Audit actual QQ16 output stock and exclusive workspace obligation

research/qq16-output-stock/PREDECESSORS.json

@@ -0,0 +1,31 @@
+{
+  "canonical_base": "20ecf2891d80b5acf18d980b2164fb44ea7faa90",
+  "canonical_sources": "All five SOURCES input paths authenticated before parsing; source executables read only as provenance.",
+  "pending_data": {
+    "pr": 4015,
+    "head": "0fff81d8997cef646538bcd4f60d7d455cf93b8e",
+    "source_package": "research/qq16-streaming-recovery",
+    "local_path": "vendor/pr4015",
+    "files": {
+      "WORD.json": {
+        "sha256": "272d8c1bd172c29044eb227ec6d67a882501250978234685e035158f4479aa58",
+        "git_blob": "9a57a6f9c2fd8cdc4e5934408d78ef54e5f266b6"
+      },
+      "RESULT.json": {
+        "sha256": "b4af55d3db3212e79f8f31108e048c5c2d4c32d520fc980ebaa66f47933ad622",
+        "git_blob": "e9b6b8ea6f5a7dc47d8547cd7ed255e3d5864f7d"
+      }
+    },
+    "reuse": "Exact word and invoice data; no pending executable; final F17 algebra inherited, not independently replayed."
+  },
+  "lineage": [
+    "PR4007 output pebbling",
+    "PR3985 fusion",
+    "ywz65 PR2707 / Arham Tahir PR2681 / Ali Romman QQ16 lineage",
+    "commdata2338 PR2651",
+    "Nick Petalas PR3339",
+    "Jeremy Kothe, Rohan Arun, Hao Yan and selected hosting/invoice contributors"
+  ],
+  "license": "Apache-2.0",
+  "ai_assistance": "Substantial OpenAI Codex assistance in source tracing, model construction, code, proof and validation. Automated peer review is not human or formal-kernel review."
+}

