Compute least actual-body borrowing on fixed Count tapes

research/encoded-body-depth-borrowing/PROOF.md

@@ -0,0 +1,240 @@
+# Count-tape refinement of actual-body borrowing
+
+This result refines Nick Petalas's [PR3486](https://github.com/CrocSwap/integer-mult-bounds/pull/3486)
+at `991861d40a1ebdbbf35be9adc1726e6af5b71e49`. Its byte-pinned proof is
+retained in `predecessor/PR3486-PROOF.md`. The new contribution is the
+`selector.py` implementation, its setup and ownership invoice, and bounded
+checks against independent integer specifications. The monotonicity and
+inverse-depth arguments remain PR3486's work.
+
+The execution vocabulary is Jose Manuel's PR2899 Count selector and its
+retained PR2809/PR2753 source closure. The consumer contract is Tekalign's
+PR3264 ordinary one-factor adapter, using Nick Petalas's PR3246 NODE-guard
+reserve. Source access, completed children, pointwise fresh-row restoration,
+physical refinement and uniform caller costs remain inherited premises.
+
+## 1. Contract and arithmetic refinement
+
+Fix compiled integers `q>=2`, `m>r>=1`, `W>=1`, `Q>=1` and a fixed rational
+width exponent `alpha=A/C`, with `C>0` and `0<=A<=C`. The zero exponent is
+useful for reduced fixtures; the selected exponent is `17/10000`. For a
+positive canonical input Count `e`, define
+
+```
+w = ceil(e^alpha),
+N = product_(i=0)^(m-1) (q^m-q^i),
+b = W*N*q^(m*m*(w-1)),
+D(n) = 0                         if n<m,
+D(n) = 1+D(r*floor(n/m))          otherwise,
+S_0 = 1,  S_d = Q*b^d            for d>=1.
+```
+
+For a source-admissible prime `q`, `N=|GL_m(F_q)|`. Validation of the
+arithmetic selector only requires integer `q>=2`; this does not admit a
+composite radix to the selected finite-field construction.
+
+The retained `encoded.atom_width` computes the stated ceiling using exact
+integer powers and bisection. All subsequent values depending on `e` are
+Counts. The host expressions for `N`, `q^(m*m)`, `W*N`, and the profile are
+compiled source constants. Neither `e`, `w`, `k`, `D(n)` nor a stock value is
+decoded to a Python integer by the selector.
+
+The new `_power(base, exponent)` scans the canonical exponent from most
+significant bit to least significant bit. If the scanned prefix has value
+`p`, its invariant is `value=base^p`. Squaring and then multiplying by the
+base exactly when the next bit is one changes the exponent to `2p+bit`.
+The initial value is one, so this also handles zero. Count products copy
+their inputs, and the exponent is rewound on return. The two inputs retain
+their contents and origin positions. No recursion or list of exponent bits
+is required.
+
+For a trial `0<=k<=e`, `encoded.divide(e-k,w)` returns its exact quotient
+and remainder. Repeated small division by `m` followed by multiplication by
+`r` computes `D(n)`; this terminates because the child is strictly smaller
+than each positive internal width. `_power` then constructs the exact
+`stock=S_D(n)` and `rows=q^k`. At positive depth, `Q` is multiplied once.
+At depth zero, stock is one. Every trial's body, remainder, depth, stock and
+rows are recomputed from its own borrowing Count.
+
+## 2. Least feasible borrowing
+
+Let
+
+```
+n(k)=floor((e-k)/w),
+U=min(floor((e-1)/2), e-m*w).
+```
+
+Exactly the integers `k` in `[0,U]` satisfy both `2k<e` and `n(k)>=m`.
+PR3486 proves that, on this interval,
+
+```
+P(k): q^k >= S_D(n(k))
+```
+
+is monotone: `D` is nondecreasing, `n(k)` is nonincreasing, and the stock
+sequence is nondecreasing. This selector implements that same predicate by
+comparing its two exact Count values, without approximating logarithms.
