Factor actual QQ16 pair repair and expose native acquisition cost obstruction

research/qq16-query-factor/ADVERSARIAL-REVIEW.json

@@ -0,0 +1,74 @@
+{
+  "executed_checks": [
+    {
+      "check": "Fresh verify.authenticate()",
+      "result": "PASS, all 11 input/predecessor SHA256 and Git blob records authenticated against the frozen manifests."
+    },
+    {
+      "check": "Fresh cost_audit.compute() under Python -I -O -Werror -B",
+      "result": "PASS, exact canonical output equality to frozen RESULT.json."
+    },
+    {
+      "check": "Fresh native_adapter.compute() under Python -I -O -Werror -B",
+      "result": "PASS, exact canonical output equality to frozen RESULT.json."
+    },
+    {
+      "check": "Independent native_query_probe.py, no primary/native/cost module imports",
+      "result": "PASS, source archive/packet/member authenticated; actual chart matrices and translations reconstructed; legal X-after1 and Y-before2 controls pass on 112 ports and 326 zero/unit/pair characters each."
+    },
+    {
+      "check": "Independent actual ingress obstruction",
+      "result": "PASS, event32 source phase0 versus declared target phase1 at ownerI/e0; an arbitrary translation can add only phase0 or2."
+    },
+    {
+      "check": "Independent fixed-carrier two-source obstruction",
+      "result": "PASS, actual q0 ingress events32 and50 use Y0/Y25 with coefficients+1 and phases0/3 at ownerI/e0. Their phase parities differ, excluding a single fixed carrier with these routes and translation-only compensation; carrier changes and paid native words remain open."
+    }
+  ],
+  "execution_limits": [
+    "This reviewer did not independently execute the full 224-column primary compute() or root normal/optimized Git-free export suite. The primary code, formulas and frozen receipt were reviewed; those execution results belong to the construction/root workers.",
+    "Rerunning cost_audit and native_adapter verifies reproducibility of their code, not an independently written second complete cost or native implementation. The separate native_query_probe is independently written and has the stated limited scope.",
+    "External publication, concurrent PR4106 CI, current selected kappa and remote overlap claims in README/TASK are root-owned provenance statements; this review does not independently refresh them.",
+    "No all-payload implementation, full recursive supplier, outer integer-input reachability or complete saving is certified."
+  ],
+  "findings": [],
+  "independent_probe_sha256": {
+    "NATIVE-QUERY-PROBE.json": "a21b27cc9b5ef8bbd092ab18b0d44dc398b6b7674de15295aa38efdc5cc84888",
+    "native_query_probe.py": "a53b698517bc79714d775c232bdd0673d27b219227ec9ede1244994166ced3d5"
+  },
+  "pending_separate_review": [
+    "Any subsequent source-event REMOVALS artifact/checker must be reviewed and bound separately; it is absent from this frozen review."
+  ],
+  "review_status": "PASS_SCOPED_REVIEW_NO_SCIENTIFIC_BLOCKER",
+  "reviewed_at_utc": "2026-10-20T01:13:42.998870+00:00",
+  "reviewed_claims": [
+    "The factor is H on current Q outputs, with both current X and Y matching the selected G pair on the full actual owner domain at constant payload. It is not a decoder-output substitution.",
+    "The current a=R1Y query does not equal old f in general. Recovery f=ell0,T P1,T a uses the actual selected-T inverse; noncommuting owner products retain their order.",
+    "The free-current B/F inverse check operates on 224 independent persistent data fields and reapplies both contracts. No private-clearing map is inverted.",
+    "The emitted word uses 33 declared owned fields. n and c alias only after explicit CLEAR; the delta temporary clears before and after all selected-port uses. Ordinary X, pair1 and borrowed helpers have no repair writes; pair1 and helpers have no repair reads.",
+    "Literal local scalar replay includes all 712 columns. B-prefix scalar/map/native-line guards exclude arbitrary borrowed helper registers; zero-helper prefix replay alone is not asserted to prove arbitrary-dirt restoration.",
+    "The native first-gate obstruction uses actual event32 and nonzero payload, and is explicitly distinct from the positive payload-constant factor proof.",
+    "The full-Y ingress/egress route costs 224 rank-one children. The 128-unit excess is conditional on the declared common tariff and grants all remaining costs zero only for rejection. It is not a universal all-repair bound.",
+    "The sixteen centre deletions are credited once. Literal native/rank/scalar/map/wrapper counts are not a complete physical cost. Physical stock, native scratch lease, movement, precision, usage and supplier correspondence remain open."