research/qq16-output-stock/PROOF.md

@@ -0,0 +1,165 @@
+# Actual stock and the missing exclusive lease
+
+This audit closes a bounded allocation question, not the QQ16 producer or
+physical supplier theorem. The source is canonical main
+`20ecf2891d80b5acf18d980b2164fb44ea7faa90`; the demanded word is PR4015 at
+`0fff81d8997cef646538bcd4f60d7d455cf93b8e`. Only its exact WORD and RESULT data
+are retained. No pending executable is imported, and the decoder algebra and
+native kernels are inherited rather than replayed here.
+
+## 1. Actual caller and stock
+
+The selected replay archive's `t16/global/hosted/GLOBAL-TEMPLATE.json.gz`
+contains16 replicas and144 complete local invocations. Replica0 begins
+F0 (source event0), B1 (event1), pair1 idle preparation (event2), and bridge1→0
+(event3). Its B1 invocation uses provider `gauge44`, orientation backward,
+pair0 and stage1, at asynchronous time4. This is an actual selected boundary;
+it is not silently replaced by the QQ16 producer.
+
+The template and its independently retained finite invoice agree on:
+
+| Stock | Half-open physical family interval | Count |
+|---|---|---:|
+| Productive data/owner families | [0,14336) | 14336 |
+| Private centres | [14336,14344) | 8 |
+| Reserved tableau | [14344,14824) | 480 |
+| Coefficient work | [14824,14826) | 2 |
+
+The invoice's physical stock identity explicitly includes the480 local-helper
+reserve. The hosted helper roles themselves occupy productive families below
+14336. The final template has no dedicated helper banks or bank-padding
+families. Historical `replica_lift.bank_stock` is inherited construction
+metadata, not additional free stock in the final hosted template.
+
+Source anchors: `research/gauge44-slots-t16/code/emit_allcold.py` lines80–104
+route every helper to a distinct productive owner and declare this private
+namespace; lines107–132 serialize the complete asynchronous continuation.
+`code/invoice_allcold.py` lines101–117 charge a cleared coefficient work stream
+for each scalar macro; lines270–300 charge the physical stock, including the
+helper reserve. The local emitter
+`research/complex-sw4-frame8/local/hpe_emit_local.py` lines53–120 emits scalar,
+adapter, climb and centre events in namespaces L and C. Its audit checks
+private centre and coefficient return. These exact source files are pinned,
+read as evidence, and never executed by this checker.
+
+## 2. A concrete helper-bank candidate fails
+
+Consider assigning the224 output roles Z0…Z111,W0…W111 to the first224
+helper owners of the actual B1 call. The receipt supplies all those physical
+family IDs, and all480 helpers' ordered routes, entry and core-exit frame
+bases, last local read/write indices and next explicit global use.
+
+The allocation model is deliberately bounded: fixed source owners; arbitrary
+independent productive contents; no evacuation, recomputation, destructive
+retirement of the original output family, or changed representation. An
+exclusive output may overwrite arbitrary old *owned* dirt. It may not erase
+a still-productive family merely because its helper role has ended.
+
+Every candidate is below14336, and every one has a later explicit use in the
+actual continuation. Local completion preserves its productive content under
+the paid invertible residual transformation; it does not turn that content
+into disposable zero. Thus every candidate conflicts with an outstanding
+productive obligation. In the bipartite allocation graph from224 output roles
+to eligible candidate banks, the eligible neighborhood is empty: matching
+size0, deficit224. Equivalently, contracting the protected productive elements
+of the free-bank partition matroid leaves rank0 on this candidate set.
+
+This is a capability/interference obstruction, not a universal information
+lower bound. Changing a source/consumer contract, evacuating data, or proving
+a different representation may change eligibility. The audit does not count
+an already eliminated centre child as new stock or new savings. It is distinct
+from PR3976's appended-output-dirt counterexample: the candidates here are
+actual source-owned physical families with exact future uses.
+
+## 3. The charged reserve supplies an address-level positive fixture
+
+There is a concrete alternative inside the existing physical stock:
+
+- Zp ↦14344+p and Wp ↦14456+p for0≤p<112;
+- Fk ↦14568+k and Gk ↦14576+k for0≤k<8;
+- current X/Y map to the first224 actual B1 owners (families0…223).
+
+The output and scratch leases use240 of the480 reserved tableau fields,
+leaving240 reserve fields, all8 centres and both coefficient fields separate.
+The checker scans the entire frozen3813-event PR4015 word. Each target belongs
+to an active owned role; every read follows initialization; borrowed inputs
+are never written; physical output/scratch/input roles are disjoint; private
+windows return zero before release; no private role spans a native event.
+It records each output's first initialization and final word access. The
+unchanged PR4015 theorem supplies the final F17 frame and exact output values;
+this audit does not infer phase correctness from address disjointness.
+
+Independently, the checker enumerates all482 explicit selected global events.
+Local owners, idle child owners, bridges, terminal translations/exchanges and
+final live-family correction do not address any of these480 reserve IDs.
+For the two local provider words, every explicit register reference is L or C;
+L is mapped through the selected owners and C through the centre interval.
+Coefficient macro work uses the separately declared final two fields.
+Therefore the proposed map has zero *explicit top-level* conflicts, including
+through the actual next bridge. The bridge reads current pair0/pair1 X/Y; it
+has no read of the newly decoded Z/W outputs.
+
+This is a positive literal-address allocation fixture. It refutes the claim
+that224 *additional addresses* are forced by the decoder's output count.
+It does **not** establish that those240 reserve fields are exclusively
+available inside every opaque native child, wrapper, map implementation or
+six-tape compiler. The inherited general reserve has not been proved unused
+by those interiors. Absence from a macro trace is not an exclusive lease.
+
+## 4. A discriminating native-interior test
+
+A complete substitution must provide an effect contract excluding the leased
+240 families from every child/map/wrapper's internal work, or supply an
+explicit disjoint scoped allocation. The positive fixture assumes that effect
+contract. The checker also evaluates the conservative alternative in which a
+native child may use the shared tableau reserve. The first native line occurs
+after live output definitions; a legal-to-the-unrefined-arena clobber of a
+retained output violates its lifetime. The negative control rejects it.
+
+This is a precise obstruction to inferring a composed allocation from the
+current macro contracts: two address-level refinements differ on protected
+output effects while the displayed native target is unchanged. We do not
+claim an existing native implementation actually performs that clobber, or
+that it fits the selected finite allowance. The countermodel concerns missing
+effect restrictions only. Proving a disjoint native workspace would discharge
+this obstruction; assigning unknown workspace behavior zero would not.
+
+The selected `gauge44` producer and the changed QQ16 producer also remain
+separate premises. Carving addresses from the selected reserve does not prove
+that selected F0/B1 produces PR4015's borrowed input state. That algebraic
+binding is a different investigation.
+
+## 5. Complete local stock/return bill and remaining costs
+
+The unchanged PR4015 word costs224 H1 children,448 wrappers,352 maps,
+416 CLEARs and26944 scalar primitives. The proposed address renaming adds no
+scalar/native/map event, no productive family, and no physical family address
+in the literal model. It uses224 exclusively owned output fields and16 private
+scratch fields within an already charged480-field reserve. This is not a
+physical compiler-space bound or a new complete invoice.
+
+Outputs return in F17. Private scratch returns zero/identity by the fixed
+source contract. If the outer private-stock contract requires eventual zero
+return after the outputs have been legitimately consumed or discarded, add
+224 full-cover CLEARs:448 real scalar primitives, zero native children and
+zero maps. The module-plus-output-erasure scalar allowance is27392. No inverse
+frame transform is needed to erase an owned output; zero may be initialized in
+the identity frame. This erasure destroys the decoded demand, so it cannot be
+moved before an actual last consumer. The next selected bridge is not that
+consumer. A terminal consumer/retirement schedule is still required.
+
+| Obligation | Status |
+|---|---|
+| Actual field IDs, helper future use, stock identity | Proved by authenticated data census |
+| Helper-only fixed-owner allocation | Precisely obstructed (0 eligible of224) |
+| Reserve address injection and explicit continuation survival | Constructive, checked on the complete literal words |
+| Exclusive native/map/wrapper interiors | Unknown; explicit clobber test rejects its omission |
+| Selected gauge44 → QQ16 input binding | Unknown here; independent obligation |
+| Output last consumer and legal erasure | Unknown; conditional erasure bill448 is exact |
+| Six-tape movement/control, finite precision, productive coverage, both supplier caps | Unknown; no κ claim |
+
+The next task is a narrowly specified240-field exclusive lease or a smaller
+proved native workspace footprint for these exact addresses, together with a
+real output consumer. Stop before another decoder optimization or complete
+supplier claim. PR3339's distinction between core, occurrence and consumer
+costs applies: an unused local address is not productive-family coverage.

