate(c['frames']) if len(f) == 9)
for p in programs.values():
    assert p[3][:2] == ['warp', ['L', 273]] and p[4][:2] == ['warp', ['L', 273]]
    p[3][4] = full; p[4][3] = full          # frames 0 -> 0 -> 0 become 0 -> 1 -> 0
V = J.F.load(root + '/research/kappa-causal-continuation/buffer-borrowing/verify_buffers.py', 'v')
X = J.F.load(root + '/research/kappa-rebuild/complex/native_extensions.py', 'x')
for d, p in programs.items():
    rows, rec = X.literal_replay(V, c, p, d == 'backward')
    assert all(rows['L', r] == V.expected(('L', r), [], d == 'backward', False) for r in range(632))
    rb = copy.deepcopy(c); rb['local_profile'] = {int(k): v for k, v in rec['paid_profile'].items()}
    V.replay(p, rb, [], d == 'backward', False)
    print(d, 'accepted, paid profile', rec['paid_profile'])

I did this with help from Claude (Anthropic) agents; the runs were done locally.