+  ],
+  "reviewed_file_sha256": {
+    "CANDIDATE-WORD.json": "2a969e1f651fd5b6e8800073a1f345942de9c77594c8456aba5e245a00496192",
+    "COST.md": "b9227c75500dfe1ac32960e67063d169ae193f571dbdccf45af985c413f25419",
+    "NATIVE.md": "dd90080321be7ac8ad4e5440ef98f8ca1a922edfd17d51149bab81c481b33e81",
+    "PREDECESSORS.json": "f3184201fdc0e3f8c6f3ff29b64118a555e5b5e85174aa7e97664099a0a9dbdf",
+    "PROOF.md": "2a385b66155440aec4ced9b8baad79adf0353e4b34571844736cd6c74bab8667",
+    "README.md": "a7144c00197191b7879874f59bf47ee7f239e73bd260d0411bc34bbf7f10791a",
+    "RESULT.json": "66277267959f01bc01b30bb2def6380a81c1449b8c2e337aa9f779ad9636b6d7",
+    "SOURCES.json": "e2624f8406598e2ab7e04d4d26f58044a2fe1c93436553d096c5b64c0be16394",
+    "TASK.json": "a9fe177a6def45342d85bed251f166fcd8468a8c086ffa0f3bd923550e726475",
+    "VERIFY.json": "55a5b715927ee0c463b703d66faa58ac78b023c962ed7be9f011fc5bdc72187d",
+    "cost_audit.py": "b9d210b26811fcae03574daa79bac101b62fc295650c28df95dc03c8b5eaff50",
+    "native_adapter.py": "9f1aeb44f93202c650d38a20b96f6f920fd422f81afdeeeb2f9042f9c4776bed",
+    "primary.py": "9c885ec92bbfb60d5022f5593cf39f60d0c4e1fcc697db8bd43298679b9ca78f",
+    "test_verify.py": "2bbd5b046e989b5d492746c09e99ab427eaf1f7c2ef7cf8f72e74a44670b7bf8",
+    "verify.py": "9abac79bc8d87d6a1b6ba5ff4296c2fd5e05a5ebbdec9de47f7c32f7e266eb18"
+  },
+  "reviewer": "centre_copy_trace, OpenAI Codex assisted adversarial worker; shared task and source context, no independent human or formal-kernel acceptance",
+  "schema_version": 1,
+  "scientific_base": "bb4bccbf42844d2801487450727c2f63e10d1d0f"
+}

research/qq16-query-factor/COST.md

@@ -0,0 +1,163 @@
+# Paid query-factor repair: cost and restoration contract
+
+This note concerns a new correction after the actual QQ16 F0/B1 pair,
+with both current X/Y outputs required to match the selected pair before
+its next bridge. The pair-1 bridge inputs must remain unchanged. A
+correction to an earlier input, a decoder output held elsewhere, or a
+constant-owner identity does not by itself meet this endpoint contract.
+
+## What the existing obstructions cover
+
+PR4003 (`309189077d0f760248bbdaadab42ecbff4f3ea2d`) concerns the different
+full-recovery prefix boundary. Its residual is
+`Q2(X_T) - M21 Q1(Y)`, where the T-port X term is indispensable.
+The exact 104-branch bound applies to parallel sums of constant rational
+8-by-8 channel matrices times one shared owner permutation per branch.