research/qq16-output-stock/README.md

@@ -0,0 +1,59 @@
+# Audit actual QQ16 output stock
+
+The first selected B1 caller does not release its productive helper fields as
+scratch. A concrete224-bank candidate drawn from its helper owners has **zero
+eligible banks** under a fixed-owner, no-evacuation allocation model. All480
+helper lifetimes, frames and next explicit uses are recorded.
+
+There is nevertheless an existing charged **480-field private tableau
+reserve**. This package constructs a precise224-output plus16-scratch address
+map within it, verifies the complete PR4015 word's lifetimes and aliases, and
+checks survival through all482 explicit selected continuation events. It adds
+no physical family address in that literal model.
+
+The missing implication is now explicit: **exclusive native/map/wrapper
+interiors must preserve the240 leased fields**. Macro-trace absence alone does
+not establish that lease; a clobber control rejects the inference. Selected
+gauge44-to-QQ16 producer binding and an actual output consumer are separate
+obligations. Conditional eventual output erasure costs224 CLEARs /448 scalar
+primitives. No complete physical supplier or κ improvement is claimed.
+
+See [PROOF.md](PROOF.md) for the models, source anchors, positive map and
+obstructions. RESULT.json contains the exact field/route/lifetime ledger and
+all controls. PR4015 is pinned at0fff81d8997cef646538bcd4f60d7d455cf93b8e and
+retained only as data. No pending or canonical predecessor executable runs.
+
+## Reproduce
+
+```sh
+python3 -I -B research/qq16-output-stock/verify.py
+python3 -I -O -B research/qq16-output-stock/verify.py
+python3 -B scripts/research_package.py --package research/qq16-output-stock
+```
+
+Standard-library Python3.12. Normal replay is read-only; explicit regeneration
+refuses overwrite. The verifier authenticates SHA256 and Git blobs before
+reading inputs and validates the complete typed receipt. Native/phase algebra
+is inherited from PR4015 and is not independently reimplemented here.
+
+## Scope and credit
+
+User-assigned actual-output-stock follow-up, priority6, canonical main20ecf289.
+This closes an actual caller allocation test rather than repeating the local
+inverse, PR2651's early-record reuse, or PR3976's appended-dirt witness. Overlap
+checks are partial; no novelty guarantee. The selected frontier is unchanged.
+
+Credit PR4015 and PR4007 for the zero-extra-temporary words; PR3985 and the
+retained ywz65/Arham Tahir/Ali Romman QQ16 lineage; commdata2338/PR2651;
+Nick Petalas/PR3339; Jeremy Kothe, Rohan Arun, Hao Yan and the retained selected
+hosting/invoice contributors. Chris R / Clear1nsight with substantial OpenAI
+Codex assistance, Apache-2.0. No human or formal-kernel review is claimed.
+
+## Open next questions
+
+- Bind a disjoint native/map/wrapper workspace contract to the named240-field
+  lease; the explicit clobber control is the first acceptance test.
+- Supply QQ16 input semantics at the actual source boundary independently of
+  storage availability; selected gauge44 does not become QQ16 by renaming.
+- Pin an actual last consumer, then charge output return, movement/control,
+  precision and productive coverage before evaluating either supplier cap.