diff --git a/research/output-sign-restoration-seed51/CERTIFICATE.json b/research/output-sign-restoration-seed51/CERTIFICATE.json
new file mode 100644
index 0000000000..161316d326
--- /dev/null
+++ b/research/output-sign-restoration-seed51/CERTIFICATE.json
@@ -0,0 +1,172 @@
+{
+  "basis_columns": 3168,
+  "boundary_enumeration": {
+    "admitted": 126,
+    "price_cases": 384,
+    "schedules": 21840
+  },
+  "controls": {
+    "invalid_inputs": 7,
+    "mathematical": 7
+  },
+  "deeper_readers": [
+    {
+      "ADD": 976,
+      "NEG": 1152,
+      "data_reads": 3104,
+      "data_writes": 2128,
+      "depth": 2,
+      "descriptor_fields": 6208,
+      "eager": false,
+      "instructions": 2128,
+      "registers": 25
+    },
+    {
+      "ADD": 976,
+      "NEG": 1768,
+      "data_reads": 3720,
+      "data_writes": 2744,
+      "depth": 2,
+      "descriptor_fields": 7440,
+      "eager": true,
+      "instructions": 2744,
+      "registers": 25
+    },
+    {
+      "ADD": 9776,
+      "NEG": 11552,
+      "data_reads": 31104,
+      "data_writes": 21328,
+      "depth": 3,
+      "descriptor_fields": 62208,
+      "eager": false,
+      "instructions": 21328,
+      "registers": 33
+    },
+    {
+      "ADD": 9776,
+      "NEG": 17768,
+      "data_reads": 37320,
+      "data_writes": 27544,
+      "depth": 3,
+      "descriptor_fields": 74640,
+      "eager": true,
+      "instructions": 27544,
+      "registers": 33
+    }
+  ],
+  "recursive_cases": 384,
+  "schema": 1,
+  "seed": 51,
+  "selected": {
+    "NEG_saved": 56,
+    "children": 5,
+    "eager": {
+      "ADD": 96,
+      "NEG": 160,
+      "data_reads": 352,
+      "data_writes": 256,
+      "descriptor_fields": 704,
+      "instructions": 256
+    },
+    "framed": {
+      "ADD": 96,
+      "NEG": 104,
+      "data_reads": 296,
+      "data_writes": 200,
+      "descriptor_fields": 592,
+      "instructions": 200
+    },
+    "matrix": [
+      [
+        -3,
+        3,
+        -3,
+        3,
+        1,
+        -1,
+        1,
+        -1
+      ]
+    ],
+    "output_width": 1,
+    "registers": 17,
+    "tree": {
+      "children": [
+        {
+          "matrix": [
+            [
+              -1,
+              -1,
+              -1,
+              -1,
+              1,
+              1,
+              1,
+              1
+            ]
+          ]
+        },
+        {
+          "matrix": [
+            [
+              1,
+              1,
+              1,
+              1,
+              -1,
+              -1,
+              -1,
+              1
+            ]
+          ]
+        },
+        {
+          "matrix": [
+            [
+              -1,
+              1,
+              -1,
+              1,
+              1,
+              1,
+              1,
+              -1
+            ]
+          ]
+        },
+        {
+          "matrix": [
+            [
+              -1,
+              1,
+              -1,
+              1,
+              -1,
+              -1,
+              -1,
+              -1
+            ]
+          ]
+        },
+        {
+          "matrix": [
+            [
+              -1,
+              1,
+              -1,
+              1,
+              1,
+              -1,
+              1,
+              -1
+            ]
+          ]
+        }
+      ]
+    },
+    "word_sha256": "02f969a30bfbddcce7a3af7a1c20373c0e94940d1ff03e8c4cb96fb5ff6990cf",
+    "workspace_width": 8
+  },
+  "status": "finite recursive interface; no new kappa"
+}
diff --git a/research/output-sign-restoration-seed51/CLAIM.md b/research/output-sign-restoration-seed51/CLAIM.md
new file mode 100644
index 0000000000..f7cbf4c966
--- /dev/null
+++ b/research/output-sign-restoration-seed51/CLAIM.md
@@ -0,0 +1,89 @@
+# Output sign frames for a sign-drifting recursive reader
+
+Claimed locally, 2026-10-13 20:10:49 UTC. No pinned coordination issue
+exists. Expected finish: 2026-10-13 20:43:52 UTC.
+
+- Track: recursive interfaces. Fresh OS-random assignment seed: 51.
+- Exact base: `1b59b624d21924f8e3537cdc1ac52d3be6eda2fe`.
+- Object: fixed linear-reader children `C_i(D,W)=(D+R_i W,-W)`.
+- Hypothesis: an alternating sign frame on the smaller output register can
+  replace intermediate full-workspace restorations, even when every reader
+  observes the changing workspace. A complete two-pass dirty echo must still
+  eliminate the incoming workspace from the returned source-dependent output.
+- Method: prove the all-input identity; emit only signed two-address ADD and
+  NEG instructions; replay every source, output and dirty-scratch basis column
+  independently; compare literal inverse words and complete scalar invoices.
+- Seed-selected example: five children, workspace width eight, output width
+  one. `k=3+2*(seed%2)`, `N=2+seed%9`, `d=1`.
+- Deliverable: one scoped research construction, exact certificate, complete
+  recursive cost/storage recurrence, independent finite replay and meaningful
+  negative controls. No new kappa or supplier adoption.
+
+## Three candidates and overlap
+
+1. Output sign frames for fixed sign-drifting readers. Selected. The original
+   readers remain unchanged, while the parent changes the output sign between
+   children. Preliminary complete echo counts save 56 NEG instructions at the
+   selected dimensions; this remains to be checked by an emitted word.
+2. Noncommuting reader compatibility. Rejected as covered by PR1203 and PR1205,
+   alongside PR1199's diagonal cut planner. Those keep or constrain reader
+   observations instead of paying for a changing output frame.
+3. Exact rational borrowing widths. Rejected due to active discussion1202 and
+   PR1159's modular borrowing contract.
+
+Checked 816 open PR titles/bodies and all five current discussions. A semantic
+search for output/target frames and negation found supplier geometry and frame
+retiming work, but no matching recursive sign-frame wrapper. PR1155's restored
+batch model, PR1199's reader counterexample correction, PR1203's noncommuting
+wrapper and PR1205's observer distinction are predecessors, not new claims here.
+Prior compact-control boundary obstruction PR1108 concerns different primitives.
+
+Acceptance: prove the stated identity and invoice, reproduce the predicted
+finite saving, expose one failure when an output sign or workspace restoration
+is omitted, and leave every existing repository file unchanged. Only this
+directory will be added. Child source accesses, scratch, inverse calls and
+control/preparation costs must be explicit. Physical supplier admission,
+rounding, full multiplication formalization and a better exponent are outside
+this contribution.
+
+Prepared by Sagar Thakrar with substantial OpenAI Codex assistance.
+
+## Submission overlap check
+
+At 20:23 UTC, inspected 830 open PRs through #1221 and refreshed the
+discussion inventory. No matching output-sign boundary wrapper was found.
+This is bounded overlap evidence, not proof of novelty. PR1203 and PR1205
+still have the pinned heads listed in SOURCE-PINS.json. PR1211 prices a
+different balanced factor-tape traversal; PR1216 excludes cheap CK/JP8 dirty
+donors. Neither result establishes or defeats this fixed-reader interface.
+
+Upstream advanced to `49b3157d1d89adcef16df8be98445451672be5ba` during the
+check, adding onboarding and optional package replay tools. Its selected
+certificate is unchanged. The exact investigation base remains the original
+commit above. The new contribution rules and package guide were inspected;
+the requested open-next-question section is included. The existing offline
+archive format is retained, without inventing a catalogue assignment for the
+user's explicit track. Scope is a refinement of that track and is unchanged
+since the local claim. No evidence-driven pivot was needed.
+
+## Completed result, 2026-10-13 20:30 UTC
+
+[PR1227](https://github.com/CrocSwap/integer-mult-bounds/pull/1227) submits the
+completed scoped construction. The sharp uniform wrapper minimum is
+`(k mod 2)N + 2 floor(k/2) min(N,d)`. The complete seed-selected dirty echo
+uses 200 scalar instructions versus 256 eager, saving 56 NEG operations;
+both words implement the same source-only map and restore all scratch.
+The fixed-child and final-observer restrictions are explicit. No new kappa.
+
+All 21,840 sign schedules, 384 price cases, 384 recursive cases and 3,168
+small-case basis columns pass, plus selected/deeper dense words, inverses,
+rational dirty probes, seven mathematical and seven input controls. Python
+3.14.8 normal/optimized and 3.11.17 optimized runs pass. Relocation, four
+on-disk corruptions, source identities and canonical regeneration pass.
+
+The immediate submission refresh covered 834 open PRs through #1225.
+PR784's sharp bound is for dirty-echo leaf calls, not this boundary alphabet.
+No matching output-sign wrapper was found. The repository has neither the
+`codex` nor `codex-automation` label. Selected cold replay, Linux, physical
+supplier admission, complete formalization and independent human review were
+not performed. Hosted CI is separate from the local evidence.
diff --git a/research/output-sign-restoration-seed51/README.md b/research/output-sign-restoration-seed51/README.md
new file mode 100644
index 0000000000..ade3f00abb
--- /dev/null
+++ b/research/output-sign-restoration-seed51/README.md
@@ -0,0 +1,240 @@
+# Output sign frames replace large workspace restorations
+
+This is a recursive-interface research construction with a sharp boundary
+cost in a restricted model. It does not improve the selected multiplication
+exponent. With five fixed children, an eight-coordinate dirty workspace and
+one output coordinate, a complete source-dependent echo uses **96 ADD + 104
+NEG**, versus **96 ADD + 160 NEG** with eager restoration. Both restore every
+scratch coordinate on every input. The saving is 56 scalar negations.
+
+The restriction matters: child calls are indivisible. The parent may negate
+either the whole output register or the whole workspace between calls. A
+compiler that can remove a child's internal drift can beat both words. For
+example, the explicit matrix leaves below expose their final negations; direct
+evaluation of their sum is cheaper than the echo. This is an exact interface
+result, not an optimized matrix algorithm or a runtime benchmark.
+
+## Interface and exact boundary cost
+
+Work over the integers, rationals or complex numbers with exact arithmetic.
+Let `D` have width `d`, `W` have width `N`, and let fixed children satisfy
+
+```
+C_i(D,W) = (D + R_i W, -W),       i = 1,...,k.
+```
+
+Each `R_i` is a linear map. A child's private scratch is arbitrary and restored;
+its cost includes its reader, source access, source negation and private work.
+The caller has both execution directions at the same declared scalar cost.
+These children are involutions, but the implementation still emits the literal
+reverse word for inverse calls. No sign-controllable reader is assumed.
+
+The desired batch is `B(D,W)=(D + (sum_i R_i)W,W)`. Eager execution restores
+`W` after every child, for `kN` additional scalar NEG instructions. The parent
+can instead execute these operations:
+
+1. Call the first child directly.
+2. Before each subsequent child, negate all `d` output coordinates.
