diff --git a/research/t16-audit-mutant-coverage/EXPECTED.json b/research/t16-audit-mutant-coverage/EXPECTED.json
new file mode 100644
index 0000000000..d69c82a030
--- /dev/null
+++ b/research/t16-audit-mutant-coverage/EXPECTED.json
@@ -0,0 +1,1263 @@
+{
+ "accepted_fields": {
+  "async_schedule": [],
+  "async_schedule.scope": [],
+  "async_schedule.source_plan_sha256": [],
+  "cover": [],
+  "expanded_scalar_interface": [],
+  "hosting": [],
+  "hosting.idle_remainder_semantics": [],
+  "hosting.owner_map_sha256": [],
+  "hosting.pooled_slots.0.time": [],
+  "hosting.rule": [],
+  "hosting.scope": [],
+  "loop_order": [],
+  "m": [],
+  "port_restriction": [],
+  "provider_dispatch": [],
+  "replica_lift": [],
+  "route_semantics": [],
+  "supplier_substitution": [],
+  "version": []
+ },
+ "accepted_new_mutants": [
+  "pooled slot time changed"
+ ],
+ "assert_lines_in_audit": 42,
+ "assert_lines_reached_by_any": [
+  93,
+  94,
+  95,
+  96,
+  97,
+  100,
+  101,
+  103,
+  108,
+  111,
+  112,
+  114,
+  119,
+  120,
+  121,
+  122,
+  129,
+  130,
+  131,
+  132,
+  148,
+  149,
+  151,
+  152,
+  153,
+  156,
+  159,
+  163,
+  169,
+  171,
+  172,
+  173,
+  178,
+  181
+ ],
+ "assert_lines_reached_by_shipped": [
+  93,
+  94,
+  111,
+  149,
+  151,
+  152,
+  159,
+  181
+ ],
+ "assert_lines_unreached": [
+  98,
+  123,
+  157,
+  160,
+  161,
+  164,
+  167,
+  182
+ ],
+ "audit_script_sha256": "1467a2acb654e62552c69fb9a7c4c85f70a02120881d222313865058ab71a6cc",
+ "coverage": {
+  "100": {
+   "field": 1,
+   "new": 1,
+   "shipped": 0,
+   "statement": "src=parent['execution_schedule'];assert t['async_schedule']['source_schedule']==src"
+  },
+  "101": {
+   "field": 1,
+   "new": 0,
+   "shipped": 0,
+   "statement": "assert t['async_schedule']['source_call_order']==[[c['stage'],c['replica']]for c in parent['calls']]"
+  },
+  "103": {
+   "field": 3,
+   "new": 1,
+   "shipped": 0,
+   "statement": "assert [list(x)for x in order]==t['async_schedule']['order'] and len(set(order))==144"
+  },
+  "108": {
+   "field": 1,
+   "new": 0,
+   "shipped": 0,
+   "statement": "r=e['replica'];assert 0<=r<16 and j<30;perrep[r].append(j)"
+  },
+  "111": {
+   "field": 32,
+   "new": 2,
+   "shipped": 1,
+   "statement": "assert e==expected"
+  },
+  "112": {
+   "field": 5,
+   "new": 0,
+   "shipped": 0,
+   "statement": "assert 0<=e['time']<144 and order[e['time']][1]==r"
+  },
+  "114": {
+   "field": 0,
+   "new": 1,
+   "shipped": 0,
+   "statement": "assert order[e['time']]==(e['stage'],r);all_local.append((e['stage'],r,e['time']))"
+  },
+  "119": {
+   "field": 9,
+   "new": 1,
+   "shipped": 0,
+   "statement": "assert e==expected"
+  },
+  "120": {
+   "field": 0,
+   "new": 3,
+   "shipped": 0,
+   "statement": "assert all(v==list(range(30))for v in perrep.values()) and globals_==[30,31]"
+  },
+  "121": {
+   "field": 0,
+   "new": 1,
+   "shipped": 0,
+   "statement": "assert all_local==[(st,r,i)for i,(st,r)in enumerate(order)]"
+  },
+  "122": {
+   "field": 0,
+   "new": 1,
+   "shipped": 0,
+   "statement": "assert all('replica'in e for e in t['execution_schedule'][:-2])"
+  },
+  "123": {
+   "field": 0,
+   "new": 0,
+   "shipped": 0,
+   "statement": "assert [e['source_event']for e in t['execution_schedule'][-2:]]==[30,31]"
+  },
+  "129": {
+   "field": 0,
+   "new": 1,
+   "shipped": 0,
+   "statement": "assert e['time']==block"
+  },
+  "130": {
+   "field": 1,
+   "new": 1,
+   "shipped": 0,
+   "statement": "assert t['bank_padding']==dict(parent['bank_padding'],families=[],children=[])"
+  },
+  "131": {
+   "field": 1,
+   "new": 0,
+   "shipped": 0,
+   "statement": "assert t['cover_final_correction']==dict(parent['cover_final_correction'],families=[0,DATA],charged_calls_per_cover=DATA)"
+  },
+  "132": {
+   "field": 1,
+   "new": 1,
+   "shipped": 0,
+   "statement": "assert t['private_namespace']=={'centers':[DATA,DATA+CENTRES],'reserved_tableau':[DATA+CENTRES,DATA+CENTRES+R],'coefficient':[DATA+CENTRES+R,PHYSICAL]}"
+  },
+  "148": {
+   "field": 3,
+   "new": 0,
+   "shipped": 0,
+   "statement": "assert {k:v for k,v in call.items()if k not in('owners','time','provider_id','local_program_sha256')}=={k:v for k,v in old.items()if k not in('owners','local_pr"
+  },
+  "149": {
+   "field": 1,
+   "new": 0,
+   "shipped": 1,
+   "statement": "pid=expected_provider(call['stage'],call['replica']);assert call['provider_id']==pid"
+  },
+  "151": {
+   "field": 1,
+   "new": 0,
+   "shipped": 1,
+   "statement": "assert call['local_program_sha256']==checks[call['orientation']]['sha256']"
+  },
+  "152": {
+   "field": 2,
+   "new": 1,
+   "shipped": 3,
+   "statement": "s,rep,pair=call['stage'],call['replica'],call['pair'];assert call['time']==t['async_schedule']['order'].index([s,rep]);own=call['owners'];assert len(own)==N and"
+  },
+  "153": {
+   "field": 0,
+   "new": 1,
+   "shipped": 0,
+   "statement": "assert own[:(2*V)]==old['owners'][:(2*V)]"
+  },
+  "156": {
+   "field": 0,
+   "new": 4,
+   "shipped": 0,
+   "statement": "assert windows[ownerrep,i][0]<callpos[s,rep]<windows[ownerrep,i][1] and fampair==pairs[i] and side==sides[i] and 0<=off and off+w<=prank[i]"
+  },
+  "157": {
+   "field": 0,
+   "new": 0,
+   "shipped": 0,
+   "statement": "B=bases[port];pend=[int(x)for x in ph['recipes'][port]['idle_children'][i]['orthogonal_axes']];assert len(pend)==prank[i]"
+  },
+  "159": {
+   "field": 0,
+   "new": 1,
+   "shipped": 3,
+   "statement": "assert route==([3,i,off]if w==9 else[4,i,off,w,sp]);assert len(set(occ+sp))==9"
+  },
+  "160": {
+   "field": 0,
+   "new": 0,
+   "shipped": 0,
+   "statement": "order=occ+sp+[j for j in range(M)if j not in occ and j not in sp];assert sorted(order)==list(range(M));sigma=[B[j]for j in order]"
+  },
+  "161": {
+   "field": 0,
+   "new": 0,
+   "shipped": 0,
+   "statement": "assert sigma[:w]==pend[off:off+w]and sigma[w:9]==[B[j]for j in sp]"
+  },
+  "163": {
+   "field": 0,
+   "new": 1,
+   "shipped": 0,
+   "statement": "key=(i,ownerrep,port);cells=set(range(off,off+w));assert not used[key]&cells;used[key]|=cells"
+  },
+  "164": {
+   "field": 0,
+   "new": 0,
+   "shipped": 0,
+   "statement": "role=(s,rep,h);assert role not in roles;roles[role]=dict(stage=s,replica=rep,helper=h,family=family,owner_replica=ownerrep,child=i,copy=ownerrep*V+port,port=por"
+  },
+  "167": {
+   "field": 0,
+   "new": 0,
+   "shipped": 0,
+   "statement": "assert set(roles)=={(s,rep,h)for s in range(9)for rep in range(16)for h in range(R)}"
+  },
+  "169": {
+   "field": 0,
+   "new": 1,
+   "shipped": 0,
+   "statement": "assert len(t['hosting']['pooled_slots'])==HOSTED"
+  },
+  "171": {
+   "field": 0,
+   "new": 1,
+   "shipped": 0,
+   "statement": "key=(z['stage'],z['replica'],z['helper']);assert key in roles"
+  },
+  "172": {
+   "field": 10,
+   "new": 1,
+   "shipped": 0,
+   "statement": "assert {k:z[k]for k in roles[key]}==roles[key]"
+  },
+  "173": {
+   "field": 0,
+   "new": 1,
+   "shipped": 0,
+   "statement": "assert len({(z['stage'],z['replica'],z['helper'])for z in t['hosting']['pooled_slots']})==HOSTED"
+  },
+  "178": {
+   "field": 0,
+   "new": 1,
+   "shipped": 0,
+   "statement": "u=used[i,rep,port];assert u==set(range(len(u)));r=old['rank']-len(u)"
+  },
+  "181": {
+   "field": 9,
+   "new": 2,
+   "shipped": 1,
+   "statement": "assert t['idle_children']==wanted"
+  },
+  "182": {
+   "field": 0,
+   "new": 0,
+   "shipped": 0,
+   "statement": "mass=sum(r*n for r,n in paid.items());assert73=73*DATA-mass;assert assert73==5120 and 73**2>2*max(paid)**2"
+  },
+  "93": {
+   "field": 2,
+   "new": 0,
+   "shipped": 1,
+   "statement": "assert(t['live'],t['physical'])==(DATA,PHYSICAL)"
+  },
+  "94": {
+   "field": 2,
+   "new": 2,
+   "shipped": 4,
+   "statement": "assert t['local_providers']==registry and t['recipe']==parent['recipe']and 'each local invocation completes before the next' in t['loop_order'].lower()"
+  },
+  "95": {
+   "field": 0,
+   "new": 1,
+   "shipped": 0,
+   "statement": "assert not any(k in t for k in('local_programs','exact_local_clifford_recipe_sha256','residual_adapter_sha256'))"
+  },
+  "96": {
+   "field": 3,
+   "new": 2,
+   "shipped": 0,
+   "statement": "assert len(t['calls'])==144 and t['hosting']['max_helpers_per_physical_family_per_call']==1 and t['hosting']['banks']==[0]*9"
+  },
+  "97": {
+   "field": 2,
+   "new": 0,
+   "shipped": 0,
+   "statement": "for key in('exact_data_phase_recipe_sha256','adapter_policy'):assert t[key]==parent[key]"
+  },
+  "98": {
+   "field": 0,
+   "new": 0,
+   "shipped": 0,
+   "statement": "assert t['exact_data_phase_recipe_sha256']==sha(BASE/'work/complex-nine-native/DATA-PHASES.json')"
+  }
+ },
+ "field_census": {
+  "adapter_policy": {
+   "exception": "AssertionError",
+   "line": 97,
+   "result": "REJECTED",
+   "statement": "for key in('exact_data_phase_recipe_sha256','adapter_policy'):assert t[key]==parent[key]"
+  },
+  "async_schedule": {
+   "result": "ACCEPTED"
+  },
+  "async_schedule.order": {
+   "exception": "AssertionError",
+   "line": 103,
+   "result": "REJECTED",
+   "statement": "assert [list(x)for x in order]==t['async_schedule']['order'] and len(set(order))==144"
+  },
+  "async_schedule.scope": {
+   "result": "ACCEPTED"
+  },
+  "async_schedule.source_call_order": {
+   "exception": "AssertionError",
+   "line": 101,
+   "result": "REJECTED",
