diff --git a/research/qq16-finite-handle-charge/PROOF.md b/research/qq16-finite-handle-charge/PROOF.md
new file mode 100644
index 0000000000..89af6cbfab
--- /dev/null
+++ b/research/qq16-finite-handle-charge/PROOF.md
@@ -0,0 +1,118 @@
+# Conditional sequential-handle control bound
+
+JoyboyBrian, with substantial OpenAI Codex assistance. Apache-2.0.
+
+This is a bound for a new executable metadata kernel, conditional on a source
+encoding contract. It is not a claim that CPython pointers, dictionaries or
+reflection are tape primitives. The original #4790 scientific sources and guards
+are unchanged. The kernel consumes exact snapshots of those sources and must
+agree with them.
+
+Let K bound the sum of vertices, traversed edges and inspected object attributes
+of the three current owner graphs, all supplied role-list lengths, plus one.
+Every distinct physical Tape receives a positive stable handle at most K.
+Non-Tape vertices have local handles. Tape bodies are opaque. Source field
+classification/omission follows exactly the authenticated `owned_tapes` skip
+alphabet. A producer/service lifetime must supply this complete encoding at
+every check; a constructor-only graph bound does not suffice.
+
+The kernel uses at most Q=64K words of w=bit_length(Q) bits. Every graph pointer,
+Tape handle, array address, count and cursor fits this width. It implements
+visited sets by encoded flags and follows encoded adjacency, rather than using
+Python identity hashes as unit-cost membership. It explicitly checks cached
+engine membership/uniqueness, engine disjointness, producer separation, ordered
+external roles and the storage/acquisition/external exclusivity predicate.
+
+## Addressed bit model
+
+The macro simulator's host list indexing only fast-forwards a fully charged
+sequential scan. For each word read or write, reset a w-bit scan index; scan all
+Q words; compare all w address bits at each word; branch; copy the selected
+word bit by bit; advance the head; execute a padded eight-instruction-per-bit
+increment; test the loop; rewind the entire store; halt. It costs exactly
+
+`A(Q,w) = Q(12w+3)+3w+1`
+
+in the stated bit-instruction model: reset w, per word compare 2w+1 (zero difference bit, then XOR and OR for every
+address bit), branch-on-zero 1,
+forward movement w, padded increment 8w, loop branch 1; the unique selected
+copy costs 2w, complete rewind costs Qw, and halt costs 1. Selected copy reads or writes
+only the current head cell and immediately advances one cell per bit; unselected
+words perform the same forward moves without copying. No offset cell lookup
+is part of the bit machine. Each increment bit pays carry initialization (only
+on the first bit; otherwise NOP), old-bit copy, XOR, AND, digit assignment,
+carry assignment and two NOPs: exactly eight instructions per bit. Fixed-width
+bit loops are unrolled in the compiled control, whose frontend belongs to F. Fixed registers are
+bits/Booleans, compiled for this fixed K; no unbounded integer is free. The
+independent checker expands these instructions on small stores and checks
+values, addresses, preserved cells, restored head and exact prices.
+
+Other bounded-word comparisons, copies, arithmetic and branches are charged
+16w+16 per scalar macro, sufficient for two full w-bit scans, fixed-width
+increment/subtraction and branch bookkeeping. Source payload operations are
+outside this metadata kernel and retain their earlier R/W/move tariff. This
+model does not choose the repository's physical-machine compiler or its source
+frontend. A physical embedding must provide this bit-register/store interface,
+including its additional control storage; no zero-tape-space claim is made.
+
+The simulator charges Q accesses for initial zero fill and Q accesses for full
+retirement, even though its Python storage omits unused padding. Each imported
+metadata word pays one source read and one owned write. Thus metadata copying,
+workspace initialization and cleanup are included; producing a trustworthy
+source encoding remains a separately stated embedding condition.
+
+## Counting bound
+
+DFS pops exactly e+1 stack entries (including repeats). There are at most g
+first visits and e pushes. A first visit reads four header words, sets one flag,
+and either appends one opaque Tape handle or pushes children in reverse order.
+The stack has e+1 cells. Both imported graph words and returned handle words
+are charged. Three walks use fewer than 96K accesses and 192K scalar macros.
+
+There are four complete mark-array clears (two engine comparisons, combined
+inventory, and storage exclusivity). The mark universe is at most K. Every
+source role-list element is scanned a bounded number of times: saved engine
+lists at most six, current lists at most three, and external/auxiliary/storage
+lists at most four. All encodings, result buffers and duplicate imported lists
+fit 64K words. Conservatively allowing 128K accesses for initialization and
+retirement, 128K for all imports, 96K for walks, and 128K for all remaining
+list scans gives less than 1024K accesses. The corresponding loop, branch,
+scalar bookkeeping is less than 4096K. `Store.finish` checks both independent
+ceilings on every executed kernel call. Therefore
+
+`U(K)=1024K A(64K,w)+4096K(16w+16)`
+
+is a conservative bit-instruction upper bound per validation. The same envelope
+also covers an exchange (one scan/copy of a role list), including its own zero
+fill/import/cleanup. This intentionally does not optimize metadata reuse.
+
+## Source sites and whole lifetime
+
+Put C=511014Γ and S=336Γ, from #4166/#4790's inherited complete successful root
+census. #4790 performs one constructor validation and exactly two validations
+per adopted return: **1+2C**, each traversing three owner graphs. Its native cache
+exchange runs C times and its service cache exchange S times: **C+S**. The test
+harness's final `check_inventory` is not an algorithmic site and is excluded.
+
+Reserve one further U(K) binding budget for initialization and one per return
+for remaining fixed dispatch, the credited #4167 finite packet/private/parked
+rebinding, and rebuilding external tuples. This last budget is conditional on
+the same K contract covering those finite lists and scalar fields; it does not
+charge payload clearing again. Copying/clearing common payload intervals retains
+the predecessor's cancellation premise. The fixed number of comparisons and
+list scans is below the same conservative 1024K/4096K ceilings. The source AST
+anchors and actual cache-exchange counts are checked independently of this sum.
+
+Hence this encoded-control realization has additional metadata charge at most
+
+`B(K,Γ) = (4C+S+2) U(K)`.
+
+Let F include any compilation/frontend/encoding-embedding charge not discharged
+by this kernel contract and any remaining positive control difference outside
+these intervals. Then the sufficient matched D* versus frozen D condition is
+
+`F + B(K,Γ) < C(11v+4)`.
+
+Equivalently v must exceed `(F+B−4C)/(11C)`. F is **not zero** by default. No
+uniform production K or physical embedding is established by reduced logs.
+The full D* versus B* ledger has additional unmatched costs and remains open.
diff --git a/research/qq16-finite-handle-charge/README.md b/research/qq16-finite-handle-charge/README.md
new file mode 100644
index 0000000000..4af2ebbaaa
--- /dev/null
+++ b/research/qq16-finite-handle-charge/README.md
@@ -0,0 +1,159 @@
+# Conditional bounded-graph charge for QQ16 return control
+
+This package gives an executable, explicitly charged **metadata controller**
+for #4790's inventory checks and cache substitutions. It checks the actual
+unchanged installed caller, including initialization and all return sites.
+The cost theorem is conditional on a complete bounded source encoding; it
+is not a production graph bound or a new physical QQ16 implementation.
+
+For a contract size K, put Q=64K, w=bit_length(Q), and
+
+```
+A(Q,w) = Q(12w+3)+3w+1,
+U(K)   = 1024K A(Q,w) + 4096K(16w+16).
+```
+
+Every word access pays a complete sequential Q-word scan with explicit w-bit
+address comparison, selected bit copy, head movement and rewind. No Python
+pointer, hash-table lookup or reflection is declared a unit-cost tape primitive.
+Initialization, input-word copying and complete owned-store retirement are
+charged. [PROOF.md](PROOF.md) states the model, elementary counts, source
+encoding contract and remaining physical-embedding obligations.
+
+Let C=511014Γ and S=336Γ be #4166/#4790's credited complete caller census.
+The actual source has **1+2C validations**, **C+S cache exchanges** and a
+conservative additional **C+1 finite binding budgets**. The first term includes
+initialization; the final test-harness audit is excluded. The resulting bound is
+
+```
+B(K,Γ) = (4C+S+2) U(K).
+```
+
+The credited tape-action saving remains `C(11v+4)`. If F accounts for source
+frontend/compilation/encoding and any remaining positive control charge outside
+the stated kernel contract, a sufficient D* versus frozen D condition is
+
+```
+F + B(K,Γ) < C(11v+4).
+```
+
+**F is not assumed zero.** Neither a uniform production K nor a physical
+embedding is supplied. This does not decide D* versus B*, execute production
+O73 payloads, establish supplier admission or change κ. The bound deliberately
+uses expensive scans and fresh scratch; it is not a performance recommendation.
+
+## Why a constructor census is insufficient
+
+The actual unchanged two-generation case executes 24 original-C calls: twelve
+producer and twelve service calls in total, with the original per-generation
+chronology `4 producer → 6 service → 2 later producer`. It produces 49 algorithmic
+inventory validations, 147 owner traversals and 36 cache exchanges. The retained
+verifier performs one additional final audit; the observer labels it separately.