+3. At exit, negate `W` if `k` is odd, or negate `D` if `k` is even.
+
+Before child `i`, both registers are in sign `(-1)^(i-1)` relative to the
+canonical eager state. Linearity makes the child's increment have that same
+sign. It then flips `W`, and the next output negation aligns the two signs
+again. The final operation restores both canonical registers. This proves the
+batch identity for every dimension and every tuple of linear maps, including
+nonzero readers of every changing workspace coordinate.
+
+The additional cost of this schedule is `2 floor(k/2)d + (k mod 2)N`.
+Choosing it when `d<N`, and eager restoration otherwise, gives
+
+```
+b(k,N,d) = (k mod 2)N + 2 floor(k/2) min(N,d).
+```
+
+This is the minimum **uniform** boundary cost over all maps `R_i`, using one
+call to each fixed child in the fixed order and only complete-register
+negations in the `k+1` gaps. It need not be the minimum for a special tuple
+whose contributions cancel, for partial-coordinate operations, or for a
+different call alphabet.
+
+To prove the lower bound, track signs `t` on the original output and `w` on
+the workspace. After normalizing the output by `t`, child `i` contributes
+`tw R_i W`. Correctness for independently variable `R_i` requires `tw=1`
+before every call. Every call flips `tw`. Consequently each of the `k-1`
+interior gaps and the exit gap needs at least one boundary negation. If `a`
+workspace and `b` output block negations are used, `a+b>=k`. Restoration also
+requires `a = k mod 2` and `b = 0 mod 2`. Minimizing `aN+bd` under these
+constraints gives the displayed formula, and the two schedules attain it.
+Operations in the entrance gap cannot improve this lower bound.
+
+Thus `d>=N` yields no saving in this model. For `d<N`, the batch saving is
+`2 floor(k/2)(N-d)` scalar NEG instructions. Each NEG is paid; no metadata-only
+reinterpretation of a physical register is counted as a free operation.
+
+## A transparent echo and a recursive implementation
+
+Let `X` be a width-`N` source that is preserved, and let `W` be arbitrary dirt.
+With `R=sum_i R_i`, execute
+
+```
+W += X;  B(D,W);  W -= X;  B^-1(D,W).
+```
+
+The two batch calls contribute `R(W_initial+X)-R W_initial = R X`. The final
+state is exactly `(D_initial+R X, X, W_initial)`. This includes both sets of
+child calls, both source copies and all batch restorations. The inverse
+reverses every instruction and changes every ADD sign. Oddness alone does not
+make this echo transparent: `(W+X)^3-W^3` still depends on dirt. Linearity is an
+explicit interface assumption, not a conclusion inferred from finite tests.
+
+`word.py` recursively realizes this contract. A leaf performs its signed
+matrix ADDs and negates its source port. An interior reader runs the echo
+using its child readers, then negates its own source port. One dirty block per
+active interior level suffices; siblings reuse the block after restoration.
+No clean initialization, hidden accumulator or extra copy register is used.
+This realizes a tree of sums of linear maps. It does not supply a missing
+multiplication or supplier interface.
+
+For a reader node `v` with `k_v` children, let `A_v,G_v` count all ADD and NEG
+instructions, including descendants and both directions. With common widths
+`N,d`, the complete recurrence is
+
+```
+leaf: A_v = number of nonzero signed matrix entries; G_v = N
+A_v = 2 sum_i A_i + 2N
+G_v = 2 sum_i G_i + 2 b(k_v,N,d) + N
+```
+
+For a root echo, omit the final `+N`. Eager restoration replaces `b` by `k_v N`.
+All children are called twice. The last `+N` is the reader's source drift,
+not scratch cleanup. A tree of maximum depth `h` uses `d+(h+1)N` scalar data
+registers, counting output, source and all dirty scratch. There is no input
+size recurrence or bound on kappa being inferred from this depth recurrence.
+
+The frozen instruction format has four fields per ADD and two per NEG. For
+`A` ADDs and `G` NEGs, the explicit interpreter invoice is:
+
+| Resource | Exact count |
+| --- | ---: |
+| Arithmetic instructions and dispatches | `A+G` |
+| Data reads | `2A+G` |
+| Data writes | `A+G` |
+| Instruction fields, including signs and addresses | `4A+2G` |
+
+On a unit-cost addressed machine, assigning prices to these resources gives
+a complete weighted execution bill by substitution. With atomic inclusive
+ADD/NEG prices `alpha,gamma`, the recursive reader cost is
+`T_v=2 sum_i T_i+2N alpha+(2b+N)gamma`. Source reads and restoration are already
+included. Preparation is separate: the supplied compiler materializes the
+whole frozen word. For source-description size `M` and `P=A+G`, it uses
+`O(M+P+h)` compiler/program storage and `O(M+(h+1)P)` worst-case preparation
+time; the frozen word must be read at execution as priced above.
+Its construction and validation are not free online work. On a tape machine,
+routing between addresses and address/control realization must also be
+implemented and charged. No end-to-end saving is claimed before those costs
+and the fixed-child contract are justified for a real supplier.
+
+At the seed-selected dimensions, the echo has 17 scalar data registers, 200
+dispatches, 296 data reads, 200 writes and 592 descriptor fields. Eager uses
+256 dispatches, 352 reads, 256 writes and 704 fields. A depth-three reader
+uses 33 data registers and 21,328 scalar instructions, versus 27,544 eager.
+These are exact event counts, not elapsed-time measurements or bit costs.
+
+## Reproduce and inspect the evidence
+
+From the repository root, with Python 3.11 or newer and no dependencies:
+
+```sh
+python3 -I -O -B research/output-sign-restoration-seed51/verify.py
+python3 -I -O -B research/output-sign-restoration-seed51/test_package.py
+```
+
+Expected markers:
+
+```
+PASS_OUTPUT_SIGN_RESTORATION schedules=21840 recursive_cases=384 saved_NEG=56 source_pins=3 kappa=unchanged
+PASS_OUTPUT_SIGN_PACKAGE relocation=1 corruptions=4
+```
+
+`verify.py --emit` prints the complete recomputed certificate. The ordinary
+command compares every field with `CERTIFICATE.json`. It also authenticates
+the three retained predecessor notes by SHA256 and Git blob identity. These
+checks run under Python's optimized mode; no required check uses `assert`.
+
+The independent boundary enumeration replays all `4^(k+1)` words for each
+`1<=k<=6`. Each gap chooses identity, workspace negation, output negation or
+both. It tracks an independent formal coefficient for every child, without
+using the sign-frame formula. All 21,840 schedules are covered, 126 are
+admitted, and their minimum costs agree at all 384 width pairs `1<=N,d<=8`.
+The stopping rule is completion of this finite domain. The lower bound above
+is a written proof for general k; enumeration alone is not that proof.
+
+The recursive census covers `1<=N<=4`, `1<=d<=3`, `1<=k<=4`, depths one and
+two, both schedules and both echo/reader contracts: 384 cases and 3,168 basis
+columns. Every case also checks the literal inverse and a rational dirty
+probe. Leaves use `random.Random(51)` with coefficients in `{-1,0,1}`. The
+separate dense selected example uses seed 51 and `{-1,1}`; deeper examples
+use seeds `51+depth` at depths two and three. All coverage is completed.
+
+Seven mathematical controls catch an omitted output sign, source uncopy,
+workspace restoration or entire second pass; unframed deferral; a nonlinear
+dirty echo; and a premature canonical-output observer. Seven invalid inputs
+are rejected. The package test relocates the complete directory and rejects
+four actual file corruptions. The selected source construction is untouched,
+so its costly cold replay is outside this check's scope.
+
+Local verification passed on CPython 3.14.8 in normal and optimized mode,
+and CPython 3.11.17 in optimized mode. Both versions passed standalone
+relocation and all package corruptions. Canonical certificate regeneration
+was byte-identical. This archive-based package retains its own offline source
+pins and commands; it does not opt into the optional catalogue-based generic
+replay manifest introduced during the session.
+
+## Open next questions
+
+Does a currently supported recursive supplier expose an indivisible
+`(D+R W,-W)` child with `d<N` whose internal drift cannot simply be removed?
+This determines whether the boundary saving can improve an actual supplier
+rather than only the stated interface model. The first step is to trace one
+candidate's full source-return map and retained child boundary, then price
+both schedules with its routing and precision requirements. No such supplier
+has been identified here; that concrete contract and its complete physical
+invoice are the blockers. A visible terminal source negation that the parent
+can cancel is an immediate reason to reject the candidate.
+
+## Observation contract, provenance and credit
+
+The caller observes canonical registers only when a batch or echo returns.
+During an output sign frame, the physical output can be the negative of its
+canonical partial sum. Adaptive readers, exception exits or recursive clients
+that demand a canonical intermediate output need an additional priced
+interface. This example does not establish their safety. Exact arithmetic is
+also essential here; fixed precision, overflow and rounded inverses are not
+verified. The all-input basis checks establish the emitted finite linear
+maps, not a formal proof of the full integer-multiplication theorem.
+
+Base: `1b59b624d21924f8e3537cdc1ac52d3be6eda2fe`. The selected certificate at
+that base is PR1094's conditional `836330098538459/500000000000000000`, by
+Rohan Arun on Jeremy Kothe's packing and the retained slot/T16 and bit chains.
+Its actual assembly, manifest, review and construction README were inspected;
+their hashes are recorded in `SOURCE-PINS.json` as context, not dependencies.
+None of that selected evidence or `upstream/` is edited.
+
+Aaron Wang / navinor's [PR1155](https://github.com/CrocSwap/integer-mult-bounds/pull/1155)
+provides the eager/deferred batch question. Sagar Thakrar's
+[PR1199](https://github.com/CrocSwap/integer-mult-bounds/pull/1199), mightyOil's
+[PR1203](https://github.com/CrocSwap/integer-mult-bounds/pull/1203), and Adam
+Gall's [PR1205](https://github.com/CrocSwap/integer-mult-bounds/pull/1205)
+already establish compatible nonzero readers and observation distinctions.
+No priority for those results is claimed. The new mechanism pays for changing
+the output sign while keeping each reader fixed, with a sharp uniform
+boundary minimum and a recursively executable transparent echo. PR889's
+common-factor dirty echo is also credited for the existing cancellation
+method, by CubeJerry. Exact heads and byte-identical retained notes are pinned; no code is
+imported from these contributions.
+
+Prepared by Sagar Thakrar with substantial OpenAI Codex assistance, including
+the algebra, implementation, evidence and prose. New material is Apache-2.0
+under the repository license; retained notes keep their original notices.