+   "statement": "assert t['async_schedule']['source_call_order']==[[c['stage'],c['replica']]for c in parent['calls']]"
+  },
+  "async_schedule.source_plan_sha256": {
+   "result": "ACCEPTED"
+  },
+  "async_schedule.source_schedule": {
+   "exception": "AssertionError",
+   "line": 100,
+   "result": "REJECTED",
+   "statement": "src=parent['execution_schedule'];assert t['async_schedule']['source_schedule']==src"
+  },
+  "bank_padding": {
+   "exception": "AssertionError",
+   "line": 130,
+   "result": "REJECTED",
+   "statement": "assert t['bank_padding']==dict(parent['bank_padding'],families=[],children=[])"
+  },
+  "calls": {
+   "exception": "AssertionError",
+   "line": 96,
+   "result": "REJECTED",
+   "statement": "assert len(t['calls'])==144 and t['hosting']['max_helpers_per_physical_family_per_call']==1 and t['hosting']['banks']==[0]*9"
+  },
+  "calls.0.local_program_sha256": {
+   "exception": "AssertionError",
+   "line": 151,
+   "result": "REJECTED",
+   "statement": "assert call['local_program_sha256']==checks[call['orientation']]['sha256']"
+  },
+  "calls.0.orientation": {
+   "exception": "AssertionError",
+   "line": 148,
+   "result": "REJECTED",
+   "statement": "assert {k:v for k,v in call.items()if k not in('owners','time','provider_id','local_program_sha256')}=={k:v for k,v in old.items()if k not in('owners','local_pr"
+  },
+  "calls.0.owners": {
+   "exception": "AssertionError",
+   "line": 152,
+   "result": "REJECTED",
+   "statement": "s,rep,pair=call['stage'],call['replica'],call['pair'];assert call['time']==t['async_schedule']['order'].index([s,rep]);own=call['owners'];assert len(own)==N and"
+  },
+  "calls.0.pair": {
+   "exception": "AssertionError",
+   "line": 148,
+   "result": "REJECTED",
+   "statement": "assert {k:v for k,v in call.items()if k not in('owners','time','provider_id','local_program_sha256')}=={k:v for k,v in old.items()if k not in('owners','local_pr"
+  },
+  "calls.0.provider_id": {
+   "exception": "AssertionError",
+   "line": 149,
+   "result": "REJECTED",
+   "statement": "pid=expected_provider(call['stage'],call['replica']);assert call['provider_id']==pid"
+  },
+  "calls.0.replica": {
+   "exception": "AssertionError",
+   "line": 103,
+   "result": "REJECTED",
+   "statement": "assert [list(x)for x in order]==t['async_schedule']['order'] and len(set(order))==144"
+  },
+  "calls.0.stage": {
+   "exception": "AssertionError",
+   "line": 103,
+   "result": "REJECTED",
+   "statement": "assert [list(x)for x in order]==t['async_schedule']['order'] and len(set(order))==144"
+  },
+  "calls.0.time": {
+   "exception": "AssertionError",
+   "line": 152,
+   "result": "REJECTED",
+   "statement": "s,rep,pair=call['stage'],call['replica'],call['pair'];assert call['time']==t['async_schedule']['order'].index([s,rep]);own=call['owners'];assert len(own)==N and"
+  },
+  "calls.0.window": {
+   "exception": "AssertionError",
+   "line": 148,
+   "result": "REJECTED",
+   "statement": "assert {k:v for k,v in call.items()if k not in('owners','time','provider_id','local_program_sha256')}=={k:v for k,v in old.items()if k not in('owners','local_pr"
+  },
+  "cover": {
+   "result": "ACCEPTED"
+  },
+  "cover_final_correction": {
+   "exception": "AssertionError",
+   "line": 131,
+   "result": "REJECTED",
+   "statement": "assert t['cover_final_correction']==dict(parent['cover_final_correction'],families=[0,DATA],charged_calls_per_cover=DATA)"
+  },
+  "exact_data_phase_recipe_sha256": {
+   "exception": "AssertionError",
+   "line": 97,
+   "result": "REJECTED",
+   "statement": "for key in('exact_data_phase_recipe_sha256','adapter_policy'):assert t[key]==parent[key]"
+  },
+  "execution_schedule": {
+   "exception": "TypeError",
+   "line": 106,
+   "result": "REJECTED",
+   "statement": "j=e['source_event'];old=copy.deepcopy(src[j])"
+  },
+  "execution_schedule.0.entry_exit_phase_adapters [local_cover_sweep]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.0.kind [local_cover_sweep]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.0.provider_id [local_cover_sweep]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.0.replica [local_cover_sweep]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.0.replicas [local_cover_sweep]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.0.source_event [local_cover_sweep]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.0.stage [local_cover_sweep]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.0.time [local_cover_sweep]": {
+   "exception": "AssertionError",
+   "line": 112,
+   "result": "REJECTED",
+   "statement": "assert 0<=e['time']<144 and order[e['time']][1]==r"
+  },
+  "execution_schedule.232.kind [terminal_Y_translations]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.232.pairs [terminal_Y_translations]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.232.replica [terminal_Y_translations]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.232.replicas [terminal_Y_translations]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.232.source_event [terminal_Y_translations]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.232.time [terminal_Y_translations]": {
+   "exception": "AssertionError",
+   "line": 112,
+   "result": "REJECTED",
+   "statement": "assert 0<=e['time']<144 and order[e['time']][1]==r"
+  },
+  "execution_schedule.232.vector [terminal_Y_translations]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.233.kind [terminal]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.233.pairs [terminal]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.233.replica [terminal]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.233.replicas [terminal]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.233.source_event [terminal]": {
+   "exception": "AssertionError",
+   "line": 108,
+   "result": "REJECTED",
+   "statement": "r=e['replica'];assert 0<=r<16 and j<30;perrep[r].append(j)"
+  },
+  "execution_schedule.233.time [terminal]": {
+   "exception": "AssertionError",
+   "line": 112,
+   "result": "REJECTED",
+   "statement": "assert 0<=e['time']<144 and order[e['time']][1]==r"
+  },
+  "execution_schedule.480.children_source [bank_padding_cover_sweep]": {
+   "exception": "AssertionError",
+   "line": 119,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.480.families [bank_padding_cover_sweep]": {
+   "exception": "AssertionError",
+   "line": 119,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.480.kind [bank_padding_cover_sweep]": {
+   "exception": "AssertionError",
+   "line": 119,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.480.source_event [bank_padding_cover_sweep]": {
+   "exception": "AssertionError",
+   "line": 119,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.481.charged_calls_per_cover [translate_every_live_family]": {
+   "exception": "AssertionError",
+   "line": 119,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.481.families [translate_every_live_family]": {
+   "exception": "AssertionError",
+   "line": 119,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.481.formula [translate_every_live_family]": {
+   "exception": "AssertionError",
+   "line": 119,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.481.kind [translate_every_live_family]": {
+   "exception": "AssertionError",
+   "line": 119,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.481.must_follow_bank_padding_and_data_signed_exchange [translate_every_live_family]": {
+   "exception": "AssertionError",
+   "line": 119,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.481.source_event [translate_every_live_family]": {
+   "exception": "IndexError",
+   "line": 106,
+   "result": "REJECTED",
+   "statement": "j=e['source_event'];old=copy.deepcopy(src[j])"
+  },
+  "execution_schedule.5.child_indices [idle_cover_sweep]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.5.from_level [idle_cover_sweep]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.5.kind [idle_cover_sweep]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.5.pair [idle_cover_sweep]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.5.replica [idle_cover_sweep]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.5.replicas [idle_cover_sweep]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.5.source_event [idle_cover_sweep]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.5.time [idle_cover_sweep]": {
+   "exception": "AssertionError",
+   "line": 112,
+   "result": "REJECTED",
+   "statement": "assert 0<=e['time']<144 and order[e['time']][1]==r"
+  },
+  "execution_schedule.5.to_level [idle_cover_sweep]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.6.coefficient [bridge]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.6.dst [bridge]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.6.kind [bridge]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.6.replica [bridge]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.6.replicas [bridge]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.6.source_event [bridge]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.6.src [bridge]": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "execution_schedule.6.time [bridge]": {
+   "exception": "AssertionError",
+   "line": 112,
+   "result": "REJECTED",
+   "statement": "assert 0<=e['time']<144 and order[e['time']][1]==r"
+  },
+  "expanded_scalar_interface": {
+   "result": "ACCEPTED"
+  },
+  "hosting": {
+   "result": "ACCEPTED"
+  },
+  "hosting.banks": {