+All original endpoint bytes, guards, cleanup and the complete typed #4790 case
+receipt remain unchanged.
+
+The source object graph changes across phases. In the initial investigation,
+the three different owners had 2,310 to 2,327 record Tape roles; this range
+compares owners and does not establish tape allocation over time. Their graph
+traversals had 5,017 to 5,054 edges. These are observations from reduced geometry,
+not a universal maximum or a production inventory. The registered verifier
+requires a same-owner vertex/edge/attribute increase over its initial graph,
+furnishing a concrete
+counterexample to replacing every traversal by its constructor-size census.
+In the completed log, the same service owner grows from 5,033 to 5,054 edges
+and 1,403 to 1,404 inspected attributes. Its 2,327 Tape roles remain constant.
+Python object sharing can change vertex counts without changing semantics.
+
+The replay instead enforces the explicit cap **K=65,536** on every complete
+snapshot: the sum of three graph vertex/edge/attribute counts, all supplied
+role-list lengths, plus one. Handles are persistent positive labels throughout the observed caller lifetime,
+at most K; they are not reidentified independently at each check.
+This gives Q=4,194,304 words and w=23 bits. Every current snapshot must satisfy
+the cap; failure is a rejection, not an extrapolated successful invoice.
+The enormous conservative upper bound is intentional and cannot justify a
+speedup on the 512-bit reduced fixture.
+
+## Executable boundary and independent checks
+
+[kernel.py](kernel.py) executes encoded graph traversal with a visited-flag
+array, complete engine membership checks, producer separation, ordered external
+bindings, storage/acquisition exclusivity and finite cache substitution. It
+performs no Tape payload read or numerical operation. Its host arrays simulate
+charged sequential scans; they are not physical memory accesses of cost one.
+The complete control trace includes zero filling, imports and cleanup, and
+checks both the access and scalar-instruction upper bounds.
+
+[observer.py](observer.py) independently encodes the actual three owner graphs.
+It preserves the authenticated source's omission alphabet and checks exact
+Tape encounter order against original `owned_tapes` at every site. The original
+`ReturnProtocol.check_inventory` and exchange still execute after the kernel;
+no source guard is replaced or waived. Current/auxiliary/acquisition fields
+are all included. The one observer hook is inserted in #4790's **test harness**;
+full AST comparison proves its removal recovers the unchanged harness. The
+actual producer, service, native child and numerical sources are unchanged.
+
+[check_bits.py](check_bits.py) is a separate bit-register/store implementation.
+It expands the access path on 156 read/write cases, including address zero and
+last addresses, and checks selected values, preserved other words, restored
+head and exact instruction counts. It neither imports the primary charge
+formula nor obtains counts by evaluating that formula. Twelve negative controls
+cover every omitted snapshot field, an exceeded graph cap, insufficient handle
+width, stale external order, a duplicate cache role, an out-of-range graph edge
+and dropping later returns from the whole-source invoice.
+
+The scalar-macro and residual-binding envelopes are written conservative
+bounds, not independently executed physical lowerings. A producer of the encoded
+source graph must prove that its own cost is included in F or in a separately
+justified bounded acquisition implementation. The kernel cannot authenticate a
+physical graph that its caller omitted. The read-only source observer checks
+that implication only for the executed source case.
+
+## Reproduction and provenance
+
+```
+python3.12 -B scripts/research_package.py --package research/qq16-finite-handle-charge
+python3.12 -I -B research/qq16-finite-handle-charge/verify.py --log /tmp/qq16-control-log.json
+```
+
+The default replay is read-only; `--write` explicitly regenerates RESULT.json.
+`--log` writes only the requested observation file, including every phase's
+shape and charged counters. The receipt accepts a bounded current trace rather
+than requiring incidental Python object-identity sharing to reproduce exactly.
+Normal and optimized registered commands run the same explicit guards.
+
+SOURCES.json binds 144 live inputs. The inherited loader retains its original
+hash checks and exact historical selected-record projection. No selected record
+or frozen source is changed. Exports need no Git or network. No full historical
+suite, production replay, Lean or Docker run is required.
+
+Base `b91956876e5b4122fd89179f1b57557ff8378f15`, priority revision 7.
+[Canonical claim](https://github.com/CrocSwap/integer-mult-bounds/discussions/4744#discussioncomment-19138319).
+Entry overlap covered 317 open PRs, 4,064 Discussion records and all 6,636 base
+local notes. Closed arbitrary diffs and unpublished work are outside that
+coverage. #4949's arrangement audit and #4956's portable integration are credited
+completed work; they are not repeated or superseded by this cost certificate.
+
+## Credit
+
+JoyboyBrian's #4790 supplies the installed-return composition and complete
+source census interface; Mihir Srivastava's #4949 supplies the independent
+ownership audit; #4956 supplies the portable-replay follow-up. Chris R /
+Clear1nsight's #4166/#4167/#4172/#4177 supply the actual caller, return exchange,
+prior tariff and complete-cost lineage. Tekalign's finite-role exchange and
+Jose Manuel's physical controller/Ordinary/Compact sources retain their credit,
+as do all retained QQ16/native predecessor notices. This conditional kernel,
+source observer, bit checker and writing are by JoyboyBrian with substantial
+OpenAI Codex assistance. Apache-2.0.
+
+## Open next questions
+
+- Prove a uniform production graph cap K from the actual controller, Ordinary
+  inventories and lease/context lifetimes. Start at every return phase, since
+  the constructor-only substitution fails. The missing invariant blocks
+  production use of the reduced cap.
+- Implement and price a complete physical source encoder/store interface and
+  its frontend F, including control storage and compilation. The sequential
+  macro price alone does not discharge this embedding.
+- Combine this conditional charge with the complete unmatched D* versus B*
+  native/nonchild ledger. Unknown remaining terms prevent a total sign or κ
+  conclusion; the credited return saving must be used only once.
diff --git a/research/qq16-finite-handle-charge/RESULT.json b/research/qq16-finite-handle-charge/RESULT.json
new file mode 100644
index 0000000000..7d44886948
--- /dev/null
+++ b/research/qq16-finite-handle-charge/RESULT.json
@@ -0,0 +1,33 @@
+{
+  "actual": {
+    "algorithm_validations": 49,
+    "cache_exchanges": 36,
+    "constructor_size_not_uniform": true,
+    "contract_size": 65536,
+    "excluded_final_audit": 1,
+    "graph_walks": 147,
+    "returns": 24,
+    "service_returns": 12,
+    "unchanged_complete_receipt": true
+  },
+  "assumption": "Encoded complete bounded graphs; F remains separate and is not assumed zero.",
+  "bit_access_cases": 156,
+  "per_kernel_upper": {
+    "accesses": 67108864,
+    "bits": 78531626279108608,
+    "capacity": 4194304,
+    "scalar": 268435456,
+    "width": 23
+  },
+  "rejection_controls": 12,
+  "scope": "Conditional metadata charge only; no production K, physical embedding, D* versus B* or kappa.",
+  "status": "PASS_QQ16_FINITE_HANDLE_CHARGE",