+No independent human review, hosted CI result, physical supplier admission,
+new kappa, or complete formal multiplication proof is claimed.
diff --git a/research/output-sign-restoration-seed51/SOURCE-PINS.json b/research/output-sign-restoration-seed51/SOURCE-PINS.json
new file mode 100644
index 0000000000..77adb1e2f9
--- /dev/null
+++ b/research/output-sign-restoration-seed51/SOURCE-PINS.json
@@ -0,0 +1,55 @@
+{
+  "base_commit": "1b59b624d21924f8e3537cdc1ac52d3be6eda2fe",
+  "selected_kappa": "836330098538459/500000000000000000",
+  "retained_sources": [
+    {
+      "pr": 1155,
+      "author": "Aaron Wang / navinor, with opencode assistance",
+      "commit": "9821c6e9388f3fc097e94b72be9fa7b41a849527",
+      "repository_path": "research/restoration-coalescing/README.md",
+      "local_path": "sources/PR1155-README.md",
+      "sha256": "1af4e8d65700207092859b80fa5e4f4a7bd254ac0104d83c2b74e3a7477e823b",
+      "git_blob": "43ef54beedd197b8a41e7820a155f3186c91ca3a"
+    },
+    {
+      "pr": 1203,
+      "author": "mightyOil, with AI assistance as retained in the source notice",
+      "commit": "38459854fd5bb93099871a84324413bd0e338d8e",
+      "repository_path": "research/invariant-reader-restoration/README.md",
+      "local_path": "sources/PR1203-README.md",
+      "sha256": "039206964404ab6e6a57fca7aa55057796263c0e5cb102d9e2990b38685f7ad1",
+      "git_blob": "b884fdff7672cacd8cc9014b75d4b3e1d6c7f606"
+    },
+    {
+      "pr": 1205,
+      "author": "Adam Gall / adamgall, with OpenAI Codex assistance",
+      "commit": "e2008d7ffcad464da7ec21c69e8d8a8c91de4930",
+      "repository_path": "research/observer-safe-restoration/README.md",
+      "local_path": "sources/PR1205-README.md",
+      "sha256": "fc672e69f4b3363fa7736efa4b4103c755fcb72f6f5d45e5d268c10e133a914d",
+      "git_blob": "7ed4d89d17c5cdeba0e5e5eb160919e0e9c5a076"
+    }
+  ],
+  "additional_predecessors": [
+    {
+      "pr": 1199,
+      "author": "Sagar Thakrar, with OpenAI Codex assistance",
+      "commit": "85ac2880ea5bda44f28632b71ffa2b4e35ec6b7d",
+      "scope": "reader-compatible restoration cuts; no priority claimed here for reader deferral"
+    },
+    {
+      "pr": 889,
+      "author": "CubeJerry",
+      "commit": "e2021d1c9e06948528cbc0a8fd7079b671da981d",
+      "scope": "common-factor dirty echo; no priority claimed here for additive cancellation"
+    }
+  ],
+  "base_context_sha256": {
+    "certificates/selected-result.json": "10b9e340fd8e354a37a0c4813c90e5de1dd42044b5f6aca4a3fc5a42b685fa32",
+    "research/community-frontier1094-audit/ASSEMBLY.json": "1122cb3a575f8c788345fc1bf4c108ac7c3250fb81a5988671f5eb04b3ab3045",
+    "research/community-frontier1094-audit/SELECTED-SOURCE.json": "79b3de5db3dbcb9829789ba58e9e45758926031e2a7d80667a08429d369be53b",
+    "docs/research/community-batch1099-review.md": "7e76d2c38e5fce30587835b7251df1430488ae4dd372611ef69a3f03f476b6cb",
+    "research/complex-t16-rare-pattern-exchanges/README.md": "da542711a6a3eb01ce1ebdf8f28a748e6195512687f61d003b95ac5ff281a7b2"
+  },
+  "source_role": "Retained notes are context and attribution, not imported code or assumed mathematical lemmas. Their SHA256 and Git blob identities are checked offline. Base-context hashes record orientation and are checked against the original base separately; standalone replay does not depend on those files."
+}
diff --git a/research/output-sign-restoration-seed51/sources/PR1155-README.md b/research/output-sign-restoration-seed51/sources/PR1155-README.md
new file mode 100644
index 0000000000..43ef54beed
--- /dev/null
+++ b/research/output-sign-restoration-seed51/sources/PR1155-README.md
@@ -0,0 +1,267 @@
+# Restoration coalescing across a recursion batch
+
+Research note: one explicit way to eliminate restoration work, with a complete
+cost recurrence, a sharp correctness boundary, and a sharp cost boundary.
+Navinor, with help from opencode. Apache-2.0. **No new multiplication exponent.**
+
+## Summary
+
+Every recursive child that borrows a dirty workspace stream must return it, and
+the inherited contract restores it **after every child** so that the next child
+sees the node-entry state. When a node issues `r` children this pays `r`
+restoration passes. This note prices a single operator-level change: let the
+workspace drift across the batch and replace the `r` restorations by the **one**
+composed restoration `(G_r...G_1)^{-1}` at the node exit. The question is not
+what a particular assembly does with that slack (that is assembly pricing), but
+when this rewrite is even a *valid and pass-reducing identity on the restored
+operator*. Two independent conditions decide it, both decidable exactly.
+
+* **Correctness (read-free batch).** The deferred single restoration returns the
+  identical observables (final data and final workspace) if and only if no child
+  reads the workspace's intermediate value to build an observable output. If the
+  workspace is write-only scratch across the batch, deferral is exact. One reader
+  child breaks it; the note gives a concrete counterexample over Gaussian
+  rationals.
+
+* **Cost (composable family).** Deferral removes restoration work only when the
+  individual restoration operators are closed under a composition that stays
+  cheap to apply. Diagonal unit phases compose to a diagonal unit phase and
+  permutations compose to a permutation, so a batch of `r` such restorations
+  collapses from `r` passes to `1` pass. When the restorations are a *mixture*
+  (a phase, a Walsh transform, a permutation), the composed restoration is a
+  dense linear map; applying it once costs `N^2` scalar multiplications against
+  `16` for the three structured eager restorations in the tested batch, so
+  deferral *loses*. Structure, not the number of restorations alone, decides.
+
+Both facts are checked by one exact stdlib program over Gaussian rationals.
+Nothing here changes the selected frontier, `upstream/`, or the assembly.
+
+## Reproduce
+
+From the repository root, Python 3.10+, standard library only:
+
+```sh
+python3 -I -O -B research/restoration-coalescing/verify.py
+```
+
+Expected first line:
+
+```
+PASS_RESTORATION_COALESCING phase=3->1(x3) perm=3->1 hetero_dense=True reader_diverges=True
+```
+
+The command recomputes the certificate and compares every field with
+[CERTIFICATE.json](CERTIFICATE.json), failing on any drift. `--json` prints the
+full certificate; `--write PATH` writes the same deterministic result elsewhere.
+There is no floating point, no random tolerance, and no imported supplier
+verifier. Coefficients are exact Gaussian rationals (`Fraction` real and
+imaginary parts); the checker builds every operator explicitly at `N = 8`.
+
+## Starting point and scope selection
+
+Base commit `ce7ad1b6ab09452c3478723a2e96ed5ff212dc08` (current `origin/main`).
+At this base the selected conditional result is the
+`CrocSwap/integer-mult-bounds#1094`-on-`CrocSwap/integer-mult-bounds#1087`
+assembly,
+`kappa = 836330098538459/500000000000000000 = 0.001672660197076918`; see the
+[selected record](../../certificates/selected-result.json) and
+[current status](../../docs/research/current-status.md). This note does not
+adopt any larger number from a pending pull request.
+
+The OS-generated assignment seed was **53**, assigning the recursive-interface
+track (one explicit way to eliminate boundary or restoration work, with a
+complete cost recurrence). The three candidates I weighed were: coalescing
+per-child dirty-workspace restoration (chosen); deferring the compact-control
+"exceptional-address repair charged at every node"; and eliminating the Walsh
+entrance/exit boundary between same-subset children. The seed selected
+restoration coalescing because it is the one whose correctness and cost
+conditions can both be decided exactly and independently, without re-opening a
+closed supplier search.
+
+There was no pinned sprint coordination issue reachable here. The local
+[claim](CLAIM.json) records the three candidates, the overlap check against
+`research/seed51-clean-residual-dilation` (seed 51, recursive-interface track:
+a spectral-split residual encoder, a different object), and the scope.
+Exact source and dependency heads are in [SOURCE-PINS.json](SOURCE-PINS.json).
+
+## The model
+
+State is a data stream `D` and a borrowed dirty workspace stream `W`, each of
+`N` Gaussian-rational positions, plus a read-only source vector `s`. A node
+issues `r` children. Child `i` applies an invertible workspace operator `G_i`
+(as scratch) and contributes a data increment:
+
+```
+scratch-only child i :  D' = D + B_i s ,  W' = G_i W
+reader child i       :  D' = D + B_i W ,  W' = G_i W      (reads W)
+```
+
+The inherited **eager** rule restores `W` to its node-entry value `w0` after
+every child, i.e. it applies `G_i^{-1}` immediately. The **deferred** rule lets
+`W` drift and applies the single composed restoration
+`(G_r ... G_1)^{-1} = G_1^{-1} ... G_r^{-1}` at the node exit. Observables are
+the final `D` and final `W`. The child data work `sum_i B_i(·)` is identical in
+both schemes and cancels from the comparison; only restoration is priced.
+
+This is the same restoration invariant the repository already charges: dirty
+connectors and private child scratch are restored
+(`CrocSwap/integer-mult-bounds#905`, `CrocSwap/integer-mult-bounds#929`,
+`CrocSwap/integer-mult-bounds#951`;
+[universal-connector-boundary](../universal-connector-boundary/README.md)), and
+the compact-control construction "restores arbitrary values ... and charges
+exceptional-address repair at every node" ([current status](../../docs/research/current-status.md)).
+
+## Complete cost recurrence
+
+Write `Restore(N)` for one restoration pass over `N` coefficient positions. In
+the repository's additive accounting a coefficient pass is a `Scan(N,p)`; a
+diagonal unit-phase restoration is exactly one such pass, and a permutation
+restoration is one routing pass. Let `r` be the children per node. The node's
+restoration term is
+
+```
+eager   :  r * Restore(N)
+deferred:  1 * Restore_composed(N)
+```
+
+**Composable family (phases, or permutations).** `Restore_composed(N) =
+Restore(N)`, because the composition stays in the family. The node saves
+
+```
+(r - 1) * Restore(N)  =  (r - 1) * Scan(N, p)
+```
+
+plus the `O(r)` bookkeeping of composing `r` phase/permutation descriptors,
+which is not an `N`-volume pass. Over a recursion with `r` children per node and
+`d` levels, the total restoration overhead falls by the same factor `r`
+(`sum_nodes r*Scan -> sum_nodes 1*Scan`), while every child term
+`(k/m)^sigma / W` is untouched. The full node recurrence, restoring only the
+changed term, is
+
+```
+R(N, {k_i}) =  sum_i  (k_i/m)^sigma / W   +  Restore(N)  +  O(r)  +  unchanged
+                                 ^ was r * Restore(N) in the inherited rule
+```
+
+**Heterogeneous family.** `Restore_composed(N) = Theta(N^2)` (a dense
+matrix-vector product), against `sum_i` of the structured eager restorations.
+At `N = 8` the exact counts are `64` dense multiplications versus `16` across
+the three structured restorations, so the deferred rule is `4x` more expensive
+and is rejected. The obstruction is structural: composing a phase with a Walsh
+transform with a permutation destroys the structure that made each individual
+restoration cheap. Deferral does **not** remove work here.