+   "exception": "AssertionError",
+   "line": 96,
+   "result": "REJECTED",
+   "statement": "assert len(t['calls'])==144 and t['hosting']['max_helpers_per_physical_family_per_call']==1 and t['hosting']['banks']==[0]*9"
+  },
+  "hosting.idle_remainder_semantics": {
+   "result": "ACCEPTED"
+  },
+  "hosting.max_helpers_per_physical_family_per_call": {
+   "exception": "AssertionError",
+   "line": 96,
+   "result": "REJECTED",
+   "statement": "assert len(t['calls'])==144 and t['hosting']['max_helpers_per_physical_family_per_call']==1 and t['hosting']['banks']==[0]*9"
+  },
+  "hosting.owner_map_sha256": {
+   "result": "ACCEPTED"
+  },
+  "hosting.pooled_slots.0.child": {
+   "exception": "AssertionError",
+   "line": 172,
+   "result": "REJECTED",
+   "statement": "assert {k:z[k]for k in roles[key]}==roles[key]"
+  },
+  "hosting.pooled_slots.0.copy": {
+   "exception": "AssertionError",
+   "line": 172,
+   "result": "REJECTED",
+   "statement": "assert {k:z[k]for k in roles[key]}==roles[key]"
+  },
+  "hosting.pooled_slots.0.family": {
+   "exception": "AssertionError",
+   "line": 172,
+   "result": "REJECTED",
+   "statement": "assert {k:z[k]for k in roles[key]}==roles[key]"
+  },
+  "hosting.pooled_slots.0.helper": {
+   "exception": "AssertionError",
+   "line": 172,
+   "result": "REJECTED",
+   "statement": "assert {k:z[k]for k in roles[key]}==roles[key]"
+  },
+  "hosting.pooled_slots.0.offset": {
+   "exception": "AssertionError",
+   "line": 172,
+   "result": "REJECTED",
+   "statement": "assert {k:z[k]for k in roles[key]}==roles[key]"
+  },
+  "hosting.pooled_slots.0.owner_replica": {
+   "exception": "AssertionError",
+   "line": 172,
+   "result": "REJECTED",
+   "statement": "assert {k:z[k]for k in roles[key]}==roles[key]"
+  },
+  "hosting.pooled_slots.0.port": {
+   "exception": "AssertionError",
+   "line": 172,
+   "result": "REJECTED",
+   "statement": "assert {k:z[k]for k in roles[key]}==roles[key]"
+  },
+  "hosting.pooled_slots.0.replica": {
+   "exception": "AssertionError",
+   "line": 172,
+   "result": "REJECTED",
+   "statement": "assert {k:z[k]for k in roles[key]}==roles[key]"
+  },
+  "hosting.pooled_slots.0.stage": {
+   "exception": "AssertionError",
+   "line": 172,
+   "result": "REJECTED",
+   "statement": "assert {k:z[k]for k in roles[key]}==roles[key]"
+  },
+  "hosting.pooled_slots.0.time": {
+   "result": "ACCEPTED"
+  },
+  "hosting.pooled_slots.0.width": {
+   "exception": "AssertionError",
+   "line": 172,
+   "result": "REJECTED",
+   "statement": "assert {k:z[k]for k in roles[key]}==roles[key]"
+  },
+  "hosting.rule": {
+   "result": "ACCEPTED"
+  },
+  "hosting.scope": {
+   "result": "ACCEPTED"
+  },
+  "idle_children": {
+   "exception": "AssertionError",
+   "line": 181,
+   "result": "REJECTED",
+   "statement": "assert t['idle_children']==wanted"
+  },
+  "idle_children.0.child": {
+   "exception": "AssertionError",
+   "line": 181,
+   "result": "REJECTED",
+   "statement": "assert t['idle_children']==wanted"
+  },
+  "idle_children.0.family": {
+   "exception": "AssertionError",
+   "line": 181,
+   "result": "REJECTED",
+   "statement": "assert t['idle_children']==wanted"
+  },
+  "idle_children.0.hosted": {
+   "exception": "AssertionError",
+   "line": 181,
+   "result": "REJECTED",
+   "statement": "assert t['idle_children']==wanted"
+  },
+  "idle_children.0.pending_offset": {
+   "exception": "AssertionError",
+   "line": 181,
+   "result": "REJECTED",
+   "statement": "assert t['idle_children']==wanted"
+  },
+  "idle_children.0.port": {
+   "exception": "AssertionError",
+   "line": 181,
+   "result": "REJECTED",
+   "statement": "assert t['idle_children']==wanted"
+  },
+  "idle_children.0.rank": {
+   "exception": "AssertionError",
+   "line": 181,
+   "result": "REJECTED",
+   "statement": "assert t['idle_children']==wanted"
+  },
+  "idle_children.0.replica": {
+   "exception": "AssertionError",
+   "line": 181,
+   "result": "REJECTED",
+   "statement": "assert t['idle_children']==wanted"
+  },
+  "idle_children.0.replicas": {
+   "exception": "AssertionError",
+   "line": 181,
+   "result": "REJECTED",
+   "statement": "assert t['idle_children']==wanted"
+  },
+  "live": {
+   "exception": "AssertionError",
+   "line": 93,
+   "result": "REJECTED",
+   "statement": "assert(t['live'],t['physical'])==(DATA,PHYSICAL)"
+  },
+  "local_providers": {
+   "exception": "AssertionError",
+   "line": 94,
+   "result": "REJECTED",
+   "statement": "assert t['local_providers']==registry and t['recipe']==parent['recipe']and 'each local invocation completes before the next' in t['loop_order'].lower()"
+  },
+  "loop_order": {
+   "result": "ACCEPTED"
+  },
+  "m": {
+   "result": "ACCEPTED"
+  },
+  "physical": {
+   "exception": "AssertionError",
+   "line": 93,
+   "result": "REJECTED",
+   "statement": "assert(t['live'],t['physical'])==(DATA,PHYSICAL)"
+  },
+  "port_restriction": {
+   "result": "ACCEPTED"
+  },
+  "private_namespace": {
+   "exception": "AssertionError",
+   "line": 132,
+   "result": "REJECTED",
+   "statement": "assert t['private_namespace']=={'centers':[DATA,DATA+CENTRES],'reserved_tableau':[DATA+CENTRES,DATA+CENTRES+R],'coefficient':[DATA+CENTRES+R,PHYSICAL]}"
+  },
+  "provider_dispatch": {
+   "result": "ACCEPTED"
+  },
+  "recipe": {
+   "exception": "AssertionError",
+   "line": 94,
+   "result": "REJECTED",
+   "statement": "assert t['local_providers']==registry and t['recipe']==parent['recipe']and 'each local invocation completes before the next' in t['loop_order'].lower()"
+  },
+  "replica_lift": {
+   "result": "ACCEPTED"
+  },
+  "route_semantics": {
+   "result": "ACCEPTED"
+  },
+  "supplier_substitution": {
+   "result": "ACCEPTED"
+  },
+  "version": {
+   "result": "ACCEPTED"
+  }
+ },
+ "new_mutants": {
+  "bank padding families restored": {
+   "exception": "AssertionError",
+   "line": 130,
+   "result": "REJECTED",
+   "statement": "assert t['bank_padding']==dict(parent['bank_padding'],families=[],children=[])"
+  },
+  "bank padding global event moved to the front": {
+   "exception": "AssertionError",
+   "line": 122,
+   "result": "REJECTED",
+   "statement": "assert all('replica'in e for e in t['execution_schedule'][:-2])"
+  },
+  "bridge coefficient negated": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "bridge event dropped": {
+   "exception": "AssertionError",
+   "line": 120,
+   "result": "REJECTED",
+   "statement": "assert all(v==list(range(30))for v in perrep.values()) and globals_==[30,31]"
+  },
+  "bridge retimed to another invocation of its replica": {
+   "exception": "AssertionError",
+   "line": 129,
+   "result": "REJECTED",
+   "statement": "assert e['time']==block"
+  },
+  "call stage relabelled": {
+   "exception": "AssertionError",
+   "line": 103,
+   "result": "REJECTED",
+   "statement": "assert [list(x)for x in order]==t['async_schedule']['order'] and len(set(order))==144"
+  },
+  "call time off by one": {
+   "exception": "AssertionError",
+   "line": 152,
+   "result": "REJECTED",
+   "statement": "s,rep,pair=call['stage'],call['replica'],call['pair'];assert call['time']==t['async_schedule']['order'].index([s,rep]);own=call['owners'];assert len(own)==N and"
+  },
+  "data owner prefix permuted within a call": {
+   "exception": "AssertionError",
+   "line": 153,
+   "result": "REJECTED",
+   "statement": "assert own[:(2*V)]==old['owners'][:(2*V)]"
+  },
+  "entering helper spectators permuted": {
+   "exception": "AssertionError",
+   "line": 159,
+   "result": "REJECTED",
+   "statement": "assert route==([3,i,off]if w==9 else[4,i,off,w,sp]);assert len(set(occ+sp))==9"
+  },
+  "global events swapped": {
+   "exception": "AssertionError",
+   "line": 120,
+   "result": "REJECTED",
+   "statement": "assert all(v==list(range(30))for v in perrep.values()) and globals_==[30,31]"
+  },
+  "global translation charge changed": {
+   "exception": "AssertionError",
+   "line": 119,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "helper hosted after its idle child was swept (owner replica changed only)": {
+   "exception": "AssertionError",
+   "line": 156,
+   "result": "REJECTED",
+   "statement": "assert windows[ownerrep,i][0]<callpos[s,rep]<windows[ownerrep,i][1] and fampair==pairs[i] and side==sides[i] and 0<=off and off+w<=prank[i]"
+  },
+  "helper hosted before its idle window opens (owner replica changed only)": {
+   "exception": "AssertionError",
+   "line": 156,
+   "result": "REJECTED",
+   "statement": "assert windows[ownerrep,i][0]<callpos[s,rep]<windows[ownerrep,i][1] and fampair==pairs[i] and side==sides[i] and 0<=off and off+w<=prank[i]"
+  },
+  "helper on the other side of its idle pair": {
+   "exception": "AssertionError",
+   "line": 156,
+   "result": "REJECTED",
+   "statement": "assert windows[ownerrep,i][0]<callpos[s,rep]<windows[ownerrep,i][1] and fampair==pairs[i] and side==sides[i] and 0<=off and off+w<=prank[i]"
+  },
+  "hosted cells leave a gap in the pending prefix": {
+   "exception": "AssertionError",
+   "line": 178,
+   "result": "REJECTED",
+   "statement": "u=used[i,rep,port];assert u==set(range(len(u)));r=old['rank']-len(u)"
+  },
+  "idle remainder pending offset shifted": {
+   "exception": "AssertionError",
+   "line": 181,
+   "result": "REJECTED",
+   "statement": "assert t['idle_children']==wanted"
+  },
+  "idle remainder rank plus one": {
+   "exception": "AssertionError",
+   "line": 181,