+  "whole_cover_bill": {
+    "cache_exchanges": 511350,
+    "control_upper": 160549585575251963543552,
+    "residual_binding_budgets": 511015,
+    "tape_saving_coefficient": 5621154,
+    "tape_saving_constant": 2044056,
+    "validations": 1022029
+  }
+}
diff --git a/research/qq16-finite-handle-charge/SOURCES.json b/research/qq16-finite-handle-charge/SOURCES.json
new file mode 100644
index 0000000000..e0c906b4f8
--- /dev/null
+++ b/research/qq16-finite-handle-charge/SOURCES.json
@@ -0,0 +1,882 @@
+{
+  "schema_version": 1,
+  "base_commit": "b91956876e5b4122fd89179f1b57557ff8378f15",
+  "files": [
+    {
+      "path": "certificates/selected-result.json",
+      "usage": "provenance",
+      "git_blob": "c35482cd9035843b15a634cc8276a7e1e40e8395",
+      "sha256": "6fe0a099b89aa2aed796a13c3a21dafc63f3388ebf397464e44e0451893b9375"
+    },
+    {
+      "path": "docs/research/agent-task-catalog.json",
+      "usage": "provenance",
+      "git_blob": "f126dd2e2dad2b669e75d1d0d0bd05c600725602",
+      "sha256": "f7a48bfa2659b88378282a8eee7d9fe52cdf505594124c4d1686b58510fffd72"
+    },
+    {
+      "path": "notes/batched-complex-rows.tex",
+      "usage": "input",
+      "git_blob": "e13bd96eb29bdc6526f10dc32e0a146bc17848a4",
+      "sha256": "64c70926a8705874f1c9b42a2f703e42cad4e90f927f544458cfdf729540236c"
+    },
+    {
+      "path": "notes/compact-control-layout.tex",
+      "usage": "input",
+      "git_blob": "16f4d233471a7d189163ae7e7902becadecbba64",
+      "sha256": "2bc28e50f3eb092195294cafa81213e520f6d42e7935e9905ad8a6199e2a7c87"
+    },
+    {
+      "path": "notes/compact-control-movement.tex",
+      "usage": "input",
+      "git_blob": "06b6a9ef24245ac7b724c53a204635415b402357",
+      "sha256": "b963c3d2f4e1b7059aa289bb4b4ac89b688920bcf42f5b20d7698cdef0132cc6"
+    },
+    {
+      "path": "research/bit2234-stock-threshold/README.md",
+      "usage": "input",
+      "git_blob": "ede0d322c477af91d4c2cc33db0fd10958f45eab",
+      "sha256": "1e050c9f963421d751d9208092f9a15321ed77810e03912df8eb5eb56bbb06e7"
+    },
+    {
+      "path": "research/community-frontier1042-audit/selected-replay.tar.gz",
+      "usage": "input",
+      "git_blob": "6f4dc6fe7631d8aacf8081fcaecf32197181685b",
+      "sha256": "22c3f4dce4b897a1d423d1388801933e288b6a6b1906cb15e1b16a5eb68db754"
+    },
+    {
+      "path": "research/community-frontier1094-audit/selected-replay.tar.gz",
+      "usage": "input",
+      "git_blob": "c24daf067f9c543421d89ca2eeaa4eb78a57fb6f",
+      "sha256": "f1da80610bf33c58527f18ad63b4350d0b864e1d4486141ee17ac9bed4d529d6"
+    },
+    {
+      "path": "research/community-hyperplane599-audit/pr589/bit589/v9/hosted/GLOBAL-TEMPLATE.json.gz",
+      "usage": "input",
+      "git_blob": "9eafb8776cbf78c72124f833534469ddfa5e98ec",
+      "sha256": "0357b7cfbd7c29b4983982baf153c8a9f1e1e412690cd7fa9fc3d23d7963b20f"
+    },
+    {
+      "path": "research/community-hyperplane599-audit/pr589/bit589/v9/nine/GEOMETRY.json",
+      "usage": "input",
+      "git_blob": "44006542202ca6037533a754f0bcd00549d7e088",
+      "sha256": "0058c491d839142aa99ef86a5ec697ce99857632228531512ea3fa74fb24d734"
+    },
+    {
+      "path": "research/complex-grid-prefix-audit/PROOF.md",
+      "usage": "input",
+      "git_blob": "30f019e14866200660cbd2ad82f3bff707003210",
+      "sha256": "9c2473e080a64de5139abf66680534043143ec9f4488ceabf62403702047a3ad"
+    },
+    {
+      "path": "research/e8-bit-p111-tuned/tune/EXPECTED.json",
+      "usage": "input",
+      "git_blob": "e293ddc557742637f9f679f083a1a282d87b1b13",
+      "sha256": "b9f0e5ca038abe837b0007c8fe006f366a6f02009244ac57705a8a200e2301f4"
+    },
+    {
+      "path": "research/e8-bit-p111-tuned/tune/bitE8mut-p111-tuned.json.gz",
+      "usage": "input",
+      "git_blob": "85a4499bf9e4911a705d50567a2c2ef6cf23739a",
+      "sha256": "e3e301e62bc2b41dbf1ceac0acf3d35824ebeab1848c5a2142d4577b109da52f"
+    },
+    {
+      "path": "research/gaussian-normalization-stream/SOURCES.json",
+      "usage": "input",
+      "git_blob": "58fce750dc2814f36ac096b407dd28293539bf8f",
+      "sha256": "c434302f4489366c1763f918ba59e2f57efc0a41d72310fd3c6bbe1553370275"
+    },
+    {
+      "path": "research/gaussian-normalization-stream/normalizer.py",
+      "usage": "input",
+      "git_blob": "5d1a0961ace6b7edccb26c05780623c5509a7597",
+      "sha256": "2b0acaa831219faf3e7776969bdcffc3f0f9c608b15d6b4c343ff20cf6a50107"
+    },
+    {
+      "path": "research/gaussian-parity-synthesis/REVIEW.md",
+      "usage": "input",
+      "git_blob": "0a6a4c7c1e8bef9c9aa9c7fb636e5ad6c0c411ae",
+      "sha256": "7d7b9ac63ccd2927f592e9edac1b4c11d58a6c74c5813d488e112f729090f60c"
+    },
+    {
+      "path": "research/gaussian-parity/gaussian-parity-certificates.tex",
+      "usage": "input",
+      "git_blob": "e364cff719a12a5dfd52f2975cd07cc0318da511",
+      "sha256": "e21e1063141cbc798e73052e22d01eec57f1c173a580041e55aa196b1b0479f8"
+    },
+    {
+      "path": "research/joint-query/certificate.json.gz",
+      "usage": "input",
+      "git_blob": "c6e876d8b48d768214deee265ade428f8983b566",
+      "sha256": "a5ed85fac5ebf3c091482a113ab0d351eb5a7892fe2841a35e16017ec1ff49f7"
+    },
+    {
+      "path": "research/joint-query/evidence/BRIDGE-REVIEW.md",
+      "usage": "input",
+      "git_blob": "86139908c418235588045324f0873de6ac9f9707",
+      "sha256": "d01b5f4959f7c91f835496d050dfae3eeab9dee2f581571c316a42571eaa1cd3"
+    },
+    {
+      "path": "research/joint-query/evidence/JOINT-QUERY-TRANSFER.md",
+      "usage": "input",
+      "git_blob": "a6805c58f23132f9420efebf90f5b7e863c2e179",
+      "sha256": "9e13e73ebf3192a6548798c2f1d13bd4d83957e8db0dc34de12b1a5311a52a75"
+    },
+    {
+      "path": "research/joint-query/source_data.py",
+      "usage": "input",
+      "git_blob": "c9d465ed47500304bef65fcb588befe356c5cf09",
+      "sha256": "d23924511e3aed41e5e64511ca70126a636d91c8aa02e656cb61d6ceca1fe0a0"
+    },
+    {
+      "path": "research/joint-query/verify_native.py",
+      "usage": "input",
+      "git_blob": "ede9e7e42744dd0c96790516a9acdfe07d180018",
+      "sha256": "1c58e7b6e8e1cde4df455c2129601c145ed763fc63a3ab427eb1058d1fc08bd2"
+    },
+    {
+      "path": "research/joint-query/verify_scalar.py",
+      "usage": "input",
+      "git_blob": "7a7051fa8a70f48589fa1fccd5c38fccb5eacbf7",
+      "sha256": "33bdbad17a0531fe527aff306eb235d9c38c1629db4fd167b989725930b0327a"
+    },
+    {
+      "path": "research/p104-whole-word-internal-grid/README.md",
+      "usage": "input",
+      "git_blob": "4075bb303592ccc53cd7d29399f15ff01c89da5d",
+      "sha256": "d98c0b0a4835d766852e960299dd87112375990ed645d2c9e84edb08b79500e4"
+    },
+    {
+      "path": "research/physical-complex-controller/PROOF.md",
+      "usage": "input",
+      "git_blob": "c505caecc7ced19a4efc35c423efedda9427bea5",
+      "sha256": "471185621c0ecce295ffd327b1244aed234efe5ff05a804aaaa11316f1a8319e"
+    },
+    {
+      "path": "research/physical-complex-controller/SOURCES.json",
+      "usage": "input",
+      "git_blob": "a56a247ecb28c77fcb055fac031be471b291777d",
+      "sha256": "c9c47d9df2445fc554673316d42f68f0a1b800ea3593ac568835c9b063025eb4"
+    },
+    {
+      "path": "research/physical-complex-controller/bank_packets.py",
+      "usage": "input",
+      "git_blob": "defda707199e8eba83ee483daf5ae7acb642c43c",
+      "sha256": "83e2f80fb72c906ccc7857f2b5139758ca8a997b17f51a5db29e2bb3c1143477"
+    },
+    {
+      "path": "research/physical-complex-controller/cohort.py",
+      "usage": "input",
+      "git_blob": "3876ab737f3c2a90100749e4ba141f1923caff79",