+It is not a native-call, scalar-operation, movement or storage lower bound.
+Sequential reuse, different native kernels and other alphabets require
+separate accounting.
+
+PR4030 (`12df564caa8918453de658fe49601de6a9227017`, proof Git blob
+`3ed514dee41b4ab79d459927c4816750cb58ab9a`) fixes those 104 owner routes,
+the F16 output query frame and separate normalization of each branch. It
+allows arbitrary common input quadratic frames, including plane mixing,
+and prescribes the optimistic rank-k phase-normalizer tariff `k^(1-a)`.
+For positive integer lambda and `0 <= a <= 10/13`, its sharp formal
+normalization-only envelope is `104 lambda^(1-a)`. Every nonzero common
+polar perturbation costs more in that class. It explicitly grants other
+nonnegative obligations free only for that lower-bound screen.
+
+Neither result automatically applies to a changed producer-pair factor.
+A claimed application must identify the same operator, owner decomposition,
+input/output frames, separately normalized branch contract and tariff.
+Changing one of those hypotheses is a new construction obligation, not a
+contradiction of either predecessor. Conversely, a rank-eight formal query
+factor does not supply a paid native implementation.
+
+## Baseline credit is granted once
+
+Relative to the two selected source words, the QQ16 pair proposes replacing
+sixteen rank-eight centre calls by thirty-two rank-one line calls. Its
+literal scalar allowance increases by 28,616 real primitives. It also
+introduces 528 explicit owner maps and 64 native line wrapper maps.
+The native call count increases by 16 while the sum of child ranks falls
+by 96. Neither count alone specifies a recursive tariff.
+
+Only after endpoint compatibility and comparable tariffs are established
+may a complete positive saving be screened by
+
+```
+16 C8 > 32 C1 + 28,616 S
+        + repair + conversion + retention + restoration
+        + allocation + movement + precision + control.
+```
+
+C8/C1 denote common-unit tariffs for the removed and introduced children;
+S denotes the scalar real-primitive tariff. Wrappers must be included
+exactly once in child tariffs or priced separately. Explicit owner maps
+require a tariff too. No numerical cap is substituted for the unknown
+right-hand terms. Any repair invoice is added to this same baseline:
+the sixteen removed centres cannot be credited a second time.
+
+If a production recursive model establishes moment weights for exactly
+these calls and supplies actual replacement incidence, its moment change
+can then be evaluated. The incumbent fixed-usage moment is not imposed on
+a different unproved incidence. The PR3976 proposed invocation fraction
+and 553 allowance are not available budget. No current kappa or global
+multiplication bound follows from this local screen.
+
+## Required query and workspace contract
+
+The repair must read queries of the *current* QQ16 outputs, or explicitly
+retain earlier queries through a paid lifetime. Reusing the same symbol
+for an original query and a newly measured current query does not prove
+their equality. Forming, routing, normalizing and consuming each query
+must be listed in its word.
+
+At the pair boundary the selected and QQ16 local words return their
+borrowed helpers and clear their private streams. Those eight private
+streams do not constitute free persistent query storage across native
+calls. A borrowed arbitrary helper cannot be cleared to initialize a
+clean query. Dirty borrowing needs a reversible protocol and its exact
+restoration. Owned scratch needs allocation, live-range and terminal
+contracts. The #4015 decoder's 224 owned outputs are not automatically
+available source fields or scratch.
+
+Any final receipt must distinguish: exact operator equality, native frame
+and owner legality, literal local counts, scratch ownership/restoration,
+physical movement, recursive precision, and actual outer incidence.
+Unknown terms remain unknown, even when the finite factor identity passes.
+
+## Conditional screen for the generic common-frame construction
+
+The source bindings distinguish a model assumption from the finite arithmetic.
+The gauge44 canonical word lists eight centre frames, each with eight axes.
