diff --git a/research/qq16-protected-return-caller/README.md b/research/qq16-protected-return-caller/README.md
new file mode 100644
index 0000000000..2e4c95780f
--- /dev/null
+++ b/research/qq16-protected-return-caller/README.md
@@ -0,0 +1,220 @@
+# Protected child returns across the installed QQ16 callers
+
+**A new opt-in D* protocol, compared with frozen #4166 D.** The package composes
+#4167's existing protected-return exchange with the actual QQ16 producer,
+decoder service and Installation inventories. It preserves the original guards
+and controlled cleanup. For a successful complete installed root, the resulting
+read/write/unit-move saving is
+
+```
+T_D - T_D* = 511014 Γ (5v+2, 2v, 4v+2).
+```
+
+Here v is one complete returned child packet, including prefixes, unused rows,
+physical component width, coefficient count and all address spectators. This
+is an exact tape-action difference of matched executions under the inherited
+successful caller contracts. Additional finite validation/rebinding/compilation
+control is **not zero** and is charged separately below. This does not decide
+D* versus the fair baseline B*, execute production O73 payloads, establish
+supplier admission or improve κ.
+
+## The new composition obligation
+
+#4167 already proves the return-site exchange and its `(5n+2,2n,4n+2)` saving;
+those are credited prior results. #4166 already supplies the actual installed
+producer/service connection, all root-call counts and whole-bank publication
+adoption. #4177's exclusion concerns frozen D, and #4753 locates the first
+nonterminal C8 band. None of those credits is counted again as a new gain.
+
+The missing connection is concrete. `Installation.__init__` caches
+`engine_roles=(owned_tapes(service),owned_tapes(native_child))`, and
+`CallerStorage.external_roles` includes those same physical identities.
+`adopt_return` changes the dedicated child's output identity. Merely installing
+that transaction in `ProducerMachine.enter_child` leaves these caches stale.
+The unmodified integrated fixture executes four producer child returns and then
+rejects at the original Installation guard:
+
+```
+active producer and original/service engines have distinct fixed inventories
+```
+
+The nominal native output is now a producer packet, but the old cached native
+inventory still includes it. Removing the guard would conceal the ownership
+problem and would leave controlled disposal using the wrong role partition.
+
+[adapter.py](adapter.py) changes only the two original return expressions
+`transfer(result,self.packet(target)); erase_marker(result)` in each caller's
+`enter_child`, after the original connection factory succeeds. All prepared
+header, PC, target/rank, primitive-boundary, original-C invocation, capsule and
+header disposal, PC increment and observation statements remain the original
+AST. The protected-return transaction itself is the unchanged authenticated
+#4167 method inside #4177's nested source archive.
+
+## Ownership invariant and continuation proof
+
+Write P for producer roles, S for service roles and N for the dedicated original
+C roles. Initially these finite physical inventories are disjoint. Let o be the
+caller's dead target and r the completed protected N output. The existing
+transaction physically clears/erases o, installs r at the same target slot,
+updates `parked` and `parking.roles`, and makes o the new N output.
+
+The new adapter performs the corresponding finite cache update:
+
+- Producer return: `N'=(N−{r})∪{o}`; S is unchanged.
+- Service return: `S'=(S−{o})∪{r}` and `N'=(N−{r})∪{o}`.
+- In both cases `storage.external_roles` is rebuilt from the two current engine
+  tuples followed by the unchanged auxiliary tuple.
+
+Before and after each valid transaction, the adapter checks complete current
+engine membership, uniqueness, mutual disjointness, producer separation, exact
+external-role bindings and the original storage exclusivity guard. Each tuple
+replacement requires exactly one old identity and no new identity already in
+that tuple. These checks inspect finite role tables; they never decode a
+payload length or select a role using numerical data. Fixed and deliberately
+stale variants are comparison/rejection controls; the default is the adopted
+protocol.
+
+The union of all physical roles is unchanged. Public root input/output, parent
+output and the service's public result are not exchanged. Bank selection and
+encoded continuation headers use finite slot numbers, not escaped Tape aliases;
+`packet(target)` resolves the updated role. The complete current bank, descriptors,
+source groups, numerical arenas and allocator order are unchanged. No pointer
+to a protected return may escape this fixed closed composition; arbitrary
+external clients are outside the contract.
+
+After an exchange, the state is the original fixed-copy state under this finite
+role permutation: the target contains the same completed value, the backend
+output is empty with its marker erased, and every authoritative ownership table
+has the corresponding permutation. All other source instructions are equivariant
+under that permutation. The next producer instruction, suspended-parent service
+entry, subsequent original-C run, service extraction, whole-bank publication,
+remaining root suffix and next generation therefore preserve this relation.
+The arithmetic uses exactly the same native objects, calls, payloads and
+allocator histories; none of the separate-engine history cancellations needed
+for D versus B* is asserted here.
+
+`Installation.discard` follows the refreshed engine tuples. On a controlled
+failure after an adopted service return, the actual source cleanup closes the
+service/compiler/storage lifetimes and erases the current owned inventory while
+preserving borrowed payload/descriptors and heads. The fixture checks this
+**before** its own final cleanup. There is no claim about asynchronous
+interruption, arbitrary invalid Tape heads or exception cleanup outside the
+source's controlled contract. No frozen source or guard is edited.
+
+## Complete matched bill
+
+For returned length n and old target length m, #4167's literal source tariff is
+
+```
+fixed transfer: (5n+2m+7, 2n+m, 4n+2m+10),
+old-target clear: (2m+3, m, 2m+4),
+adoption origin checks: (2,0,4).
+```
+
+Each arm erases one marker. Thus the return saving is `(5n+2,2n,4n+2)`,
+independent of m. The new cache checks/updates create no Tape and perform no Tape
+read/write/move. Their control cost remains separately charged. All other
+complete source intervals match under the invariant above, including setup,
+acquisition/compiler/service work, already-adopted whole-bank publication,
+original-C bodies with all their descendants and final cleanup. No generic
+outer parking or internal C8 parking credit is added here.
+
+For arbitrary returned lengths the complete tape saving is the sum of this
+vector over **every** installed producer and service invocation. The inherited
+full source census gives 510678Γ producer calls and 336Γ service calls, including
+493097Γ later producer calls. The checker binds the original/changed histograms,
+entry-plus-later partition and decoder count to the authenticated #4166 receipt;
+#4753's independently reconstructed original histogram agrees. This census is
+inherited evidence, not a newly rerun full production compiler.
+
+For the fixed actual root descriptor, all returned packets have
+
+```
+v = P U · 2H_b c · 2^b,
+b = 3 compact_bits + front + before + width·spacing + after + back.
+```
+
+`Machine.prepare_child` uses rows U and moves the removed active axes into
+`after`, preserving b. The successful exact C contract preserves complete packet
+length, even when the child is nonterminal. `service_descriptors` copies all
+other root descriptors and sets service rows to `U·families·Γ`. Its unchanged
+node quotient therefore recovers exactly U. Its 336Γ child returns have the
+same v. No Γ is inserted inside v a second time. This yields the leading formula
+without assuming a terminal child or discarding later calls.
+
+Let Δ_control be the new total finite compilation, validation and rebinding
+control charge minus the old return-control charge, under a chosen step model.
+The complete **unweighted tape-action plus that control** comparison is
+
+```
+T_D* - T_D = -511014 Γ (11v+4) + Δ_control.
+```
+
+A step improvement requires `Δ_control < 511014Γ(11v+4)`; no unspecified control
+tariff or practical wall-time advantage is claimed. The new algorithm adds no
+physical Tape inventory, but historical backing follows physical tapes and is
+not reclaimed by erasure or role exchange. No memory reduction is asserted.
+
+## Evidence and reproduction
+
+```
+python3.12 -B scripts/research_package.py --package research/qq16-protected-return-caller
+```
+
+[RESULT.json](RESULT.json) records fixed/adopted executions of the original
+nonconstant reduced integrated fixture: two producer/service generations, 24
+real original-C calls, both source bridge legs, all endpoint bytes, preserved
+borrowed inputs/descriptors, dirty scratch retirement and all original factory
+and root-attachment checks. Per generation the actual chronology is four
+producer calls, six service calls, then two later producer calls. Each returned
+packet has 512 bits. The two arms create the same 8,046 record Tapes including
+all fixture/constructor activity. Their complete record-Tape action difference
+is exactly
+
+```
+(reads, writes, moves) = (61488, 24576, 49200)
+                      = 24 · (5·512+2, 2·512, 4·512+2).
+```
+
+This whole-fixture metering is separate from the source proof: it is reduced
+geometry, and its record-Tape census is not called a production all-engine
+measurement. It agrees with every individually metered return interval.
+Controls reproduce the original stale-engine failure, reject a stale external
+inventory and a real output alias, and interrupt after the first adopted
+service return to check controlled disposal before fixture recovery.
+
+All 136 live inputs authenticate before inherited execution. A disposable
+projection restores only the exact historical selected record required by
+#4166 (`bb2eaa...129`, Git blob `b1fea0c...81`), reusing its unchanged retained
+bytes on current main. Other original caller/source files remain byte-identical.
+The original source manifests and authentication still run; the current selected
+record is not changed. Child processes use separate fresh cache namespaces.
+Git-free exports need no Git executable or historical object database. Ordinary
+and optimized registered checks are read-only; only explicit `--write`
+regenerates RESULT.json.
+
+Base: `624de9dc66858af0945e5f8a0942488d62280d43`, priority revision 7. Canonical
+[claim](https://github.com/CrocSwap/integer-mult-bounds/discussions/4744#discussioncomment-19131467).
+Entry overlap covered 299 open PRs, 3,695 Discussion records and all 6,319
+base local notes; scoped searches found no match. Closed arbitrary code and
+unpublished work were not exhaustive. No Lean, Docker, full historical suite,
+production O73/RootLayer execution, hosted CI or human/formal review is claimed.
+
+## Credit
+
+Chris R / Clear1nsight's #4166/#4167/#4172/#4177 provide the caller, exact return
+exchange, tariff and native-history/cost lineage. Tekalign's #3380 provides the
+finite-role exchange idea; Jose Manuel supplies the physical controller and
+original C/Ordinary/Compact operations. Sagar Thakrar, ywz65, Ali Romman, Arham
+Tahir and all retained source notices keep their predecessor attribution.
+New inventory composition, controlled failure test, complete D* versus D bill
+and writing: JoyboyBrian, with substantial OpenAI Codex assistance. Apache-2.0.
+
+## Open next questions
+
+- Price the finite control difference for a specified compiled step model; the
+  tape-action theorem alone does not make that work free.
+- Compare this implemented D* with B* at the first nonterminal C8 band. The new
+  return credit does not price the complete unmatched nonchild/native work.