+      "sha256": "8fb650c0cc3dfaad94811149b0c0e725777a8cff195c5f21e21a7576494e84f1"
+    },
+    {
+      "path": "research/physical-complex-controller/cover.py",
+      "usage": "input",
+      "git_blob": "2b9b9df832a747bcb02505d5495f79d38deffa43",
+      "sha256": "d797daec10275f439f6019c596b89afbc32a7716cb657648adfcaae2408949da"
+    },
+    {
+      "path": "research/physical-complex-controller/fixture_binding.py",
+      "usage": "input",
+      "git_blob": "447ddc84d7dd9905c767c91acc7467a495093475",
+      "sha256": "efcb94cf050412ccd2d5eea592d77f294f6124f6feebc86580b16a73e5c2c202"
+    },
+    {
+      "path": "research/physical-complex-controller/grid_boundary.py",
+      "usage": "input",
+      "git_blob": "387576fc2f0701709237430febed7ea5b730828b",
+      "sha256": "55f32b8cfaa3482d5d62127ac90c2370fc0dc8122263815e1564ee95093ffccc"
+    },
+    {
+      "path": "research/physical-complex-controller/machine.py",
+      "usage": "input",
+      "git_blob": "92f9467ffd3346d672a0e2c56f2508e33ed21689",
+      "sha256": "b648792a361fdf98597a2f56c634767508be8e818b82e482fbfc60b5c63cc855"
+    },
+    {
+      "path": "research/physical-complex-controller/monomial_packets.py",
+      "usage": "input",
+      "git_blob": "5b4eaf49b3847cafa7bd99e7147c8818b248a021",
+      "sha256": "6856e80c13ebf3b6e9e0e142ed65420579b5a1b4892f23859d3c6e5f17a334b4"
+    },
+    {
+      "path": "research/physical-complex-controller/native_program.py",
+      "usage": "input",
+      "git_blob": "7d1c54c7d1394de28585d48b1a703d4b00069e98",
+      "sha256": "177d87445659d7ddbef11370d0b4cdc0596732147ed26c1fa11bad16ae53c93b"
+    },
+    {
+      "path": "research/physical-complex-controller/parking.py",
+      "usage": "input",
+      "git_blob": "34bc6a0bd0daade7ccc69d0c236984f024d22ef4",
+      "sha256": "33e6d2a6fcdc648de31b374132bf885259eec9748bafa6facca3822a78427e94"
+    },
+    {
+      "path": "research/physical-complex-controller/root_layer.py",
+      "usage": "input",
+      "git_blob": "389efd17af0f8d68711f0e7c6d8b6be65421e846",
+      "sha256": "247b82feefecedc12142379fd7c9c6cdd5ac7e5309e443c4b4fa703d6b995c21"
+    },
+    {
+      "path": "research/physical-complex-controller/root_plan.py",
+      "usage": "input",
+      "git_blob": "78390164c3551bfcce8da6b0f23197a4048a7e5e",
+      "sha256": "494cad3edc376928684f380cd16568076b286a53bd763d910d49efa5b03f07c9"
+    },
+    {
+      "path": "research/physical-complex-controller/root_streams.py",
+      "usage": "input",
+      "git_blob": "213144a6c905ac5dfbec9aaadc43f14eb4b1044d",
+      "sha256": "b67daf3de591b6788220a016b0394cfe2cc8e94ffd41426bb2544ad578b715c8"
+    },
+    {
+      "path": "research/physical-complex-controller/scalar_packets.py",
+      "usage": "input",
+      "git_blob": "66ea778399423005695bdea1e43ef9dcde903402",
+      "sha256": "cc48f726325c000ab2304eb691feb950ff4abeab5c537d6165d5b3322dc45c35"
+    },
+    {
+      "path": "research/physical-complex-controller/scalar_program.py",
+      "usage": "input",
+      "git_blob": "30ba678c7b828285d549e923b34e315e439b8452",
+      "sha256": "4c005167b4c2fe0d98d2dd93b7f931b251259417ff4392b67ee0fbe290f6d48a"
+    },
+    {
+      "path": "research/physical-complex-controller/selected_binding.py",
+      "usage": "input",
+      "git_blob": "5fe097ff688f5304a45945054e9d4a4af05f13d8",
+      "sha256": "d6583458d00e4933c3a3fd83cc376f21c059e9fc6aa338c00d66c1deeaa0e985"
+    },
+    {
+      "path": "research/physical-complex-controller/selected_source.py",
+      "usage": "input",
+      "git_blob": "6bdc133472e85d2230d59c91813390b3547caf8d",
+      "sha256": "02601c9e7d88e58e62d63509ff709c6498a40fbbc0f95fab328379ae6acaa87a"
+    },
+    {
+      "path": "research/physical-gaussian-leaf/PROOF.md",
+      "usage": "input",
+      "git_blob": "e98db470cdb8bfc49e9da86c39c0d6ae16e92716",
+      "sha256": "29ebd43146f921077f980a408915ecc3a5199a07fcdadc624a8282c06b0b8104"
+    },
+    {
+      "path": "research/physical-gaussian-leaf/SOURCES.json",
+      "usage": "input",
+      "git_blob": "2ae5d4a9bd2b62bf21fee81106fa9e38bbd84bd0",
+      "sha256": "c693fc79212652d7427560189ad8eb5e841fe71325e6d7a0d61e05f97438a5e1"
+    },
+    {
+      "path": "research/physical-gaussian-leaf/axis_stream.py",
+      "usage": "input",
+      "git_blob": "ba8230443fdb0370b72a7a617ba7d88eb23a9c37",
+      "sha256": "40dea1c6fa41effd8e7a61f39a3a599e897370ca118e332ee5301a905dbb2998"
+    },
+    {
+      "path": "research/physical-gaussian-leaf/coefficient_engine.py",
+      "usage": "input",
+      "git_blob": "dff2f099b60c23310a10665cd81e443282b249e8",
+      "sha256": "fff28cbc27b95ed546ac65f70279fa41a933421f1cd32b988ae8910632f0efcf"
+    },
+    {
+      "path": "research/physical-gaussian-leaf/inputs/pr3087.tar",
+      "usage": "input",
+      "git_blob": "6daedf70a927fa1359caec68d56fc0cbdaeb54dd",
+      "sha256": "d7e9c04a5e6d3f76158555d84080786c7cd8028ca31a61c9399de2b2c67bfd53"
+    },
+    {
+      "path": "research/physical-gaussian-leaf/leaf_sources.py",
+      "usage": "input",
+      "git_blob": "31c33dbed6061ca7c0455a9170fd05fb388f4607",
+      "sha256": "e0f958a0169257ba08eac5e025a3fc7ce99009efc18974cdd231f16758004014"
+    },
+    {
+      "path": "research/physical-gaussian-leaf/signed_linear.py",
+      "usage": "input",
+      "git_blob": "d17018a976ea4af15b6b5828a091d799435bacfc",
+      "sha256": "5b86afc33042e1c43eaa6957f94e0ebf403d1b07bb26d30ba89aa14d71f76078"
+    },
+    {
+      "path": "research/physical-scalar-stream/scalar_engine.py",
+      "usage": "input",
+      "git_blob": "aea19253f6a772047f22d2f0e1927b9bf319aba9",
+      "sha256": "be74c74862ff2b152d3752cb887c6682ddf2d889bc9f16f6328e418618e4c8b6"
+    },
+    {
+      "path": "research/physical-scalar-stream/scalar_words.py",
+      "usage": "input",
+      "git_blob": "36919dc569678656a1696f23454cba2d1fb0f393",
+      "sha256": "f4293c5ea5a7b65be920997f2ff33ce046ae3d9707ecbcecb3bd163d821dfd00"
+    },
+    {
+      "path": "research/pr589-five-helper-hosting/PROOF.md",
+      "usage": "input",
+      "git_blob": "bbd3f12b9a32b3ad3cba85a2d5a1b3054214fa02",
+      "sha256": "59cae781bfbe1a01ed9e66a8efeeb5a2b995e5ecdf908586b23ecc39f2b8d647"
+    },
+    {
+      "path": "research/pr589-five-helper-hosting/verify.py",
+      "usage": "input",
+      "git_blob": "dbc71f56bb4205ebe378ada1f9f4ea88630d1d39",
+      "sha256": "cf90e19ae9991b0698be03d395a8cc29061ecb307eb7fea19adfb2d23c25a367"
+    },
+    {
+      "path": "research/qq16-all-depth-producer-grid/PROOF.md",
+      "usage": "input",
+      "git_blob": "9cf1ec57646fb760fd26f206d754e52c99c347e3",
+      "sha256": "6dd878aa01807eecf4a37f7ce3fbc1105d79f6b1b06791b23d4deeef90b7d994"
+    },
+    {
+      "path": "research/qq16-caller-install/ADMISSION.json",
+      "usage": "input",
+      "git_blob": "804c010ce80fd9caa80ba2a2436aa39d630324db",
+      "sha256": "fef2407cc8cc081bfd5e5fa9dbee23d1d119b2b59b6fad0b3484593cdcfb0187"
+    },
+    {
+      "path": "research/qq16-caller-install/BILL.json",
+      "usage": "input",
+      "git_blob": "674b8493d82accb134de4884b7e6fa63c7d265db",
+      "sha256": "ccc10df473fb4bf7c2aa0b9e5c0ad01bf029ae9d2102dc1caa48ca59eb8e46a6"
+    },
+    {
+      "path": "research/qq16-caller-install/COMPILATION.json",
+      "usage": "input",
+      "git_blob": "a9f8017f06f7c9517b090f7d02bf408138ecb28e",
+      "sha256": "eda249c33de0924c3bff99a2ae2b0f137990808a904cb3c46d36399ea49703ed"
+    },
+    {
+      "path": "research/qq16-caller-install/CONTINUATION.md",
+      "usage": "input",
+      "git_blob": "c3d5959ec2815abd31f1f885712340caafcaa26b",