+   "result": "REJECTED",
+   "statement": "assert t['idle_children']==wanted"
+  },
+  "idle sweep levels changed": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "idle sweep moved one position earlier": {
+   "exception": "AssertionError",
+   "line": 120,
+   "result": "REJECTED",
+   "statement": "assert all(v==list(range(30))for v in perrep.values()) and globals_==[30,31]"
+  },
+  "local providers gain an extra entry": {
+   "exception": "AssertionError",
+   "line": 94,
+   "result": "REJECTED",
+   "statement": "assert t['local_providers']==registry and t['recipe']==parent['recipe']and 'each local invocation completes before the next' in t['loop_order'].lower()"
+  },
+  "local sweep retimed to another invocation of its replica": {
+   "exception": "AssertionError",
+   "line": 114,
+   "result": "REJECTED",
+   "statement": "assert order[e['time']]==(e['stage'],r);all_local.append((e['stage'],r,e['time']))"
+  },
+  "loop order sentence removed": {
+   "exception": "AssertionError",
+   "line": 94,
+   "result": "REJECTED",
+   "statement": "assert t['local_providers']==registry and t['recipe']==parent['recipe']and 'each local invocation completes before the next' in t['loop_order'].lower()"
+  },
+  "one bank declared": {
+   "exception": "AssertionError",
+   "line": 96,
+   "result": "REJECTED",
+   "statement": "assert len(t['calls'])==144 and t['hosting']['max_helpers_per_physical_family_per_call']==1 and t['hosting']['banks']==[0]*9"
+  },
+  "pooled slot copy index changed": {
+   "exception": "AssertionError",
+   "line": 172,
+   "result": "REJECTED",
+   "statement": "assert {k:z[k]for k in roles[key]}==roles[key]"
+  },
+  "pooled slot dropped": {
+   "exception": "AssertionError",
+   "line": 169,
+   "result": "REJECTED",
+   "statement": "assert len(t['hosting']['pooled_slots'])==HOSTED"
+  },
+  "pooled slot duplicated over another": {
+   "exception": "AssertionError",
+   "line": 173,
+   "result": "REJECTED",
+   "statement": "assert len({(z['stage'],z['replica'],z['helper'])for z in t['hosting']['pooled_slots']})==HOSTED"
+  },
+  "pooled slot names a helper index past R": {
+   "exception": "AssertionError",
+   "line": 171,
+   "result": "REJECTED",
+   "statement": "key=(z['stage'],z['replica'],z['helper']);assert key in roles"
+  },
+  "pooled slot time changed": {
+   "result": "ACCEPTED"
+  },
+  "private namespace overlaps live data": {
+   "exception": "AssertionError",
+   "line": 132,
+   "result": "REJECTED",
+   "statement": "assert t['private_namespace']=={'centers':[DATA,DATA+CENTRES],'reserved_tableau':[DATA+CENTRES,DATA+CENTRES+R],'coefficient':[DATA+CENTRES+R,PHYSICAL]}"
+  },
+  "retired top-level local_programs reintroduced": {
+   "exception": "AssertionError",
+   "line": 95,
+   "result": "REJECTED",
+   "statement": "assert not any(k in t for k in('local_programs','exact_local_clifford_recipe_sha256','residual_adapter_sha256'))"
+  },
+  "source schedule tampered": {
+   "exception": "AssertionError",
+   "line": 100,
+   "result": "REJECTED",
+   "statement": "src=parent['execution_schedule'];assert t['async_schedule']['source_schedule']==src"
+  },
+  "two helpers overlap axis cells of one idle child": {
+   "exception": "AssertionError",
+   "line": 163,
+   "result": "REJECTED",
+   "statement": "key=(i,ownerrep,port);cells=set(range(off,off+w));assert not used[key]&cells;used[key]|=cells"
+  },
+  "two helpers per physical family declared": {
+   "exception": "AssertionError",
+   "line": 96,
+   "result": "REJECTED",
+   "statement": "assert len(t['calls'])==144 and t['hosting']['max_helpers_per_physical_family_per_call']==1 and t['hosting']['banks']==[0]*9"
+  },
+  "two local sweeps of different replicas swapped in list order": {
+   "exception": "AssertionError",
+   "line": 121,
+   "result": "REJECTED",
+   "statement": "assert all_local==[(st,r,i)for i,(st,r)in enumerate(order)]"
+  },
+  "width-nine helper runs past its idle child rank": {
+   "exception": "AssertionError",
+   "line": 156,
+   "result": "REJECTED",
+   "statement": "assert windows[ownerrep,i][0]<callpos[s,rep]<windows[ownerrep,i][1] and fampair==pairs[i] and side==sides[i] and 0<=off and off+w<=prank[i]"
+  }
+ },
+ "rejections_by_exception": {
+  "ACCEPTED": 20,
+  "AssertionError": 139,
+  "IndexError": 1,
+  "TypeError": 1
+ },
+ "shipped_controls": {
+  "alias two whole owners": {
+   "exception": "AssertionError",
+   "line": 152,
+   "result": "REJECTED",
+   "statement": "s,rep,pair=call['stage'],call['replica'],call['pair'];assert call['time']==t['async_schedule']['order'].index([s,rep]);own=call['owners'];assert len(own)==N and"
+  },
+  "gauge44: entering helper width silently restored to nine": {
+   "exception": "AssertionError",
+   "line": 94,
+   "result": "REJECTED",
+   "statement": "assert t['local_providers']==registry and t['recipe']==parent['recipe']and 'each local invocation completes before the next' in t['loop_order'].lower()"
+  },
+  "gauge44: stale per-call local program hash": {
+   "exception": "AssertionError",
+   "line": 151,
+   "result": "REJECTED",
+   "statement": "assert call['local_program_sha256']==checks[call['orientation']]['sha256']"
+  },
+  "gauge44: stale serialized provider program": {
+   "exception": "AssertionError",
+   "line": 94,
+   "result": "REJECTED",
+   "statement": "assert t['local_providers']==registry and t['recipe']==parent['recipe']and 'each local invocation completes before the next' in t['loop_order'].lower()"
+  },
+  "gauge44: unbound residual adapter hash": {
+   "exception": "AssertionError",
+   "line": 94,
+   "result": "REJECTED",
+   "statement": "assert t['local_providers']==registry and t['recipe']==parent['recipe']and 'each local invocation completes before the next' in t['loop_order'].lower()"
+  },
+  "gauge44: wrong per-call residual width": {
+   "exception": "AssertionError",
+   "line": 159,
+   "result": "REJECTED",
+   "statement": "assert route==([3,i,off]if w==9 else[4,i,off,w,sp]);assert len(set(occ+sp))==9"
+  },
+  "gauge44: wrong provider at its invocation": {
+   "exception": "AssertionError",
+   "line": 149,
+   "result": "REJECTED",
+   "statement": "pid=expected_provider(call['stage'],call['replica']);assert call['provider_id']==pid"
+  },
+  "gauge44: wrong provider width registry": {
+   "exception": "AssertionError",
+   "line": 94,
+   "result": "REJECTED",
+   "statement": "assert t['local_providers']==registry and t['recipe']==parent['recipe']and 'each local invocation completes before the next' in t['loop_order'].lower()"
+  },
+  "gauge44: wrong sweep provider": {
+   "exception": "AssertionError",
+   "line": 111,
+   "result": "REJECTED",
+   "statement": "assert e==expected"
+  },
+  "helper on active data family": {
+   "exception": "AssertionError",
+   "line": 152,
+   "result": "REJECTED",
+   "statement": "s,rep,pair=call['stage'],call['replica'],call['pair'];assert call['time']==t['async_schedule']['order'].index([s,rep]);own=call['owners'];assert len(own)==N and"
+  },
+  "omit idle remainder": {
+   "exception": "AssertionError",
+   "line": 181,
+   "result": "REJECTED",
+   "statement": "assert t['idle_children']==wanted"
+  },
+  "owner in private namespace": {
+   "exception": "AssertionError",
+   "line": 152,
+   "result": "REJECTED",
+   "statement": "s,rep,pair=call['stage'],call['replica'],call['pair'];assert call['time']==t['async_schedule']['order'].index([s,rep]);own=call['owners'];assert len(own)==N and"
+  },
+  "understate physical reserve": {
+   "exception": "AssertionError",
+   "line": 93,
+   "result": "REJECTED",
+   "statement": "assert(t['live'],t['physical'])==(DATA,PHYSICAL)"
+  },
+  "wrong residual width": {
+   "exception": "AssertionError",
+   "line": 159,
+   "result": "REJECTED",
+   "statement": "assert route==([3,i,off]if w==9 else[4,i,off,w,sp]);assert len(set(occ+sp))==9"
+  },
+  "wrong spectator coordinate": {
+   "exception": "AssertionError",
+   "line": 159,
+   "result": "REJECTED",
+   "statement": "assert route==([3,i,off]if w==9 else[4,i,off,w,sp]);assert len(set(occ+sp))==9"
+  }
+ },
+ "status": "PASS_T16_AUDIT_MUTANT_COVERAGE",
+ "template_sha256": "9c4c51425251389ee9a747c465814cd07c64812c15b7aeef704dad7d65395a74",
+ "template_to_frozen_owners_binding": {
+  "owner_map_sha256_names_frozen_gzip": true,
+  "pooled_slots_equal_frozen_owners": true,
+  "roles": 69120
+ }
+}
diff --git a/research/t16-audit-mutant-coverage/README.md b/research/t16-audit-mutant-coverage/README.md
new file mode 100644
index 0000000000..d1cb8bec04
--- /dev/null
+++ b/research/t16-audit-mutant-coverage/README.md
@@ -0,0 +1,120 @@
+# Mutant coverage of the selected T16 controller/owner audit
+
+**Scope.** This package audits one checker of the selected #1094 record: the frozen PR1087
+`code/audit_allcold.py` (SHA-256 `1467a2ac…`). The selected stage
+`research/complex-t16-rare-pattern-exchanges/verify.py` runs it through `verify_t16.py`, with
+`--mutation-controls`. The fixture is the selected hosted template archived in
+`research/community-frontier1094-audit/selected-replay.tar.gz`. The question is which of the audit's
+acceptance predicates its 15 shipped mutation controls actually reach. For the predicates they miss, does a
+targeted semantic mutant get rejected? This is an adversarial audit of an acceptance boundary. It makes no
+κ, certificate, supplier or frontier change, and it is not a cold replay.