+- Any all-node use needs a new ownership/installation invariant and supplier
+  bootstrap proof; this contribution modifies only the two outer callers.
diff --git a/research/qq16-protected-return-caller/RESULT.json b/research/qq16-protected-return-caller/RESULT.json
new file mode 100644
index 0000000000..c7fb1a147d
--- /dev/null
+++ b/research/qq16-protected-return-caller/RESULT.json
@@ -0,0 +1,576 @@
+{
+  "cases": {
+    "adopt": {
+      "calls": [
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 1034,
+            "reads": 1031,
+            "writes": 513
+          }
+        }
+      ],
+      "case": "adopt",
+      "final_inventory_exact": true,
+      "fresh_record_tapes": 8046,
+      "record_tape_actions": {
+        "moves": 18068378,
+        "reads": 19276033,
+        "writes": 5541582
+      },
+      "scientific": {
+        "actual_connection_factory_checked": true,
+        "actual_root_layer_attachment_checked": true,
+        "actual_signed_original_C_calls": true,
+        "all_entry_exit_outputs_checked": true,
+        "borrowed_preserved": true,
+        "both_bridge_legs": true,
+        "completed_generations": 2,
+        "complex_values": 64,
+        "dirty_owned_scratch_retired": true,
+        "factory_inventory_rejection_checked": true,
+        "families": 4,
+        "outer_prefixes": 2,
+        "owners": 2,
+        "physical_component_bits": 32,
+        "root_attachment_negative_controls": 6,
+        "same_engine_second_generation_sha256": "7f9e3e9514e1645324e8907a7736f691ded6ea0f6495711fc5ec59c2139a93ae",
+        "scope": "Reduced physical composition; selected O73 proof and production cost remain separate.",
+        "sha256": "fa12c5b1d81bc2d3c7cae2f0fc5e7783276cdef52c230a7f183a3fd911ead99f",
+        "source_preparation": "test oracle only",
+        "status": "PASS_CONTINUOUS_PHYSICAL_CALLER_INSTALLATION"
+      }
+    },
+    "fixed": {
+      "calls": [
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "service",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        },
+        {
+          "bits": 512,
+          "caller": "producer",
+          "return_actions": {
+            "moves": 3084,
+            "reads": 3593,
+            "writes": 1537
+          }
+        }
+      ],
+      "case": "fixed",
+      "final_inventory_exact": true,
+      "fresh_record_tapes": 8046,
+      "record_tape_actions": {
+        "moves": 18117578,
+        "reads": 19337521,
+        "writes": 5566158
+      },
+      "scientific": {
+        "actual_connection_factory_checked": true,
+        "actual_root_layer_attachment_checked": true,
+        "actual_signed_original_C_calls": true,
+        "all_entry_exit_outputs_checked": true,
+        "borrowed_preserved": true,
+        "both_bridge_legs": true,
+        "completed_generations": 2,
+        "complex_values": 64,
+        "dirty_owned_scratch_retired": true,
+        "factory_inventory_rejection_checked": true,
+        "families": 4,
+        "outer_prefixes": 2,
+        "owners": 2,
+        "physical_component_bits": 32,
+        "root_attachment_negative_controls": 6,
+        "same_engine_second_generation_sha256": "7f9e3e9514e1645324e8907a7736f691ded6ea0f6495711fc5ec59c2139a93ae",
+        "scope": "Reduced physical composition; selected O73 proof and production cost remain separate.",
+        "sha256": "fa12c5b1d81bc2d3c7cae2f0fc5e7783276cdef52c230a7f183a3fd911ead99f",
+        "source_preparation": "test oracle only",
+        "status": "PASS_CONTINUOUS_PHYSICAL_CALLER_INSTALLATION"
+      }
+    },
+    "output-alias": {
+      "attempted_callers": [
+        "producer",
+        "producer",
+        "producer",
+        "producer"
+      ],
+      "case": "output-alias",
+      "cleanup_observations": [],
+      "completed_returns": 4,
+      "original_fixture_cleanup_check": true,
+      "rejected": "exclusive physical caller/native/wrapper inventory"
+    },
+    "service-stop": {
+      "attempted_callers": [
+        "producer",
+        "producer",
+        "producer",
+        "producer",
+        "service"
+      ],
+      "case": "service-stop",
+      "cleanup_observations": [
+        "checked before fixture finally"
+      ],
+      "completed_returns": 5,
+      "original_fixture_cleanup_check": false,
+      "rejected": "deliberate stop after adopted service return"
+    },
+    "stale-engines": {
+      "attempted_callers": [
+        "producer",
+        "producer",
+        "producer",
+        "producer"
+      ],
+      "case": "stale-engines",
+      "cleanup_observations": [],
+      "completed_returns": 4,
+      "original_fixture_cleanup_check": false,
+      "rejected": "active producer and original/service engines have distinct fixed inventories"
+    },
+    "stale-external": {
+      "attempted_callers": [
+        "producer"
+      ],
+      "case": "stale-external",
+      "cleanup_observations": [],
+      "completed_returns": 0,
+      "original_fixture_cleanup_check": false,
+      "rejected": "current complete external inventory"
+    }
+  },
+  "finite_matched_saving_RWM": {
+    "moves": 49200,
+    "reads": 61488,
+    "writes": 24576
+  },
+  "finite_rebinding_control": "separate signed charge; no zero-cost role-swap assumption",
+  "live_inputs": 136,
+  "scope": "Installed D* versus frozen D only; no full comparison with B*, numerical supplier admission or new kappa.",
+  "source_protocol_census": {
+    "complete_per_Gamma": 511014,
+    "later_producer_per_Gamma": 493097,
+    "producer_per_Gamma": 510678,
+    "service_per_Gamma": 336
+  },
+  "status": "PASS_QQ16_PROTECTED_RETURN_CALLER",
+  "whole_root_saving_RWM": [
+    "511014*Gamma*(5*v+2)",
+    "511014*Gamma*(2*v)",
+    "511014*Gamma*(4*v+2)"
+  ]
+}
diff --git a/research/qq16-protected-return-caller/SOURCES.json b/research/qq16-protected-return-caller/SOURCES.json
new file mode 100644
index 0000000000..9f76f7ff2b
--- /dev/null
+++ b/research/qq16-protected-return-caller/SOURCES.json
@@ -0,0 +1,834 @@
+{
+  "schema_version": 1,
+  "base_commit": "624de9dc66858af0945e5f8a0942488d62280d43",
+  "files": [
+    {
+      "path": "certificates/selected-result.json",
+      "usage": "provenance",
+      "git_blob": "c35482cd9035843b15a634cc8276a7e1e40e8395",
+      "sha256": "6fe0a099b89aa2aed796a13c3a21dafc63f3388ebf397464e44e0451893b9375"
+    },
+    {
+      "path": "docs/research/agent-task-catalog.json",
+      "usage": "provenance",
+      "git_blob": "f126dd2e2dad2b669e75d1d0d0bd05c600725602",
+      "sha256": "f7a48bfa2659b88378282a8eee7d9fe52cdf505594124c4d1686b58510fffd72"
+    },
+    {
+      "path": "notes/batched-complex-rows.tex",
+      "usage": "input",
+      "git_blob": "e13bd96eb29bdc6526f10dc32e0a146bc17848a4",
+      "sha256": "64c70926a8705874f1c9b42a2f703e42cad4e90f927f544458cfdf729540236c"
+    },
+    {
+      "path": "notes/compact-control-layout.tex",
+      "usage": "input",
+      "git_blob": "16f4d233471a7d189163ae7e7902becadecbba64",
+      "sha256": "2bc28e50f3eb092195294cafa81213e520f6d42e7935e9905ad8a6199e2a7c87"
+    },
+    {
+      "path": "notes/compact-control-movement.tex",
+      "usage": "input",
+      "git_blob": "06b6a9ef24245ac7b724c53a204635415b402357",
+      "sha256": "b963c3d2f4e1b7059aa289bb4b4ac89b688920bcf42f5b20d7698cdef0132cc6"
+    },
+    {
+      "path": "research/bit2234-stock-threshold/README.md",
+      "usage": "input",
+      "git_blob": "ede0d322c477af91d4c2cc33db0fd10958f45eab",
+      "sha256": "1e050c9f963421d751d9208092f9a15321ed77810e03912df8eb5eb56bbb06e7"
+    },
+    {
+      "path": "research/community-frontier1042-audit/selected-replay.tar.gz",
+      "usage": "input",
+      "git_blob": "6f4dc6fe7631d8aacf8081fcaecf32197181685b",
+      "sha256": "22c3f4dce4b897a1d423d1388801933e288b6a6b1906cb15e1b16a5eb68db754"
+    },
+    {
+      "path": "research/community-frontier1094-audit/selected-replay.tar.gz",
+      "usage": "input",
+      "git_blob": "c24daf067f9c543421d89ca2eeaa4eb78a57fb6f",
+      "sha256": "f1da80610bf33c58527f18ad63b4350d0b864e1d4486141ee17ac9bed4d529d6"
+    },
+    {
+      "path": "research/community-hyperplane599-audit/pr589/bit589/v9/hosted/GLOBAL-TEMPLATE.json.gz",
+      "usage": "input",
+      "git_blob": "9eafb8776cbf78c72124f833534469ddfa5e98ec",
+      "sha256": "0357b7cfbd7c29b4983982baf153c8a9f1e1e412690cd7fa9fc3d23d7963b20f"
+    },
+    {
+      "path": "research/community-hyperplane599-audit/pr589/bit589/v9/nine/GEOMETRY.json",
+      "usage": "input",
+      "git_blob": "44006542202ca6037533a754f0bcd00549d7e088",
+      "sha256": "0058c491d839142aa99ef86a5ec697ce99857632228531512ea3fa74fb24d734"
+    },
+    {
+      "path": "research/complex-grid-prefix-audit/PROOF.md",
+      "usage": "input",
+      "git_blob": "30f019e14866200660cbd2ad82f3bff707003210",
+      "sha256": "9c2473e080a64de5139abf66680534043143ec9f4488ceabf62403702047a3ad"
+    },
+    {
+      "path": "research/e8-bit-p111-tuned/tune/EXPECTED.json",
+      "usage": "input",
+      "git_blob": "e293ddc557742637f9f679f083a1a282d87b1b13",
+      "sha256": "b9f0e5ca038abe837b0007c8fe006f366a6f02009244ac57705a8a200e2301f4"
+    },
+    {
+      "path": "research/e8-bit-p111-tuned/tune/bitE8mut-p111-tuned.json.gz",
+      "usage": "input",
+      "git_blob": "85a4499bf9e4911a705d50567a2c2ef6cf23739a",
+      "sha256": "e3e301e62bc2b41dbf1ceac0acf3d35824ebeab1848c5a2142d4577b109da52f"
+    },
+    {
+      "path": "research/gaussian-normalization-stream/SOURCES.json",
+      "usage": "input",
+      "git_blob": "58fce750dc2814f36ac096b407dd28293539bf8f",
+      "sha256": "c434302f4489366c1763f918ba59e2f57efc0a41d72310fd3c6bbe1553370275"
+    },
+    {
+      "path": "research/gaussian-normalization-stream/normalizer.py",
+      "usage": "input",
+      "git_blob": "5d1a0961ace6b7edccb26c05780623c5509a7597",
+      "sha256": "2b0acaa831219faf3e7776969bdcffc3f0f9c608b15d6b4c343ff20cf6a50107"
+    },
+    {
+      "path": "research/gaussian-parity-synthesis/REVIEW.md",
+      "usage": "input",
+      "git_blob": "0a6a4c7c1e8bef9c9aa9c7fb636e5ad6c0c411ae",
+      "sha256": "7d7b9ac63ccd2927f592e9edac1b4c11d58a6c74c5813d488e112f729090f60c"
+    },
+    {
+      "path": "research/gaussian-parity/gaussian-parity-certificates.tex",
+      "usage": "input",
+      "git_blob": "e364cff719a12a5dfd52f2975cd07cc0318da511",