+      "sha256": "a2d928d14fcff9b16d4e88dd60237fd13b93fcf21d4996d7d98eeacd834e9867"
+    },
+    {
+      "path": "research/qq16-caller-install/COST.md",
+      "usage": "input",
+      "git_blob": "122f19d101be401800e9819f1d8fd3e7983e699b",
+      "sha256": "cf6d68babc70ac268f02fe53f3abfa5172b5204dbef692a94c4942a65bfc5b40"
+    },
+    {
+      "path": "research/qq16-caller-install/DECODER.md",
+      "usage": "input",
+      "git_blob": "2961fd8d8a2a98d4195167f82aad5249c698727d",
+      "sha256": "3bef6d83596ce8d90ea1d9f2da9ab081287f498b27e34cf56e7a46be643e56d9"
+    },
+    {
+      "path": "research/qq16-caller-install/EXECUTION.json",
+      "usage": "input",
+      "git_blob": "72e5c299de44b795057363c5ea4f6386ec57a1aa",
+      "sha256": "2d49db217eefa8e55f56476b90b9132ceddcb2986691b7aa20a8c555b725f0c8"
+    },
+    {
+      "path": "research/qq16-caller-install/LIFECYCLE.md",
+      "usage": "input",
+      "git_blob": "ed1e42e347eab6d74ee654f38a381bb835577049",
+      "sha256": "881153d57505325456c91bf8c5a3eca2980b634f792217d18e8a07130c8c08dd"
+    },
+    {
+      "path": "research/qq16-caller-install/PACKET.md",
+      "usage": "input",
+      "git_blob": "3e3142d427f48d4e7de3015ed65c4896658590ab",
+      "sha256": "dab89829f5553d945866219c2f668cec6a71a8f694effbe9ac0e3e091ee3e99b"
+    },
+    {
+      "path": "research/qq16-caller-install/PREDECESSORS.json",
+      "usage": "input",
+      "git_blob": "4eef989ff4beb190b0cf6aaab4d0459afc572c42",
+      "sha256": "57440a9f5cae02f123b38ad68e43928b694e7ca4e6569098c7904d7fe846b0c4"
+    },
+    {
+      "path": "research/qq16-caller-install/PRODUCER.md",
+      "usage": "input",
+      "git_blob": "c22aa5ac997d4097a164cad39a15592be77ff608",
+      "sha256": "49b360232f422e299a17cf908f1a39d44847dbe1cd11ec2e5f8533f60829ba70"
+    },
+    {
+      "path": "research/qq16-caller-install/PROOF.md",
+      "usage": "input",
+      "git_blob": "a19beac6fc3b56625dc4caf684d47c7c28f23e7e",
+      "sha256": "fde109910f348266a4781239d9b673e27ed335a33549d29a1914fa485855f158"
+    },
+    {
+      "path": "research/qq16-caller-install/README.md",
+      "usage": "input",
+      "git_blob": "d1d42d5e494f22a9db6da8ae4539d9edf2165334",
+      "sha256": "b781f1cd3ff625c5cf1264f8cf61f9b4413ea3516e35b3984d816bbf45b25fdc"
+    },
+    {
+      "path": "research/qq16-caller-install/RESULT.json",
+      "usage": "input",
+      "git_blob": "94f0c6dc816f5280bb2d06414e6c0f2cb9a8deb0",
+      "sha256": "08e59d781a60aa0eb49bc86cb819111ad4e0ccf9ce9807d8fb09fa12884c7925"
+    },
+    {
+      "path": "research/qq16-caller-install/REUSE.json",
+      "usage": "input",
+      "git_blob": "7439823c3c52f7244e87c5fbd8b13dd19875b2f4",
+      "sha256": "3c1954483d8f8769335ac81cbc87ec9fdf9956b0ffac6bd82b5d999e77ce5f8d"
+    },
+    {
+      "path": "research/qq16-caller-install/REVIEW.json",
+      "usage": "input",
+      "git_blob": "23bea95cf478b0477da6dade0a38a613118732c9",
+      "sha256": "d6f3d15890224125ec40849d88601d00f993458335db3e60081bd97e2e739950"
+    },
+    {
+      "path": "research/qq16-caller-install/SOURCES.json",
+      "usage": "input",
+      "git_blob": "54df1264ecc0f082c595f7670bfac9e3505a6450",
+      "sha256": "3ba36d49185c81691dc8c5a87f3f80a0540579bfd8b97658a52037aaa62274a6"
+    },
+    {
+      "path": "research/qq16-caller-install/TASK.json",
+      "usage": "input",
+      "git_blob": "4a960f18037f3e8fd956fca8011f4ebe55fa5f6a",
+      "sha256": "59884e2b7ac9d8c26e01807eae431e4e47fe9b2f8206678c81a8d06e91fe6848"
+    },
+    {
+      "path": "research/qq16-caller-install/VERIFY.json",
+      "usage": "input",
+      "git_blob": "fa219dde4e9b43f7a95b06ed151ce7c5092e6214",
+      "sha256": "b3d0eb4cfff3b0a885d6b4bb7b11aa961f57526dee4e3b7ae0e25d3e1164d839"
+    },
+    {
+      "path": "research/qq16-caller-install/auth.py",
+      "usage": "input",
+      "git_blob": "b49b3a87709a05659a44afc85216a53fb0ee8d63",
+      "sha256": "98cd015d9b6c9501f36a305b58f9bef88b904b9d6bbd921e0a6ecd351b960a79"
+    },
+    {
+      "path": "research/qq16-caller-install/connection.py",
+      "usage": "input",
+      "git_blob": "8d010eeece6622ea7dfbf1462ecd4ae1b0702c61",
+      "sha256": "3da2ac158a6f36a568d0873cbb45f230ba8fa609cf8092bfbd55da83bae498c2"
+    },
+    {
+      "path": "research/qq16-caller-install/continuation.py",
+      "usage": "input",
+      "git_blob": "0639356935a69610c3ab1c79e96d56887ce711b8",
+      "sha256": "9fa2de5d79768b4130f81a74f29f388ffc28c990512a9fa22921ec2d75401aca"
+    },
+    {
+      "path": "research/qq16-caller-install/cost.py",
+      "usage": "input",
+      "git_blob": "01da5024495a16a8ad6cfb5be2dcd7ac0a36fdd6",
+      "sha256": "935b23fee0abdce52279820febce93d23a2095f347ddf0da4fbd424995b99842"
+    },
+    {
+      "path": "research/qq16-caller-install/decoder-fixture.py",
+      "usage": "input",
+      "git_blob": "c6829e39be76da90c695162afa00dffd89e64db0",
+      "sha256": "b09b2751fccc37e3c2c864ce89aa13bbdc6bfba3296bbb816b9636ff1fbffea4"
+    },
+    {
+      "path": "research/qq16-caller-install/decoder.py",
+      "usage": "input",
+      "git_blob": "edc8bdbd22083b7d9f8648fef1c12460572c6885",
+      "sha256": "e169a8b160bfa89dd22bc618df1ed947ebe668e82bca1014c70781ff9dcf75ce"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR3055-PROOF.md",
+      "usage": "input",
+      "git_blob": "f65f38123ca0adb02f6ca69351cbfc933506e5cb",
+      "sha256": "ec6395822ae500242f3fe5e2cf40caf9a7f9fa259d475d2c14970d951ff4df48"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR3380-PROOF.md",
+      "usage": "input",
+      "git_blob": "d32e60ad65aee0b2a1663d5d739e78c3bf03009a",
+      "sha256": "c208f16c93be22795b9b01a5a1702a446541163ebf823251b12a891597077826"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR3464-PROOF.md",
+      "usage": "input",
+      "git_blob": "1e241b1e9e46a5d41bd29d4413e326104407adc2",
+      "sha256": "b3c41ea0f812315a7bab877edecc911e6dffb5b596f4135a39c3d5b99aae14c5"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR3464-bank_packets.py",
+      "usage": "input",
+      "git_blob": "defda707199e8eba83ee483daf5ae7acb642c43c",
+      "sha256": "83e2f80fb72c906ccc7857f2b5139758ca8a997b17f51a5db29e2bb3c1143477"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR3464-machine.py",
+      "usage": "input",
+      "git_blob": "92f9467ffd3346d672a0e2c56f2508e33ed21689",
+      "sha256": "b648792a361fdf98597a2f56c634767508be8e818b82e482fbfc60b5c63cc855"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR3464-parking.py",
+      "usage": "input",
+      "git_blob": "34bc6a0bd0daade7ccc69d0c236984f024d22ef4",
+      "sha256": "33e6d2a6fcdc648de31b374132bf885259eec9748bafa6facca3822a78427e94"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR3464-selected_binding.py",
+      "usage": "input",
+      "git_blob": "5fe097ff688f5304a45945054e9d4a4af05f13d8",
+      "sha256": "d6583458d00e4933c3a3fd83cc376f21c059e9fc6aa338c00d66c1deeaa0e985"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR3607-PROOF.md",
+      "usage": "input",
+      "git_blob": "158cd78492161aeab75ba09f050a8e5d1a91ef71",
+      "sha256": "fab92623c04ff43868c1cf787b0fbdf619e81301a83f6272f6d33cadf6c42f9d"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR3619-PROOF.md",
+      "usage": "input",
+      "git_blob": "afaff74d38945d26d02f4fc8e9884b4f811d8249",
+      "sha256": "88edbc9718c00302c0aae2036a32e4d9f534090a9754eb7d267707e637971cbb"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR3993-PROOF.md",
+      "usage": "input",
+      "git_blob": "51e4fade5fdcec75be981d0be77d3f8ab2aced53",