+
+If `e<m*w`, it returns no fit. Otherwise it constructs the nonnegative `U`,
+tests zero, and then tests `U`. A successful zero is minimal. A failed `U`
+rules out every candidate. In the remaining case the maintained endpoints
+satisfy `0<=lower<upper<=U`, with `P(lower)` false and `P(upper)` true.
+Their integer midpoint is strictly between them when the gap exceeds one.
+Replacing the appropriate endpoint preserves the invariant and at least
+halves the gap, rounded up. Thus the loop takes `O(log(e+1))` trials and
+terminates at adjacent endpoints. Its upper endpoint is the least feasible
+borrowing. This nonnegative formulation needs no encoded negative sentinel.
+
+After bisection, a fresh final trial materializes all five dependent fields.
+Together with `width` and `borrowed`, the seven returned Counts describe
+exactly the accepted plan. They belong to the caller. A no-fit result has the
+true width, zero depth/borrowed/body/remainder, and unit stock/rows. Those
+sentinel fields describe no admitted recursive call. They cannot be reused
+as stale fields from a rejected trial. `close_plan` releases all seven Counts.
+
+Optimality is for this fixed width and the explicit covering constraint
+`q^k>=S_D(n)`. It does not optimize width or all possible padding budgets.
+In particular, the optimum need not satisfy `k=ceil(log_q S_D(n(k)))`;
+PR3486's discontinuous-depth example explains why fixed-point iteration
+would be incorrect.
+
+## 3. Complete setup invoice
+
+This invoice counts the retained sequential binary-tape operations, subject
+to their existing physical refinement. Constants below may depend on the
+fixed profile and radix. Put
+
+```
+h = 1+ceil(log_2(e+1)),
+B = e+w*h.
+```
+
+Since `w<=e` and `r/m<1`, trial depths are `O(h)`. The bitlengths of the
+input, geometric endpoints, body, remainder and depth are `O(h)`; the level
+`b` has `O(w)` bits; and a trial stock has `O(w*h)` bits. The full `q^k`
+may have `Theta(e)` bits even for a rejected trial with small `w`. It is
+therefore included in `B`. The bound does not charge only the final stock
+threshold or silently replace full radix powers by saturated comparisons.
+
+A copy, comparison, small fixed multiplication/division, increment,
+subtraction, normalization or clear costs `O(L)` at word length `L`.
+Retained binary long division and `Count.product` cost `O(L^2)` when all
+operands and results have `O(L)` bits. In the product, at most `O(L)` scanned
+multiplier bits each cause an `O(L)` shift/add scan. An MSB exponentiation
+with a `t`-bit exponent consequently costs `O(t*L^2)`. All intermediate
+exponents are prefixes of the final exponent, including the doubled prefix
+before a conditional multiply. Bases here are at least one, so no
+intermediate product exceeds its final power.
+
+The charges are as follows; they include the scans that rewind, normalize,
+copy and clear each temporary.
+
+| Stage | Bound in retained tape operations |
+| --- | --- |
+| Atom-width selection | `O(h^3)` |
+| Geometric bounds and endpoint setup | `O(h)` |
+| Construct `b` from the compiled `q^(m*m)` and Count exponent `w-1` | `O(h*w^2)` |
+| One trial's quotient/remainder and depth recurrence | `O(h^2)` |
+| One trial's stock power and one compatibility multiplication | `O((1+log(h+1))*(w*h)^2)` |
+| One trial's full radix power `q^k` | `O(h*e^2)` |
+| Endpoint tests, `O(h)` bisection trials and one final materialization | `O(h^2*B^2)` in total |
+| Final returned-plan disposal and other remaining cleanup | `O(B)` |
+
+For the first row, the fixed numerator gives an `O(h)`-bit target `e^A`.
+Width bisection has `O(h)` iterations. The fixed-denominator powers saturate
+at that target: an unsaturated product has at most twice its bitlength.
+There are a fixed number of products per fixed-exponent power, each costing
+`O(h^2)`. For the level row, there are at most `O(h)` exponent bits and
+`O(w)`-bit intermediate values. For the stock row, `D(n)=O(h)` has only
+`O(1+log(h+1))` bits. The conservative total also includes zero and upper
+endpoint trials, discarded plans and the final complete recomputation.