+      "sha256": "e21e1063141cbc798e73052e22d01eec57f1c173a580041e55aa196b1b0479f8"
+    },
+    {
+      "path": "research/joint-query/certificate.json.gz",
+      "usage": "input",
+      "git_blob": "c6e876d8b48d768214deee265ade428f8983b566",
+      "sha256": "a5ed85fac5ebf3c091482a113ab0d351eb5a7892fe2841a35e16017ec1ff49f7"
+    },
+    {
+      "path": "research/joint-query/evidence/BRIDGE-REVIEW.md",
+      "usage": "input",
+      "git_blob": "86139908c418235588045324f0873de6ac9f9707",
+      "sha256": "d01b5f4959f7c91f835496d050dfae3eeab9dee2f581571c316a42571eaa1cd3"
+    },
+    {
+      "path": "research/joint-query/evidence/JOINT-QUERY-TRANSFER.md",
+      "usage": "input",
+      "git_blob": "a6805c58f23132f9420efebf90f5b7e863c2e179",
+      "sha256": "9e13e73ebf3192a6548798c2f1d13bd4d83957e8db0dc34de12b1a5311a52a75"
+    },
+    {
+      "path": "research/joint-query/source_data.py",
+      "usage": "input",
+      "git_blob": "c9d465ed47500304bef65fcb588befe356c5cf09",
+      "sha256": "d23924511e3aed41e5e64511ca70126a636d91c8aa02e656cb61d6ceca1fe0a0"
+    },
+    {
+      "path": "research/joint-query/verify_native.py",
+      "usage": "input",
+      "git_blob": "ede9e7e42744dd0c96790516a9acdfe07d180018",
+      "sha256": "1c58e7b6e8e1cde4df455c2129601c145ed763fc63a3ab427eb1058d1fc08bd2"
+    },
+    {
+      "path": "research/joint-query/verify_scalar.py",
+      "usage": "input",
+      "git_blob": "7a7051fa8a70f48589fa1fccd5c38fccb5eacbf7",
+      "sha256": "33bdbad17a0531fe527aff306eb235d9c38c1629db4fd167b989725930b0327a"
+    },
+    {
+      "path": "research/p104-whole-word-internal-grid/README.md",
+      "usage": "input",
+      "git_blob": "4075bb303592ccc53cd7d29399f15ff01c89da5d",
+      "sha256": "d98c0b0a4835d766852e960299dd87112375990ed645d2c9e84edb08b79500e4"
+    },
+    {
+      "path": "research/physical-complex-controller/PROOF.md",
+      "usage": "input",
+      "git_blob": "c505caecc7ced19a4efc35c423efedda9427bea5",
+      "sha256": "471185621c0ecce295ffd327b1244aed234efe5ff05a804aaaa11316f1a8319e"
+    },
+    {
+      "path": "research/physical-complex-controller/SOURCES.json",
+      "usage": "input",
+      "git_blob": "a56a247ecb28c77fcb055fac031be471b291777d",
+      "sha256": "c9c47d9df2445fc554673316d42f68f0a1b800ea3593ac568835c9b063025eb4"
+    },
+    {
+      "path": "research/physical-complex-controller/bank_packets.py",
+      "usage": "input",
+      "git_blob": "defda707199e8eba83ee483daf5ae7acb642c43c",
+      "sha256": "83e2f80fb72c906ccc7857f2b5139758ca8a997b17f51a5db29e2bb3c1143477"
+    },
+    {
+      "path": "research/physical-complex-controller/cohort.py",
+      "usage": "input",
+      "git_blob": "3876ab737f3c2a90100749e4ba141f1923caff79",
+      "sha256": "8fb650c0cc3dfaad94811149b0c0e725777a8cff195c5f21e21a7576494e84f1"
+    },
+    {
+      "path": "research/physical-complex-controller/cover.py",
+      "usage": "input",
+      "git_blob": "2b9b9df832a747bcb02505d5495f79d38deffa43",
+      "sha256": "d797daec10275f439f6019c596b89afbc32a7716cb657648adfcaae2408949da"
+    },
+    {
+      "path": "research/physical-complex-controller/fixture_binding.py",
+      "usage": "input",
+      "git_blob": "447ddc84d7dd9905c767c91acc7467a495093475",
+      "sha256": "efcb94cf050412ccd2d5eea592d77f294f6124f6feebc86580b16a73e5c2c202"
+    },
+    {
+      "path": "research/physical-complex-controller/grid_boundary.py",
+      "usage": "input",
+      "git_blob": "387576fc2f0701709237430febed7ea5b730828b",
+      "sha256": "55f32b8cfaa3482d5d62127ac90c2370fc0dc8122263815e1564ee95093ffccc"
+    },
+    {
+      "path": "research/physical-complex-controller/machine.py",
+      "usage": "input",
+      "git_blob": "92f9467ffd3346d672a0e2c56f2508e33ed21689",
+      "sha256": "b648792a361fdf98597a2f56c634767508be8e818b82e482fbfc60b5c63cc855"
+    },
+    {
+      "path": "research/physical-complex-controller/monomial_packets.py",
+      "usage": "input",
+      "git_blob": "5b4eaf49b3847cafa7bd99e7147c8818b248a021",
+      "sha256": "6856e80c13ebf3b6e9e0e142ed65420579b5a1b4892f23859d3c6e5f17a334b4"
+    },
+    {
+      "path": "research/physical-complex-controller/native_program.py",
+      "usage": "input",
+      "git_blob": "7d1c54c7d1394de28585d48b1a703d4b00069e98",
+      "sha256": "177d87445659d7ddbef11370d0b4cdc0596732147ed26c1fa11bad16ae53c93b"
+    },
+    {
+      "path": "research/physical-complex-controller/parking.py",
+      "usage": "input",
+      "git_blob": "34bc6a0bd0daade7ccc69d0c236984f024d22ef4",
+      "sha256": "33e6d2a6fcdc648de31b374132bf885259eec9748bafa6facca3822a78427e94"
+    },
+    {
+      "path": "research/physical-complex-controller/root_layer.py",
+      "usage": "input",
+      "git_blob": "389efd17af0f8d68711f0e7c6d8b6be65421e846",
+      "sha256": "247b82feefecedc12142379fd7c9c6cdd5ac7e5309e443c4b4fa703d6b995c21"
+    },
+    {
+      "path": "research/physical-complex-controller/root_plan.py",
+      "usage": "input",
+      "git_blob": "78390164c3551bfcce8da6b0f23197a4048a7e5e",
+      "sha256": "494cad3edc376928684f380cd16568076b286a53bd763d910d49efa5b03f07c9"
+    },
+    {
+      "path": "research/physical-complex-controller/root_streams.py",
+      "usage": "input",
+      "git_blob": "213144a6c905ac5dfbec9aaadc43f14eb4b1044d",
+      "sha256": "b67daf3de591b6788220a016b0394cfe2cc8e94ffd41426bb2544ad578b715c8"
+    },
+    {
+      "path": "research/physical-complex-controller/scalar_packets.py",
+      "usage": "input",
+      "git_blob": "66ea778399423005695bdea1e43ef9dcde903402",
+      "sha256": "cc48f726325c000ab2304eb691feb950ff4abeab5c537d6165d5b3322dc45c35"
+    },
+    {
+      "path": "research/physical-complex-controller/scalar_program.py",
+      "usage": "input",
+      "git_blob": "30ba678c7b828285d549e923b34e315e439b8452",
+      "sha256": "4c005167b4c2fe0d98d2dd93b7f931b251259417ff4392b67ee0fbe290f6d48a"
+    },
+    {
+      "path": "research/physical-complex-controller/selected_binding.py",
+      "usage": "input",
+      "git_blob": "5fe097ff688f5304a45945054e9d4a4af05f13d8",
+      "sha256": "d6583458d00e4933c3a3fd83cc376f21c059e9fc6aa338c00d66c1deeaa0e985"
+    },
+    {
+      "path": "research/physical-complex-controller/selected_source.py",
+      "usage": "input",
+      "git_blob": "6bdc133472e85d2230d59c91813390b3547caf8d",
+      "sha256": "02601c9e7d88e58e62d63509ff709c6498a40fbbc0f95fab328379ae6acaa87a"
+    },
+    {
+      "path": "research/physical-gaussian-leaf/PROOF.md",
+      "usage": "input",
+      "git_blob": "e98db470cdb8bfc49e9da86c39c0d6ae16e92716",
+      "sha256": "29ebd43146f921077f980a408915ecc3a5199a07fcdadc624a8282c06b0b8104"
+    },
+    {
+      "path": "research/physical-gaussian-leaf/SOURCES.json",
+      "usage": "input",
+      "git_blob": "2ae5d4a9bd2b62bf21fee81106fa9e38bbd84bd0",
+      "sha256": "c693fc79212652d7427560189ad8eb5e841fe71325e6d7a0d61e05f97438a5e1"
+    },
+    {
+      "path": "research/physical-gaussian-leaf/axis_stream.py",
+      "usage": "input",
+      "git_blob": "ba8230443fdb0370b72a7a617ba7d88eb23a9c37",
+      "sha256": "40dea1c6fa41effd8e7a61f39a3a599e897370ca118e332ee5301a905dbb2998"
+    },
+    {
+      "path": "research/physical-gaussian-leaf/coefficient_engine.py",
+      "usage": "input",
+      "git_blob": "dff2f099b60c23310a10665cd81e443282b249e8",
+      "sha256": "fff28cbc27b95ed546ac65f70279fa41a933421f1cd32b988ae8910632f0efcf"
+    },
+    {
+      "path": "research/physical-gaussian-leaf/inputs/pr3087.tar",
+      "usage": "input",
+      "git_blob": "6daedf70a927fa1359caec68d56fc0cbdaeb54dd",
+      "sha256": "d7e9c04a5e6d3f76158555d84080786c7cd8028ca31a61c9399de2b2c67bfd53"
+    },
+    {
+      "path": "research/physical-gaussian-leaf/leaf_sources.py",
+      "usage": "input",
+      "git_blob": "31c33dbed6061ca7c0455a9170fd05fb388f4607",
+      "sha256": "e0f958a0169257ba08eac5e025a3fc7ce99009efc18974cdd231f16758004014"
+    },
+    {
+      "path": "research/physical-gaussian-leaf/signed_linear.py",
+      "usage": "input",
+      "git_blob": "d17018a976ea4af15b6b5828a091d799435bacfc",
+      "sha256": "5b86afc33042e1c43eaa6957f94e0ebf403d1b07bb26d30ba89aa14d71f76078"
+    },
+    {
+      "path": "research/physical-scalar-stream/scalar_engine.py",
+      "usage": "input",
+      "git_blob": "aea19253f6a772047f22d2f0e1927b9bf319aba9",
+      "sha256": "be74c74862ff2b152d3752cb887c6682ddf2d889bc9f16f6328e418618e4c8b6"
+    },
+    {
+      "path": "research/physical-scalar-stream/scalar_words.py",
+      "usage": "input",
+      "git_blob": "36919dc569678656a1696f23454cba2d1fb0f393",
+      "sha256": "f4293c5ea5a7b65be920997f2ff33ce046ae3d9707ecbcecb3bd163d821dfd00"
+    },
+    {
+      "path": "research/pr589-five-helper-hosting/PROOF.md",
+      "usage": "input",
+      "git_blob": "bbd3f12b9a32b3ad3cba85a2d5a1b3054214fa02",
+      "sha256": "59cae781bfbe1a01ed9e66a8efeeb5a2b995e5ecdf908586b23ecc39f2b8d647"
+    },
+    {
+      "path": "research/pr589-five-helper-hosting/verify.py",
+      "usage": "input",
+      "git_blob": "dbc71f56bb4205ebe378ada1f9f4ea88630d1d39",
+      "sha256": "cf90e19ae9991b0698be03d395a8cc29061ecb307eb7fea19adfb2d23c25a367"
+    },
+    {
+      "path": "research/qq16-all-depth-producer-grid/PROOF.md",
+      "usage": "input",
+      "git_blob": "9cf1ec57646fb760fd26f206d754e52c99c347e3",
+      "sha256": "6dd878aa01807eecf4a37f7ce3fbc1105d79f6b1b06791b23d4deeef90b7d994"
+    },
+    {
+      "path": "research/qq16-caller-install/ADMISSION.json",
+      "usage": "input",
+      "git_blob": "804c010ce80fd9caa80ba2a2436aa39d630324db",
+      "sha256": "fef2407cc8cc081bfd5e5fa9dbee23d1d119b2b59b6fad0b3484593cdcfb0187"
+    },
+    {
+      "path": "research/qq16-caller-install/BILL.json",
+      "usage": "input",
+      "git_blob": "674b8493d82accb134de4884b7e6fa63c7d265db",
+      "sha256": "ccc10df473fb4bf7c2aa0b9e5c0ad01bf029ae9d2102dc1caa48ca59eb8e46a6"
+    },
+    {
+      "path": "research/qq16-caller-install/COMPILATION.json",
+      "usage": "input",
+      "git_blob": "a9f8017f06f7c9517b090f7d02bf408138ecb28e",
+      "sha256": "eda249c33de0924c3bff99a2ae2b0f137990808a904cb3c46d36399ea49703ed"
+    },
+    {
+      "path": "research/qq16-caller-install/CONTINUATION.md",
+      "usage": "input",
+      "git_blob": "c3d5959ec2815abd31f1f885712340caafcaa26b",