+      "sha256": "18a0b88a25817aee02356fc8156ecfb6f175a3689dc16b2eb31e23ad4bdf83e9"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4106-WORD.json",
+      "usage": "input",
+      "git_blob": "6c6f726cd14010f9763155518f833862eb167263",
+      "sha256": "b4f2b5662734178d02a5d620ebd071bc284abd4d9b6dbe11b5d9646455a0f021"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4114-README.md",
+      "usage": "input",
+      "git_blob": "cc4743dd9d56f0facc6e63f7a67b1b03f9cf37f5",
+      "sha256": "734d8d3578be00e6899bd500b91f0fe992e13d3921faebc9fc2400d32e208bd6"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4129-COST.md",
+      "usage": "input",
+      "git_blob": "989da4b71d9f3c8bb43b7e2f975c1d9c7f590a54",
+      "sha256": "05699f427530cc0417e28bd1c3a94b018ffdd0d5c4bc9f4261d49a557e293d9b"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4129-NATIVE.md",
+      "usage": "input",
+      "git_blob": "c0133ac0e758b3ab8ebf053811910404a2e74f24",
+      "sha256": "567e4d12ac7d57f5916d7ecc24c77cd351ce3fcc966acf8348d7288ee9801b03"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4129-PREDECESSORS.json",
+      "usage": "input",
+      "git_blob": "e7e6b6130fea5737b24f24fa668d1d3202a02ed4",
+      "sha256": "209170a530f2ec5897edb102c029863bada01409fb2f838132a94127ff768315"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4129-PROOF.md",
+      "usage": "input",
+      "git_blob": "5de56af0213bf710ae3e832f21de74cf0ac9c7b0",
+      "sha256": "b547277ab5380b218893908a3e8e8874efc0cf3f9717b582f8972698d87418a2"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4129-README.md",
+      "usage": "input",
+      "git_blob": "71858dcddef078456016716c05d7e310eee77bcc",
+      "sha256": "fd47f198b534ae0b9a1d1896614100c56145dc5004650de6c9d4b27a8cba219a"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4129-RESULT.json",
+      "usage": "input",
+      "git_blob": "af630ea7b9fcfab3e399191437405332d5067e03",
+      "sha256": "7dd05d54817202d86de77b550b0e68517756eb8ec71d3b591ebde0cb4e9e2389"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4129-SOURCES.json",
+      "usage": "input",
+      "git_blob": "e7121d9892727c96dcb7c9bbe92d32b1e0596cc5",
+      "sha256": "d4b3343f6f6b1d08a2879df693e6d2ab89246615f20fb978a4e9cbfd5ee2e26d"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4129-TASK.json",
+      "usage": "input",
+      "git_blob": "e031101d7f1bf6344b273912d896145f4ce57599",
+      "sha256": "73729ec6260d118bd0a73fd89576f2c33aff772d4a932bb56330ac42fdb326d3"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4129-bridge.py",
+      "usage": "input",
+      "git_blob": "4d5d99ee8f1da0eaa941e7040be8cefafb984e1f",
+      "sha256": "120cd3a2d0deb44b9c059636b1ac9bdd8a6b998143718f4252794780edf7decb"
+    },
+    {
+      "path": "research/qq16-caller-install/inputs/PR4129-construction.py",
+      "usage": "input",
+      "git_blob": "79573076c53126618c125c9ad4d21c06ee70a8ba",
+      "sha256": "bbfb0014e8636ab4f66ff925189fd523fd4e8e377aec51509f4f3fe6877c3007"
+    },
+    {
+      "path": "research/qq16-caller-install/installer.py",
+      "usage": "input",
+      "git_blob": "fdb932baa00482d61b4ab48ca1413dd45ba319a3",
+      "sha256": "6af289c0b21c11dad7efaa2f7373ad0f61a3d1d6975bcfb5d1560320373260df"
+    },
+    {
+      "path": "research/qq16-caller-install/integrated-fixture.py",
+      "usage": "input",
+      "git_blob": "871a21846e5b0479ba22f5b63c912990322442e3",
+      "sha256": "e4f8bcc947e761ca4f1efb825794210dfd56ca79e049a5207fbfad26ee7e71ae"
+    },
+    {
+      "path": "research/qq16-caller-install/lifecycle.py",
+      "usage": "input",
+      "git_blob": "56c16368013ba2ba212890325f34039326040747",
+      "sha256": "2eadca77717ee28c24dd6ff175a115277a83d852c56d320cc93937cab27e5191"
+    },
+    {
+      "path": "research/qq16-caller-install/packet.py",
+      "usage": "input",
+      "git_blob": "9b965f8f639e1deafdd6f0c4b2f078bb47d368c2",
+      "sha256": "d8f4e63feae1ed372951ba5643dadf02e2af006bf3632d29137e92d05067234e"
+    },
+    {
+      "path": "research/qq16-caller-install/physical.py",
+      "usage": "input",
+      "git_blob": "79a8a5b82e7b775e3c069a6cc07ef07406213118",
+      "sha256": "d37813bcfbdd95f2e1b756d6f978ba2fdd4ec2b82212f2b7b228cb3422ee9b0a"
+    },
+    {
+      "path": "research/qq16-caller-install/producer-fixture.py",
+      "usage": "input",
+      "git_blob": "84e4552c75b4d58035306cd3bcfdaa44409fa50d",
+      "sha256": "4744a12cc9c015f6cfa6bddff6886f2eb163fec4ff2e3e07556cb37152c2ebf3"
+    },
+    {
+      "path": "research/qq16-caller-install/producer.py",
+      "usage": "input",
+      "git_blob": "7abf64aba3e6813afe26f68b9cbb09e1d9cb181d",
+      "sha256": "69a7cc6c9545a0d8684a529d6365345c337276f9c8faaf2dcdb0923ca72c396d"
+    },
+    {
+      "path": "research/qq16-caller-install/runtime.py",
+      "usage": "input",
+      "git_blob": "c037424904ad291598670851de348c3fe9559038",
+      "sha256": "ec760da8c8799ebb0c02e4ec0464d50c627e24d6a64514ab8f753d9d10cb8764"
+    },
+    {
+      "path": "research/qq16-caller-install/test_verify.py",
+      "usage": "input",
+      "git_blob": "6a00d4d61147037d8098f9c1f44561b9fab31c78",
+      "sha256": "08388023367b028f3d98fbfc3188505d12d6b11f23ae563b104238c68f9ddf0c"
+    },
+    {
+      "path": "research/qq16-caller-install/verify.py",
+      "usage": "input",
+      "git_blob": "7639dca0296fb8d7d3c2d8d828bb0cd0f271eaf7",
+      "sha256": "46f16651383d5677e641c3e2fed86b6c2f3b62834d0be1699cfa03a1de0385ec"
+    },
+    {
+      "path": "research/qq16-complete-cost/inputs/PR4172.tar",
+      "usage": "input",
+      "git_blob": "9c28c6447f46e7156557131ff26cb4c33ffcb8cd",
+      "sha256": "ebfb717d60bf37b8edd894036827210a93c2594d637d4a6b8d617018567767a3"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/PREDECESSORS.json",
+      "usage": "input",
+      "git_blob": "db77dbf21b0f89b1f5bdbd308ab20d0045f61561",
+      "sha256": "a8be0439e350d7a634a188176894ec51180efc0d236a56b293d39dc96383a87d"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/PROOF.md",
+      "usage": "input",
+      "git_blob": "f7c694ff54e590416e4a52fa762f9d3b9474bccb",
+      "sha256": "0a0995e70f2a64c15cdd1aee66634d1ba221cbcb2a7cfa3a4d4950a37d0e143a"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/RESULT.json",
+      "usage": "input",
+      "git_blob": "ba4167dbf133cff51513bb832802c290edcdffea",
+      "sha256": "58df4ad68e2ff335ee58fa4336a449d0f73f3366d840574e5e30b50f507c358d"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/SOURCES.json",
+      "usage": "input",
+      "git_blob": "300c183db8d263899ee1795033af215ba6522b9f",
+      "sha256": "66bf8f57019632ef45780769c6f112d287e145e23ff03336998589b474165fbe"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/vendor/pr2681/PROOF.md",
+      "usage": "input",
+      "git_blob": "38cd38aa1d342f3bfe0d6d7f3c388aff0352f370",
+      "sha256": "471f6360cdac94d9e1054c6c9530ace1822b11942f7e141dfd344864d2357862"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/vendor/pr2681/README.md",
+      "usage": "input",
+      "git_blob": "c3d4d76b28fa47b86da37cc7428d5da362c7bf9a",
+      "sha256": "b658e00db095f1097b9ae7ec49d8dd465c1a317cdc84da4251cbdd3e0af597d3"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/vendor/pr2681/RESULT.json",
+      "usage": "input",
+      "git_blob": "a16a8f9a23cd00c9030f9b03cf0ae52c0ff4b526",
+      "sha256": "e4f3ff28be27f96c341b225a62a2ba84d3907ed3466122d18bcaaf5a60da740e"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/vendor/pr2681/SOURCES.json",
+      "usage": "input",
+      "git_blob": "1db7201ed145d1ef3707ab24bb599d341439050d",
