Certify conditional R437 original-root STEP and capsule handoff (no new κ)

research/r437-root-step-handoff/README.md

@@ -0,0 +1,256 @@
+# R437 original-root STEP / capsule correspondence
+
+**Conditional metadata certificate; no new κ, supplier admission or physical cost
+claim.** Prepared by **codyw912**, with substantial **OpenAI Codex (GPT-6 Astra)**
+assistance. Apache-2.0; inherited sources and attribution remain unchanged.
+
+## Claim and evidence boundary
+
+For carrier **D**, derive the early **SOURCE87 MOVE**, stage **0**, replica **0**
+from the actual topology, use its **common** preparation matrix, and select its
+inverse modulo the named prime `q = 2^127-1` as the good GL64 low class. At the
+conditional metadata cut with original root
+
+```
+e = n = 2048, h = 0, w = 2, L = 255, I = 13,
+Q = the actual fresh catalogue code width, modulus = q^2, root unit = 1,
+B = 2, G = 3, S = 5,
+```
+
+an actual emitted GOOD residual block gives a child of width **64**, stored
+history **1**. The literal `child_program → Callback → children.extend` produces
+exactly one STEP `(GOOD, actual code, rank 2, field 0, reverse 0, half 0,
+parent 2048, child 64)` while retaining original-root size and unit. The literal
+`Machine.prepare_child` copies exactly its eight capsule ports, with unchanged
+modulus and event width/depth grants. Its rows port receives **unused**, not
+`leading = unused*B`.
+
+This is a source-bound conditional implication, **not a proof that payload
+execution reaches that cut**. The harness does not construct the giant root
+payload or directory. It starts with a genuine root-only Program (zero STEPs),
+not a descendant `Program.fixture` history. The event comes from the literal
+`residual_blocks.events`, not an invented event namespace. The parent Program
+object identity is checked separately from byte equality. The successor's
+serialized width/depth are checked independently against the emitted event and
+copied grants: the retained `prepare_child` itself does not check this equality.
+
+The implementer performed no research executions. The parent subsequently ran
+the explicit receipt-writing command successfully (exit 0, 44.086 seconds
+including environment setup), then both registered normal and optimized replays
+successfully (exit 0, 88.544 seconds combined including environment setup), on
+Python **3.12.13**, Linux **x86_64**. Both emitted
+`PASS_R437_CONDITIONAL_ROOT_STEP_HANDOFF`; the package runner emitted
+`PASS_REGISTERED_RESEARCH_PACKAGE` with outcome `completed`. `TASK.json` contains
+the actually observed receipt; default replay compares it without rewriting it.
+An independent read-only **AI code review** reported PASS with no blockers.
+These are local execution and static-review results, not hosted CI, human review,
+formal verification or verification of the full multiplication theorem.
+
+No public Discussion claim was posted. Upstream PR creation requires operator
+approval; publication status is reported in the handoff.
+Parent refreshed overlap at **2026-10-22 16:48Z**: 469 open PRs, 3624 discussion
+records and 5864 local notes (5860 tracked, complete; four from this work).
+Coverage excludes code diffs, closed remote PRs and unpublished work. Canonical
+main remained the pinned base, and #4685's cited head remained unchanged.
+
+## Source closure and historical context
+
+Base: `b58ad9ef4d4e861b0eaa5dba41742bdc072dca51`.
+[SOURCES.json](SOURCES.json) pins 191 source/provenance files by Git object and
+SHA-256. All 188 live inputs are declared in [VERIFY.json](VERIFY.json); every
+mapped temporary pathname is explicit. Package-local verifier changes are inputs
+to replay automatically. Its own SHA-256 is emitted as the adapter identity.
+
+The current selected record is pinned **as historical orientation at this base**:
+**#4470, 60403/20000000**. It is not the runtime's historical selection. Parent
+observed that importing the old carrier runtime directly against current selection
+fails `unrecognized complete selected record`; this package does not suppress or
+repeat that failure.