+
+## Result
+
+The pinned audit runs unchanged and in-process; the verifier only records which line rejects each mutant.
+On the unmutated template it reproduces every field of the archived selected `ASYNC-AUDIT.json` except the
+two mutation-run fields.
+
+| Mutant set | Count | Rejected | Accepted | Further lines with an `assert` reached first |
+|---|---:|---:|---:|---:|
+| Shipped controls (exact text of the pinned control block) | 15 | 15 | 0 | 8 of 42 |
+| New targeted semantic mutants | 35 | 34 | 1 | 20 |
+| One-field census of the template | 111 | 92 | 19 | 6 |
+
+- **Shipped controls are concentrated.** Four of the 15 shipped controls are rejected first by line 94 (the
+  whole provider-registry equality). Three are rejected by line 152 and three by line 159. In the
+  single-provider selected run, the per-provider controls exercise one equality, not separate predicates.
+- **Predicates first exercised here.** Every new semantic mutant except one is rejected, by an
+  `AssertionError` at the intended statement:
+  - the idle window, from both sides: the owner replica changed only, so a helper runs before its child goes
+    idle or after the child is swept (line 156);
+  - the wrong side of the idle pair, and a width-nine helper running past the child's rank (line 156);
+  - overlapping axis cells across two calls (line 163);
+  - a gap in the hosted pending prefix, with the route and pooled slot moved together (line 178);
+  - schedule list order and retiming (lines 114, 121, 122 and 129);
+  - pooled-slot count, key and field binding (lines 169, 171, 172 and 173);
+  - the retired top-level `local_programs` (line 95).
+- **Accepted: 19 path mutations, in three groups.**
+  - *Pooled-slot `time`.* Line 172 compares a pooled slot's roles fields but not its `time`. The audit
+    itself would therefore accept a template whose pooled times differ from the frozen owners. See the
+    binding below for why this does not affect the selected fixture.
+  - *15 fields that `audit()` never reads.* These are `cover`, `m`, `version`, `port_restriction`,
+    `provider_dispatch`, `replica_lift`, `route_semantics`, `supplier_substitution` and
+    `expanded_scalar_interface`, plus `hosting.{rule, scope, idle_remainder_semantics, owner_map_sha256}`
+    and `async_schedule.{scope, source_plan_sha256}`.
+  - *Three partial checks.* The audit reads `loop_order` but only requires one sentence to be present,
+    so appended text passes. It reads named subfields of `hosting` and `async_schedule`, so an extra key
+    in either passes.
+
+  A text search of the PR1087 archive and the maintainer frontier1094 scripts finds no reader of the 15
+  unread fields in the hosted template after `emit`. The files that mention those key names are their
+  producers (`emit_allcold.py`) or stages that run before `emit`, such as `restore_parent.py`,
+  `build_parent.py`, `lift16.py` and `prepare_global.py`. `invoice_allcold.py` and `assemble.py` read
+  none of them. This is a text search, not a proof.
+- **Cross-stage binding that no selected stage checks.** The audit checks the hosted template.
+  `lift16` and `independent-t16` check the frozen `data/OWNERS.json.gz` instead, and the final binding
+  compares only counts and profiles. The verifier checks the link directly. The template's
+  `hosting.pooled_slots` is exactly the frozen owner list: 69,120 roles, with `time` fields included.
+  `hosting.owner_map_sha256` is the SHA-256 of that gzip. So for the selected fixture, the one field the
+  audit ignores equals the time that `independent-t16` checks against invocation times. Each stage of the
+  selected chain is deterministic. The link between them was previously implied by that determinism, not checked.
+- **Eight lines with an `assert` are not reachable by any template-only mutation.** The other 34 of the 42 are reached. Lines 98, 157 and 182
+  depend only on base inputs (DATA-PHASES and the provider artifacts) once earlier lines pass. Lines 123,
+  160, 161, 164 and 167 follow from earlier assertions or from how the audit builds the values: line 123
+  from 120 and 122; lines 160 and 161 from how `sigma` is built; lines 164 and 167 from lines 103, 148
+  and 152.
+- **Incidental exceptions.** Two census mutants are rejected by `TypeError` and `IndexError` at line 106,
+  before any predicate: an appended `None` event, and an out-of-range global `source_event`. The shipped
+  harness counts these exception types as rejections. Every other rejection is an `AssertionError`.
+
+**Conclusion.** For the selected fixture, no missing implication was found in this checker. Each of
+its 34 reachable assertion lines rejects some mutant first. This is line coverage: on a line with a
+compound condition, such as lines 94, 152 and 156, not every conjunct has its own mutant.
+
+What `audit()` implies for *any* template is narrower than what is checked here for the *selected* one.
+The audit alone accepts changed pooled-slot times and the 15 unread fields. For the selected template,
+`verify.py` checks separately that the pooled owners, including their times, equal the frozen owners
+that `independent-t16` checks. The unread fields have no reader after `emit` (text search).
+
+## Reproduce
+
+```sh
+python3 -B research/t16-audit-mutant-coverage/verify.py      # ~70 s; compares with EXPECTED.json
+python3.12 scripts/research_package.py --package research/t16-audit-mutant-coverage
+```
+
+Stdlib only; needs CPython 3.10.12+ (tar `filter='data'`). Checked on CPython 3.10, 3.12 and 3.14 (macOS arm64),
+with identical output. `--write` regenerates `EXPECTED.json`. Copies use a `marshal` round trip, checked once
+for equality, following jackmgaller's PR1939 observation that `deepcopy` dominates this audit's time.
+
+**Not checked:** mutations of the base inputs (DATA-PHASES, provider artifacts, parent template) and the
+module-level provider checks in lines 20–80. Other stages are also not mutation-tested: `invoice_allcold.py`,
+`assemble.py`, `indep16.py` and the #1042 ancestry. There is no cold rebuild, and no Linux or Windows run.
+
+## Open next questions
+
+1. **Same receipt for the other `audit_allcold.py` versions.** Why it matters: PR1939's handoff lists nine other
+   hashes of this file in the repository, and each has its own shipped controls. First step:
+   parametrize `verify.py` by archive member and script hash, and use the #1042 audit archive as the
+   fixture. Blocked by: locating each version's hosted template in the retained receipts.
+2. **Bind the template owner map in the replay driver.** Why it matters: today the template-to-OWNERS link
+   rests on deterministic stages, not on a check. First step: add the two-line binding (see this
+   package's `template_to_frozen_owners_binding`) to a successor driver; the frozen PR1087 code stays unchanged.
+   Blocked by: a maintainer decision on whether to wrap the frozen `verify_t16.py`.
+3. **Mutation-test the invoice.** Why it matters: `invoice_allcold.py` carries the finite inequalities
+   (prefix 397 < 512, row 16,469 < 20,161) and has no mutation-control block of its own. Whether the 69 admission controls cover its inputs was not checked. First step: the same in-process
+   harness on its `run()` with one-field template and receipt mutants. Blocked by: nothing; it was out of
+   this session's time.
+
+## Credit
+
+The audited checker and its shipped controls are the PR1087 archive's `code/`, byte-identical to Jeremy
+Kothe's #870 gauge44-barch-t16 code. Its docstring credits OpenAI Codex, and it includes the T16 edits from
+Hao Yan's (@FanPUYen) #858. Rohan Arun's #1094
+supplies the selected exchanges and archived run. The maintainer's frontier1094 audit archived the fixture.
+jackmgaller's PR1939 identified the copy cost and the copy-isolation dependence of the shipped controls.
+Session 26 (PR1824) established that the final stage's outputs are byte-stable across interpreters. My PR1091
+is an independent owner/event-window recount, a different checker from the one audited here.
+
+Prepared by Josie Elliston (JosieElliston) with substantial Claude Code (Claude Opus 5.5) assistance in a
+donated session. Apache-2.0.