+Each of the sixteen removed calls binds to an actual rank-eight Clifford
+child between frame zero and that centre frame, in the listed direction. The QQ16 line recipes use the
+normalized rank-one Cq convention in the pinned bridge operator review.
+Thus the relevant rank indices are those of the actual phase children,
+not the rank of a data-map discrepancy.
+
+Suppose these actual calls have comparable lifted native-moment tariffs
+`C_r(lambda)=K(lambda)*(r*lambda)^(1-a)`, with `K(lambda)>0` and `0<=a<=1`.
+Then `C8/C1=8^(1-a)<=8`. All unchanged native children cancel in the
+same-boundary comparison. The sixteen removed H8 calls therefore credit
+at most 128 H1 units, while QQ16 already adds 32 H1 units. There is at most
+96 H1 units left for **all** repair native work, even if every other cost
+is granted free.
+
+The explicit generic construction which promotes every one of the 112 Y
+hole fields to the common F17 frame already uses 112 H1 calls on ingress.
+Its native moment is therefore at least 16 H1 units above the selected
+pair before query formation or output restoration. Promoting and restoring
+all 112 fields uses 224 H1 calls, giving an excess of at least 128 H1 units.
+These differences are derived from the literal port and source-child
+counts. They do not require the proposed PR3976 invocation fraction:
+under the stated tariff they hold pointwise at each lambda, so any positive
+incidence of this replacement preserves the excess.
+
+The rank tariff and its production recursive lift correspondence remain
+explicit premises. This is a rejection of that generic normalization
+route in that native-moment model. It is not an arbitrary physical-cost
+bound, a bound on every realization of the query factor, or a claim that
+104 normalizers from PR4030 apply to this new repair.
+
+## Literal candidate arithmetic and owned lifetimes
+
+The current candidate word contains 6,216 events: 6,112 logical routed
+ADDs and 104 CLEARs. Its coefficients occur as 1,760 signed units,
+4,320 signed quarters and 32 signed eleven-quarters. Under the stated
+scalar compiler this costs 66,832 real primitives, including all CLEARs.
+Together with the unrepaired QQ16 pair's scalar increment, this is
+95,448 additional scalar primitives before native conversion, physical
+address work or precision costs. This is a literal arithmetic allowance,
+not a complete executable native cost.
+
+There are 4,736 nonidentity-owner routed reads and 1,376 identity-owner
+reads, using 329 distinct owner matrices. These counts are not numbers
+of physical map calls. An `add_view` describes a logical source view;
+its paid realization must supply legal source and target frames, payload
+translations, source preservation, and access/movement costs.
+
+Five eight-field query records use 32 owned fields because the n and c
+records explicitly reuse the same eight slots after CLEAR. One additional
+owned field carries selected-output deltas, giving 33 declared owned
+cover fields. The independent audit checks initialization before use,
+CLEAR confined to declared owned fields, zero terminal values, no
+borrowed-helper or pair-1 access, and no writes to ordinary current X.
+The 33-field requirement is an allocation contract; this audit does not
+find those fields in the selected physical stock or price their lifetime.
+
+An independent one-source owner-ring check also tests the critical query
+availability premise. It replays the literal F0 word and B1 prefix for
+arbitrary owner-dependent X at port 0 and constant payload, reconstructs
+all 112 stage-1 owner maps directly from the phase source, and verifies
+`f=ell0,T P1,T (R1 Y_current)`. Replacing that expression by the current
+query `a=R1 Y_current` fails. This check imports no primary verifier; its
+scope is this critical availability identity, not a second full-column
+factor proof or a native implementation of query acquisition.
+
+The generic normalization screen grants correctness and all additional
+conversions free when rejecting that route under its stated native tariff.
+It does not claim that all 112 ingress calls are unavoidable for every
+repair, or that the remaining routed ADDs are already legal native gates.

