Audit the hosting boundary of PR1817’s retimed rank-one word

research/diagonal-retiming-host-boundary/README.md

@@ -0,0 +1,134 @@
+# PR1817 retiming preserves the selected whole-call hosting projection
+
+**Independent substitution-interface audit; no rank-16 child or new kappa.**
+At [PR1817](https://github.com/CrocSwap/integer-mult-bounds/pull/1817) head
+`ac3a759e874e8e526bc884fc2cb8eb114695b063`, the credited generator moves
+original rank-one climbs inside their phases and identifies 134 potential
+diagonal batches per orientation. The predecessor checks local replay but
+explicitly leaves global owner/window and idle-frame sensitivity unverified.
+This package closes that **coarse boundary projection** gap for its exact words.
+
+Every original child retains its rank and frame endpoints. The audit does not
+replace any group with a rank-16 child. The actual local paid profile stays
+`{1:2412,2:418,3:432,4:142,5:82,8:8}` and all added interface charges remain
+outside this result. The original construction card's five-percent gate is not met.
+
+## Contract and proof
+
+The selected T16 controller completes each local invocation, its cover and
+normalization wrappers before the next invocation. A whole helper occupies one
+physical family for that complete invocation; its route and orthogonal chart
+are fixed there. All 704 logical L owners in each call are distinct. Private
+centre/tableau/coefficient roles retain their separate namespaces and their
+inherited complete-child scratch contracts. Native implementation and tape
+validity of those contracts remain assumptions of the selected construction.
+In particular, each completed primitive must restore its shared implementation
+workspace to the required caller state and have no dependence on its event
+position. Disjoint logical supports alone do not prove physical commutation.
+
+Match every candidate event to one identical original occurrence. Within each
+phase, the verifier compares the ordered occurrence list touching **each role**,
+including reads, writes, scale/copy/ADD/CLEAR, frame climbs, centres, and all
+adapters. It also fixes the non-rank-one skeleton and every phase marker.
+
+Why this proves local substitution: both words are linear extensions of the
+same shared-role dependency order. To transform one into the other, move its
+first desired occurrence left across the occurrences preceding it. Any such
+crossed occurrence must have disjoint logical support, or its shared-role order
+would differ. The two complete logical actions commute, so the swap preserves
+the exact map on arbitrary inputs. Repeat inductively. Applying this argument
+separately in each phase gives the same complete phase map, hence the same state
+and frame boundary at every phase cut, including private cleanup. This assumes
+the retained complete-primitive semantics; it is not a new native compiler proof.
+
+Why the hosting projection then stays unchanged: the actual selected window
+reader measures eligibility between a replica's previous family touch and its
+idle sweep, using **complete** local-cover events and bridges. It never uses a
+position within the local word. The frozen source is
+`research/complex-t16-rare-pattern-exchanges/upstream1087.tar.gz`, members
+`code/audit_allcold.py` lines 124–156 and `t16/build_parent.py` lines 171–195.
+The new independent geometry checker reconstructs those windows from the
+selected outer schedule, rather than trusting their stored lists.
+
+Helper widths are the actual final-minus-start frame dimensions. Fixed widths,
+owners, offsets and data axes determine the occupied pending coordinates and
+the 73-axis spectator chart. The remaining idle frame is exactly the pending
+axis suffix after the occupied prefix. None of these functions takes a
+within-phase position as input. The checked unchanged local boundary and outer
+schedule therefore yield identical whole-call reservations, charts and idle
+frames. This also uses the inherited full-invocation residual-wrapper semantics.
+
+The result applies to this exact original-rank retiming with unchanged call
+schedule and exclusive whole-call reservations. It gives no permission to
+interleave calls, change an owner, move across a phase, or replace the native
+operator alphabet. Global physical traces and precision envelopes were not replayed.