+
+The resulting bound is
+
+```
+T_setup = O(h^3 + h^2*(e+w*h)^2),
+S_setup = O(e+w*h) binary cells on a fixed number of roles.
+```
+
+There is an additional fixed compilation/initialization constant for the
+chosen `q,m,r,W,Q,A,C`; this is not uniform in these source parameters. For
+the selected fixed exponent `0<alpha<1`, `w*h=O(e)`, so setup is
+`O(e^2*h^2+h^3)` and uses `O(e)` cells. More generally `alpha<=1` gives the
+still polynomial bound `O(e^2*h^4+h^3)`. With the inherited relation
+`e=O_q(log V)`, either is a fixed polynomial in `1+log V`. Setup is charged
+in addition to the consumer's full payload bill. This proof supplies no
+numerical machine-step constant or new asymptotic multiplication exponent.
+
+## 4. Fixed roles and successful-return ownership
+
+Each `_Owned` dictionary has a fixed finite set of literal names; loop
+iterations replace existing slots. A trial is closed before the next one,
+and `_power` uses one replacement accumulator. Thus the Python bookkeeping
+does not encode an unbounded table or a growing recursion stack.
+
+The count includes the temporary tape used by `Count.literal`, not merely
+the returned Counts. A Count product has at most four simultaneous internal
+tapes: factor, scan, result, and either the result literal's temporary or the
+copy used by addition. A power retains one old accumulator while that
+product is constructed, so it needs at most five additional roles beyond
+its borrowed inputs.
+
+| Phase | Conservative simultaneous roles, excluding the borrowed input |
+| --- | --- |
+| Inherited width helper, before other selector fields exist | 10 |
+| Main scope plus active trial and power temporaries | 17 |
+| No-fit sentinel construction while the upper trial is still live | 19 |
+
+For the second row, the main scope has at most eight live Counts, including
+the midpoint. The trial retains at most four other Counts while creating
+its rows power, which adds at most five. Its division path uses fewer roles.
+For the last row there are seven main Counts, five completed trial Counts,
+six sentinel Counts and one literal-construction temporary. Including the
+borrowed input still leaves a conservative allowance of 24 roles. Width
+selection has already returned before the later main/trial scopes overlap.
+
+Under the retained fixed-role allocator these requests fit within the
+predecessor's 64 setup-role allowance. This is an analytic upper bound on
+successful well-formed executions, not an inference from a finite observed
+peak. The input Count is preserved and rewound. Every other result is either
+transferred once to the returned plan or closed by its scope; replacement
+closes the old value after the new value is computed. The caller closes the
+plan after use. This preserves the inherited successful-return marker and
+lease convention. It does not promise transactional recovery from arbitrary
+exceptions inside predecessor arithmetic or supply a new universal physical
+compiler proof.
+
+## 5. Conditional consumer implication and limits
+
+For an admitted plan let `d=D(n)`, `R=q^k` and
+`R'=ceil(R/S_d)*S_d`. The predicate proves `R>=S_d`, hence
+`R<=R'<2R`. PR3486 and PR3264 then give the same NODE-guard implication:
+the whole fresh quotient passes to children, completed siblings reuse it,
+and compatibility `Q` is not charged again at each ancestor. Both padded
+ordinary calls use this same reserve. The genuine other high field stays
+`R`, and each padded return is immediately restricted to its genuine rows.
+These implications retain the completed-callee, exact source, pointwise
+restoration, restriction and ownership hypotheses of those predecessors.
+
+No callback or default backend is changed here, and the verifier does not
+run a selected-parameter Boolean payload. The setup implementation can be
+passed to the existing plan hook only with its inherited consumer contracts.
+The older simultaneous full-depth-format contract remains a distinct,
+stronger requirement.
+
+If PR3264's old `D(e)` selector fits, its borrowing is feasible here because
+`D(n)<=D(e)` and the guard stock is nondecreasing. The new least borrowing
+is no greater. The existing sufficient fallback cutoff therefore remains
+sufficient, conditional on the same source contracts. This says neither that
+all inputs fit nor that a smaller borrowing is a runtime speed factor.