research/qq16-query-factor/DELTA-REVIEW.json

@@ -0,0 +1,53 @@
+{
+  "checks": [
+    "Portable native_probe.py calculation AST equals the original independent probe after removing only BASE/ROOT path assignments and final output/receipt handling. Mathematical definitions, route derivations, witnesses and controls are unchanged.",
+    "NATIVE-PROBE.json data equals the independently generated external NATIVE-QUERY-PROBE.json exactly.",
+    "Both registered quick commands were freshly run under -I -O -Werror -B and passed.",
+    "REMOVALS source centres independently compared to the separate authenticated LOCAL-PROGRAMS archive member, which exactly equals the template provider programs. Source indices, events and program SHA256 agree for both orientations.",
+    "Independent packet traversal verified every recorded native_line event/index and every explicit map index; both expanded QQ16 programs have no remaining centre event and every recorded line label has rank1. Counts are16 proposed removed H8,32 added H1 and528 explicit maps.",
+    "REMOVALS explicitly accepts zero source work removed and preserves all native/stock/bridge/restoration/precision/usage obligations; no decoder saving or double centre credit is introduced.",
+    "NAVIGATION retained proof SHA256 and Git blob recomputed successfully. The proof was read for fixed-route, fixed-F16, separate-normalization and tariff scope; its result is not applied as a universal bound on this factor.",
+    "All14 previously reviewed files other than VERIFY.json are byte-identical, including the scientific core, candidate word and RESULT. VERIFY adds only the two bounded quick-check commands."
+  ],
+  "findings": [],
+  "limitations": [
+    "No independent full primary or root export-suite execution was added in this delta; earlier review limitations remain.",
+    "Source-event records describe a proposed comparison, not an admitted deletion, physical gate correspondence or native supplier.",
+    "Navigation live commit/PR provenance remains root-owned; the retained bytes and stated proof scope were checked locally."
+  ],
+  "prior_review_sha256": "bed2450e42ca547a638e7bd6b5f99489606b830b176b0657d9fcf868e04d2ef2",
+  "resolved_findings": [
+    {
+      "finding": "The first reviewed removals.py version lacked standalone archive and packet authentication.",
+      "resolution": "Root added both exact SHA256 pins before parsing; final reviewed file and successful rerun include this fix."
+    }
+  ],
+  "review_status": "PASS_BOUNDED_DELTA_NO_SCIENTIFIC_BLOCKER",
+  "reviewed_at_utc": "2026-10-20T01:15:33.285321+00:00",
+  "reviewed_file_sha256": {
+    "NATIVE-PROBE.json": "a21b27cc9b5ef8bbd092ab18b0d44dc398b6b7674de15295aa38efdc5cc84888",
+    "NAVIGATION.json": "42d680c79b97befebee45a65cdd8216328a9a53edcc721f8abb97aaddd15e1ee",
+    "REMOVALS.json": "15c7fce5768ee9c9ee4d19538653a0b6279c2e941bf504cd4ffa75ff059baa85",
+    "VERIFY.json": "df79ef6ec75fe3f4f61c1c828569dc5ae6a4f307717ad9c1145fa7b3d07d17a2",
+    "native_probe.py": "2e3d866e4efd66d095f35538a4a5470875fe0a462bab99d7d9efc29dc9e24ef9",
+    "removals.py": "04a7be456bdb125c886f86a0c157267be39527cd4afac878854ec61361267b1a",
+    "vendor/PR4030-PROOF.md": "fa7b82f7210ac755b3144c5a55b0c40001480a3f3ecab3b9503144c482b6b3f9"
+  },
+  "schema_version": 1,
+  "unchanged_previously_reviewed_files": [
+    "CANDIDATE-WORD.json",
+    "COST.md",
+    "NATIVE.md",
+    "PREDECESSORS.json",
+    "PROOF.md",
+    "README.md",
+    "RESULT.json",
+    "SOURCES.json",
+    "TASK.json",
+    "cost_audit.py",
+    "native_adapter.py",
+    "primary.py",
+    "test_verify.py",
+    "verify.py"
+  ]
+}