+
+Instead, authenticate `r437-preparation-composition/POOLED-SOURCES.json` against
+`PREDECESSORS.json`, authenticate its exact **154-file** vendor inventory
+(including exact directories and rejecting symlinks), and copy it to an isolated
+repository-shaped temporary directory. Its selected record has SHA-256
+`bb2eaa58647b353f88d0aec2eafb9d30df1be53589231b23e12ceef3e4bad129`, already accepted
+by the unchanged archived loader. Add the pinned current carrier
+`compiler.py`, `admission.py`, `numerical.py`, carrier candidate/chunks, and pooled
+`SOURCES.json` plus **all nine retained inputs**, including `check_transport.py`.
+Overlapping mappings must be byte-identical. A fresh subprocess imports compiler
+from its normal position: `ROOT` resolves naturally inside the temporary tree.
+No loader authentication, selected-source guard or frozen/live input is changed.
+The unrelated preparation package's rank-14 fixture is never executed.
+
+## Executed versus adapted versus unexecuted
+
+| Boundary | What the verifier actually requests |
+|---|---|
+| Source construction | Retained `admission.load_certified("D")`, exact named Lucas–Lehmer certificate and fresh-source authentication. Its already-existing named-prime guard adapter is retained, not silently bypassed. |
+| Common low class | Invert the **actual common preparation** modulo q, check inverse product equals identity, encode/decode it with the exact ordinal adapter below, resolve actual Specifications and rank-two good plan. Native identity is not substituted. |
+| Regional compiler | Execute **unchanged AST** of nested `macro_code.compile_node.residual`, from a fully authenticated module. Run actual `LocalState.accept` through the selected source position and require its MOVE request equals topology lookup. Execute actual `SelectedBinding.residual` and `Cursor.take`. Record source hash, function line range and operations. This is not execution of the complete enclosing compiler or `admitted_compile_node`. |
+| Parent and child Program | Literal root record, with no invented ancestor history; actual Callback validation and literal child constructor. Independent parser uses tag/word grammar directly, not `Program.root/step`. |
+| Event | Literal GOOD block from the nested emitter; literal `residual_blocks.events` / `trace.child`, with original encoded geometry and parent identity. |
+| Handoff | Literal `Machine.prepare_child`, literal `read_prefix`, literal eight-port `append_tape`, and literal numerical grant copies. Allocate a metadata-only Machine without its infeasible `q^2+128` scratch pool. |
+| Rows/counts | **Symbolic count transport**, not binary `Count` arithmetic. A port carries a versioned JSON monomial encoded as bits. Exact symbolic quotient and local divisibility are checked independently. The numeric row payload is not allocated. |
+| Spectators | Original `Layout.__init__` and `child_extents` code objects and all geometry guards, with a private globals dictionary replacing only Count products, positivity and atom-power arithmetic by exact symbolic operations. No production module is modified. |
+| Directory | One actual serialized zero-high prefix: an independently justified member of the producer's domain. It is **not** the output of `directory.produce`. Symbolic prefix count is `q^4096`; the one-prefix metadata tape does not physically realize that multiplicity. |
+| Source port | Empty metadata-boundary tape copied literally. It represents no executed payload and is not asserted consistent with the symbolic counts. |
+| Omitted | `Machine.node/block/call/run`, complete high-field production, preceding routes, forward/payload/backward sweeps, child execution/return, physical row arithmetic, cost tariffs and supplier admission. |
+
+The retained dispatch source `macro_machine.py:253-282` calls `prepare_child`
+only for an `enter` event whose width is at least 64. The verifier checks that
+predicate on the actual event; it does **not** claim to execute `Machine.block`.
+A separate actual emitted width-two event is rejected as a recursive handoff.
+
+## Exact arithmetic and edge proof
+
+Let
+
+```
+N = product(q^64-q^i, i=0..63), H = q^4096,
+A = 28416*N*H,
+D(n) = 0 if n<64, otherwise 1+D(42*floor(n/64)).