+      "sha256": "a2d928d14fcff9b16d4e88dd60237fd13b93fcf21d4996d7d98eeacd834e9867"
+    },
+    {
+      "path": "research/qq16-caller-install/COST.md",
+      "usage": "input",
+      "git_blob": "122f19d101be401800e9819f1d8fd3e7983e699b",
+      "sha256": "cf6d68babc70ac268f02fe53f3abfa5172b5204dbef692a94c4942a65bfc5b40"
+    },
+    {
+      "path": "research/qq16-caller-install/DECODER.md",
+      "usage": "input",
+      "git_blob": "2961fd8d8a2a98d4195167f82aad5249c698727d",
+      "sha256": "3bef6d83596ce8d90ea1d9f2da9ab081287f498b27e34cf56e7a46be643e56d9"
+    },
+    {
+      "path": "research/qq16-caller-install/EXECUTION.json",
+      "usage": "input",
+      "git_blob": "72e5c299de44b795057363c5ea4f6386ec57a1aa",
+      "sha256": "2d49db217eefa8e55f56476b90b9132ceddcb2986691b7aa20a8c555b725f0c8"
+    },
+    {
+      "path": "research/qq16-caller-install/LIFECYCLE.md",
+      "usage": "input",
+      "git_blob": "ed1e42e347eab6d74ee654f38a381bb835577049",
+      "sha256": "881153d57505325456c91bf8c5a3eca2980b634f792217d18e8a07130c8c08dd"
+    },
+    {
+      "path": "research/qq16-caller-install/PACKET.md",
+      "usage": "input",
+      "git_blob": "3e3142d427f48d4e7de3015ed65c4896658590ab",
+      "sha256": "dab89829f5553d945866219c2f668cec6a71a8f694effbe9ac0e3e091ee3e99b"
+    },
+    {
+      "path": "research/qq16-caller-install/PREDECESSORS.json",
+      "usage": "input",
+      "git_blob": "4eef989ff4beb190b0cf6aaab4d0459afc572c42",
+      "sha256": "57440a9f5cae02f123b38ad68e43928b694e7ca4e6569098c7904d7fe846b0c4"
+    },
+    {
+      "path": "research/qq16-caller-install/PRODUCER.md",
+      "usage": "input",
+      "git_blob": "c22aa5ac997d4097a164cad39a15592be77ff608",
+      "sha256": "49b360232f422e299a17cf908f1a39d44847dbe1cd11ec2e5f8533f60829ba70"
+    },
+    {
+      "path": "research/qq16-caller-install/PROOF.md",
+      "usage": "input",
+      "git_blob": "a19beac6fc3b56625dc4caf684d47c7c28f23e7e",
+      "sha256": "fde109910f348266a4781239d9b673e27ed335a33549d29a1914fa485855f158"
+    },
+    {
+      "path": "research/qq16-caller-install/README.md",
+      "usage": "input",
+      "git_blob": "d1d42d5e494f22a9db6da8ae4539d9edf2165334",
+      "sha256": "b781f1cd3ff625c5cf1264f8cf61f9b4413ea3516e35b3984d816bbf45b25fdc"
+    },
+    {
+      "path": "research/qq16-caller-install/RESULT.json",
+      "usage": "input",
+      "git_blob": "94f0c6dc816f5280bb2d06414e6c0f2cb9a8deb0",
+      "sha256": "08e59d781a60aa0eb49bc86cb819111ad4e0ccf9ce9807d8fb09fa12884c7925"
+    },
+    {
+      "path": "research/qq16-caller-install/REUSE.json",
+      "usage": "input",
+      "git_blob": "7439823c3c52f7244e87c5fbd8b13dd19875b2f4",
+      "sha256": "3c1954483d8f8769335ac81cbc87ec9fdf9956b0ffac6bd82b5d999e77ce5f8d"
+    },
+    {
+      "path": "research/qq16-caller-install/REVIEW.json",
+      "usage": "input",
+      "git_blob": "23bea95cf478b0477da6dade0a38a613118732c9",
+      "sha256": "d6f3d15890224125ec40849d88601d00f993458335db3e60081bd97e2e739950"
+    },
+    {
+      "path": "research/qq16-caller-install/SOURCES.json",
+      "usage": "input",
+      "git_blob": "54df1264ecc0f082c595f7670bfac9e3505a6450",
+      "sha256": "3ba36d49185c81691dc8c5a87f3f80a0540579bfd8b97658a52037aaa62274a6"
+    },
+    {
+      "path": "research/qq16-caller-install/TASK.json",
+      "usage": "input",
+      "git_blob": "4a960f18037f3e8fd956fca8011f4ebe55fa5f6a",
+      "sha256": "59884e2b7ac9d8c26e01807eae431e4e47fe9b2f8206678c81a8d06e91fe6848"
+    },
+    {
+      "path": "research/qq16-caller-install/VERIFY.json",
+      "usage": "input",
+      "git_blob": "fa219dde4e9b43f7a95b06ed151ce7c5092e6214",
+      "sha256": "b3d0eb4cfff3b0a885d6b4bb7b11aa961f57526dee4e3b7ae0e25d3e1164d839"
+    },
+    {
+      "path": "research/qq16-caller-install/auth.py",
+      "usage": "input",
+      "git_blob": "b49b3a87709a05659a44afc85216a53fb0ee8d63",
+      "sha256": "98cd015d9b6c9501f36a305b58f9bef88b904b9d6bbd921e0a6ecd351b960a79"
+    },
+    {
+      "path": "research/qq16-caller-install/connection.py",
+      "usage": "input",
+      "git_blob": "8d010eeece6622ea7dfbf1462ecd4ae1b0702c61",
+      "sha256": "3da2ac158a6f36a568d0873cbb45f230ba8fa609cf8092bfbd55da83bae498c2"
+    },
+    {
+      "path": "research/qq16-caller-install/continuation.py",
+      "usage": "input",
+      "git_blob": "0639356935a69610c3ab1c79e96d56887ce711b8",
+      "sha256": "9fa2de5d79768b4130f81a74f29f388ffc28c990512a9fa22921ec2d75401aca"
+    },
+    {
+      "path": "research/qq16-caller-install/cost.py",
+      "usage": "input",
+      "git_blob": "01da5024495a16a8ad6cfb5be2dcd7ac0a36fdd6",
+      "sha256": "935b23fee0abdce52279820febce93d23a2095f347ddf0da4fbd424995b99842"
+    },
+    {
+      "path": "research/qq16-caller-install/decoder-fixture.py",
+      "usage": "input",
+      "git_blob": "c6829e39be76da90c695162afa00dffd89e64db0",
+      "sha256": "b09b2751fccc37e3c2c864ce89aa13bbdc6bfba3296bbb816b9636ff1fbffea4"
+    },
+    {
+      "path": "research/qq16-caller-install/decoder.py",
+      "usage": "input",
+      "git_blob": "edc8bdbd22083b7d9f8648fef1c12460572c6885",
+      "sha256": "e169a8b160bfa89dd22bc618df1ed947ebe668e82bca1014c70781ff9dcf75ce"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR3055-PROOF.md",
+      "usage": "input",
+      "git_blob": "f65f38123ca0adb02f6ca69351cbfc933506e5cb",
+      "sha256": "ec6395822ae500242f3fe5e2cf40caf9a7f9fa259d475d2c14970d951ff4df48"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR3380-PROOF.md",
+      "usage": "input",
+      "git_blob": "d32e60ad65aee0b2a1663d5d739e78c3bf03009a",
+      "sha256": "c208f16c93be22795b9b01a5a1702a446541163ebf823251b12a891597077826"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR3464-PROOF.md",
+      "usage": "input",
+      "git_blob": "1e241b1e9e46a5d41bd29d4413e326104407adc2",
+      "sha256": "b3c41ea0f812315a7bab877edecc911e6dffb5b596f4135a39c3d5b99aae14c5"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR3464-bank_packets.py",
+      "usage": "input",
+      "git_blob": "defda707199e8eba83ee483daf5ae7acb642c43c",
+      "sha256": "83e2f80fb72c906ccc7857f2b5139758ca8a997b17f51a5db29e2bb3c1143477"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR3464-machine.py",
+      "usage": "input",
+      "git_blob": "92f9467ffd3346d672a0e2c56f2508e33ed21689",
+      "sha256": "b648792a361fdf98597a2f56c634767508be8e818b82e482fbfc60b5c63cc855"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR3464-parking.py",
+      "usage": "input",
+      "git_blob": "34bc6a0bd0daade7ccc69d0c236984f024d22ef4",
+      "sha256": "33e6d2a6fcdc648de31b374132bf885259eec9748bafa6facca3822a78427e94"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR3464-selected_binding.py",
+      "usage": "input",
+      "git_blob": "5fe097ff688f5304a45945054e9d4a4af05f13d8",
+      "sha256": "d6583458d00e4933c3a3fd83cc376f21c059e9fc6aa338c00d66c1deeaa0e985"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR3607-PROOF.md",
+      "usage": "input",
+      "git_blob": "158cd78492161aeab75ba09f050a8e5d1a91ef71",
+      "sha256": "fab92623c04ff43868c1cf787b0fbdf619e81301a83f6272f6d33cadf6c42f9d"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR3619-PROOF.md",
+      "usage": "input",
+      "git_blob": "afaff74d38945d26d02f4fc8e9884b4f811d8249",
+      "sha256": "88edbc9718c00302c0aae2036a32e4d9f534090a9754eb7d267707e637971cbb"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR3993-PROOF.md",
+      "usage": "input",
+      "git_blob": "51e4fade5fdcec75be981d0be77d3f8ab2aced53",
+      "sha256": "18a0b88a25817aee02356fc8156ecfb6f175a3689dc16b2eb31e23ad4bdf83e9"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4106-WORD.json",
+      "usage": "input",
+      "git_blob": "6c6f726cd14010f9763155518f833862eb167263",
+      "sha256": "b4f2b5662734178d02a5d620ebd071bc284abd4d9b6dbe11b5d9646455a0f021"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4114-README.md",
+      "usage": "input",
+      "git_blob": "cc4743dd9d56f0facc6e63f7a67b1b03f9cf37f5",
+      "sha256": "734d8d3578be00e6899bd500b91f0fe992e13d3921faebc9fc2400d32e208bd6"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4129-COST.md",
+      "usage": "input",
+      "git_blob": "989da4b71d9f3c8bb43b7e2f975c1d9c7f590a54",
+      "sha256": "05699f427530cc0417e28bd1c3a94b018ffdd0d5c4bc9f4261d49a557e293d9b"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4129-NATIVE.md",
+      "usage": "input",
+      "git_blob": "c0133ac0e758b3ab8ebf053811910404a2e74f24",
+      "sha256": "567e4d12ac7d57f5916d7ecc24c77cd351ce3fcc966acf8348d7288ee9801b03"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4129-PREDECESSORS.json",
+      "usage": "input",
+      "git_blob": "e7e6b6130fea5737b24f24fa668d1d3202a02ed4",
+      "sha256": "209170a530f2ec5897edb102c029863bada01409fb2f838132a94127ff768315"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4129-PROOF.md",
+      "usage": "input",
+      "git_blob": "5de56af0213bf710ae3e832f21de74cf0ac9c7b0",
+      "sha256": "b547277ab5380b218893908a3e8e8874efc0cf3f9717b582f8972698d87418a2"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4129-README.md",
+      "usage": "input",
+      "git_blob": "71858dcddef078456016716c05d7e310eee77bcc",
+      "sha256": "fd47f198b534ae0b9a1d1896614100c56145dc5004650de6c9d4b27a8cba219a"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4129-RESULT.json",
+      "usage": "input",
+      "git_blob": "af630ea7b9fcfab3e399191437405332d5067e03",
+      "sha256": "7dd05d54817202d86de77b550b0e68517756eb8ec71d3b591ebde0cb4e9e2389"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4129-SOURCES.json",
+      "usage": "input",
+      "git_blob": "e7121d9892727c96dcb7c9bbe92d32b1e0596cc5",
+      "sha256": "d4b3343f6f6b1d08a2879df693e6d2ab89246615f20fb978a4e9cbfd5ee2e26d"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4129-TASK.json",
+      "usage": "input",
+      "git_blob": "e031101d7f1bf6344b273912d896145f4ce57599",
+      "sha256": "73729ec6260d118bd0a73fd89576f2c33aff772d4a932bb56330ac42fdb326d3"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4129-bridge.py",
+      "usage": "input",
+      "git_blob": "4d5d99ee8f1da0eaa941e7040be8cefafb984e1f",
+      "sha256": "120cd3a2d0deb44b9c059636b1ac9bdd8a6b998143718f4252794780edf7decb"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4129-construction.py",
+      "usage": "input",