+
+This is a complete invoice for the restoration term only. It is not a transfer
+into the tight fixed-tape overhead allowance, and it makes no claim that the
+restoration term is binding in the selected assembly. If restoration is a
+lower-order term beside the child recursion, the induced change to `kappa` is
+zero. **No stronger bound is claimed.**
+
+## Exact evidence and limits
+
+`verify.py` builds every operator explicitly at `N = 8` over Gaussian rationals
+and checks, on the actual vectors:
+
+1. **Phase batch (3 children, read-free).** Deferred equals eager on both
+   observables; the composed restoration is verified to be diagonal and applied
+   as one pass. Restoration passes `3 -> 1`; multiplications `24 -> 8`.
+2. **Permutation batch (3 children, read-free).** Deferred equals eager; the
+   composed restoration is verified to be a permutation and applied as one
+   routing pass. Restoration passes `3 -> 1`; moves `24 -> 8`; multiplications
+   `0 -> 0`.
+3. **Reader negative control (correctness).** A single reader child is inserted.
+   The final workspace is still restored to `w0`, but the data output of the
+   deferred scheme differs from eager by an explicit nonzero Gaussian-rational
+   vector. This is a concrete counterexample: the read-free condition is
+   necessary, not a stylistic choice.
+4. **Heterogeneous negative control (cost).** A phase, a Walsh transform and a
+   permutation compose to a dense operator (64 of 64 entries nonzero). The
+   structured-form detector self-checks each cheap application against the exact
+   dense product on the standard basis before using it, so the low cost figures
+   are certified against the exact operator rather than assumed. Deferred `64`
+   multiplications beat nothing: the eager structured sum is `16`.
+
+For each batch the composed restoration is *derived* from the exact dense
+product `G_1^{-1} ... G_r^{-1}` and then checked to agree with it, so a
+composition-order bug cannot silently flatter the result. Controls that must
+fail do fail: no "no candidate" claim, no impossibility theorem, no optimality
+claim for the eager rule.
+
+The scope is a restoration-elimination mechanism, its recurrence, and its exact
+applicability boundary. It is **not** an all-size physical compiler, a numerical
+precision contract, a common tape, an analytic transfer, a full owner schedule,
+or the integer-multiplication theorem. The finite checks are exact algebraic
+identities and exact cost counts; they do not certify a whole E8 word or the
+selected `kappa`. Neither the selected frontier nor `upstream/` changes. Inherited
+all-size/compiler, hosting, precision/tape and analytic assumptions remain with
+their existing constructions.
+
+## Relation to concurrent and prior work
+
+Two concurrent, same-track contributions already price *restoration deferral* at
+the assembly level, and this note is deliberately narrower and complementary,
+not a replacement or a re-derivation of either.
+
+* **[CrocSwap/integer-mult-bounds#1012](https://github.com/CrocSwap/integer-mult-bounds/pull/1012)**
+  (thakrarsagar, seed 57) prices restoration deferral of the U8 helper
+  rank/frame *climbs* inside the hosted T37 recurrence, using the hosting lemma
+  and the `8k+1+hosted+idle=73` coverage identity, and reports exact kappa
+  ceilings. Its conclusion is that deferral is *mass-neutral* there and its value
+  is consolidation inside shared hosting windows. That is a statement about rank
+  mass and window capacity in one frozen assembly.
+
+* **[CrocSwap/integer-mult-bounds#974](https://github.com/CrocSwap/integer-mult-bounds/pull/974)**
+  (avirazza, same track) prices the same boundary classes with zero parent cost;
+  thakrarsagar's note independently reproduces its T37 one-unit value.
+
+This note asks a different question at a different layer: **as an operator
+identity, when does replacing `r` restorations by one composed restoration
+preserve the observables and actually remove passes?** Its two answers — the
+read-free condition (correctness) and the composable-family condition (cost) —
+are exact algebraic facts about the restored operator, independent of any
+assembly, kappa ceiling, hosting lemma, or T37 payload. The cost unit here is a
+coefficient/routing pass (a diagonal unit phase is one `Scan`, a permutation is
+one `Route`, per the retained recurrence vocabulary), not the rank mass those
+assembly notes count. So there is no contradiction with the "mass-neutral"
+finding there: helper climbs are rank-advancing frame work whose mass is
+coverage-productive, whereas the restoration passes coalesced here are
+phase/routing passes whose operators compose. This note gives the
+operator-level preconditions and a standalone sub-second exact verifier (no T37
+archives, no pinned engines); those notes give the assembly-level ceiling
+effect. Both are needed before deferral can be placed in a real supplier call.
+Where thakrarsagar's note shows the T37 slack is consolidation in shared
+windows, this note shows exactly which restoration families admit a genuine
+`r -> 1` pass reduction at all, and which (heterogeneous) make it worse.
+
+This is a second, independent treatment of the restoration question using a
+meaningfully different method (exact Gaussian-rational operator algebra and
+structure detection, versus assembly-level pricing on frozen payloads), as the
+sprint invites. It does not claim priority on "restoration deferral" and does not
+reproduce either note's numbers.
+
+## Attribution
+
+The eager per-child restoration contract and the dirty-connector model are
+repository-wide: `CrocSwap/integer-mult-bounds#905`/
+`CrocSwap/integer-mult-bounds#929`/ `CrocSwap/integer-mult-bounds#951` (Chafik
+Boukhalfa), `CrocSwap/integer-mult-bounds#877`/
+`CrocSwap/integer-mult-bounds#896` (Gareth Davidson),
+`CrocSwap/integer-mult-bounds#934`/ `CrocSwap/integer-mult-bounds#943`/
+`CrocSwap/integer-mult-bounds#944`/ `CrocSwap/integer-mult-bounds#953` (Ross
+Richardson), and
+[universal-connector-boundary](../universal-connector-boundary/README.md). The
+compact-control per-node restoration/repair charge is credited to Douglas
+Colkitt's retained construction ([current status](../../docs/research/current-status.md)).
+The unequal-width child recurrence `(k/m)^sigma / W` is from the retained
+[complex batching note](../../notes/batched-complex-rows.tex).
+
+The sibling recursive-interface note
+[research/clean-residual-dilation](../clean-residual-dilation/README.md) (seed 51,
+Douglas R. Colkitt with Codex) prices a *spectral-split residual encoder* and its
+own per-stream dirty restoration. This note is a different object (restoration
+coalescing across a batch, not encoded hosting), reaches a different and
+independent boundary (read-free + composable family), and does not rely on its
+conclusions. Where both charge a "restoration" pass, the accounting vocabulary is
+shared but the mechanisms are distinct. This encoder-free coalescing result,
+exact checker and scoped recurrence were developed by Navinor with help from
+opencode, under the repository's Apache-2.0 license.
diff --git a/research/output-sign-restoration-seed51/sources/PR1203-README.md b/research/output-sign-restoration-seed51/sources/PR1203-README.md
new file mode 100644
index 0000000000..b884fdff76
--- /dev/null
+++ b/research/output-sign-restoration-seed51/sources/PR1203-README.md
@@ -0,0 +1,315 @@
+# Reader-compatible restoration deferral
+
+**Research note / exact recursive interface; no new kappa.** Nonzero reads of
+borrowed workspace need not prevent deferring its restoration. The precise
+condition is that each read annihilates the accumulated drift. A fully expanded
+example, including cancellation of incoming dirt and both source calls, reduces
+**210 to 150 two-address ADD instructions**, and **5,864 to 4,504 data-tape word
+transitions**, for the same fixed borrowing interface. Preparation and control
+costs are separately and explicitly charged below; these counts are not a
+runtime benchmark or an optimal circuit claim.
+
+This refines Navinor's [PR1155](https://github.com/CrocSwap/integer-mult-bounds/pull/1155)
+at `9821c6e9388f3fc097e94b72be9fa7b41a849527`. Its retained
+[original note](sources/PR1155-README.md) states that read-freedom is necessary
+and sufficient and uses one failing reader as evidence of necessity. That
+counterexample shows that **some** readers fail, not that **every** reader fails.
+The construction here has compatible readers after actual nonidentity drift.
+PR1155's shared-final-target observability also admits a weaker cancellation
+condition, distinguished below. No assertion is made about its executable
+fixtures beyond the statement inspected in that pinned note.
+
+Concurrent [PR1199](https://github.com/CrocSwap/integer-mult-bounds/pull/1199)
+by Sagar Thakrar at `85ac2880ea5bda44f28632b71ffa2b4e35ec6b7d` independently
+corrects the same necessity claim, supplies a diagonal-sign checkpoint planner,
+and states the general summed-defect identity. **No priority is claimed for
+that correction or the prefix-defect identity.** This package adds separate
+noncommuting-permutation evidence, distinct-output admission, an explicitly
+dirt-independent shared-B wrapper, and a separately implemented symbolic
+scalar/tape invoice. It does not reproduce or supersede PR1199's cut planner.
+The exact concurrent source was inspected at the final submission check;
+its results are credited, not silently treated as our discovery.
+
+## Reproduce
+
+Python 3.10+, standard library only, from the repository root:
+
+```sh
+python3 -I -O -B research/invariant-reader-restoration/verify.py
+```
+
+Expected:
+
+```text
+PASS_INVARIANT_READER_RESTORATION cases=5832 wrapped_adds=210->150 no_new_kappa
+```
+
+The command verifies retained source hashes, recomputes every certificate field,
+and compares against [CERTIFICATE.json](CERTIFICATE.json). Required checks use
+explicit exceptions and remain active with `-O`. The companion command
+`python3 -I -O -B research/invariant-reader-restoration/test_package.py` checks
+relocation, deterministic export and deliberate on-disk corruptions. Neither
+command regenerates selected or upstream artifacts. `--write PATH` is explicitly
+an authoring/export mode, not acceptance against the committed certificate.
+
+## Exact typed interface and proof
+
+Work over the rationals, with all arithmetic exact. Let `z` be arbitrary borrowed
+workspace, `y_i` distinct arbitrary output accumulators, and `G_i` fixed invertible
+linear workspace maps. A child first performs `y_i += H_i z`, then `z <- G_i z`.
+All coefficients are immutable; no output aliases workspace or another output.
+Readers are target-independent, and private scratch and tape positions used by
+complete child operations are restored. The code specializes `G_i` to permutations
+and `H_i` to rows with coefficients in `{-1,0,1}`.
+
+The eager contract follows each child with `G_i^-1`. The deferred contract
+omits these restorations and applies `(G_r ... G_1)^-1` once at batch exit. Put
+`P_0 = I`, `P_j = G_j ... G_1`. Then:
+
+- Eager output `i` is `y_i^0 + H_i z_0`.
+- Deferred output `i` is `y_i^0 + H_i P_(i-1) z_0`.
+- Both final workspaces are `z_0`.
+
+Consequently, equality for **all incoming dirty states** is equivalent to
+
+```text
+H_i (P_(i-1) - I) = 0     for every i.                    (1)
+```
+
+Sufficiency follows by subtraction. For necessity, a nonzero defect matrix has
+a nonzero column; the corresponding standard basis workspace is a counterexample.