+```
+
+The executed `numerical.check_root_domain` checks the exact original-root
+precision inequality `(w-1)^10000 < e^17 <= w^10000`, chronological bound and
+canonical L/I/Q. Prime and source admission are checked independently. No call
+to `checked_entry` is claimed: that wrapper requires a concrete integer stock.
+
+Choose the retained conservative root contract `R=(9475*A)^D(2048)`. The supplied
+symbolic `U=9475^D*A^(D-1)` satisfies **exactly** `U*A=R` and is divisible by 9475.
+This authenticates the conditional `unused` premise; `prepare_child` does not
+compute it and `SelectedBinding.check_stock` does not supply a proof of it.
+The local row divisor comes from retained `fresh_rows.quotient`; no source guard
+is weakened. Monomials `[c,a,b]` denote `c*A^a*q^b`; matching exponent/coefficient
+identities are sufficient exact equalities, not a claimed globally unique integer
+factorization.
+
+**Nick Petalas's already-main #3246** establishes the sharper sufficient stock
+`9475*A^D`. That theorem is **not new here**. The verifier keeps it separate from
+the stronger old-entry divisor: at this depth its coefficient lacks the old
+`9475^D` divisor. It does not claim that old `checked_entry` admits sharper rows.
+This package instead answers the actual Program/capsule question requested by
+**Mihir Srivastava's #4685 / #4682 arithmetic handoff**.
+
+Since `floor(2048/64)=32`, the actual good event has
+
+```
+a = 0, b = (2*64-2)*32 = 4032, c = 2*32 = 64, total = 4096.
+```
+
+There is no embedding remainder. The two selected chunks are `[0,64)` and
+`[4032,4096)`. Their complete spectators are
+
+```
+B' = 2, G' = 3*(q^2)^3968 = 3*q^7936, S' = 5.
+```
+
+All 3968 unselected atoms and the external gap appear exactly once, and
+`B'*G'*S'*(q^2)^(2*64) = 30*(q^2)^(2*2048)`. U remains a separate factor.
+With B=2, confusing `leading=2*U` and `unused=U` is observable. Doubling U remains
+locally divisible but fails **exact parent/child quotient equality**.
+
+### Bounded codec ordinal-count adapter
+
+The original GL codec enumerates `range(value)` while ranking and `range(q)`
+while unranking. Common preparation inverse entries may be `q-1`, so literal
+q127 enumeration is not feasible. Only these candidate-count loops are replaced;
+original `Constraints`, source tags, matrix/range guards, encode/decode and outer
+mixed-radix rank/unrank are retained. This is **harness count arithmetic**, not a
+claim that the original implementation runs at q127. Its identity is the emitted
+package `verify.py` hash, distinct from the unchanged catalogue identity (which
+hashes original file bytes). Exact codec results are memoized; authentication is
+not cached or bypassed by the harness.
+
+For one column let `T=q^(dimension-column-1)`, and let C(t) count admissible
+candidates with value `<t`. Summing the original `Constraints.excluded` gives:
+
+* already inconsistent: `C(t)=t*T`;
+* pivot exists: `C(t)=t*(T-q^(len(rows)-len(basis)-1))`;
+* no pivot: `C(t)=t*T - [rhs<t]*q^(len(rows)-len(basis))`.
+
+Rank adds C(value) and calls the unchanged `choose`. Unrank finds the first
+endpoint `t` with `C(t)>ordinal`, chooses `t-1`, and subtracts C(t-1). The strict
+upper bound skips zero-count plateaus. Each step checks `0<=ordinal<C(q)`;
+final rank-zero/independence guards are preserved. Thus induction over columns
+and unchanged mixed radices gives the same GL ordinal, not a new codebook.
+Permanent finite-q comparisons enumerate every independent row prefix in
+GL2(3), every candidate next row and every ordinal, including dependent rows,
+invalid endpoints and zero-count plateaus. The actual q127 low matrix also
+round-trips through encode/decode. These tests support, not replace, the formula
+proof.
+
+## Permanent rejection controls
+
+* Valid other replica with original request key; native/common mismatch; stale
+  source identity; foreign Specifications catalogue.