+      "git_blob": "79573076c53126618c125c9ad4d21c06ee70a8ba",
+      "sha256": "bbfb0014e8636ab4f66ff925189fd523fd4e8e377aec51509f4f3fe6877c3007"
+    },
+    {
+      "path": "research/qq16-caller-install/installer.py",
+      "usage": "input",
+      "git_blob": "fdb932baa00482d61b4ab48ca1413dd45ba319a3",
+      "sha256": "6af289c0b21c11dad7efaa2f7373ad0f61a3d1d6975bcfb5d1560320373260df"
+    },
+    {
+      "path": "research/qq16-caller-install/integrated-fixture.py",
+      "usage": "input",
+      "git_blob": "871a21846e5b0479ba22f5b63c912990322442e3",
+      "sha256": "e4f8bcc947e761ca4f1efb825794210dfd56ca79e049a5207fbfad26ee7e71ae"
+    },
+    {
+      "path": "research/qq16-caller-install/lifecycle.py",
+      "usage": "input",
+      "git_blob": "56c16368013ba2ba212890325f34039326040747",
+      "sha256": "2eadca77717ee28c24dd6ff175a115277a83d852c56d320cc93937cab27e5191"
+    },
+    {
+      "path": "research/qq16-caller-install/packet.py",
+      "usage": "input",
+      "git_blob": "9b965f8f639e1deafdd6f0c4b2f078bb47d368c2",
+      "sha256": "d8f4e63feae1ed372951ba5643dadf02e2af006bf3632d29137e92d05067234e"
+    },
+    {
+      "path": "research/qq16-caller-install/physical.py",
+      "usage": "input",
+      "git_blob": "79a8a5b82e7b775e3c069a6cc07ef07406213118",
+      "sha256": "d37813bcfbdd95f2e1b756d6f978ba2fdd4ec2b82212f2b7b228cb3422ee9b0a"
+    },
+    {
+      "path": "research/qq16-caller-install/producer-fixture.py",
+      "usage": "input",
+      "git_blob": "84e4552c75b4d58035306cd3bcfdaa44409fa50d",
+      "sha256": "4744a12cc9c015f6cfa6bddff6886f2eb163fec4ff2e3e07556cb37152c2ebf3"
+    },
+    {
+      "path": "research/qq16-caller-install/producer.py",
+      "usage": "input",
+      "git_blob": "7abf64aba3e6813afe26f68b9cbb09e1d9cb181d",
+      "sha256": "69a7cc6c9545a0d8684a529d6365345c337276f9c8faaf2dcdb0923ca72c396d"
+    },
+    {
+      "path": "research/qq16-caller-install/runtime.py",
+      "usage": "input",
+      "git_blob": "c037424904ad291598670851de348c3fe9559038",
+      "sha256": "ec760da8c8799ebb0c02e4ec0464d50c627e24d6a64514ab8f753d9d10cb8764"
+    },
+    {
+      "path": "research/qq16-caller-install/test_verify.py",
+      "usage": "input",
+      "git_blob": "6a00d4d61147037d8098f9c1f44561b9fab31c78",
+      "sha256": "08388023367b028f3d98fbfc3188505d12d6b11f23ae563b104238c68f9ddf0c"
+    },
+    {
+      "path": "research/qq16-caller-install/verify.py",
+      "usage": "input",
+      "git_blob": "7639dca0296fb8d7d3c2d8d828bb0cd0f271eaf7",
+      "sha256": "46f16651383d5677e641c3e2fed86b6c2f3b62834d0be1699cfa03a1de0385ec"
+    },
+    {
+      "path": "research/qq16-complete-cost/inputs/PR4172.tar",
+      "usage": "input",
+      "git_blob": "9c28c6447f46e7156557131ff26cb4c33ffcb8cd",
+      "sha256": "ebfb717d60bf37b8edd894036827210a93c2594d637d4a6b8d617018567767a3"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/PREDECESSORS.json",
+      "usage": "input",
+      "git_blob": "db77dbf21b0f89b1f5bdbd308ab20d0045f61561",
+      "sha256": "a8be0439e350d7a634a188176894ec51180efc0d236a56b293d39dc96383a87d"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/PROOF.md",
+      "usage": "input",
+      "git_blob": "f7c694ff54e590416e4a52fa762f9d3b9474bccb",
+      "sha256": "0a0995e70f2a64c15cdd1aee66634d1ba221cbcb2a7cfa3a4d4950a37d0e143a"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/RESULT.json",
+      "usage": "input",
+      "git_blob": "ba4167dbf133cff51513bb832802c290edcdffea",
+      "sha256": "58df4ad68e2ff335ee58fa4336a449d0f73f3366d840574e5e30b50f507c358d"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/SOURCES.json",
+      "usage": "input",
+      "git_blob": "300c183db8d263899ee1795033af215ba6522b9f",
+      "sha256": "66bf8f57019632ef45780769c6f112d287e145e23ff03336998589b474165fbe"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/vendor/pr2681/PROOF.md",
+      "usage": "input",
+      "git_blob": "38cd38aa1d342f3bfe0d6d7f3c388aff0352f370",
+      "sha256": "471f6360cdac94d9e1054c6c9530ace1822b11942f7e141dfd344864d2357862"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/vendor/pr2681/README.md",
+      "usage": "input",
+      "git_blob": "c3d4d76b28fa47b86da37cc7428d5da362c7bf9a",
+      "sha256": "b658e00db095f1097b9ae7ec49d8dd465c1a317cdc84da4251cbdd3e0af597d3"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/vendor/pr2681/RESULT.json",
+      "usage": "input",
+      "git_blob": "a16a8f9a23cd00c9030f9b03cf0ae52c0ff4b526",
+      "sha256": "e4f3ff28be27f96c341b225a62a2ba84d3907ed3466122d18bcaaf5a60da740e"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/vendor/pr2681/SOURCES.json",
+      "usage": "input",
+      "git_blob": "1db7201ed145d1ef3707ab24bb599d341439050d",
+      "sha256": "30a88d8bf33c603836fffdcab3c3dabf663b98f2deda95893685e394c60ea95c"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/vendor/pr2681/WORD.json",
+      "usage": "input",
+      "git_blob": "80de97cf168441a888e7d05fc2c3cace919f31ec",
+      "sha256": "f02e57d238f127c8fd195dc6a4a9dce6db6bee9f6050bd9d5b9c14cf6e1946d0"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/vendor/pr2681/references/PR2540-PROOF.md",
+      "usage": "input",
+      "git_blob": "6ae136c8baef4793f4f7ae630720afff6c23a953",
+      "sha256": "09d587f1d6bc250e90e29fa8751a40f45be79f1a8a56af0b645c144cefaefa46"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/vendor/pr2681/references/PR2540-README.md",
+      "usage": "input",
+      "git_blob": "e91138fb0fabbc0fe0e9fd80ee189ed4366a0f61",
+      "sha256": "07588c3863b8d686497d9c0b263c35c47424fa3b63d43b7c2e5f788bd31a8d3f"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/vendor/pr2681/verify.py",
+      "usage": "input",
+      "git_blob": "99bd60a9139b4d7ef070b69f38a954e64e0f8aa1",
+      "sha256": "71f9a010553691e892703e3ec8d5eedf3e48d72b7f6af24b954a5442f4a52ccf"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/verify.py",
+      "usage": "input",
+      "git_blob": "a8f3c811108414eda0b507d295cfc9301c04d585",
+      "sha256": "0f6fb86aafb74b9722f20cc97af70a3a3c78bd012c142b2eaa19cb00e02d1fe9"
+    },
+    {
+      "path": "research/qq16-nonterminal-c8-tree/README.md",
+      "usage": "input",
+      "git_blob": "55bd5ce66846b5ddf124c655c617a8b47b52d9b7",
+      "sha256": "e57f9c84275c5cf0baf914322392a8ba0b39e014490c396ed1da85fb005337a2"
+    },
+    {
+      "path": "research/qq16-nonterminal-c8-tree/RESULT.json",
+      "usage": "input",
+      "git_blob": "8c11adabc19648de3ebcfb20cbad1cd47ee63e5d",
+      "sha256": "0e3fbddf58103dd04c2bdf2912b30c218e3e68a974aac868bd07b2cc1280230b"
+    },
+    {
+      "path": "research/qq16-tagged-cover-routing/PROOF.md",
+      "usage": "input",
+      "git_blob": "44725131a9ecb8b41533492efa7a83bd65aca9ae",
+      "sha256": "1b32c88e6c6ace2b41a1f2168a6754c329fb1bf9a5b64cf3fec53b31085604ea"
+    },
+    {
+      "path": "research/qq16-tagged-cover-routing/oracle.py",
+      "usage": "input",
+      "git_blob": "555efb4b105c6bc59395f445625eb335688cd6aa",
+      "sha256": "00328380126faa55b9f8027c81872663985610a247d0a61108951b394ad27fff"
+    },
+    {
+      "path": "research/qq16-tagged-cover-routing/router.py",
+      "usage": "input",
+      "git_blob": "1994ad9fa80e5fbce5b58dffed0c44d89a7259a7",
+      "sha256": "a5221ec8a3a38b5d0133abc685ec28e392e946ef5b60dec37f69a605a45ba7ce"
+    },
+    {
+      "path": "research/qq16-tagged-cover-routing/verify.py",
+      "usage": "input",
+      "git_blob": "c89b57e23f8e5167c64128763807f4c379e862a0",
+      "sha256": "05b06299545c7fc74de34d13951e083cc7f8f8ab1e9b9c8eb96df892a430776e"
+    },
+    {
+      "path": "research/r437-leaf-dispatch/retained/selected-result.json",
+      "usage": "input",
+      "git_blob": "b1fea0c94436b236cc2b7d41a7be032811b94c81",
+      "sha256": "bb2eaa58647b353f88d0aec2eafb9d30df1be53589231b23e12ceef3e4bad129"
+    },
+    {
+      "path": "research/recursive-parking-boundary/README.md",
+      "usage": "input",
+      "git_blob": "251f335ebaccc11d69393ee7aeb5a2e84526d0bb",
+      "sha256": "491aa208391ee4c2936510b1a5c5c018dd5509d9a0e88687c72ab8406cd77b18"
+    },
+    {
+      "path": "research/selected-bit-local-ring-sweeps/PROOF.md",
+      "usage": "input",
+      "git_blob": "4330de85dd9862ed15d84ab917887d249753df99",
+      "sha256": "846c59440cc99e28bae93ad2af99525bc769de29368080071b8427141215b4f7"
+    },
+    {
+      "path": "research/selected-bit-recursive-closure/PROOF.md",
+      "usage": "input",
+      "git_blob": "6c410cab5713979214a45835091fbeb9ee9b8531",
+      "sha256": "74cc8de20f21acb5123fe2d20996fe0925ea6e51b3dec633bd5221fb719b3344"
+    },
+    {
+      "path": "research/selected-complex-layer-closure/PROOF.md",
+      "usage": "input",
+      "git_blob": "d7ec0d101405a5f099f55f6a73e9791731737fd0",
+      "sha256": "43feda0342c07a9429699c3a44e8936a3f3fb57ce9b32f38ff3dc06ac887b265"
+    },
+    {
+      "path": "research/selected-complex-layer-closure/arithmetic.py",
+      "usage": "input",
+      "git_blob": "009d7b7166718832ebbf11893cb1ef258184a4f9",
+      "sha256": "31e4b21bb64924d723d1248a7eccf4e9c80d323ba8784804af79a75da18c346a"
+    },
+    {
+      "path": "upstream/build/sections/02-streams.tex",
+      "usage": "input",
+      "git_blob": "088fceea1867abc76271d7efe7532b779fee9039",
+      "sha256": "606c80db61cad13aa0c3b6060dc4b88dbbe7ac60cdd831aa93f28d908fd09dab"
+    }
+  ]
+}
diff --git a/research/qq16-protected-return-caller/TASK.json b/research/qq16-protected-return-caller/TASK.json
new file mode 100644
index 0000000000..042a544a8a
--- /dev/null
+++ b/research/qq16-protected-return-caller/TASK.json
@@ -0,0 +1,97 @@
+{
+  "schema_version": 1,
+  "task_id": "joint-query-controller",
+  "priority_revision": 7,
+  "base_commit": "624de9dc66858af0945e5f8a0942488d62280d43",
+  "original_card": {
+    "id": "joint-query-controller",
+    "question": "Can the installed QQ16 caller win a complete matched protocol bill, or can a changed demand eliminate actual paid work?",
+    "starting_points": [
+      "docs/research/research-family-status.md",
+      "certificates/selected-result.json",
+      "research/qq16-caller-install/README.md"
+    ],
+    "methods": [
+      "Derive the matched whole-caller physical bill for installed and baseline protocols.",
+      "Change the actual demanded observations and prove a cheaper legal producer/consumer contract."