+      "sha256": "30a88d8bf33c603836fffdcab3c3dabf663b98f2deda95893685e394c60ea95c"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/vendor/pr2681/WORD.json",
+      "usage": "input",
+      "git_blob": "80de97cf168441a888e7d05fc2c3cace919f31ec",
+      "sha256": "f02e57d238f127c8fd195dc6a4a9dce6db6bee9f6050bd9d5b9c14cf6e1946d0"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/vendor/pr2681/references/PR2540-PROOF.md",
+      "usage": "input",
+      "git_blob": "6ae136c8baef4793f4f7ae630720afff6c23a953",
+      "sha256": "09d587f1d6bc250e90e29fa8751a40f45be79f1a8a56af0b645c144cefaefa46"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/vendor/pr2681/references/PR2540-README.md",
+      "usage": "input",
+      "git_blob": "e91138fb0fabbc0fe0e9fd80ee189ed4366a0f61",
+      "sha256": "07588c3863b8d686497d9c0b263c35c47424fa3b63d43b7c2e5f788bd31a8d3f"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/vendor/pr2681/verify.py",
+      "usage": "input",
+      "git_blob": "99bd60a9139b4d7ef070b69f38a954e64e0f8aa1",
+      "sha256": "71f9a010553691e892703e3ec8d5eedf3e48d72b7f6af24b954a5442f4a52ccf"
+    },
+    {
+      "path": "research/qq16-line-normalized-decoder/verify.py",
+      "usage": "input",
+      "git_blob": "a8f3c811108414eda0b507d295cfc9301c04d585",
+      "sha256": "0f6fb86aafb74b9722f20cc97af70a3a3c78bd012c142b2eaa19cb00e02d1fe9"
+    },
+    {
+      "path": "research/qq16-nonterminal-c8-tree/README.md",
+      "usage": "input",
+      "git_blob": "55bd5ce66846b5ddf124c655c617a8b47b52d9b7",
+      "sha256": "e57f9c84275c5cf0baf914322392a8ba0b39e014490c396ed1da85fb005337a2"
+    },
+    {
+      "path": "research/qq16-nonterminal-c8-tree/RESULT.json",
+      "usage": "input",
+      "git_blob": "8c11adabc19648de3ebcfb20cbad1cd47ee63e5d",
+      "sha256": "0e3fbddf58103dd04c2bdf2912b30c218e3e68a974aac868bd07b2cc1280230b"
+    },
+    {
+      "path": "research/qq16-protected-return-caller/README.md",
+      "usage": "input",
+      "git_blob": "2e4c95780f25f02c8880bcf78c7e6430c152d276",
+      "sha256": "33aa76b07a5631efbdb8dd4736df8014de325b5f26a1d6090e83b099a87c358a"
+    },
+    {
+      "path": "research/qq16-protected-return-caller/RESULT.json",
+      "usage": "input",
+      "git_blob": "c7fb1a147dab1f39e45a3d946242b214968d4e72",
+      "sha256": "4495e3a116bc8be86cc21765fff62f68d9822c57d9b13bc0a2ce8904dd2f0a9f"
+    },
+    {
+      "path": "research/qq16-protected-return-caller/SOURCES.json",
+      "usage": "input",
+      "git_blob": "9f76f7ff2be9938fe9de935704be11cf09261304",
+      "sha256": "c430fb1b15ca4a3c6549de33da81f854155dea056ce34a20a50917765df347f2"
+    },
+    {
+      "path": "research/qq16-protected-return-caller/TASK.json",
+      "usage": "input",
+      "git_blob": "042a544a8a0e903150e6d0857485dc258cfeb884",
+      "sha256": "0479256600172d68fffb0febe70cdc2a5dacf2627b8654661b792d6f907c60e4"
+    },
+    {
+      "path": "research/qq16-protected-return-caller/VERIFY.json",
+      "usage": "input",
+      "git_blob": "de2b8fe81945c5199bb7da0553dd29eec56e1d5a",
+      "sha256": "7394d2b99c4c81bf7d98ae0c1f6442dc49bb3b63b764a4ba39fac5410ebc280e"
+    },
+    {
+      "path": "research/qq16-protected-return-caller/adapter.py",
+      "usage": "input",
+      "git_blob": "d25a04b9bbfd01851aabe905cc73837dda8ec2ed",
+      "sha256": "af3e39b64483075fc8dcee9fe13fecff643b30e22a861bce8fd4770f243df53a"
+    },
+    {
+      "path": "research/qq16-protected-return-caller/verify.py",
+      "usage": "input",
+      "git_blob": "1bcd5f9a1a5010fcf1cc4de04faa73059d092ec4",
+      "sha256": "798f1d0eb25cace11bd7e5fae344930a4e29170226ba036bfe6654f0ef590f98"
+    },
+    {
+      "path": "research/qq16-return-inventory-audit/README.md",
+      "usage": "input",
+      "git_blob": "475e025eb1223ee58420b5a8b5b8b7d61f5ca375",
+      "sha256": "628c2af14456316d784edb02a380966131ff4bcba5171237091e286752ec3fca"
+    },
+    {
+      "path": "research/qq16-tagged-cover-routing/PROOF.md",
+      "usage": "input",
+      "git_blob": "44725131a9ecb8b41533492efa7a83bd65aca9ae",
+      "sha256": "1b32c88e6c6ace2b41a1f2168a6754c329fb1bf9a5b64cf3fec53b31085604ea"
+    },
+    {
+      "path": "research/qq16-tagged-cover-routing/oracle.py",
+      "usage": "input",
+      "git_blob": "555efb4b105c6bc59395f445625eb335688cd6aa",
+      "sha256": "00328380126faa55b9f8027c81872663985610a247d0a61108951b394ad27fff"
+    },
+    {
+      "path": "research/qq16-tagged-cover-routing/router.py",
+      "usage": "input",
+      "git_blob": "1994ad9fa80e5fbce5b58dffed0c44d89a7259a7",
+      "sha256": "a5221ec8a3a38b5d0133abc685ec28e392e946ef5b60dec37f69a605a45ba7ce"
+    },
+    {
+      "path": "research/qq16-tagged-cover-routing/verify.py",
+      "usage": "input",
+      "git_blob": "c89b57e23f8e5167c64128763807f4c379e862a0",
+      "sha256": "05b06299545c7fc74de34d13951e083cc7f8f8ab1e9b9c8eb96df892a430776e"
+    },
+    {
+      "path": "research/r437-leaf-dispatch/retained/selected-result.json",
+      "usage": "input",
+      "git_blob": "b1fea0c94436b236cc2b7d41a7be032811b94c81",
+      "sha256": "bb2eaa58647b353f88d0aec2eafb9d30df1be53589231b23e12ceef3e4bad129"
+    },
+    {
+      "path": "research/recursive-parking-boundary/README.md",
+      "usage": "input",
+      "git_blob": "251f335ebaccc11d69393ee7aeb5a2e84526d0bb",
+      "sha256": "491aa208391ee4c2936510b1a5c5c018dd5509d9a0e88687c72ab8406cd77b18"
+    },
+    {
+      "path": "research/selected-bit-local-ring-sweeps/PROOF.md",
+      "usage": "input",
+      "git_blob": "4330de85dd9862ed15d84ab917887d249753df99",
+      "sha256": "846c59440cc99e28bae93ad2af99525bc769de29368080071b8427141215b4f7"
+    },
+    {
+      "path": "research/selected-bit-recursive-closure/PROOF.md",
+      "usage": "input",
+      "git_blob": "6c410cab5713979214a45835091fbeb9ee9b8531",
+      "sha256": "74cc8de20f21acb5123fe2d20996fe0925ea6e51b3dec633bd5221fb719b3344"
+    },
+    {
+      "path": "research/selected-complex-layer-closure/PROOF.md",
+      "usage": "input",
+      "git_blob": "d7ec0d101405a5f099f55f6a73e9791731737fd0",
+      "sha256": "43feda0342c07a9429699c3a44e8936a3f3fb57ce9b32f38ff3dc06ac887b265"
+    },
+    {
+      "path": "research/selected-complex-layer-closure/arithmetic.py",
+      "usage": "input",
+      "git_blob": "009d7b7166718832ebbf11893cb1ef258184a4f9",
+      "sha256": "31e4b21bb64924d723d1248a7eccf4e9c80d323ba8784804af79a75da18c346a"
+    },
+    {
+      "path": "upstream/build/sections/02-streams.tex",
+      "usage": "input",
+      "git_blob": "088fceea1867abc76271d7efe7532b779fee9039",
+      "sha256": "606c80db61cad13aa0c3b6060dc4b88dbbe7ac60cdd831aa93f28d908fd09dab"
+    }
+  ]
+}
diff --git a/research/qq16-finite-handle-charge/TASK.json b/research/qq16-finite-handle-charge/TASK.json
new file mode 100644
index 0000000000..b20fa454c1
--- /dev/null
+++ b/research/qq16-finite-handle-charge/TASK.json
@@ -0,0 +1,103 @@
+{
+  "schema_version": 1,
+  "task_id": "joint-query-controller",
+  "priority_revision": 7,
+  "base_commit": "b91956876e5b4122fd89179f1b57557ff8378f15",
+  "original_card": {
+    "id": "joint-query-controller",
+    "question": "Can the installed QQ16 caller win a complete matched protocol bill, or can a changed demand eliminate actual paid work?",
+    "starting_points": [
+      "docs/research/research-family-status.md",
+      "certificates/selected-result.json",
+      "research/qq16-caller-install/README.md"
+    ],
+    "methods": [
+      "Derive the matched whole-caller physical bill for installed and baseline protocols.",
+      "Change the actual demanded observations and prove a cheaper legal producer/consumer contract."