+
+Independent integer specifications and reduced literal Count replays are
+finite evidence for this refinement. They do not discharge full-cover,
+completed-leaf, source-access, uniform physical-cost, routing, precision,
+outer-transfer or complete multiplication-theorem obligations. All children,
+helpers, padding, restriction, output copies and cleanup remain charged in
+the inherited consumer recurrence. No selected-frontier change is claimed.
+
+Prepared by Hiroki Kumazaki with substantial OpenAI Codex assistance.
+Predecessor attribution above is retained. Apache-2.0.

research/encoded-body-depth-borrowing/README.md

@@ -0,0 +1,131 @@
+# Least actual-body borrowing on Count tapes
+
+This closes the encoded-selector and setup-invoice part of [PR3486's
+handoff](https://github.com/CrocSwap/integer-mult-bounds/discussions/2319#discussioncomment-19010306)
+at `991861d40a1ebdbbf35be9adc1726e6af5b71e49`. The predecessor proves the
+threshold with host integers; this package computes it using the retained
+binary Count tapes and fixed physical roles. It is an opt-in setup component,
+not a selected supplier, default-backend change or new multiplication bound.
+
+## Result
+
+For compiled radix/profile constants, fix the atom width
+`w=ceil(e^(A/C))` before borrowing. The selector returns the least `k` with
+
+```
+2*k < e,
+n = floor((e-k)/w) >= m,
+q^k >= S_D(n),
+D(n) = 0 if n<m, otherwise 1+D(r*floor(n/m)),
+S_0 = 1, S_d = Q * (W*|GL_m(F_q)|*q^(m*m*(w-1)))^d for d>0.
+```
+
+`selector.select_body_stock` uses encoded bisection, actual-body depth at
+every trial, and MSB-scanned Count exponentiation. It accepts the same compiled
+profile vocabulary and returns the seven owned Count fields plus `fits` used
+by the existing ordinary plan hook. No host-decoded input or input-dependent
+depth table is used. On no fit, `width` is retained, `depth/borrowed/body/remainder`
+are zero and `stock/rows` are one; these are explicitly nonadmitted sentinels.
+The caller must close every plan with `close_plan`.
+
+For `h=1+ceil(log2(e+1))`, the complete setup invoice is
+
+```
+time  O(h^3 + h^2*(e+w*h)^2),
+space O(e+w*h), on at most 24 roles including the borrowed input.
+```
+
+Constants depend on the compiled radix/profile. This includes width selection,
+level construction, discarded trials, **full** trial radix powers, final-plan
+recomputation and cleanup. It fits within the inherited 64-role setup allowance.
+For the selected fixed exponent `17/10000`, the time is `O(e^2*h^2+h^3)`.
+The relation `e=O_q(log V)` makes this a fixed polynomial setup addition to the
+inherited full payload bill. These are conditional tape-operation bounds, not
+measured performance or a new universal physical compiler proof.
+
+## Discriminating examples
+
+Use `q=2,m=2,r=1,W=Q=1,w=1`:
+
+| Original width | Exact decision | What it checks |
+| --- | --- | --- |
+| 12 | No fit | `k=6` covers the stock but violates strict `2k<e`. |
+| 13 | `k=6,n=7,D=2,S=36,R=64` | Actual-body depth fits where the old `D(e)` choice needs `k=8` and fails. |
+| 24 | `k=9,n=15,D=3,S=216,R=512` | Required-stock substitution cycles `8 → 11 → 8`; the least admitted `k` exceeds its own required digit count of 8. |
+
+With width exponent `1/3`, `e=61` gives `w=4,k=30,n=7,remainder=3`.
+The literal tape tests also cross the ceiling-width boundaries `8/9` and
+`64/65`. These are reduced setup examples, not selected GL64 payload runs.