+    ],
+    "acceptance_gate": "Name the changed premise of the fixed F0/B1 observation obstruction. Show exactly which query is recovered, legal native reads and restoration, and a full favorable budget including cover maps, helpers and endpoints. Local inverse identities alone do not close the global controller. A scoped local result may be retained without a complete supplier. Expanding it into further construction rounds requires the family-level budget and obligation gate in research-family-status.md; an optimistic passing relaxation alone is not acceptance.",
+    "first_step": {
+      "command": [
+        "python3",
+        "-B",
+        "scripts/research_baseline.py"
+      ],
+      "expected": "PASS_RESEARCH_BASELINE_BINDINGS_ONLY",
+      "inspect": "Read #4166 COST.md and ADMISSION.json. An actual caller connection is now proposed. Its native-component profile loses; parent park/restore versus external-call costs remain unresolved. Retain the producer and recovery lineage rather than rebuild it.",
+      "scope": "Source-binding orientation only; no scientific replay, theorem acceptance or supplier admission. Budget any heavy replay separately."
+    },
+    "first_experiment": "At the actual installed cut, compare matched complete parent park/restore and external input/return protocols at the same bank/packet geometry, including every later root call and service cost. Alternatively pin both bridge observations and derive a genuinely smaller source-compatible demand. Stop if the complete necessary inequality fails or an essential cost is unknown; no larger decoder scan from a local tape-action saving.",
+    "bottleneck_link": "The native local words exist; retained query information and its physical access are the missing link to a composed recursive interface.",
+    "allowed_variations": [
+      "One paid query, one changed first pair, or one precisely specified affine helper state.",
+      "A counterexample or lower bound for that exact proposed repair.",
+      "One unresolved obligation of a newer local decoder, with exact source heads and a distinct claim/domain."
+    ],
+    "scope_change_triggers": [
+      "Retaining the fixed first pair and ordinary schedule while allowing only homogeneous selected-only control, already excluded by the witness.",
+      "Treating cover-map counts as zero-cost physical address operations.",
+      "Recreating the pending complete local decoder or early-record/output-bank coalescing already under investigation without a distinct audit or changed premise.",
+      "Treating a completed-output defect inequality as a producer-interior, dirty-range or physical-cost certificate.",
+      "Recreating completed-output recovery or caller wiring already supplied by #4166 without new independent coverage.",
+      "Dropping retained later root calls or claiming native-profile dominance from the isolated publication saving."
+    ],
+    "overlap_terms": [
+      "QQ16",
+      "joint-query",
+      "changing-chart controller",
+      "selected observation",
+      "1969",
+      "2540",
+      "early record",
+      "output-bank retention",
+      "complete native decoder",
+      "2965",
+      "producer defect",
+      "dirty-helper range",
+      "F17 consumer",
+      "4166",
+      "qq16-caller-install"
+    ],
+    "existing_checks": [
+      {
+        "scope": "PR #4166: author-checked installed producer/service/return/bridge connection; native-component comparison loses.",
+        "evidence": "research/qq16-caller-install/README.md",
+        "remaining": "Complete matched physical protocol bill, or changed source-compatible demand/circuit; no affordable supplier yet.",
+        "status": "author-checked",
+        "source_commit": "0b082d22a0e9a442d264ab0633e35ef26c790630",
+        "selected_record_sha256": "bb2eaa58647b353f88d0aec2eafb9d30df1be53589231b23e12ceef3e4bad129"
+      }
+    ]
+  },
+  "scope_status": "refined",
+  "actual_scope": "Compose protected-child-return adoption with both actual QQ16 callers and all cached installation inventories; complete matched protocol delta versus frozen D.",
+  "scope_change_reason": "After #4753 the nonterminal body tree is known but total comparison remains unpriced. Resolve a different explicit boundary: apply the existing return optimization to the installed producer/service while preserving alias and controlled-disposal contracts.",
+  "bottleneck_link": "A local return exchange is not composable while Installation owns stale role caches. A safe composition gives an exact whole-root protocol delta without inventing prices for the remaining D* versus B* terms.",
+  "budget_minutes": 60,
+  "stop_rule": "First reproduce stale inventory in 15 minutes. Stop at a precise safe-composition failure if the source invariant or matched action equality cannot be closed; no larger lambda grid.",
+  "outcome": "partial",
+  "evidence": "Actual paired reduced caller execution over two generations, unchanged return transaction, source-bound role permutation proof, exact whole-root occurrence/volume bill and targeted rejection/cleanup controls.",
+  "author": "JoyboyBrian, with substantial OpenAI Codex assistance",
+  "ai_assistance": "Substantial OpenAI Codex assistance for source analysis, implementation, proof and validation.",
+  "open_questions": [
+    {
+      "question": "What is the finite control cost of the complete inventory validation and rebinding in a specified step model?",
+      "why_it_matters": "Positive tape-action savings alone do not price finite control.",
+      "first_step": "Compile the fixed role alphabet and count the signed control delta at every actual return.",
+      "blocked_by": "No selected control tariff is supplied."
+    },
+    {
+      "question": "Does implemented D* beat B* on the nonterminal C8 band?",
+      "why_it_matters": "The return improvement is an exact component, not the complete matched comparison.",
+      "first_step": "Use #4753 and this delta once in a fully priced nonchild/native ledger.",
+      "blocked_by": "Unpriced unmatched candidate and original source intervals."
+    }
+  ],
+  "canonical_discussion": "https://github.com/CrocSwap/integer-mult-bounds/discussions/4744#discussioncomment-19131467"
+}
diff --git a/research/qq16-protected-return-caller/VERIFY.json b/research/qq16-protected-return-caller/VERIFY.json
new file mode 100644
index 0000000000..de2b8fe819
--- /dev/null
+++ b/research/qq16-protected-return-caller/VERIFY.json
@@ -0,0 +1,167 @@
+{
+  "schema_version": 1,
+  "status": "ready",
+  "python": "3.12",
+  "requirements": [],
+  "inputs": [
+    "notes/batched-complex-rows.tex",
+    "notes/compact-control-layout.tex",
+    "notes/compact-control-movement.tex",
+    "research/bit2234-stock-threshold/README.md",
+    "research/community-frontier1042-audit/selected-replay.tar.gz",
+    "research/community-frontier1094-audit/selected-replay.tar.gz",
+    "research/community-hyperplane599-audit/pr589/bit589/v9/hosted/GLOBAL-TEMPLATE.json.gz",
+    "research/community-hyperplane599-audit/pr589/bit589/v9/nine/GEOMETRY.json",
+    "research/complex-grid-prefix-audit/PROOF.md",
+    "research/e8-bit-p111-tuned/tune/EXPECTED.json",
+    "research/e8-bit-p111-tuned/tune/bitE8mut-p111-tuned.json.gz",
+    "research/gaussian-normalization-stream/SOURCES.json",
+    "research/gaussian-normalization-stream/normalizer.py",
+    "research/gaussian-parity-synthesis/REVIEW.md",
+    "research/gaussian-parity/gaussian-parity-certificates.tex",
+    "research/joint-query/certificate.json.gz",
+    "research/joint-query/evidence/BRIDGE-REVIEW.md",
+    "research/joint-query/evidence/JOINT-QUERY-TRANSFER.md",
+    "research/joint-query/source_data.py",
+    "research/joint-query/verify_native.py",
+    "research/joint-query/verify_scalar.py",
+    "research/p104-whole-word-internal-grid/README.md",
+    "research/physical-complex-controller/PROOF.md",
+    "research/physical-complex-controller/SOURCES.json",
+    "research/physical-complex-controller/bank_packets.py",
+    "research/physical-complex-controller/cohort.py",
+    "research/physical-complex-controller/cover.py",
+    "research/physical-complex-controller/fixture_binding.py",
+    "research/physical-complex-controller/grid_boundary.py",
+    "research/physical-complex-controller/machine.py",
+    "research/physical-complex-controller/monomial_packets.py",
+    "research/physical-complex-controller/native_program.py",
+    "research/physical-complex-controller/parking.py",
+    "research/physical-complex-controller/root_layer.py",
+    "research/physical-complex-controller/root_plan.py",
+    "research/physical-complex-controller/root_streams.py",
+    "research/physical-complex-controller/scalar_packets.py",
+    "research/physical-complex-controller/scalar_program.py",
+    "research/physical-complex-controller/selected_binding.py",
+    "research/physical-complex-controller/selected_source.py",
+    "research/physical-gaussian-leaf/PROOF.md",
+    "research/physical-gaussian-leaf/SOURCES.json",
+    "research/physical-gaussian-leaf/axis_stream.py",
+    "research/physical-gaussian-leaf/coefficient_engine.py",
+    "research/physical-gaussian-leaf/inputs/pr3087.tar",
+    "research/physical-gaussian-leaf/leaf_sources.py",
+    "research/physical-gaussian-leaf/signed_linear.py",
+    "research/physical-scalar-stream/scalar_engine.py",
+    "research/physical-scalar-stream/scalar_words.py",
+    "research/pr589-five-helper-hosting/PROOF.md",
+    "research/pr589-five-helper-hosting/verify.py",
+    "research/qq16-all-depth-producer-grid/PROOF.md",
+    "research/qq16-caller-install/ADMISSION.json",
+    "research/qq16-caller-install/BILL.json",
+    "research/qq16-caller-install/COMPILATION.json",
+    "research/qq16-caller-install/CONTINUATION.md",
+    "research/qq16-caller-install/COST.md",
+    "research/qq16-caller-install/DECODER.md",
+    "research/qq16-caller-install/EXECUTION.json",
+    "research/qq16-caller-install/LIFECYCLE.md",
+    "research/qq16-caller-install/PACKET.md",
+    "research/qq16-caller-install/PREDECESSORS.json",
+    "research/qq16-caller-install/PRODUCER.md",
+    "research/qq16-caller-install/PROOF.md",
+    "research/qq16-caller-install/README.md",
+    "research/qq16-caller-install/RESULT.json",
+    "research/qq16-caller-install/REUSE.json",
+    "research/qq16-caller-install/REVIEW.json",
+    "research/qq16-caller-install/SOURCES.json",
+    "research/qq16-caller-install/TASK.json",
+    "research/qq16-caller-install/VERIFY.json",
+    "research/qq16-caller-install/auth.py",
+    "research/qq16-caller-install/connection.py",
+    "research/qq16-caller-install/continuation.py",
+    "research/qq16-caller-install/cost.py",
+    "research/qq16-caller-install/decoder-fixture.py",
+    "research/qq16-caller-install/decoder.py",
+    "research/qq16-caller-install/inputs/PR3055-PROOF.md",
+    "research/qq16-caller-install/inputs/PR3380-PROOF.md",
+    "research/qq16-caller-install/inputs/PR3464-PROOF.md",
+    "research/qq16-caller-install/inputs/PR3464-bank_packets.py",
+    "research/qq16-caller-install/inputs/PR3464-machine.py",
+    "research/qq16-caller-install/inputs/PR3464-parking.py",
+    "research/qq16-caller-install/inputs/PR3464-selected_binding.py",
+    "research/qq16-caller-install/inputs/PR3607-PROOF.md",
+    "research/qq16-caller-install/inputs/PR3619-PROOF.md",
+    "research/qq16-caller-install/inputs/PR3993-PROOF.md",
+    "research/qq16-caller-install/inputs/PR4106-WORD.json",
+    "research/qq16-caller-install/inputs/PR4114-README.md",
+    "research/qq16-caller-install/inputs/PR4129-COST.md",