diff --git a/research/t16-audit-mutant-coverage/SOURCES.json b/research/t16-audit-mutant-coverage/SOURCES.json
new file mode 100644
index 0000000000..6924899cc6
--- /dev/null
+++ b/research/t16-audit-mutant-coverage/SOURCES.json
@@ -0,0 +1,48 @@
+{
+  "schema_version": 1,
+  "base_commit": "0b1cccf86e2f5132ed286a26ef0a681a495740ea",
+  "files": [
+    {
+      "path": "certificates/selected-result.json",
+      "usage": "provenance",
+      "git_blob": "ae6a99f28aa468649eb66a361e764d769363bf11",
+      "sha256": "10b9e340fd8e354a37a0c4813c90e5de1dd42044b5f6aca4a3fc5a42b685fa32"
+    },
+    {
+      "path": "docs/research/agent-task-catalog.json",
+      "usage": "provenance",
+      "git_blob": "06c96f5579bb67ed1b86d334e78fbed7da6945f1",
+      "sha256": "6686ad58f1fbdbc87134a78901b60fd53a20d3984355e91defbbebc9e9fa8075"
+    },
+    {
+      "path": "research/community-frontier1094-audit/selected-replay.tar.gz",
+      "usage": "input",
+      "git_blob": "c24daf067f9c543421d89ca2eeaa4eb78a57fb6f",
+      "sha256": "f1da80610bf33c58527f18ad63b4350d0b864e1d4486141ee17ac9bed4d529d6"
+    },
+    {
+      "path": "research/complex-t16-rare-pattern-exchanges/data/OWNERS.json.gz",
+      "usage": "input",
+      "git_blob": "d3ba33d7e703a3229d9fb8a360f69d2f318bbb70",
+      "sha256": "87902c528dfab7d503dcf8a784260e3ab6fb7424c418a1820f7261f25be7b6bc"
+    },
+    {
+      "path": "research/complex-t16-rare-pattern-exchanges/data/PLAN.json",
+      "usage": "input",
+      "git_blob": "f1bec76e8e9b7a1f09c1e05cb6cce973b6e59f1b",
+      "sha256": "7bd786ba8e66408f02aa9ef446eaf20c1bfe981ea2e4dd1e5a929f0aa7767bc0"
+    },
+    {
+      "path": "research/complex-t16-rare-pattern-exchanges/data/SPEC.json",
+      "usage": "input",
+      "git_blob": "af013ccc2975d9d575d116f8a463cc947f220c8d",
+      "sha256": "8cb51f25a5da4a29d3783853025b73ff1f452429d4fdb30c599e598bcab0e71d"
+    },
+    {
+      "path": "research/complex-t16-rare-pattern-exchanges/upstream1087.tar.gz",
+      "usage": "input",
+      "git_blob": "2970ef79b0441e937449bed30f68f2e0558186ba",
+      "sha256": "d4acf04daef85d4514f80ec5fcd2492d0c60e5d6c49fa71b3e6523f8db2dea86"
+    }
+  ]
+}
diff --git a/research/t16-audit-mutant-coverage/TASK.json b/research/t16-audit-mutant-coverage/TASK.json
new file mode 100644
index 0000000000..82ad3bf148
--- /dev/null
+++ b/research/t16-audit-mutant-coverage/TASK.json
@@ -0,0 +1,72 @@
+{
+  "schema_version": 1,
+  "task_id": "supplier-boundary-audit",
+  "priority_revision": 3,
+  "base_commit": "0b1cccf86e2f5132ed286a26ef0a681a495740ea",
+  "original_card": {
+    "id": "supplier-boundary-audit",
+    "question": "Does one selected supplier obligation follow from its actual source-bound checks?",
+    "starting_points": [
+      "certificates/selected-result.json",
+      "research/owner-boundary-audit/README.md"
+    ],
+    "methods": [
+      "Trace one hypothesis through the source, checker and complete caller.",
+      "Construct one semantically invalid but superficially well-formed fixture and test rejection."
+    ],
+    "acceptance_gate": "Pin the current sources and one obligation; the historical owner audit is an example, not evidence of a current bug.",
+    "first_step": {
+      "command": [
+        "python3",
+        "-B",
+        "research/owner-boundary-audit/verify.py"
+      ],
+      "expected": "PASS_PR626_NEXT_TOUCH_BOUNDARY_AUDIT",
+      "inspect": "Identify why the timing-only omission passes but the full production controller still rejects it.",
+      "scope": "Positive control / source-bound orientation only; this is not a new construction or full cold replay."
+    },
+    "first_experiment": "Choose one current supplier obligation and trace whether its acceptance depends on an independent check.",
+    "bottleneck_link": "Closing a current acceptance gap or proof obligation strengthens reliability even without changing kappa.",
+    "allowed_variations": [
+      "Audit one named current condition using a new semantic counterexample."
+    ],
+    "scope_change_triggers": [
+      "Reporting the historical timing-only diagnostic as a new current acceptance bug."
+    ],
+    "overlap_terms": [
+      "owner boundary",
+      "bridge omission",
+      "hosting"
+    ]
+  },
+  "scope_status": "refined",
+  "actual_scope": "Mutant coverage of one selected-supplier checker: the frozen PR1087 code/audit_allcold.py (sha256 1467a2ac...) run in-process on the selected #1094 hosted template archived in research/community-frontier1094-audit/selected-replay.tar.gz. For the 15 shipped mutation controls, 35 new targeted semantic mutants and a 111-field one-at-a-time census, record the rejecting line; check the template owner map against the frozen data/OWNERS.json.gz.",
+  "scope_change_reason": "The card asks whether one selected supplier obligation follows from its actual checks. This narrows it to the controller/owner audit of the selected final stage and asks which of its predicates are exercised by any negative control, then supplies a semantic counterexample for each unexercised one.",
+  "bottleneck_link": "Side result for reliability: no kappa change. It shows that the selected final stage's owner/window/cell/schedule predicates each reject a targeted invalid fixture, and records the one cross-stage link (template owners = frozen OWNERS) that no stage checked.",
+  "budget_minutes": 60,
+  "stop_rule": "Stop at the first accepted semantically consequential mutant (report it) or when every reachable assert statement in audit() has a rejecting mutant; unreachable ones are explained.",
+  "outcome": "completed",
+  "evidence": "verify.py: 15/15 shipped controls rejected, first reaching 8 of the 42 lines with an assert; 34/35 new mutants rejected, reaching 20 more (the field census 6 more) (idle window both sides, cross-call cell overlap, pending-prefix gap, schedule order/retiming, pooled-slot binding); accepted: pooled-slot time (line 172 omits it), 15 fields audit() never reads (no post-emit reader by text search) and 3 partial checks; template pooled_slots == frozen OWNERS (69,120 roles) and owner_map_sha256 names it; 8 asserts unreachable by template mutation, each explained. Identical EXPECTED.json on CPython 3.10/3.12/3.14.",
+  "author": "Josie Elliston (JosieElliston)",
+  "ai_assistance": "Substantial Claude Code (Claude Opus 5.5) assistance in selection, harness implementation, verification and documentation, in a donated session.",
+  "open_questions": [
+    {
+      "question": "Do the nine other audit_allcold.py versions in the repository (PR1939 handoff) have the same predicate coverage?",
+      "why_it_matters": "Each version ships its own controls; the selected record's reuse path depends on them.",
+      "first_step": "Parametrize verify.py by archive member and script hash; use the #1042 audit archive as fixture.",
+      "blocked_by": "Locating each version's hosted template in the retained receipts."
+    },
+    {
+      "question": "Should a successor replay driver check template pooled_slots == data/OWNERS.json.gz and owner_map_sha256?",
+      "why_it_matters": "The link between the audited template and the independently checked OWNERS rests on deterministic stages, not on a check.",
+      "first_step": "Add the binding from this package's template_to_frozen_owners_binding to a wrapper around the frozen verify_t16.py.",
+      "blocked_by": "Maintainer decision on wrapping the frozen stage."
+    },
+    {
+      "question": "Which predicates of invoice_allcold.py (finite prefix/row inequalities) reject targeted mutants?",
+      "why_it_matters": "The invoice carries the 397<512 prefix and 16,469<20,161 row inequalities and has no mutation-control block of its own.",
+      "first_step": "Run the same in-process harness on invoice_allcold.run() with one-field template and receipt mutants.",
+      "blocked_by": "Nothing; out of this session's time."
+    }
+  ]
+}
diff --git a/research/t16-audit-mutant-coverage/VERIFY.json b/research/t16-audit-mutant-coverage/VERIFY.json
new file mode 100644
index 0000000000..9493d38410
--- /dev/null
+++ b/research/t16-audit-mutant-coverage/VERIFY.json
@@ -0,0 +1,24 @@
+{
+  "schema_version": 1,
+  "status": "ready",
+  "python": "3.12",
+  "requirements": [],
+  "inputs": [
+    "research/community-frontier1094-audit/selected-replay.tar.gz",
+    "research/complex-t16-rare-pattern-exchanges/data/OWNERS.json.gz",
+    "research/complex-t16-rare-pattern-exchanges/data/PLAN.json",
+    "research/complex-t16-rare-pattern-exchanges/data/SPEC.json",
+    "research/complex-t16-rare-pattern-exchanges/upstream1087.tar.gz"
+  ],
+  "commands": [
+    {
+      "argv": [
+        "{python}",
+        "-B",
+        "{package}/verify.py"
+      ],
+      "timeout_seconds": 300,
+      "checks": "Input SHA-256 pins; pinned audit_allcold.py hash; positive in-process audit equals the archived selected ASYNC-AUDIT.json; shipped control names equal the selected receipt and all 15 are rejected; 35 new mutants and 111-field census outcomes, rejecting lines and the template-to-frozen-OWNERS binding must equal EXPECTED.json byte for byte (the accepted pooled-slot time mutant shows the harness reports acceptance)."
+    }
+  ]
+}
diff --git a/research/t16-audit-mutant-coverage/verify.py b/research/t16-audit-mutant-coverage/verify.py
new file mode 100644
index 0000000000..be4bc7ad50
--- /dev/null
+++ b/research/t16-audit-mutant-coverage/verify.py
@@ -0,0 +1,384 @@
+"""Mutant coverage of the selected final stage's controller/owner audit.
+
+Runs the pinned PR1087 `code/audit_allcold.py` (sha256 1467a2ac...) unchanged and in-process on the
+selected #1094 hosted template archived in research/community-frontier1094-audit/selected-replay.tar.gz.
+It then records, for every shipped mutation control and for new targeted mutants, the exception type and
+the line of audit_allcold.py that rejects it, plus a one-field-at-a-time binding census of the template.
+
+Stdlib only; Python 3.10.12+ (tarfile filter='data').  Usage:
+  python3 -B research/t16-audit-mutant-coverage/verify.py            # compare with EXPECTED.json
+  python3 -B research/t16-audit-mutant-coverage/verify.py --write    # regenerate EXPECTED.json
+"""
+import argparse, ast, contextlib, gzip, hashlib, io, json, marshal, os, runpy, sys, tarfile, tempfile, traceback
+from collections import Counter, defaultdict
+from pathlib import Path
+
+assert __debug__, 'assertions must stay enabled'
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parents[1]
+STAGE = ROOT / 'research/complex-t16-rare-pattern-exchanges'
+ARCHIVE = ROOT / 'research/community-frontier1094-audit/selected-replay.tar.gz'
+AUDIT_SHA = '1467a2acb654e62552c69fb9a7c4c85f70a02120881d222313865058ab71a6cc'
+sha = lambda b: hashlib.sha256(b).hexdigest()
+
+
+def fast_copy(x):
+    # JSON data only (dict/list/str/int/bool/None); checked once against the original below.