+This is an all-size algebraic proof, not an inference from the finite census.
+For permutation prefixes, each reader row must be constant on each cycle of
+that prefix. It need not be invariant under every individual `G_j`, and it need
+not vanish. The condition concerns the actual chronological prefix.
+
+**One shared output at batch exit.** If all readers update the same accumulator,
+only their summed defect must vanish:
+
+```text
+sum_i H_i (P_(i-1) - I) = 0.                             (2)
+```
+
+For `G_1 = swap(0,1)`, `G_2 = G_3 = I`, and readers `0,e_0,e_1`, the individual
+defects are `0,(-1,1),(1,-1)`. Condition (2) holds while (1) fails. If the shared
+output is observable after every child, equality of consecutive partial sums
+again forces each individual defect to vanish. Thus observability is a material
+part of the contract; no general "one reader breaks it" theorem follows.
+
+## Returning arbitrary dirty workspace without exposing it
+
+Reading preserved input state is not by itself a catalytic scratch contract:
+outputs must be independent of borrowed dirt. Supply a read-only source `x`
+and a complete, exact additive call `B: z += Bx`, independent of the old target.
+Its inverse is `z -= Bx`; both restore private scratch. Execute:
+
+1. Pre-read `y_i -= H_i z` for every output.
+2. Call `B` to obtain `z_1 = z_0 + Bx`.
+3. Execute either compatible reader/permutation batch above.
+4. Call the complete inverse `B` after batch restoration.
+
+The output is `y_i^0 - H_i z_0 + H_i(z_0+Bx) = y_i^0 + H_i Bx`, and final
+workspace is exactly `z_0`. Source `x` is unchanged. All `x,z,y_i` ports are
+pairwise disjoint and excluded from private child scratch. The routing temporary
+and source accumulator are **two admitted clean scalars**, separately charged;
+no clean workspace row is assumed. Readers of other live state, nonlinear or
+rounded B calls, data-dependent permutations and intermediate observation during
+the pre-read/load sandwich are outside this contract.
+
+The same proof holds for rows of any common length `L`, with `G_i` replaced by
+`G_i tensor I_L` and the corresponding block readers. It does not construct a
+selected supplier or discharge the repository's physical recursive interfaces.
+
+## Noncommuting eight-coordinate fixture
+
+Use old-coordinate-to-new-coordinate cycle notation:
+
+```text
+G_1 = (01)(23)(45)(67)
+G_2 = (0123)(4567)
+G_3 = (04)(15)(26)(37)
+H_1 = e_0,  H_2 = e_0 + e_1,  H_3 = e_0 + e_2.
+```
+
+The first two maps do not commute. `P_2 = (02)(46)` and
+`P_3 = (06)(15)(24)(37)`. Each reader satisfies (1); the latter two read
+workspace that has actually drifted. Both have nonzero dependence on the
+original workspace. The catalytic wrapper uses
+`(Bx)_j = x_j + x_((j+1) mod 8)`; B need not be invertible or commute with G.
+The certificate spells out gather permutations `new[j] = old[p[j]]`, avoiding
+ambiguity between cycle and index-array conventions.
+
+The matrix checker uses dense exact products. The separately implemented
+[backend](backend.py) instead composes index arrays, decomposes cycles, emits
+scalar instructions and literally loads/unloads its clean accumulator. On every
+basis of the 19 arbitrary source/workspace/output coordinates (plus a mixed
+case), both complete wrapper programs implement `y_i += H_i Bx`, preserve all
+source/workspace coordinates, restore the temporary, and have a working literal
+reverse-inverse. This is finite evidence for the actual emitted fixture; the
+universal identity is proved above.
+
+## Complete invoice and recurrence
+
+A two-address ADD `d += sign*s`, with distinct ports, expands as
+`A += memory[s]; memory[d] += sign*A; A -= memory[s]`. Its source is unchanged,
+so A returns to zero. It pays two source reads, one target read, one target
+write and three scalar additions/subtractions. The data head traverses
+`0 -> s -> d -> s -> 0`, paying `2*s + 2*abs(d-s)` word transitions. The scalar
+A is separately located in a fixed arithmetic workspace; arithmetic/read/write
+macro costs include their internal access and scratch restoration.
+
+Each permutation cycle is implemented by swaps. A swap uses an initially zero
+scalar T and these **six**, fully charged, distinct-port shears:
+
+```text
+T += a; a -= T; a += b; b -= a; b += T; T -= b.
+```
+
+It returns `(a,b,T)` as `(b,a,0)`. A k-cycle uses `k-1` swaps. Here the forwards
+use 14 swaps, eager inverses another 14, and the composed inverse four. There
+is no free array copy, hidden permutation, erased scratch or unpaid inverse.
+The full wrapper has two 16-ADD B calls and ten reader ADDs.
+
+| Complete wrapper charge | Eager | Deferred |
+|---|---:|---:|
+| Forward-permutation ADDs | 84 | 84 |
+| Restoration ADDs | 84 | 24 |
+| Both B calls | 32 | 32 |
+| Pre-reads and batch reads | 10 | 10 |
+| **Two-address ADD instructions** | **210** | **150** |
+| Scalar additions/subtractions | 630 | 450 |
+| Source reads | 420 | 300 |
+| Target reads / target writes | 210 / 210 | 150 / 150 |
+| Data-tape word transitions | 5,864 | 4,504 |
+
+Workspace addresses are 0..7, outputs 8..10, T is 11, and immutable source
+addresses are 12..19. A is outside that data tape. The instruction stream has
+one fixed-width `(opcode,d,s,sign)` record per ADD; both programs use the same
+address width. Each event reads one record and returns the data head. Thus
+instruction reads, control dispatch and address decoding must be paid 210 and
+150 times, respectively, at the same declared per-record cost. No instruction
+or coefficient-access cost is claimed to be zero.
+
+For integer scalar inputs of magnitude less than `2^p`, every workspace value during the
+wrapper has magnitude at most `3*2^p`; during swaps it is either one of these
+values or zero. An intermediate output is bounded by `9*2^p`, and A loads only
+workspace, source or T. Signed width `b = p+5` therefore suffices without
+rounding. Allocation includes 20 data words and A, plus instruction storage,
+address/control counters and the scratch required by the chosen exact scalar
+arithmetic backend. This bound is about this fixture, not a floating-point
+precision contract or a fixed-tape multiplication implementation.
+
+For event-count `K`, scalar-add count `S`, word travel `J`, and word width b,
+a complete parametrized online bill is
+
+```text
+W(program;b) = S*c_add(b) + 3K*c_read(b) + K*c_write(b)
+             + b*J*c_move + K*c_dispatch(b, address_width).
+```
+
+Here read/write costs include intra-word scans and return to a word boundary;
+`c_add` includes arithmetic scratch restoration and scalar register updates;
+`c_dispatch` includes instruction-record access, decoding and counter work.
+No backend numerical timings are inferred. Online saving for the fixture is
+`180*c_add + 180*c_read + 60*c_write + 1360*b*c_move + 60*c_dispatch`.
+Startup allocation/zeroing of the two clean scalars is paid in admission `I`.
+
+For a general node, let `C_B^+/-` be complete recursive source-call costs,
+`R_H^-/+` complete reader costs, `Q(G)` complete routing costs, `P_S` program and
+coefficient preparation, and `D_S` dispatch/control not already included. With
+no double counting of these terms, the recurrences are
+
+```text
+T_E = I + P_E + C_B^+ + C_B^- + R_H^- + R_H^+
+      + sum_i [Q(G_i) + Q(G_i^-1)] + D_E,
+T_D = I + P_D + C_B^+ + C_B^- + R_H^- + R_H^+
+      + sum_i Q(G_i) + Q(P_r^-1) + D_D.
+```
+
+If `C_B^sign(L) = sum_j C_child(j,sign)(L_j) + A_B^sign(L)`, substitute the
+**entire** recurrence in both occurrences. All children, coefficient and source
+access, frame conversions, copies, private restoration and tape return belong
+in those terms. No child is eliminated by this argument. A caller requiring a
+new frame or external layout conversion must add it; this fixture stays in one
+fixed coordinate layout. Recursive children may not borrow the live rows.
+
+Preparation is not free: composing explicit n-entry permutation descriptors
+uses `r*n` index lookups and stores (24 of each here), plus validation, inverse
+construction, cycle extraction and instruction emission. General descriptors
+are not composable in merely `O(r)` work. Budget `O(r*n*log(n+1))` bit work for
+index manipulation, in addition to validation/coefficient preparation and
+writing the full instruction stream. The implementation computes the product
+in both modes to return admission metadata; a lean eager implementation could
+omit those 24 updates. We do not use this avoidable baseline work as a saving.
+For `M` invocations of a prepared fixed program, pay `I + P_S + M*W_S`.
+For a single call, the extra preparation must be smaller than the displayed
+online saving before claiming a total speedup. Neither M nor that tradeoff is
+silently assumed. The full parametrized bill makes this boundary explicit.
+
+Directly computing `H_i Bx` can be cheaper than either wrapper in this toy
+fixture. This is a legal replacement and correction within a fixed borrowing
+interface, **not** a minimum over arbitrary circuits, a claim that a new
+supplier is profitable, or a way to increase kappa from operation counts.
+
+## Coverage, failures and limits
+
+A further [separate symbolic checker](independent_check.py), included in the
+one-command replay, does not import the matrix criterion or backend execution
+engine. It checks all 873 permutations of widths 1 through 6 against the emitted
+forward words, then reconstructs both full wrapper maps using integer coefficient
+vectors. It independently derives every invoice field and bounds all intermediate
+coefficient L1 norms: workspace/T/A at most 3, outputs at most 5, source at most 1.
+The conservative integer-width allowance above is therefore sufficient. Its
+symbolic-map digest and exact bounds are retained in the certificate.
+
+The finite census exhausts all `2^3 * 9^3 = 5,832` three-child instances with
+2-coordinate permutations and reader coefficients in `{-1,0,1}`. Independent
+literal state replay on both workspace basis vectors agrees with the matrix
+criteria in every case. There are 2,592 compatible distinct-output instances,
+2,772 compatible shared-final-output instances, and 180 cancellation-only cases.
+This is completed finite coverage, not a new impossibility theorem.
+
+Controls include an incompatible nonzero reader with an explicit basis witness;
+a zero-workspace input that hides that defect; omitted final restoration;
+incorrect inverse order on a noncommuting example; an omitted reader; missing
+catalytic pre-reads that expose dirt; an omitted inverse B that fails restoration;
+and invalid/aliased instruction ports. Certificate/package mutations test
+rejection of an unpaid operation, source corruption and receipt corruption.
+
+The exact general lemma is proved in prose. Neither the finite replay nor the
+second Codex agent's algebraic review is independent human review or a formal
+proof in a proof assistant. No selected cold replay was run: this isolated note
+changes no supplier, selected certificate, shared generator, upstream source,
+review ledger or frozen predecessor evidence. All-size compiler, common-label /
+mutable-source realization, hosting, precision/tape and analytic transfer
+obligations of the selected multiplication result remain open as recorded there.