+    "research/qq16-caller-install/inputs/PR4129-NATIVE.md",
+    "research/qq16-caller-install/inputs/PR4129-PREDECESSORS.json",
+    "research/qq16-caller-install/inputs/PR4129-PROOF.md",
+    "research/qq16-caller-install/inputs/PR4129-README.md",
+    "research/qq16-caller-install/inputs/PR4129-RESULT.json",
+    "research/qq16-caller-install/inputs/PR4129-SOURCES.json",
+    "research/qq16-caller-install/inputs/PR4129-TASK.json",
+    "research/qq16-caller-install/inputs/PR4129-bridge.py",
+    "research/qq16-caller-install/inputs/PR4129-construction.py",
+    "research/qq16-caller-install/installer.py",
+    "research/qq16-caller-install/integrated-fixture.py",
+    "research/qq16-caller-install/lifecycle.py",
+    "research/qq16-caller-install/packet.py",
+    "research/qq16-caller-install/physical.py",
+    "research/qq16-caller-install/producer-fixture.py",
+    "research/qq16-caller-install/producer.py",
+    "research/qq16-caller-install/runtime.py",
+    "research/qq16-caller-install/test_verify.py",
+    "research/qq16-caller-install/verify.py",
+    "research/qq16-complete-cost/inputs/PR4172.tar",
+    "research/qq16-line-normalized-decoder/PREDECESSORS.json",
+    "research/qq16-line-normalized-decoder/PROOF.md",
+    "research/qq16-line-normalized-decoder/RESULT.json",
+    "research/qq16-line-normalized-decoder/SOURCES.json",
+    "research/qq16-line-normalized-decoder/vendor/pr2681/PROOF.md",
+    "research/qq16-line-normalized-decoder/vendor/pr2681/README.md",
+    "research/qq16-line-normalized-decoder/vendor/pr2681/RESULT.json",
+    "research/qq16-line-normalized-decoder/vendor/pr2681/SOURCES.json",
+    "research/qq16-line-normalized-decoder/vendor/pr2681/WORD.json",
+    "research/qq16-line-normalized-decoder/vendor/pr2681/references/PR2540-PROOF.md",
+    "research/qq16-line-normalized-decoder/vendor/pr2681/references/PR2540-README.md",
+    "research/qq16-line-normalized-decoder/vendor/pr2681/verify.py",
+    "research/qq16-line-normalized-decoder/verify.py",
+    "research/qq16-nonterminal-c8-tree/README.md",
+    "research/qq16-nonterminal-c8-tree/RESULT.json",
+    "research/qq16-tagged-cover-routing/PROOF.md",
+    "research/qq16-tagged-cover-routing/oracle.py",
+    "research/qq16-tagged-cover-routing/router.py",
+    "research/qq16-tagged-cover-routing/verify.py",
+    "research/r437-leaf-dispatch/retained/selected-result.json",
+    "research/recursive-parking-boundary/README.md",
+    "research/selected-bit-local-ring-sweeps/PROOF.md",
+    "research/selected-bit-recursive-closure/PROOF.md",
+    "research/selected-complex-layer-closure/PROOF.md",
+    "research/selected-complex-layer-closure/arithmetic.py",
+    "upstream/build/sections/02-streams.tex"
+  ],
+  "commands": [
+    {
+      "argv": [
+        "{python}",
+        "-I",
+        "-B",
+        "{package}/verify.py"
+      ],
+      "timeout_seconds": 240,
+      "checks": "Authenticated actual fixed/adopted producer and service execution, two generations, complete matched return bills and inventory/cleanup controls."
+    },
+    {
+      "argv": [
+        "{python}",
+        "-I",
+        "-O",
+        "-B",
+        "{package}/verify.py"
+      ],
+      "timeout_seconds": 240,
+      "checks": "Same complete scoped certificate with optimization enabled; no disabled assert guards."
+    }
+  ]
+}
diff --git a/research/qq16-protected-return-caller/adapter.py b/research/qq16-protected-return-caller/adapter.py
new file mode 100644
index 0000000000..d25a04b9bb
--- /dev/null
+++ b/research/qq16-protected-return-caller/adapter.py
@@ -0,0 +1,118 @@
+"""Opt-in exact-caller protected-return adoption with installation inventories.
+
+Chris R / Clear1nsight's original return transaction is supplied unchanged from
+its authenticated archive. New cross-caller inventory composition: JoyboyBrian,
+with substantial OpenAI Codex assistance. Apache-2.0.
+"""
+import ast
+import types
+
+
+def need(ok, message):
+    if not ok:
+        raise ValueError(message)
+
+
+def rewrite_return(method, producer_source, replacement):
+    """Retain the complete source entry; replace only transfer + marker erase."""
+    tree = ast.parse(producer_source)
+    functions = [n for n in ast.walk(tree) if isinstance(n, ast.FunctionDef)
+                 and n.name == 'enter_child']
+    need(len(functions) == 1, 'one original external child entry')
+    function = functions[0]
+    anchors = [i for i, n in enumerate(function.body)
+               if ast.unparse(n) == 'transfer(result, self.packet(target))']
+    need(len(anchors) == 1 and
+         ast.unparse(function.body[anchors[0]+1]) == 'erase_marker(result)',
+         'exact fixed protected-return interval')
+    function.body[anchors[0]:anchors[0]+2] = ast.parse('_return_protocol(self, target, result)').body
+    env = dict(method.__func__.__globals__)
+    env.update(zip(method.__func__.__code__.co_freevars,
+                   (cell.cell_contents for cell in method.__func__.__closure__ or ())))
+    env['_return_protocol'] = replacement
+    code = compile(ast.fix_missing_locations(ast.Module(body=[function], type_ignores=[])),
+                   method.__func__.__code__.co_filename, 'exec')
+    exec(code, env)
+    return env['enter_child']
+
+
+class ReturnProtocol:
+    """Finite role tables only; payload lengths never control the transaction."""
+    def __init__(self, parent, installation, owned_tapes, adopt_return,
+                 transfer, erase_marker, *, mode='adopt', observe=None):
+        need(mode in ('fixed', 'adopt', 'stale-engines', 'stale-external'), 'known return variant')
+        self.parent, self.installation = parent, installation
+        self.owned_tapes, self.adopt_return = owned_tapes, adopt_return
+        self.transfer, self.erase_marker = transfer, erase_marker
+        self.mode, self.observe = mode, observe
+        roles = installation.engine_roles
+        self.auxiliary = installation.storage.external_roles[len(roles[0])+len(roles[1]):]
+        need(parent.native_child is installation.native_child and
+             installation.service.native_child is installation.native_child,
+             'exact sequential original backend')
+        self.check_inventory()
+
+    def check_inventory(self):
+        i = self.installation
+        actual = (self.owned_tapes(i.service), self.owned_tapes(i.native_child))
+        for saved, current in zip(i.engine_roles, actual, strict=True):
+            need(len(saved) == len(current) == len({id(t) for t in saved}) and
+                 {id(t) for t in saved} == {id(t) for t in current},
+                 'current complete engine inventory')
+        combined = (*i.engine_roles[0], *i.engine_roles[1])
+        need(len({id(t) for t in combined}) == len(combined), 'disjoint current engine inventories')
+        need(not {id(t) for t in self.owned_tapes(self.parent)}.intersection(map(id, combined)),
+             'producer disjoint from current engine inventories')
+        external = (*combined, *self.auxiliary)
+        need(len(i.storage.external_roles) == len(external) and
+             all(a is b for a, b in zip(i.storage.external_roles, external, strict=True)),
+             'current complete external inventory')
+        i.storage._distinct()
+
+    @staticmethod
+    def exchange(roles, old, new):
+        need(sum(t is old for t in roles) == 1 and all(t is not new for t in roles),
+             'one finite role replacement')
+        return tuple(new if t is old else t for t in roles)
+
+    def __call__(self, caller, target, result):
+        i = self.installation
+        need(caller is self.parent or caller is i.service, 'one of the two installed callers')
+        need(i.native_child.closed and result is i.native_child.output,
+             'closed original protected return')
+        # These checks inspect fixed object bindings, never payload cells/lengths.
+        if self.mode != 'stale-engines':
+            self.check_inventory()
+        old = caller.packet(target)
+        before = self.observe('before', caller, old, result) if self.observe else None
+        if self.mode == 'fixed':
+            self.transfer(result, old)
+            self.erase_marker(result)
+        else:
+            self.adopt_return(caller, target, result)
+            if self.mode != 'stale-engines':
+                service, native = i.engine_roles
+                if caller is i.service:
+                    service = self.exchange(service, old, result)
+                native = self.exchange(native, result, old)
+                i.engine_roles = service, native
+                if self.mode != 'stale-external':
+                    i.storage.external_roles = (*service, *native, *self.auxiliary)
+                self.check_inventory()
+        if self.observe:
+            self.observe('after', caller, old, result, before)
+
+
+def install(parent, installation, owned_tapes, producer_source, adopt_return,
+            transfer, erase_marker, *, mode='adopt', observe=None):
+    """Install before input, after the original connection factory has succeeded."""
+    need(parent.closed and installation.service.closed and installation.native_child.closed
+         and installation.calls == 0, 'closed original installation before first input')
+    protocol = ReturnProtocol(parent, installation, owned_tapes, adopt_return,
+                              transfer, erase_marker, mode=mode, observe=observe)
+    for caller in (parent, installation.service):
+        method = rewrite_return(caller.enter_child, producer_source, protocol)
+        caller.enter_child = types.MethodType(method, caller)
+    # The protocol is held by function globals, never inserted in an inventoried
+    # engine object: owned_tapes must not recursively acquire another controller.
+    return protocol
diff --git a/research/qq16-protected-return-caller/verify.py b/research/qq16-protected-return-caller/verify.py
new file mode 100644
index 0000000000..1bcd5f9a1a
--- /dev/null
+++ b/research/qq16-protected-return-caller/verify.py
@@ -0,0 +1,276 @@
+#!/usr/bin/env python3
+"""Exact installed-return composition; finite executions plus source-bound bill.
+
+JoyboyBrian, substantial OpenAI Codex assistance. Apache-2.0.
+The original caller and protected-return transaction retain their authors.
+"""
+import argparse
+import ast
+import hashlib
+import io
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tarfile
+import tempfile
+import types
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parents[1]
+CALLER = 'research/qq16-caller-install'
+SELECTED = 'research/r437-leaf-dispatch/retained/selected-result.json'
+CASE_NAMES = ('fixed', 'adopt', 'stale-engines', 'stale-external',
+              'output-alias', 'service-stop')
+
+
+def need(ok, message):
+    if not ok:
+        raise ValueError(message)
+
+
+def sha(raw):
+    return hashlib.sha256(raw).hexdigest()
+
+
+def canonical(value):
+    return json.dumps(value, sort_keys=True, separators=(',', ':'), allow_nan=False)
+
+
+def authenticate():
+    rows = json.loads((HERE/'SOURCES.json').read_text())['files']
+    inputs = [row for row in rows if row['usage'] == 'input']
+    need(len(inputs) == len({r['path'] for r in inputs}), 'unique declared input closure')
+    for row in inputs:
+        path = ROOT/row['path']
+        need(path.is_file() and not path.is_symlink(), 'regular source: '+row['path'])
+        raw = path.read_bytes()
+        need(sha(raw) == row['sha256'], 'source integrity: '+row['path'])
+    return inputs
+
+
+def projection(root, inputs):
+    # Only the historical selected record differs from the current source tree.