+* Equal-byte but distinct parent Program object, changed event source,
+  width or depth; below-cutoff false recursion from an actual emitted event.
+* Serialized rank, source code, parent/child width, field, root size, root unit
+  and history changes, including the predecessor-shaped `64→2` confusion.
+* Child-reset precision, root-index reset and changed root prime/domain.
+* Doubled child rows; leading substituted for unused with B>1.
+* Missing/doubled external gap, omitted unselected atoms, lost before or suffix.
+* Exact source SHA/Git bindings, mapped closure conflicts, links and extra/missing
+  historical inventory fail closed before imports. Receipt comparison cannot
+  authorize a mathematically rejected edge.
+
+## Reproduce
+
+Python 3.12 standard library only, no new environment files. From repository root:
+
+```sh
+# One explicit maintainer/parent action after inspecting this source:
+python3.12 -I -B research/r437-root-step-handoff/verify.py --write
+# Ordinary registered commands are read-only and compare that receipt:
+python3.12 -I -B research/r437-root-step-handoff/verify.py
+python3.12 -I -O -B research/r437-root-step-handoff/verify.py
+# Generic package integration, after the receipt is committed:
+python3.12 scripts/research_package.py --package research/r437-root-step-handoff
+```
+
+Each registered command is capped at 600 seconds (worker deadline 580 seconds),
+total 1200 seconds. Stdout is deterministic JSON followed by
+`PASS_R437_CONDITIONAL_ROOT_STEP_HANDOFF`. Default replay writes no committed
+files; `--write` stores the actually observed receipt inside TASK.json to keep
+this a five-file package. A timeout/failure is not evidence of success.
+
+The parent executed the `--write` command above and the generic package runner;
+the runner executed both listed normal/optimized commands. Its local replay log
+is `/tmp/imb-astra-carrier-registered.log` (not a committed input or portable
+artifact). The recorded timings are observations, not guaranteed runtime bounds.
+
+## Open next questions
+
+1. **Actual whole-packet producer invariant.** This would turn a conditional cut
+   into a root-reachability result. First connect complete raw-prefix production,
+   preceding routed payload operations and the unused row quotient to this exact
+   SOURCE87 cut. Blocker: the numerical directory/payload is not materialized;
+   symbolic metadata alone is insufficient.
+2. **Separately named sharper-stock entry.** Useful for applying #3246 without
+   silently changing retained admission. First specify a new source-bound root
+   certificate and prove every old local guard. Blocker: old checked_entry's
+   stronger divisor remains unchanged and is not executed here.
+
+The same questions, relevance, first steps and blockers appear in TASK.json.
+
+## Predecessors and attribution
+
+* [Nick Petalas, #3246](https://github.com/CrocSwap/integer-mult-bounds/pull/3246):
+  already-main one-factor stock theorem; `selected-runtime-guard-stock`.
+* [Mihir Srivastava, #4685](https://github.com/CrocSwap/integer-mult-bounds/pull/4685),
+  head `ca336bd72aff54e025a8ddbb1f3c8b756d9b9631`, and
+  [handoff #4682](https://github.com/CrocSwap/integer-mult-bounds/discussions/4682):
+  arithmetic descendant certificate and Program/row boundary request. Citation
+  only, no pending-head runtime dependency.
+* Chris R / Clear1nsight, #4067/#4176 and preparation composition: paid carrier,
+  compiler, numerical admission, historical closure and physical bridge.
+* unpaidmoon, #4147: reverse-row coefficient retained, not rederived.
+* Jose Manuel / jmbarrancoml, #2809; David Arias, #2753: physical/logical callers.
+* Ross Richardson, #2420: stronger dual-format stock distinction;
+  commdata2338, #3223: NODE/peel/row-return refinement.
+* Tekalign: complete spectator geometry; Rohan Arun: pooling;
+  ai-nanachi: R437/OQ4; ywz65 and inherited source/hosting lineage.
+
+The carrier's added ADDs and helper obligations remain charged by predecessor
+contracts; this package reports no paid/scalar saving or change to those costs.