+
+## Provenance and credit
+
+Base: `1b59b624d21924f8e3537cdc1ac52d3be6eda2fe`. Assignment seed **50**, generated
+from OS randomness, selects recursive interfaces and the three-child/eight-entry
+fixture. There is no random search. [CLAIM.md](CLAIM.md) records the three narrow
+candidates and overlap decision; [SOURCE-PINS.json](SOURCE-PINS.json) identifies
+exact context files and retained sources. The selected result at that base is
+`836330098538459/500000000000000000`, from #1094 on #1087; complex binds in that
+assembly. We do not reassign its binding supplier or modify its frontier.
+
+Credit Navinor / Aaron Wang with opencode assistance for PR1155's deferral
+proposal and motivating reader question. Credit Sagar Thakrar's concurrent #1199 for the same applicability correction
+and its distinct checkpoint planner, and his #1012 and
+avirazza's #974 for the distinct hosted-assembly cost question; their reported
+mass-neutrality is not contradicted by this abstract-interface correction.
+Ross Richardson (CubeJerry)'s #889 supplies the shared-B, multiple-output dirty
+fanout/echo construction; the pre-read/load/unload wrapper here is an instance
+of that established mechanism, not a new batching claim. The additional result
+is admitting nonzero readers through intervening workspace permutations using
+the exact prefix condition, independently corroborating PR1199. Gareth Davidson's #1057 and woklerx's #1164 concern dirty-pool allocation and
+higher-arity echoes, not the reader-defect criterion here. Ross Richardson's
+universal-connector work and the repository's preceding dirty-restoration work
+retain their own scopes and attribution. No priority claim is made for elementary
+linear invariance or echo cancellation.
+
+Prepared for **mightyOil (Philipp)** with substantial **OpenAI Codex assistance**
+in mathematics, implementation, verification and writing, including three scoped
+Codex subagents. New files are Apache-2.0; retained source credit is in
+[NOTICE.md](NOTICE.md).
diff --git a/research/output-sign-restoration-seed51/sources/PR1205-README.md b/research/output-sign-restoration-seed51/sources/PR1205-README.md
new file mode 100644
index 0000000000..7ed4d89d17
--- /dev/null
+++ b/research/output-sign-restoration-seed51/sources/PR1205-README.md
@@ -0,0 +1,263 @@
+# Observer-safe deferred dirty restoration
+
+**Recursive-interface research construction and correction; no new kappa.**
+Adam Gall (@adamgall), with substantial OpenAI Codex assistance in the research,
+proof, implementation, verification and writing. New material is Apache-2.0.
+
+## Result and provenance
+
+[PR1155](https://github.com/CrocSwap/integer-mult-bounds/pull/1155), Aaron Wang
+(@navinor), proposes replacing per-child workspace restoration by one final
+composed restoration. Its frozen README says this preserves final observables
+“if and only if no child reads the workspace's intermediate value” and that
+“one reader child breaks it”. Its exhibited bad reader is a valid counterexample
+to *unrestricted* deferral, but cannot establish that necessity statement.
+
+This package gives the exact replacement criterion, a strictly larger constructive
+class with nonzero readers, and the distinction between terminal and prefix
+observations. It does not dispute PR1155's read-free examples or claim priority
+for restoration coalescing. Its finite census is new evidence, not a finite
+replay presented as an all-size proof. The proof below supplies the all-size
+statement in the specified linear model.
+
+Base: `1b59b624d21924f8e3537cdc1ac52d3be6eda2fe`. PR1155 source head:
+`9821c6e9388f3fc097e94b72be9fa7b41a849527`. The complete source README is
+preserved byte-for-byte under `context/`, with attribution intact; `SOURCES.json`
+pins it, the license and the base selected record. No predecessor verifier is
+imported. The actual selected base result is PR1094, conditional
+`kappa = 836330098538459/500000000000000000`, not an open PR headline. Its
+[review](../../docs/research/community-batch1099-review.md) and actual
+`research/complex-t16-rare-pattern-exchanges/README.md` were followed from the
+selected certificate. This package does not modify that construction.
+
+Seed **52**, derived from fresh OS uint32 `3718171852` modulo 100. The seed picks
+the recursive-interface track and the concrete odd arity `2 + (52 mod 7) = 5`.
+`CLAIM.json` records the three candidates and overlap decisions. No pinned sprint
+issue exists; the only open issues at claiming were #913 and #650, neither a
+coordination issue. Scope was claimed locally before implementation and reserved
+with the parent of the five independent rounds. Prior PRs #1114 and #1098 are
+not reused as these rounds' deliverables.
+
+## Exact criterion
+
+Work over any field. Let data be `D in F^d`, borrowed workspace `W in F^w`, and
+fixed child `i` perform
+
+```
+D <- D + B_i W       (reads the pre-child workspace)
+W <- G_i W          (G_i invertible)
+```
+
+Read-only external-source increments may be added to both versions and cancel.
+The children do not choose later matrices from intermediate data. Eager execution
+applies `G_i^{-1}` after every child. Deferred execution applies only
+`P_r^{-1}` at the end, where `P_0=I` and `P_i=G_i ... G_1`.
+
+**Terminal theorem.** The two programs agree on final `(D,W)` for every arbitrary
+dirty input exactly when
+
+```
+Delta_r = sum_{i=1}^r B_i (P_{i-1} - I) = 0.
+```
+
+**Proof.** Before child `i`, eager workspace is `W_0`, and deferred workspace is
+`P_{i-1} W_0`. Summing the respective data increments gives difference
+`Delta_r W_0`. Both restore workspace to `W_0`. Equality on every `W_0` is
+equivalent to the displayed matrix vanishing (test the basis columns). This is
+an all-size algebraic proof, not an inference from the census.
+
+**Prefix theorem.** If data may be observed after every child, agreement requires
+and is equivalent to `Delta_j=0` for every `j`. Subtracting consecutive equations
+makes this equivalent to `B_i(P_{i-1}-I)=0` for each `i`. It does *not* require
+`B_i=0`. These observations exclude the intentionally drifting workspace itself.
+If that workspace must be observed in its entry coordinates, it must be restored
+at that observation boundary. If a later control depends on data, use the prefix
+criterion; terminal cancellation alone is not an admissible adaptive rewrite.
+
+### Two strict counterexamples to read-free necessity
+
+Let `G_i = [[1,1],[0,1]]` for three children and write workspace `(a,b)`.
+
+1. `B_i=(0,1)` for every child. Each child reads nonzero dirty data `b`, yet
+   drift changes only `a`. Every data prefix agrees; both final programs return
+   `(D+3b,a,b)`. Final restoration is `a <- a-3b`.
+2. `B_1=(0,0), B_2=(2,0), B_3=(-1,0)`. Child 2 genuinely reads the changed
+   value `a+b`; child 3 reads `a+2b`. Deferred data increment is
+   `2(a+b)-(a+2b)=a`, equal to eager `2a-a=a`. The intermediate data difference
+   after child 2 is `2b`, so this batch is terminal-safe but not prefix-safe.
+
+The second example directly addresses observable reads of the changing component,
+not just a reader that happens to avoid it.
+
+## Constructive family and fully paid local invoice
+
+For a square-zero drift `U=uv^T` with `v^T u=0`, take `G_i=I+alpha_i U`.
+Then `P_i=I+(sum_{k<=i}alpha_k)U`, and its inverse subtracts that coefficient.
+Every `B_i` with `B_i u=0` is prefix-safe, even if nonzero. This supplies a family
+at arbitrary dimension and arity. Its cheap implementation below uses coordinate
+`u=e_a,v=e_b`, rather than pretending a dense outer product costs one primitive.
+
+There are three length-`N` streams `D,a,b`. The concrete child shell is
+`D += b; a += alpha_i b`, with each `alpha_i` equal to `+1` or `-1`.
+Every source access is retained; no clean copy of `a` or `b` is required.
+Eager additionally executes `a -= alpha_i b` after each shell. Deferred executes
+`a -= S b` once, where `S=sum alpha_i`, skipping it only when `S=0`.
+
+Count a signed ADD as one scalar primitive and a nonunit constant multiplication
+as one additional primitive; this is an exact-arithmetic accounting convention,
+not the selected complex real-primitive backend. Let `h=[S!=0]` and
+`m=[abs(S)>1]`. At one node the complete shell invoice is:
+
+| Work | Eager | Deferred |
+|---|---:|---:|
+| nonzero-reader ADDs | rN | rN |
+| forward workspace ADDs | rN | rN |
+| restoration ADDs | rN | hN |
+| nonunit constant MULs | 0 | mN |
+| total scalar primitives | 3rN | (2r+h+m)N |
+
+Each ADD reads two data scalars and writes one; each extra multiplication reads
+one scalar and writes one reusable scalar temporary. Thus reads are
+`2*ADD+MUL`, writes `ADD+MUL`, and peak allocated data is `3N+m` scalars (the
+extra scalar may be reused across all nodes). Constants and event descriptors are
+read-only program data. For the frozen family they are compile-time constants;
+constructing a general coefficient sum costs `r-1` descriptor additions once per
+node specification, not an uncharged data pass. Forward shears, output updates,
+final restoration, accesses and any temporary are all included. There are no
+frame changes, initialized auxiliary streams, source copies, or omitted inverse
+recursive calls in this explicitly specified program.
+
+All-positive coefficients give `S=r`, so the priced saving is `(r-2)N`, not
+`(r-1)N`: the multiplication by `r` is paid. The seed-selected odd-five family
+`(1,-1,1,-1,1)` gives `S=1`, so every command is an ADD: **15N -> 11N**, a saving
+of **4N**. Scratch really drifts at children 2 and 4, while each reader still
+sees the invariant stream. This is not merely omitting an identity restoration.
+
+## Complete recursion and precision boundary
+
+To make the child term explicit, `emit` constructs an actual recursive program.
+At depth `d>0`, split each stream into `r` disjoint equal partitions. For each
+child `i`, first invoke the depth-`d-1` source-restoring program on partition `i`
+with its arbitrary current dirty `a`, then execute that child's full-`N` shell
+above. Eager restores after each shell, deferred only at node exit. A leaf is
+the identity and has zero cost. Children can run with drifted `a` because every
+data read depends only on invariant `b`; by induction all children restore their
+entry workspace. Each position receives `r*d` additions of its own `b`.
+
+For `N=r^d`, the full recurrences, including all recursive work, are
+
+```
+E_0(N)=F_0(N)=0
+E_d(N)=r E_{d-1}(N/r) + 3rN
+F_d(N)=r F_{d-1}(N/r) + (2r+h+m)N
+E_d(N)=3rNd; F_d(N)=(2r+h+m)Nd.
+```
+
+These equations count scalar arithmetic, not free machine dispatch. There are
+`J=(r^d-1)/(r-1)` internal nodes, `rJ` recursive child invocations, and respectively
+`3rJ` or `(2r+h)J` stream events. Charging `C_call` per recursive invocation,
+`C_event` per event and `C_step` per scalar loop iteration adds exactly
+`rJ*C_call + events*C_event + ADD*C_step` in this abstract controller model,
+plus the separately tabulated data reads/writes. An event's five immutable
+descriptor fields can be charged five descriptor reads within `C_event`.