+
+## Exact evidence and binding limit
+
+[RESULT.json](RESULT.json) records both 24,767-event orientations, ten phase
+cuts each and every shared-role occurrence trace. There are 7,111 permuted
+positions in each orientation; batch counts reproduce 58 A, 52 B, four
+cleanup-tail and 20 final groups. The batch construction and counts remain
+PR1817's work; its unmodified generator is in `predecessor/batch.py` with exact
+head, Git blob and SHA256 recorded in [SOURCES.json](SOURCES.json).
+
+The independent geometry replay checks all **144 calls**, **69,120 helper
+reservations**, **288 exact windows**, **10,002 orthogonal 73-axis charts** and
+**7,526 idle remainders**. It compares every exported idle axis and reconstructs
+the unchanged global frame-child profile and deficit. The selected replay
+archive is byte-pinned; consumed compressed members and decompressed payloads
+are separately hashed. Nine semantic/geometric faults reject, including a private
+namespace crossing into live owner storage.
+
+Both new event hashes differ from the selected ones, and **all 144 frozen call
+bindings** name the old hashes. That is an explicit admission boundary: the
+frozen native/phase/invoice receipts cannot be silently reused. This package is
+a new finite projection receipt, not a new selected or full supplier admission.
+
+```
+python3.12 -B scripts/research_package.py --package research/diagonal-retiming-host-boundary
+```
+
+The normal command is read-only. `verify.py --write-result NEW_PATH` refuses an
+occupied destination. Standard library only. [TASK.json](TASK.json) records the
+changed scope, revision-3 selector nonce `48d7645b26b9f89e9337e038a86403f8`, base
+`0b1cccf86e2f5132ed286a26ef0a681a495740ea` and the exact remaining obligations.
+Source bindings and geometric equality are finite evidence; the substitution
+argument above is a written proof, not a Lean or independent human review.
+
+## Open next questions
+
+- Can a **changed child or encoding contract** implement the proposed sixteen
+  independent climbs with all gathering, frame, scratch, output storage and
+  restoration charged? During this session Ross Richardson completed a
+  [source-bound audit](https://github.com/RossRichardson/integer-mult-bounds/tree/8a3900c84213fd7603b99beaceaff48f501b4232/research/diagonal-child-contract-audit)
+  applying Greer Guthrie's PR679 support/volume obstruction to the monomial
+  tensor-child proposal. A follow-up must name a changed hypothesis before
+  synthesis. That separate native-contract audit is credited, not replayed here.
+- For an original-rank retimed provider, produce source-bound native/phase,
+  precision/tape and complete invoice/controller receipts for the two new
+  hashes, through fresh replay or an explicitly justified reuse path. The
+  audited boundary removes one uncertainty; old bindings cannot silently admit
+  new programs. No cold replay or selected-source update is supplied here.
+
+## Credit and overlap
+
+Josie Elliston and her disclosed Claude Code/Claude Opus 5.5 assistance supplied
+PR1817's retiming recipe, 134-group lower bound and local-auditor replay.
+PR1779 at `1e3128bf642bbaf250b7d6b9639b2bb24b98ce5e` supplied the diagonal
+premise and original contiguous screen; its body credits Jose Manuel
+(`jmbarrancoml`) and substantial Codex assistance, while the publishing account
+is `1337isnot1337`. We retain those source notices without changing attribution.
+Arham Tahir's PR1605 at `488f2ecf1835c6d813e96543656dddf0062fdc9a` supplies
+the budget/overhead obstruction; Douglas Colkitt/PR1240 supplies the ceiling;
+Sagar Thakrar/PR1012 supplies the coverage law. Whole-call hosting and asynchronous
+controller credit includes the PR442/645/858 lineage, icekylinx, Jeremy Kothe,
+Hao Yan, Rohan Arun/PR1094 and the selected review's retained contributors.
+
+Fresh PR bodies and relevant live Discussions were checked before claiming.
+Scope is distinct from the completed native-child audit and the open exact phase-B
+batch optimum. Search coverage is not a novelty certificate. New audit prepared
+by @ToikY with substantial OpenAI Codex assistance, including bounded geometry
+implementation, overlap review and independent static review. Apache-2.0;
+predecessor source remains unchanged. Selected frontier and frozen packages
+remain unchanged.