+
+## Verification and scope
+
+```sh
+python3.12 -B scripts/research_package.py --package research/encoded-body-depth-borrowing
+python3.12 -I -O -B research/encoded-body-depth-borrowing/verify.py
+```
+
+The standard-library replay authenticates 20 unchanged source inputs and the
+retained PR3486 proof. Runtime uses the predecessor's already-archived tape
+vocabulary; no executable or Git object from pending PR3486 is needed.
+`verify.py --emit` prints the deterministic receipt without overwriting it.
+
+- **171 literal Count cases**, 84 fitted, match independently written forward
+  enumeration and inverse-depth slab specifications. Physical constructors and
+  numerical decoding are disabled during selection. Borrowed inputs return
+  unchanged at their origin; all temporary/result leases close.
+- The independent integer methods agree on **5,760 cases**. All 1,139 admitted
+  plans satisfy the padded quotient and compatibility guards at every depth.
+- Twelve controls cover invalid contracts, zero input, a semantic failure after
+  complete trial construction, and executed mutants using old depth, omitting
+  Q, weakening strict fit, using the wrong radix exponent or returning the false
+  bisection endpoint. The five algorithm mutants reach the semantic oracle.
+- The observed peak is **19 setup roles**; the written 24-role bound comes from
+  a separate inventory of allocation sites, including constructor temporaries.
+
+The first literal replay exposed a scan-origin bug in the new exponentiation;
+the fixed code moves right from `LEFT` before using the retained rewind loop.
+The published tests exercise this path. Successful, fallback and the tested
+semantic-failure cleanup are covered; arbitrary interruption or allocation
+failure inside inherited arithmetic is not a transactional guarantee.
+
+The optimality, stock and inverse-depth theorems remain PR3486's results.
+[PROOF.md](PROOF.md) establishes their encoded refinement and setup invoice.
+It retains the NODE-guard covering constraint, fixed width, completed-callee,
+pointwise restoration, source, ordinary/C0 physical and uniform-cost premises.
+The simultaneous full-depth-format consumer needs its separate stronger
+contract. All children, helpers, padding, routing and consumer costs remain.
+No selected payload, full cold replay, human review or proof kernel is claimed.
+
+## Open next questions
+
+1. Bind this plan factory to one fully specified reduced completed ordinary
+   caller, checking both padded returns, all dirty spectators and fallback.
+   Start at the existing `execute_plan` hook; its physical caller contract must
+   be explicit. This package verifies setup and does not execute that payload.
+2. Can exact saturation reduce rejected-trial radix-power work? Start by capping
+   the comparison at the actual stock, proving the same threshold, and retaining
+   full materialization for the accepted plan. No faster implementation is
+   established here.
+
+## Attribution and coordination
+
+Hiroki Kumazaki with substantial OpenAI Codex assistance for analysis, code,
+execution, writing and separate same-session AI-agent checks. Apache-2.0.
+Credit Nick Petalas (PR3486 threshold and PR3246 one-factor reserve), Tekalign
+(PR3264 consumer), Jose Manuel (PR2899/2809 encoded arithmetic and physical
+setup), David Arias (PR2753 recursive caller), Ross Richardson (PR2420 format
+contract), and their retained BIT/geometry/compiler lineage. The byte-identical
+predecessor proof retains its source, hash and author attribution in SOURCES.json.
+
+Base: canonical main `6f100d4bb5083f8c35d96fd95a539811c62f245c`, priority
+revision 6. This changes the `selected-stock-envelope` card to the live encoded
+implementation handoff. Entry overlap covered 410 open PRs and 2,332 Discussion
+records with complete pagination, plus focused current-thread checks; it excludes
+unpublished work and exhaustive historical diffs. [Canonical claim/result](https://github.com/CrocSwap/integer-mult-bounds/discussions/2319#discussioncomment-19010614).
+
+The publication refresh also found the concurrent [factor-two padding
+claim](https://github.com/CrocSwap/integer-mult-bounds/discussions/2319#discussioncomment-19010608).
+That work changes the covering premise to permit `S/2<R<S` and explicitly stops
+before a full encoded borrowing selector. This package keeps `R>=S` and supplies
+that selector only for the existing covering contract; no result is transferred
+between the two admission predicates.