+Routing is an ordered contiguous scan of the named partition, not a free
+permutation. A streaming recursive realization keeps an `O(d)` index stack
+and the fixed `r` coefficients besides the stated data; it need not materialize
+the word. The verifier deliberately materializes the complete event list
+(`5*events` descriptor scalars) for independent reversal and replay. Neither
+its Python memory use nor its runtime is claimed to attain the streaming
+resource bound. All extra controller terms and the reader/scratch work remain;
+only the displayed restoration events disappear.
+
+The inverse program reverses all events and negates coefficients, without new
+storage; its scalar invoice is identical. `verify.py` replays both directions
+on every basis column of all three dirty streams for depths 0..3 and arities 3
+and 5. The zero-cost identity leaf is part of this completely implemented
+restoration experiment, not a placeholder for a promised supplier. A real leaf
+backend of cost `L` would add `r^d L` to *both* recurrences and must independently
+satisfy this reader/restoration contract.
+
+For integer inputs of magnitude at most `M`, unit shells along a depth-`d` path
+keep both data and scratch magnitudes at most `(1+rd)M`; the temporary for a
+nonunit restoration is at most `rM`. Consequently adding
+`ceil(log2(1+rd))` magnitude bits (plus a sign bit under an unsigned-magnitude
+convention) suffices in this integer model. The code uses unbounded exact Python
+integers and Fractions. No fixed-tape implementation, rounded complex arithmetic
+contract, native compiler, or supplier precision admission is claimed. This
+boundary is distinct from the rounded-leaf obstruction in PR1135 and modular
+borrowing in PR1159; it does not evade those results.
+
+## Reproduction, domain and controls
+
+From the repository root, Python 3.10+, standard library only:
+
+```sh
+python3 -I -O -B research/observer-safe-restoration/verify.py
+```
+
+The command authenticates the pinned source/context bytes, recomputes every
+certificate field and compares `EXPECTED.json`. It never writes by default.
+`--write NEW_PATH` creates a fresh certificate and refuses to overwrite one.
+No randomized search or tolerance acceptance is used.
+
+For one complete relocated replay followed by an actual source-corruption
+subprocess rejection (without repeating the expensive census for the corrupt
+source), run:
+
+```sh
+python3 -I -O -B research/observer-safe-restoration/test_package.py
+```
+
+Its final marker is
+`PASS_OBSERVER_RESTORATION_PACKAGE relocation=1 source_corruption=1`.
+
+The bounded census is all **46,656** three-child tuples: each `G_i` is one of
+four integral shears `I +/- E_12`, `I +/- E_21`; each row reader is one of the nine
+vectors in `{-1,0,1}^2`. Full 3-by-3 state-operator composition is compared with
+the separately computed two-dimensional defect. The signed coefficient domain,
+three-child stopping rule and complete coverage are fixed before execution.
+This census is not an impossibility theorem outside its domain. A noncommuting
+rational fixture additionally checks the formula with genuine denominators.
+
+The completed census finds **7,776 terminal-safe** tuples, of which **6,048**
+are prefix-safe and **1,728** are terminal-only. **7,712** terminal-safe tuples
+contain a nonzero reader. Recursive forward/inverse replay covers **588**
+dirty-state basis columns across eight `(arity,depth)` instances. At arity five,
+depth three and `N=125`, the complete emitted scalar invoice is **5,625 -> 4,125
+ADDs** (zero constant multiplications), saving 1,500 ADDs with the same 375 dirty
+data scalars. These are emitted-program counts, not a runtime measurement.
+
+Six meaningful controls require failure: a reader outside the drift annihilator,
+observing an unsafe prefix of a terminal-cancelling batch, wrong inverse order
+for noncommuting shears, omitted final restoration, changing a shear direction,
+and a defect hidden by testing only zero-initialized dirty helpers. These are
+mathematical counterexamples, not failed searches. The exact receipt records
+classification counts, all recursive invoices and the explicit rational defect.
+
+Only this isolated package's checks are relevant. No selected cold replay,
+repository-wide `make verify`, remote CI or proof-assistant build is claimed.
+The universal theorem is the written argument above; finite tests check the
+implementations and exhibited failures. Selected all-size/compiler,
+common-label/mutable-source, hosting, precision/tape, analytic and bit H1-H5
+assumptions remain untouched. No new multiplication exponent or admitted paid
+supplier profile follows from saving these boundary primitives.
+
+## Related work and credit
+
+Aaron Wang / Navinor's PR1155 is the direct predecessor and supplies the model,
+coalescing direction and source text corrected here. Its own credits to Chafik
+Boukhalfa's dirty-connector work, Gareth Davidson, Ross Richardson, Douglas
+Colkitt and the retained complex batching recurrence are preserved in the frozen
+README. PR1012 and PR974 price restoration at hosted-assembly level; this package
+changes the operator admissibility class, not their rank-mass conclusion.
+PR1057/1164 concern borrowed-port echo allocation, and PR1135/1159 concern exact
+versus rounded/modular contracts; none is a dependency of this implementation.
+PR889 (`e2021d1c9e06948528cbc0a8fd7079b671da981d`) batches common-factor
+product shears with a query-minimal one-connector word. It does not supply this
+observer defect criterion. PR1105 (`20a960b545f4b0ade4f26922ef686bd5eaf275f4`)
+audits projected cleanup with target feedback in PR543; our children have no
+data-to-workspace feedback and use full inverse workspace restoration. These
+nearby algebraic interfaces are distinct and their negative conclusions are
+not reopened.
+Substantial OpenAI Codex assistance is disclosed above; no independent human or
+formal review is asserted. The repository Apache-2.0 license is retained locally.
diff --git a/research/output-sign-restoration-seed51/test_package.py b/research/output-sign-restoration-seed51/test_package.py
new file mode 100644
index 0000000000..58da63212f
--- /dev/null
+++ b/research/output-sign-restoration-seed51/test_package.py
@@ -0,0 +1,46 @@
+"""Check relocation and real on-disk corruptions using only the standard library."""
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import tempfile
+
+HERE = Path(__file__).resolve().parent
+
+
+def run(root, ok):
+    result = subprocess.run([sys.executable, "-I", "-O", "-B", str(root / "verify.py")],
+                            cwd=root.parent, capture_output=True, text=True)
+    if (result.returncode == 0) != ok:
+        raise ValueError(result.stdout + result.stderr)
+    if ok and "PASS_OUTPUT_SIGN_RESTORATION" not in result.stdout:
+        raise ValueError("missing success marker")
+    if not ok and not any(message in result.stderr for message in
+                          ("source SHA256 mismatch", "source Git blob mismatch", "certificate mismatch")):
+        raise ValueError("corruption failed for an unrelated reason: " + result.stderr)
+
+
+def main():
+    with tempfile.TemporaryDirectory(prefix="output-sign-") as tmp:
+        root = Path(tmp) / "relocated"
+        shutil.copytree(HERE, root, ignore=shutil.ignore_patterns("__pycache__"))
+        run(root, True)
+        paths = ["sources/PR1155-README.md", "SOURCE-PINS.json", "CERTIFICATE.json"]
+        originals = {name: (root / name).read_bytes() for name in paths}
+        mutations = [
+            (paths[0], lambda data: data + b"changed source\n"),
+            (paths[1], lambda data: data.replace(b'"git_blob": "43ef54', b'"git_blob": "03ef54', 1)),
+            (paths[2], lambda data: data.replace(b'"NEG_saved": 56', b'"NEG_saved": 57', 1)),
+            (paths[2], lambda data: data.replace(b'"schedules": 21840', b'"schedules": 21839', 1))]
+        for name, mutate in mutations:
+            changed = mutate(originals[name])
+            if changed == originals[name]:
+                raise ValueError("mutation did not alter file")
+            (root / name).write_bytes(changed)
+            run(root, False)
+            (root / name).write_bytes(originals[name])
+    print("PASS_OUTPUT_SIGN_PACKAGE relocation=1 corruptions=4")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/research/output-sign-restoration-seed51/verify.py b/research/output-sign-restoration-seed51/verify.py
new file mode 100644
index 0000000000..70d1fee6fc
--- /dev/null
+++ b/research/output-sign-restoration-seed51/verify.py
@@ -0,0 +1,233 @@
+"""Independent affine replay, finite sign enumeration and package checks.
+
+Sagar Thakrar, with substantial OpenAI Codex assistance. Apache-2.0.
+Run with -I -O -B: checks deliberately do not rely on Python assert.
+"""
+import argparse
+import hashlib
+import importlib.util
+import itertools
+import json
+from pathlib import Path
+import random
+from fractions import Fraction
+
+HERE = Path(__file__).resolve().parent
+spec = importlib.util.spec_from_file_location("sign_word", HERE / "word.py")
+word = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(word)
+
+
+def require(ok, message):
+    if not ok:
+        raise ValueError(message)
+
+
+def replay(program, state):
+    state = list(state)
+    for op in program:
+        if op[0] == "add":
+            _, dst, src, sign = op
+            require(dst != src and sign in (-1, 1), "invalid ADD")
+            state[dst] += sign * state[src]
+        elif op[0] == "neg":
+            state[op[1]] = -state[op[1]]
+        else:
+            raise ValueError("unknown instruction")
+    return state
+
+
+def matrix(tree, n, d):
+    if "matrix" in tree:
+        return tree["matrix"]
+    result = [[0] * n for _ in range(d)]
+    for child in tree["children"]:
+        child_matrix = matrix(child, n, d)
+        for i in range(d):
+            for j in range(n):
+                result[i][j] += child_matrix[i][j]
+    return result
+
+
+def expected(state, transform, n, d, reader=False, direction=1):
+    result = list(state)
+    for i in range(d):
+        result[i] += (1 if reader else direction) * sum(transform[i][j] * state[d + j] for j in range(n))
+    if reader:
+        result[d:d+n] = [-x for x in state[d:d+n]]
+    return result
+
+
+def bill(program):
+    adds = sum(op[0] == "add" for op in program)
+    negs = len(program) - adds
+    return {"ADD": adds, "NEG": negs, "instructions": len(program),
+            "data_reads": 2 * adds + negs, "data_writes": adds + negs,
+            "descriptor_fields": 4 * adds + 2 * negs}
+
+
+def recurrence(tree, n, d, eager, reader):
+    if "matrix" in tree:
+        return sum(c != 0 for row in tree["matrix"] for c in row), n
+    child_bills = [recurrence(child, n, d, eager, True) for child in tree["children"]]
+    k = len(child_bills)
+    boundary = k * n if eager else (k % 2) * n + 2 * (k // 2) * min(n, d)
+    return 2 * sum(a for a, g in child_bills) + 2 * n, 2 * sum(g for a, g in child_bills) + 2 * boundary + (n if reader else 0)
+
+
+def check_map(tree, n, d, eager=False, reader=False):
+    program, registers = word.compile_word(tree, n, d, eager=eager, reader=reader)
+    transform = matrix(tree, n, d)
+    actual_bill = bill(program)
+    require((actual_bill["ADD"], actual_bill["NEG"]) == recurrence(tree, n, d, eager, reader), "recursive bill mismatch")
+    reverse = word.inverse(program)
+    require(bill(reverse) == actual_bill, "inverse price mismatch")
+    for j in range(registers):
+        state = [int(i == j) for i in range(registers)]
+        forward = replay(program, state)
+        require(forward == expected(state, transform, n, d, reader), "basis map mismatch")
+        require(replay(reverse, state) == expected(state, transform, n, d, reader, -1), "inverse basis mismatch")
+        require(replay(reverse, forward) == state, "literal inverse failed")
+    probe = [Fraction((-1)**i * (i+2), 2*i+1) for i in range(registers)]
+    require(replay(program, probe) == expected(probe, transform, n, d, reader), "rational dirty probe failed")
+    return program, registers, actual_bill
+
+
+def enumerate_boundaries():
+    # This replay knows no frame invariant or closed-form optimal schedule.