+    for row in inputs:
+        target = root/row['path']
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_bytes((ROOT/row['path']).read_bytes())
+    selected = root/'certificates/selected-result.json'
+    selected.parent.mkdir(parents=True, exist_ok=True)
+    raw = (ROOT/SELECTED).read_bytes()
+    need(sha(raw) == 'bb2eaa58647b353f88d0aec2eafb9d30df1be53589231b23e12ceef3e4bad129',
+         'exact historical complete selected record')
+    selected.write_bytes(raw)
+
+
+def original_adoption(fixture):
+    with tarfile.open(ROOT/'research/qq16-complete-cost/inputs/PR4172.tar') as t:
+        nested = t.extractfile('research/qq16-native-history/inputs/PR4167.tar').read()
+    need(sha(nested) == '68ff3b4b541434cb9df15884d027838cbc80300e9d78015eb82c395c5168d166',
+         'exact retained protocol archive')
+    with tarfile.open(fileobj=io.BytesIO(nested)) as t:
+        raw = t.extractfile('research/qq16-protocol-comparison/adapter.py').read()
+    need(sha(raw) == '77c01376ac43339a7c99ab377c7947cb89b44e96ff4a826becb545cccd045fef',
+         'exact retained adoption source')
+    matches = [n for n in ast.walk(ast.parse(raw)) if isinstance(n, ast.FunctionDef)
+               and n.name == 'adopt_return']
+    need(len(matches) == 1, 'exact original return method')
+    from words import LEFT
+    env = {'need': need, 'LEFT': LEFT, 'erase_marker': fixture.erase_marker}
+    exec(compile(ast.Module(body=matches, type_ignores=[]), 'retained-4167/adopt_return', 'exec'), env)
+    return env['adopt_return']
+
+
+def actions(tapes):
+    return {key: sum(getattr(t.meter, key) for t in tapes)
+            for key in ('reads', 'writes', 'moves')}
+
+
+def case(name):
+    inputs = authenticate()
+    with tempfile.TemporaryDirectory(prefix='qq16-return-source-') as td:
+        root = Path(td).resolve()
+        projection(root, inputs)
+        path = root/CALLER/'integrated-fixture.py'
+        sys.path.insert(0, str(path.parent))
+        fixture = types.ModuleType('retained_integrated_fixture')
+        fixture.__file__ = str(path)
+        sys.modules[fixture.__name__] = fixture
+        exec(compile(path.read_bytes(), str(path), 'exec'), fixture.__dict__)
+        adapter = types.ModuleType('return_inventory_adapter')
+        adapter.__file__ = str(HERE/'adapter.py')
+        exec(compile(Path(adapter.__file__).read_bytes(), adapter.__file__, 'exec'), adapter.__dict__)
+        need(fixture.Tape.__eq__ is object.__eq__, 'retained Tape equality is identity')
+        adopt_return = original_adoption(fixture)
+        original_install = fixture.C.install
+        registry, calls, attempts, protocols, cleanup = [], [], [], [], []
+        original_tape_init = fixture.Tape.__init__
+
+        def tape_init(tape, *args, **kwargs):
+            original_tape_init(tape, *args, **kwargs)
+            registry.append(tape)
+        fixture.Tape.__init__ = tape_init
+
+        def install(*args, **kwargs):
+            installed = original_install(*args, **kwargs)
+            parent = args[0].machine
+            mode = name if name in ('fixed', 'adopt', 'stale-engines', 'stale-external') else 'adopt'
+
+            def observe(phase, caller, old, result, before=None):
+                label = 'producer' if caller is parent else 'service'
+                if phase == 'before':
+                    # Test observation only. No body size flows to the algorithm.
+                    n = len(fixture.raw(result))
+                    attempts.append(label)
+                    return n, actions((old, result))
+                n, measured = before
+                after = actions((old, result))
+                calls.append({'caller': label, 'bits': n,
+                              'return_actions': {k: after[k]-measured[k] for k in after}})
+                if name == 'service-stop' and label == 'service':
+                    raise ValueError('deliberate stop after adopted service return')
+
+            protocol = adapter.install(parent, installed, fixture.J.owned_tapes,
+                                       (root/CALLER/'producer.py').read_bytes(), adopt_return,
+                                       fixture.transfer, fixture.erase_marker,
+                                       mode=mode, observe=observe)
+            protocols.append(protocol)
+            if name == 'service-stop':
+                original_run = parent.run
+                def run(payload, descriptors):
+                    image = bytes(payload.cells), payload.head
+                    metadata = {k: (bytes(v.tape.cells), v.tape.head) for k, v in descriptors.items()}
+                    try:
+                        return original_run(payload, descriptors)
+                    except ValueError as error:
+                        need(str(error) == 'deliberate stop after adopted service return', 'exact service failure')
+                        need((bytes(payload.cells), payload.head) == image and
+                             all((bytes(descriptors[k].tape.cells), descriptors[k].tape.head) == v
+                                 for k, v in metadata.items()), 'controlled failure preserves borrowed state')
+                        need(installed.storage.stage == installed.bundle.state == 'closed' and
+                             installed.compiler.closed and installed.service.closed and installed.native_child.closed,
+                             'actual discard closes service lifetimes')
+                        need(all(t.read() == fixture.BLANK for t in fixture.J.owned_tapes(installed)),
+                             'actual discard retires current owned inventory')
+                        cleanup.append('checked before fixture finally')
+                        raise
+                parent.run = run
+            return installed
+        fixture.C.install = install
+        try:
+            try:
+                output = fixture.run_case(mutation='output_alias' if name == 'output-alias' else None)
+            except ValueError as error:
+                expected = {
+                    'stale-engines': 'active producer and original/service engines have distinct fixed inventories',
+                    'stale-external': 'current complete external inventory',
+                    'output-alias': 'exclusive physical caller/native/wrapper inventory',
+                    'service-stop': 'deliberate stop after adopted service return',
+                }
+                need(name in expected and str(error) == expected[name], 'unexpected rejection: '+str(error))
+                need(name != 'service-stop' or len(cleanup) == 1, 'service cleanup checked before fixture cleanup')
+                need(name != 'stale-engines' or len(calls) == 4, 'naive adoption reaches actual original fence')
+                return {'case': name, 'rejected': str(error), 'completed_returns': len(calls),
+                        'attempted_callers': attempts, 'cleanup_observations': cleanup,
+                        'original_fixture_cleanup_check': name == 'output-alias'}
+            need(name in ('fixed', 'adopt') and len(calls) == 24 and output['completed_generations'] == 2,
+                 'complete two-generation execution')
+            need([r['caller'] for r in calls] == (['producer']*4+['service']*6+['producer']*2)*2,
+                 'source producer-service-later-producer chronology')
+            for protocol in protocols:
+                protocol.check_inventory()
+            return {'case': name, 'scientific': output, 'calls': calls,
+                    'record_tape_actions': actions(registry), 'fresh_record_tapes': len(registry),
+                    'final_inventory_exact': True}
+        finally:
+            fixture.Tape.__init__ = original_tape_init
+            fixture.runtime.cleanup()
+
+
+def compute():
+    inputs = authenticate()
+    rows = {}
+    for name in CASE_NAMES:
+        with tempfile.TemporaryDirectory(prefix='qq16-return-cache-') as cache:
+            command = [sys.executable, '-I', '-B']+(['-O'] if sys.flags.optimize else [])
+            command += ['-X', 'pycache_prefix='+cache, str(HERE/'verify.py'), '--case', name]
+            process = subprocess.run(command, capture_output=True, text=True, timeout=90)
+            need(process.returncode == 0, 'case '+name+': '+process.stdout+process.stderr)
+            rows[name] = json.loads(process.stdout)
+    fixed, adopted = rows['fixed'], rows['adopt']
+    need(canonical(fixed['scientific']) == canonical(adopted['scientific']), 'complete matched scientific endpoint')
+    need(fixed['fresh_record_tapes'] == adopted['fresh_record_tapes'], 'no added physical record tape')
+    saving = {'reads': 0, 'writes': 0, 'moves': 0}
+    for old, new in zip(fixed['calls'], adopted['calls'], strict=True):
+        need((old['caller'], old['bits']) == (new['caller'], new['bits']), 'matched complete returned packet')
+        n = old['bits']; expected = dict(reads=5*n+2, writes=2*n, moves=4*n+2)
+        need({k: old['return_actions'][k]-new['return_actions'][k] for k in saving} == expected,
+             'literal old-return versus adopted-return RWM delta')
+        for k in saving:
+            saving[k] += expected[k]
+    need({k: fixed['record_tape_actions'][k]-adopted['record_tape_actions'][k] for k in saving} == saving,
+         'whole reduced record-tape difference equals complete return sum')
+    # The original source invoices, not the reduced fixture, supply this census.
+    compilation = json.loads((ROOT/CALLER/'COMPILATION.json').read_text())
+    census = compilation['producer']['root_child_census']
+    original = census['baseline_whole_root']
+    installed = census['installed_whole_root']
+    need(original['calls'] == sum(original['rank_counts'].values()) == 510662,
+         'retained whole original source census')
+    prior = json.loads((ROOT/'research/qq16-nonterminal-c8-tree/RESULT.json').read_text())
+    need(original['rank_counts'] == prior['rank_histogram'], 'independent prior source census agrees')
+    need(census['qq16_added_lines']['calls'] == 32 and census['removed_centres']['calls'] == 16,
+         'actual changed source occurrence counts')
+    expected_histogram = dict(original['rank_counts'])
+    expected_histogram['1'] += 32; expected_histogram['8'] -= 16
+    need(installed['rank_counts'] == expected_histogram and
+         installed['calls'] == sum(expected_histogram.values()) == 510678,
+         'complete producer census including retained suffix')
+    need(census['retained_later_source_7_481']['calls'] == 493097 and
+         census['installed_entry_through_bridge']['calls'] + 493097 == installed['calls'],
+         'all later root calls included')
+    decoder = compilation['decoder']['physical_per_cover']
+    need(decoder['rank_one_children'] == 336, 'complete decoder and continuation child census')
+    # Exact source expressions which establish the service quotient is U and
+    # rank reduction moves active axes into spectators without reducing b.
+    machine = ast.parse((ROOT/'research/physical-complex-controller/machine.py').read_bytes())
+    funcs = {n.name:n for n in ast.walk(machine) if isinstance(n,ast.FunctionDef)}
+    prepare = ast.unparse(funcs['prepare_child'])
+    need('after = Count.product(tail, self.c(\'spacing\'))' in prepare and
+         'after.add(self.c(\'after\'))' in prepare and
+         "self.c('unused') if name == 'rows'" in prepare,
+         'source child width-to-spectator and row transfer')
+    decoder_ast = ast.parse((ROOT/CALLER/'decoder.py').read_bytes())
+    descriptors = next(n for n in decoder_ast.body if isinstance(n,ast.FunctionDef) and n.name=='service_descriptors')
+    descriptor_text = ast.unparse(descriptors)
+    need("result['rows'] = Count(caller.c('unused'))" in descriptor_text and
+         "result['rows'].multiply_small(families * caller.binding.cover.size)" in descriptor_text,
+         'source service rows restore exactly one local family-cover divisor')
+    return {'status': 'PASS_QQ16_PROTECTED_RETURN_CALLER', 'live_inputs': len(inputs),
+            'cases': rows, 'finite_matched_saving_RWM': saving,
+            'source_protocol_census': {'producer_per_Gamma': 510678, 'service_per_Gamma': 336,
+                                      'complete_per_Gamma': 511014, 'later_producer_per_Gamma': 493097},
+            'whole_root_saving_RWM': ['511014*Gamma*(5*v+2)', '511014*Gamma*(2*v)', '511014*Gamma*(4*v+2)'],
+            'finite_rebinding_control': 'separate signed charge; no zero-cost role-swap assumption',
+            'scope': 'Installed D* versus frozen D only; no full comparison with B*, numerical supplier admission or new kappa.'}
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--case', choices=CASE_NAMES)
+    parser.add_argument('--write', action='store_true')
+    args = parser.parse_args()
+    if args.case:
+        need(not args.write, 'no case artifact writes')
+        print(canonical(case(args.case)))
+        return
+    result = compute()
+    if args.write:
+        (HERE/'RESULT.json').write_text(json.dumps(result, indent=2, sort_keys=True)+'\n')
+    else:
+        need(canonical(result) == canonical(json.loads((HERE/'RESULT.json').read_text())), 'typed complete result receipt')
+    print(result['status'])
+
+
+if __name__ == '__main__':
+    main()