+    return marshal.loads(marshal.dumps(x))
+
+
+def extract(tmp):
+    pins = [f for f in json.loads((HERE / 'SOURCES.json').read_text())['files'] if f['usage'] == 'input']
+    assert len(pins) == 5
+    for f in pins:
+        assert sha((ROOT / f['path']).read_bytes()) == f['sha256'], 'pinned input changed: ' + f['path']
+    source = tmp / 'source'
+    source.mkdir()
+    with tarfile.open(STAGE / 'upstream1087.tar.gz') as t:
+        t.extractall(source, filter='data')
+    for name in ('OWNERS.json.gz', 'PLAN.json', 'SPEC.json'):  # the stage's three frozen overlays
+        (source / 'data' / name).write_bytes((STAGE / 'data' / name).read_bytes())
+    script = source / 'code/audit_allcold.py'
+    assert sha(script.read_bytes()) == AUDIT_SHA, 'audit_allcold.py is not the pinned PR1087 file'
+    g = tmp / 'g'
+    prefix = 'candidate/strict/global/'
+    with tarfile.open(ARCHIVE) as t:
+        members = [m for m in t.getmembers() if m.name.startswith(prefix) and m.isfile()]
+        for m in members:
+            m.name = m.name[len(prefix):]
+        t.extractall(g, members=members, filter='data')
+    return source, script, g
+
+
+def load_audit(source, script, g, tmp):
+    os.environ.update(PYTHONINTMAXSTRDIGITS='0', WITNESS_SPEC=str(source / 'data/SPEC.json'))
+    for k in ('WITNESS_DISCOVER', 'WITNESS_RECORD'):
+        os.environ.pop(k, None)
+    if hasattr(sys, 'set_int_max_str_digits'):
+        sys.set_int_max_str_digits(0)
+    hosted = tmp / 'hosted'
+    hosted.mkdir()
+    for f in (g / 'hosted').iterdir():
+        (hosted / f.name).write_bytes(f.read_bytes())
+    report = tmp / 'audit/ASYNC-AUDIT.json'
+    sys.argv = [str(script), str(g / 'base'), str(hosted), str(report)]  # no --mutation-controls
+    sys.path.insert(0, str(script.parent))
+    with contextlib.redirect_stdout(io.StringIO()):
+        G = runpy.run_path(str(script), run_name='__main__')
+    archived = json.loads((g / 'audit/ASYNC-AUDIT.json').read_text())
+    fresh = json.loads(report.read_text())
+    assert fresh['mutation_controls_run'] is False and fresh['mutations_rejected'] == []
+    same = {k: v for k, v in fresh.items() if k not in ('mutation_controls_run', 'mutations_rejected')}
+    assert same == {k: v for k, v in archived.items() if k not in ('mutation_controls_run', 'mutations_rejected')}, \
+        'in-process positive audit differs from the archived selected receipt'
+    return G, archived
+
+
+class Runner:
+    def __init__(self, G, script):
+        self.G, self.script = G, str(script)
+        self.lines = Path(script).read_text().splitlines()
+        self.base = G['ct']
+        assert fast_copy(self.base) == self.base
+
+    def outcome(self, mut):
+        q = fast_copy(self.base)
+        mut(q)
+        if q == self.base:
+            return dict(result='NO_OP_MUTANT')
+        try:
+            self.G['audit'](q)
+        except Exception as ex:  # record any rejection, then classify it
+            frames = [f for f in traceback.extract_tb(ex.__traceback__) if f.filename == self.script]
+            line = frames[-1].lineno if frames else None
+            caught = isinstance(ex, (AssertionError, KeyError, IndexError, ValueError, TypeError))
+            return dict(result='REJECTED' if caught else 'REJECTED_UNCAUGHT_BY_SHIPPED_HARNESS',
+                        exception=type(ex).__name__, line=line,
+                        statement=self.lines[line - 1].strip()[:160] if line else None)
+        return dict(result='ACCEPTED')
+
+
+def shipped_controls(G, runner, script):
+    text = Path(script).read_text()
+    start = text.index('controls=[]\n')
+    end = text.index('report=dict(')
+    block = text[start:end]
+    assert block.count('def reject(name,mut):') == 1
+    block = block.replace('def reject(name,mut):', 'def _shipped_reject(name,mut):')
+    out = {}
+
+    def reject(name, mut):
+        out[name] = runner.outcome(mut)
+
+    G['reject'] = reject
+    exec(compile(block, script, 'exec'), G)
+    return out
+
+
+def new_mutants(G):
+    ct, V, R, N = G['ct'], G['V'], G['R'], G['N']
+    prank, DATA = G['prank'], G['DATA']
+    stagepair = {e['stage']: e['pair'] for e in G['parent']['recipe'] if e['kind'] == 'local'}
+    es = ct['execution_schedule']
+    # Recompute the idle windows and call positions from the literal schedule (same definition as the audit).
+    last, windows, callpos, pairs, sides = {}, {}, {}, {}, {}
+    for pos, e in enumerate(es):
+        if 'replica' not in e:
+            continue
+        rep = e['replica']
+        if e['kind'] == 'local_cover_sweep':
+            callpos[e['stage'], rep] = pos
+            last[rep, stagepair[e['stage']]] = pos
+        elif e['kind'] == 'bridge':
+            last[rep, e['src']] = last[rep, e['dst']] = pos
+        elif e['kind'] == 'idle_cover_sweep':
+            for side, i in enumerate(e['child_indices']):
+                if i in prank:
+                    pairs[i], sides[i] = e['pair'], side
+                    windows[rep, i] = (last.get((rep, e['pair']), -1), pos)
+
+    def helpers():
+        for ci, c in enumerate(ct['calls']):
+            for h, (fam, route) in enumerate(c['owners'][2 * V:]):
+                ownerrep, sub = divmod(fam, 8 * V)
+                yield ci, h, fam, route, ownerrep, callpos[c['stage'], c['replica']]
+
+    fams = [{f for f, _ in c['owners']} for c in ct['calls']]
+
+    def move_replica(before):
+        for ci, h, fam, route, ownerrep, cp in helpers():
+            i = route[1]
+            for r2 in range(16):
+                if r2 == ownerrep:
+                    continue
+                lo, hi = windows[r2, i]
+                if (cp <= lo if before else cp >= hi):
+                    f2 = fam + (r2 - ownerrep) * 8 * V
+                    if f2 not in fams[ci]:
+                        return ci, h, f2
+        raise AssertionError('no window mutant found')
+
+    def set_family(ci, h, f2):
+        return lambda q: q['calls'][ci]['owners'][2 * V + h].__setitem__(0, f2)
+
+    m = {}
+    m['helper hosted before its idle window opens (owner replica changed only)'] = set_family(*move_replica(True))
+    m['helper hosted after its idle child was swept (owner replica changed only)'] = set_family(*move_replica(False))
+    # Two width-nine helpers on one idle child of one owner replica: give the later one the earlier offset.
+    seen = {}
+    pick = None
+    for ci, h, fam, route, ownerrep, cp in helpers():
+        if route[0] != 3:
+            continue
+        key = (route[1], ownerrep, fam % V)
+        if key in seen and seen[key][2] != route[2]:
+            pick = (ci, h, seen[key][2])
+            break
+        seen.setdefault(key, (ci, h, route[2]))
+    assert pick
+    m['two helpers overlap axis cells of one idle child'] = \
+        lambda q, p=pick: q['calls'][p[0]]['owners'][2 * V + p[1]][1].__setitem__(2, p[2])
+    w9 = next((ci, h, route) for ci, h, fam, route, ownerrep, cp in helpers() if route[0] == 3)
+    m['width-nine helper runs past its idle child rank'] = \
+        lambda q, p=w9: q['calls'][p[0]]['owners'][2 * V + p[1]][1].__setitem__(2, prank[p[2][1]] - 8)
+    ent = next((ci, h) for ci, h, fam, route, ownerrep, cp in helpers() if route[0] == 4 and len(route[4]) > 1)
+    m['entering helper spectators permuted'] = \
+        lambda q, p=ent: q['calls'][p[0]]['owners'][2 * V + p[1]][1][4].reverse()
+    flip = lambda fam: fam + (V if (fam // V) % 2 == 0 else -V)  # family = rep*8V + (2*pair+side)*V + port
+    side = next((ci, h, flip(fam)) for ci, h, fam, route, ownerrep, cp in helpers() if flip(fam) not in fams[ci])
+    m['helper on the other side of its idle pair'] = set_family(*side)
+    m['data owner prefix permuted within a call'] = \
+        lambda q: q['calls'][0]['owners'].__setitem__(slice(0, 2), [q['calls'][0]['owners'][1], q['calls'][0]['owners'][0]])
+    m['call time off by one'] = lambda q: q['calls'][5].__setitem__('time', q['calls'][5]['time'] + 1)
+    m['call stage relabelled'] = lambda q: q['calls'][0].__setitem__('stage', 1)
+    m['pooled slot copy index changed'] = \
+        lambda q: q['hosting']['pooled_slots'][0].__setitem__('copy', q['hosting']['pooled_slots'][0]['copy'] + 1)
+    m['pooled slot duplicated over another'] = \
+        lambda q: q['hosting']['pooled_slots'].__setitem__(1, dict(q['hosting']['pooled_slots'][0]))
+    m['pooled slot time changed'] = \
+        lambda q: q['hosting']['pooled_slots'][0].__setitem__('time', q['hosting']['pooled_slots'][0]['time'] + 1)
+    m['idle remainder rank plus one'] = lambda q: q['idle_children'][0].__setitem__('rank', q['idle_children'][0]['rank'] + 1)
+    m['idle remainder pending offset shifted'] = \
+        lambda q: q['idle_children'][0].__setitem__('pending_offset', q['idle_children'][0]['pending_offset'] - 1)
+    bridge = next(k for k, e in enumerate(es) if e['kind'] == 'bridge')
+    m['bridge event dropped'] = lambda q, k=bridge: q['execution_schedule'].pop(k)
+    idle = next(k for k, e in enumerate(es) if e['kind'] == 'idle_cover_sweep')
+    m['idle sweep moved one position earlier'] = \
+        lambda q, k=idle: q['execution_schedule'].insert(k - 1, q['execution_schedule'].pop(k))
+    m['idle sweep levels changed'] = \
+        lambda q, k=idle: q['execution_schedule'][k].__setitem__('to_level', q['execution_schedule'][k]['to_level'] + 1)
+    m['bridge coefficient negated'] = \
+        lambda q, k=bridge: q['execution_schedule'][k].__setitem__('coefficient', -q['execution_schedule'][k]['coefficient'])
+    m['global translation charge changed'] = \
+        lambda q: q['execution_schedule'][-1].__setitem__('charged_calls_per_cover', DATA - 1)
+    m['global events swapped'] = lambda q: q['execution_schedule'].__setitem__(slice(-2, None), q['execution_schedule'][-2:][::-1])
+    m['bank padding families restored'] = lambda q: q['bank_padding'].__setitem__('families', [DATA, DATA])
+    m['private namespace overlaps live data'] = \
+        lambda q: q['private_namespace'].__setitem__('centers', [DATA - 1, q['private_namespace']['centers'][1]])
+    m['two helpers per physical family declared'] = lambda q: q['hosting'].__setitem__('max_helpers_per_physical_family_per_call', 2)
+    m['one bank declared'] = lambda q: q['hosting']['banks'].__setitem__(0, 1)
+    m['source schedule tampered'] = \
+        lambda q: q['async_schedule']['source_schedule'][0].__setitem__('stage', 3)
+    m['loop order sentence removed'] = lambda q: q.__setitem__('loop_order', 'Follow the schedule.')