+    schedules = 0
+    prices = 0
+    admitted = 0
+    for k in range(1, 7):
+        valid = []
+        for gaps in itertools.product(range(4), repeat=k+1):
+            schedules += 1
+            wsign, out, a, b = 1, [1] + [0]*k, 0, 0
+            for i, gate in enumerate(gaps):
+                if gate & 1:
+                    wsign = -wsign
+                    a += 1
+                if gate & 2:
+                    out = [-v for v in out]
+                    b += 1
+                if i < k:
+                    out[i+1] += wsign
+                    wsign = -wsign
+            if wsign == 1 and out == [1]*(k+1):
+                valid.append((a, b))
+        admitted += len(valid)
+        for n in range(1, 9):
+            for d in range(1, 9):
+                prices += 1
+                require(min(a*n + b*d for a, b in valid) == (k%2)*n + 2*(k//2)*min(n, d), "boundary minimum mismatch")
+    return {"schedules": schedules, "admitted": admitted, "price_cases": prices}
+
+
+def make_tree(rng, n, d, depth, k, dense=False):
+    if depth == 0:
+        alphabet = (-1, 1) if dense else (-1, 0, 1)
+        return {"matrix": [[rng.choice(alphabet) for _ in range(n)] for _ in range(d)]}
+    return {"children": [make_tree(rng, n, d, depth-1, k, dense) for _ in range(k)]}
+
+
+def controls(tree, n, d, program, registers):
+    transform = matrix(tree, n, d)
+    def differs(bad):
+        for j in range(registers):
+            state = [int(i == j) for i in range(registers)]
+            if replay(bad, state) != expected(state, transform, n, d):
+                return True
+        return False
+    target_neg = next(i for i, op in enumerate(program) if op[0] == "neg" and op[1] < d)
+    require(differs(program[:target_neg] + program[target_neg+1:]), "missing output sign accepted")
+    source_copy = next(i for i, op in enumerate(program) if op[0] == "add" and op[1] >= d+n and d <= op[2] < d+n and op[3] == -1)
+    require(differs(program[:source_copy] + program[source_copy+1:]), "missing source uncopy accepted")
+    batch_end = source_copy - n
+    require(all(op[0] == "neg" and op[1] >= d+n for op in program[batch_end:source_copy]), "workspace boundary not found")
+    require(differs(program[:batch_end] + program[source_copy:]), "missing workspace restore accepted")
+    require(differs(program[:source_copy+n]), "missing second pass accepted")
+    # Unframed fixed readers alternate instead of adding, on a concrete input.
+    w, out = 3, 7
+    for _ in range(5):
+        out += w
+        w = -w
+    w = -w
+    require((out, w) != (22, 3), "unframed deferral control failed")
+    # Oddness is enough for the batch, but the transparent echo needs additivity.
+    require((3+2)**3 - 3**3 != 2**3, "nonlinear dirt control failed")
+    # Between the second child and its output sign repair, D is noncanonical.
+    w, out = 3, 7
+    out += w; w = -w
+    out = -out
+    out += w; w = -w
+    require(out != 7 + 2*3 and -out == 7 + 2*3, "prefix observer control failed")
+    bad_inputs = [({}, n, d), ({"children": []}, n, d), ({"matrix": [[True]*n]}, n, d),
+                  ({"matrix": [[2]*n]}, n, d), ({"matrix": [[1]*(n-1)]}, n, d),
+                  (tree, True, d), (tree, n, 0)]
+    for bad_tree, bad_n, bad_d in bad_inputs:
+        try:
+            word.compile_word(bad_tree, bad_n, bad_d, reader=True)
+        except ValueError:
+            continue
+        raise ValueError("invalid input accepted")
+    return {"mathematical": 7, "invalid_inputs": len(bad_inputs)}
+
+
+def calculate():
+    census = enumerate_boundaries()
+    rng = random.Random(51)
+    cases = columns = 0
+    for n, d, k, depth in itertools.product(range(1, 5), range(1, 4), range(1, 5), range(1, 3)):
+        tree = make_tree(rng, n, d, depth, k)
+        for eager, reader in itertools.product((False, True), repeat=2):
+            _, registers, _ = check_map(tree, n, d, eager, reader)
+            cases += 1
+            columns += registers
+    tree = make_tree(random.Random(51), 8, 1, 1, 5, dense=True)
+    program, registers, framed = check_map(tree, 8, 1)
+    _, _, eager = check_map(tree, 8, 1, eager=True)
+    deeper = []
+    for depth in (2, 3):
+        node = make_tree(random.Random(51+depth), 8, 1, depth, 5, dense=True)
+        for old in (False, True):
+            _, regs, count = check_map(node, 8, 1, eager=old, reader=True)
+            deeper.append({"depth": depth, "eager": old, "registers": regs, **count})
+    require(framed["ADD"] == 96 and framed["NEG"] == 104 and eager["NEG"] == 160, "selected invoice changed")
+    return {"schema": 1, "seed": 51, "status": "finite recursive interface; no new kappa",
+            "boundary_enumeration": census, "recursive_cases": cases, "basis_columns": columns,
+            "selected": {"children": 5, "workspace_width": 8, "output_width": 1,
+                         "registers": registers, "tree": tree, "matrix": matrix(tree, 8, 1),
+                         "framed": framed, "eager": eager, "NEG_saved": 56,
+                         "word_sha256": hashlib.sha256(json.dumps(program, separators=(",", ":")).encode()).hexdigest()},
+            "deeper_readers": deeper, "controls": controls(tree, 8, 1, program, registers)}
+
+
+def verify_pins():
+    pins = json.loads((HERE / "SOURCE-PINS.json").read_text())
+    required = {f"sources/PR{pr}-README.md" for pr in (1155, 1203, 1205)}
+    require(len(pins["retained_sources"]) == 3 and
+            {pin["local_path"] for pin in pins["retained_sources"]} == required,
+            "source pin set mismatch")
+    for pin in pins["retained_sources"]:
+        data = (HERE / pin["local_path"]).read_bytes()
+        require(hashlib.sha256(data).hexdigest() == pin["sha256"], "source SHA256 mismatch: " + pin["local_path"])
+        blob = hashlib.sha1(b"blob " + str(len(data)).encode() + b"\0" + data).hexdigest()
+        require(blob == pin["git_blob"], "source Git blob mismatch")
+    return len(pins["retained_sources"])
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--emit", action="store_true", help="print the recomputed certificate")
+    args = parser.parse_args()
+    pins = verify_pins()
+    result = calculate()
+    if args.emit:
+        print(json.dumps(result, indent=2, sort_keys=True))
+    else:
+        require(result == json.loads((HERE / "CERTIFICATE.json").read_text()), "certificate mismatch")
+        print(f"PASS_OUTPUT_SIGN_RESTORATION schedules={result['boundary_enumeration']['schedules']} recursive_cases={result['recursive_cases']} saved_NEG=56 source_pins={pins} kappa=unchanged")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/research/output-sign-restoration-seed51/word.py b/research/output-sign-restoration-seed51/word.py
new file mode 100644
index 0000000000..f676d4a669
--- /dev/null
+++ b/research/output-sign-restoration-seed51/word.py
@@ -0,0 +1,75 @@
+"""Exact words for fixed linear readers that negate their source port.
+
+Sagar Thakrar, with substantial OpenAI Codex assistance. Apache-2.0.
+"""
+
+
+def check_tree(tree, width, outputs):
+    if type(width) is not int or type(outputs) is not int or min(width, outputs) < 1:
+        raise ValueError("positive integer register widths required")
+    if not isinstance(tree, dict):
+        raise ValueError("a reader is a matrix leaf or a nonempty child list")
+    if set(tree) == {"matrix"}:
+        matrix = tree["matrix"]
+        if not isinstance(matrix, (list, tuple)) or len(matrix) != outputs:
+            raise ValueError("matrix output width mismatch")
+        for row in matrix:
+            if not isinstance(row, (list, tuple)) or len(row) != width:
+                raise ValueError("matrix source width mismatch")
+            if any(type(c) is not int or c not in (-1, 0, 1) for c in row):
+                raise ValueError("leaf coefficients must be -1, 0 or 1")
+        return 0
+    if set(tree) != {"children"} or not isinstance(tree["children"], (list, tuple)) or not tree["children"]:
+        raise ValueError("a reader is a matrix leaf or a nonempty child list")
+    return 1 + max(check_tree(child, width, outputs) for child in tree["children"])
+
+
+def inverse(word):
+    return [("add", op[1], op[2], -op[3]) if op[0] == "add" else op
+            for op in reversed(word)]
+
+
+def compile_word(tree, width, outputs, *, eager=False, reader=False):
+    """Return a frozen ADD/NEG word and its number of scalar registers.
+
+Registers are D, X, then one arbitrary dirty width-sized block per tree level.
+An echo preserves X; a reader additionally negates X on return.
+"""
+    depth = check_tree(tree, width, outputs)
+    if type(eager) is not bool or type(reader) is not bool:
+        raise ValueError("eager and reader must be booleans")
+    if not reader and "children" not in tree:
+        raise ValueError("an echo requires at least one child")
+
+    def negate(start, size):
+        return [("neg", start + j) for j in range(size)]
+
+    def child_word(node, level):
+        source = outputs + level * width
+        if "matrix" in node:
+            word = [("add", i, source + j, c)
+                    for i, row in enumerate(node["matrix"])
+                    for j, c in enumerate(row) if c]
+        else:
+            word = echo_word(node, level)
+        return word + negate(source, width)
+
+    def echo_word(node, level):
+        source = outputs + level * width
+        scratch = source + width
+        batch = []
+        children = node["children"]
+        use_workspace = eager or width <= outputs
+        for i, child in enumerate(children):
+            if not use_workspace and i:
+                batch += negate(0, outputs)
+            batch += child_word(child, level + 1)
+            if use_workspace:
+                batch += negate(scratch, width)
+        if not use_workspace:
+            batch += negate(scratch, width) if len(children) % 2 else negate(0, outputs)
+        copy = [("add", scratch + j, source + j, 1) for j in range(width)]
+        return copy + batch + inverse(copy) + inverse(batch)
+
+    word = child_word(tree, 0) if reader else echo_word(tree, 0)
+    return word, outputs + (depth + 1) * width