+    m['local providers gain an extra entry'] = \
+        lambda q: q['local_providers'].__setitem__('extra', q['local_providers'][next(iter(q['local_providers']))])
+    # Targeted at assertions no earlier mutant reaches.
+    ends = {}
+    for ci, h, fam, route, ownerrep, cp in helpers():
+        key = (route[1], ownerrep, fam % V)
+        w = 9 if route[0] == 3 else route[3]
+        if key not in ends or route[2] > ends[key][2]:
+            ends[key] = (ci, h, route[2], w, route[0])
+    gap = next(v for k, v in sorted(ends.items()) if v[4] == 3 and v[2] + v[3] + 1 <= prank[k[0]])
+    gc = ct['calls'][gap[0]]
+    gslot = next(k for k, z in enumerate(ct['hosting']['pooled_slots'])
+                 if (z['stage'], z['replica'], z['helper']) == (gc['stage'], gc['replica'], gap[1]))
+
+    def leave_gap(q, p=gap, k=gslot):  # route and pooled slot move together, as one consistent emitter bug
+        q['calls'][p[0]]['owners'][2 * V + p[1]][1][2] = p[2] + 1
+        q['hosting']['pooled_slots'][k]['offset'] = p[2] + 1
+    m['hosted cells leave a gap in the pending prefix'] = leave_gap
+    order = [(c['stage'], c['replica']) for c in ct['calls']]
+
+    def other_time(k):
+        r = es[k]['replica']
+        return next(t for t, (s, rr) in enumerate(order) if rr == r and t != es[k]['time'])
+    loc = next(k for k, e in enumerate(es) if e['kind'] == 'local_cover_sweep')
+    m['local sweep retimed to another invocation of its replica'] = \
+        lambda q, k=loc, t=other_time(loc): q['execution_schedule'][k].__setitem__('time', t)
+    m['bridge retimed to another invocation of its replica'] = \
+        lambda q, k=bridge, t=other_time(bridge): q['execution_schedule'][k].__setitem__('time', t)
+    m['pooled slot dropped'] = lambda q: q['hosting']['pooled_slots'].pop()
+    m['pooled slot names a helper index past R'] = lambda q: q['hosting']['pooled_slots'][0].__setitem__('helper', R)
+    m['retired top-level local_programs reintroduced'] = lambda q: q.__setitem__('local_programs', {})
+    l0, l1 = [k for k, e in enumerate(es) if e['kind'] == 'local_cover_sweep'][:2]
+    assert es[l0]['replica'] != es[l1]['replica']
+    m['two local sweeps of different replicas swapped in list order'] = \
+        lambda q, a=l0, b=l1: q['execution_schedule'].__setitem__(slice(a, b + 1), [q['execution_schedule'][b]] + q['execution_schedule'][a + 1:b] + [q['execution_schedule'][a]])
+    m['bank padding global event moved to the front'] = \
+        lambda q: q['execution_schedule'].insert(0, q['execution_schedule'].pop(-2))
+    return m
+
+
+def sentinel(v):
+    if isinstance(v, bool):
+        return not v
+    if isinstance(v, int):
+        return v + 1
+    if isinstance(v, str):
+        return v + ' (mutated)'
+    if isinstance(v, list):
+        return v + [None]
+    if isinstance(v, dict):
+        return dict(v, mutated=True)
+    return 'mutated'
+
+
+def census(G):
+    ct = G['ct']
+    paths = [(k,) for k in ct]
+    paths += [('hosting', k) for k in ct['hosting'] if k != 'pooled_slots']
+    paths += [('hosting', 'pooled_slots', 0, k) for k in ct['hosting']['pooled_slots'][0]]
+    paths += [('async_schedule', k) for k in ct['async_schedule']]
+    paths += [('calls', 0, k) for k in ct['calls'][0]]
+    paths += [('idle_children', 0, k) for k in ct['idle_children'][0]]
+    kinds = {}
+    for k, e in enumerate(ct['execution_schedule']):
+        kinds.setdefault(e['kind'], k)
+    for kind, k in sorted(kinds.items()):
+        paths += [('execution_schedule', k, f) for f in ct['execution_schedule'][k]]
+    out = {}
+    for p in paths:
+        def mut(q, p=p):
+            x = q
+            for s in p[:-1]:
+                x = x[s]
+            x[p[-1]] = sentinel(x[p[-1]])
+        label = '.'.join(str(s) for s in p)
+        if p[0] == 'execution_schedule' and len(p) == 3:
+            label += ' [' + ct['execution_schedule'][p[1]]['kind'] + ']'
+        out[label] = mut
+    return out
+
+
+def assert_lines(script):
+    tree = ast.parse(Path(script).read_text())
+    fn = next(n for n in tree.body if isinstance(n, ast.FunctionDef) and n.name == 'audit')
+    return sorted({n.lineno for n in ast.walk(fn) if isinstance(n, ast.Assert)})
+
+
+def downstream_mentions(source, key):
+    hits = []
+    for rel in ('code/invoice_allcold.py', 'code/assemble.py'):
+        text = (source / rel).read_text()
+        if "['%s']" % key in text or '"%s"' % key in text or "'%s'" % key in text:
+            hits.append(rel)
+    return hits
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument('--write', action='store_true', help='regenerate EXPECTED.json instead of comparing with it')
+    a = ap.parse_args()
+    with tempfile.TemporaryDirectory(prefix='t16-mutant-coverage-') as d:
+        tmp = Path(d)
+        source, script, g = extract(tmp)
+        G, archived = load_audit(source, script, g, tmp)
+        runner = Runner(G, script)
+        shipped = shipped_controls(G, runner, script)
+        assert list(shipped) == archived['mutations_rejected'], 'shipped control names differ from the selected receipt'
+        new = {k: runner.outcome(v) for k, v in new_mutants(G).items()}
+        # Cross-stage binding that no selected stage checks: the audited template's pooled owner map must be the
+        # frozen data/OWNERS.json.gz that lift16 and independent-t16 check, and owner_map_sha256 must name it.
+        owners_gz = (STAGE / 'data/OWNERS.json.gz').read_bytes()
+        frozen = json.loads(gzip.decompress(owners_gz))
+        pooled = G['ct']['hosting']['pooled_slots']
+        binding = dict(pooled_slots_equal_frozen_owners=pooled == frozen,
+                       owner_map_sha256_names_frozen_gzip=G['ct']['hosting']['owner_map_sha256'] == sha(owners_gz),
+                       roles=len(frozen))
+        assert binding['pooled_slots_equal_frozen_owners'] and binding['owner_map_sha256_names_frozen_gzip']
+        fields = {k: runner.outcome(v) for k, v in census(G).items()}
+        lines = assert_lines(script)
+        hit = defaultdict(list)
+        for group, res in (('shipped', shipped), ('new', new), ('field', fields)):
+            for name, o in res.items():
+                if o.get('line'):
+                    hit[o['line']].append(group + ': ' + name)
+        text = Path(script).read_text().splitlines()
+        coverage = {str(n): dict(statement=text[n - 1].strip()[:160],
+                                 shipped=sum(x.startswith('shipped') for x in hit.get(n, [])),
+                                 new=sum(x.startswith('new') for x in hit.get(n, [])),
+                                 field=sum(x.startswith('field') for x in hit.get(n, [])))
+                    for n in lines}
+        accepted_fields = sorted(k for k, o in fields.items() if o['result'] == 'ACCEPTED')
+        result = dict(
+            status='PASS_T16_AUDIT_MUTANT_COVERAGE',
+            audit_script_sha256=AUDIT_SHA,
+            template_sha256=archived['template_sha256'],
+            template_to_frozen_owners_binding=binding,
+            shipped_controls=shipped,
+            new_mutants=new,
+            field_census=fields,
+            assert_lines_in_audit=len(lines),
+            assert_lines_reached_by_shipped=sorted(n for n in lines if coverage[str(n)]['shipped']),
+            assert_lines_reached_by_any=sorted(n for n in lines if any(coverage[str(n)][k] for k in ('shipped', 'new', 'field'))),
+            assert_lines_unreached=sorted(n for n in lines if not any(coverage[str(n)][k] for k in ('shipped', 'new', 'field'))),
+            coverage=coverage,
+            accepted_new_mutants=sorted(k for k, o in new.items() if o['result'] == 'ACCEPTED'),
+            accepted_fields={k: downstream_mentions(source, k.split(' ')[0].split('.')[-1]) for k in accepted_fields},
+            rejections_by_exception=dict(Counter(o.get('exception', o['result']) for r in (shipped, new, fields) for o in r.values())),
+        )
+    assert all(o['result'] == 'REJECTED' for o in shipped.values()), 'a shipped control is not rejected'
+    out = json.dumps(result, indent=1, sort_keys=True) + '\n'
+    if a.write:
+        (HERE / 'EXPECTED.json').write_text(out)
+    else:
+        expected = (HERE / 'EXPECTED.json').read_text()
+        assert out == expected, 'result differs from EXPECTED.json'
+    print('PASS_T16_AUDIT_MUTANT_COVERAGE shipped=%d new=%d fields=%d accepted_new=%d accepted_fields=%d unreached_asserts=%d' % (
+        len(shipped), len(new), len(fields), len(result['accepted_new_mutants']), len(result['accepted_fields']),
+        len(result['assert_lines_unreached'])))
+
+
+if __name__ == '__main__':
+    main()