+    ],
+    "acceptance_gate": "Name the changed premise of the fixed F0/B1 observation obstruction. Show exactly which query is recovered, legal native reads and restoration, and a full favorable budget including cover maps, helpers and endpoints. Local inverse identities alone do not close the global controller. A scoped local result may be retained without a complete supplier. Expanding it into further construction rounds requires the family-level budget and obligation gate in research-family-status.md; an optimistic passing relaxation alone is not acceptance.",
+    "first_step": {
+      "command": [
+        "python3",
+        "-B",
+        "scripts/research_baseline.py"
+      ],
+      "expected": "PASS_RESEARCH_BASELINE_BINDINGS_ONLY",
+      "inspect": "Read #4166 COST.md and ADMISSION.json. An actual caller connection is now proposed. Its native-component profile loses; parent park/restore versus external-call costs remain unresolved. Retain the producer and recovery lineage rather than rebuild it.",
+      "scope": "Source-binding orientation only; no scientific replay, theorem acceptance or supplier admission. Budget any heavy replay separately."
+    },
+    "first_experiment": "At the actual installed cut, compare matched complete parent park/restore and external input/return protocols at the same bank/packet geometry, including every later root call and service cost. Alternatively pin both bridge observations and derive a genuinely smaller source-compatible demand. Stop if the complete necessary inequality fails or an essential cost is unknown; no larger decoder scan from a local tape-action saving.",
+    "bottleneck_link": "The native local words exist; retained query information and its physical access are the missing link to a composed recursive interface.",
+    "allowed_variations": [
+      "One paid query, one changed first pair, or one precisely specified affine helper state.",
+      "A counterexample or lower bound for that exact proposed repair.",
+      "One unresolved obligation of a newer local decoder, with exact source heads and a distinct claim/domain."
+    ],
+    "scope_change_triggers": [
+      "Retaining the fixed first pair and ordinary schedule while allowing only homogeneous selected-only control, already excluded by the witness.",
+      "Treating cover-map counts as zero-cost physical address operations.",
+      "Recreating the pending complete local decoder or early-record/output-bank coalescing already under investigation without a distinct audit or changed premise.",
+      "Treating a completed-output defect inequality as a producer-interior, dirty-range or physical-cost certificate.",
+      "Recreating completed-output recovery or caller wiring already supplied by #4166 without new independent coverage.",
+      "Dropping retained later root calls or claiming native-profile dominance from the isolated publication saving."
+    ],
+    "overlap_terms": [
+      "QQ16",
+      "joint-query",
+      "changing-chart controller",
+      "selected observation",
+      "1969",
+      "2540",
+      "early record",
+      "output-bank retention",
+      "complete native decoder",
+      "2965",
+      "producer defect",
+      "dirty-helper range",
+      "F17 consumer",
+      "4166",
+      "qq16-caller-install"
+    ],
+    "existing_checks": [
+      {
+        "scope": "PR #4166: author-checked installed producer/service/return/bridge connection; native-component comparison loses.",
+        "evidence": "research/qq16-caller-install/README.md",
+        "remaining": "Complete matched physical protocol bill, or changed source-compatible demand/circuit; no affordable supplier yet.",
+        "status": "author-checked",
+        "source_commit": "0b082d22a0e9a442d264ab0633e35ef26c790630",
+        "selected_record_sha256": "bb2eaa58647b353f88d0aec2eafb9d30df1be53589231b23e12ceef3e4bad129"
+      }
+    ]
+  },
+  "scope_status": "refined",
+  "actual_scope": "Conditional bounded-graph sequential-handle charge for the actual QQ16 installed inventory controller, including initialization and all producer/service returns.",
+  "scope_change_reason": "After #4790 ownership composition, #4949 arrangement audit and #4956 portable integration, finite-control pricing remains open. Quantify an explicit encoding/addressed-control contract without repeating those scopes.",
+  "bottleneck_link": "Inventory checks traverse a phase-dependent source object graph; finite handles and initialization cannot be treated as zero-cost pointer operations.",
+  "budget_minutes": 60,
+  "stop_rule": "Stop at the exact conditional graph/encoding boundary; do not infer a production graph cap or D* versus B* advantage from reduced logs.",
+  "outcome": "partial",
+  "evidence": "Executable sequential-handle kernel, independently expanded bit-access tests, authenticated unchanged actual caller trace, complete call-site census and cap/field/width controls.",
+  "author": "JoyboyBrian, with substantial OpenAI Codex assistance",
+  "ai_assistance": "Substantial OpenAI Codex assistance for source analysis, conditional model, implementation and verification.",
+  "open_questions": [
+    {
+      "question": "What uniform K bounds the complete encoded owner graphs over all admitted production caller phases?",
+      "why_it_matters": "The reduced trace does not certify production object-graph size.",
+      "first_step": "Bind the actual Ordinary/controller object and lease graph to its compiled geometry at every return.",
+      "blocked_by": "No production graph invariant is supplied."
+    },
+    {
+      "question": "What is the complete frontend/encoding and remaining-control charge F for a physical embedding?",
+      "why_it_matters": "The metadata kernel cost alone is not the entire signed machine-step difference.",
+      "first_step": "Implement the fixed-width bit-store interface and source encoder with paid construction and auxiliary-space accounting.",
+      "blocked_by": "The source compiler and full physical embedding remain unpriced."
+    },
+    {
+      "question": "Does the complete D* versus B* ledger become favorable at an admitted geometry?",
+      "why_it_matters": "All unmatched candidate and baseline intervals must be included.",
+      "first_step": "Combine the credited return saving and conditional metadata charge with the nonchild/native ledger exactly once.",
+      "blocked_by": "Other unmatched costs remain open."
+    }
+  ],
+  "canonical_discussion": "https://github.com/CrocSwap/integer-mult-bounds/discussions/4744#discussioncomment-19138319"
+}
diff --git a/research/qq16-finite-handle-charge/VERIFY.json b/research/qq16-finite-handle-charge/VERIFY.json
new file mode 100644
index 0000000000..92577d1270
--- /dev/null
+++ b/research/qq16-finite-handle-charge/VERIFY.json
@@ -0,0 +1,175 @@
+{
+  "schema_version": 1,
+  "status": "ready",
+  "python": "3.12",
+  "requirements": [],
+  "inputs": [
+    "notes/batched-complex-rows.tex",
+    "notes/compact-control-layout.tex",
+    "notes/compact-control-movement.tex",
+    "research/bit2234-stock-threshold/README.md",
+    "research/community-frontier1042-audit/selected-replay.tar.gz",
+    "research/community-frontier1094-audit/selected-replay.tar.gz",
+    "research/community-hyperplane599-audit/pr589/bit589/v9/hosted/GLOBAL-TEMPLATE.json.gz",
+    "research/community-hyperplane599-audit/pr589/bit589/v9/nine/GEOMETRY.json",
+    "research/complex-grid-prefix-audit/PROOF.md",
+    "research/e8-bit-p111-tuned/tune/EXPECTED.json",
+    "research/e8-bit-p111-tuned/tune/bitE8mut-p111-tuned.json.gz",
+    "research/gaussian-normalization-stream/SOURCES.json",
+    "research/gaussian-normalization-stream/normalizer.py",
+    "research/gaussian-parity-synthesis/REVIEW.md",
+    "research/gaussian-parity/gaussian-parity-certificates.tex",
+    "research/joint-query/certificate.json.gz",
+    "research/joint-query/evidence/BRIDGE-REVIEW.md",
+    "research/joint-query/evidence/JOINT-QUERY-TRANSFER.md",
+    "research/joint-query/source_data.py",
+    "research/joint-query/verify_native.py",
+    "research/joint-query/verify_scalar.py",
+    "research/p104-whole-word-internal-grid/README.md",
+    "research/physical-complex-controller/PROOF.md",
+    "research/physical-complex-controller/SOURCES.json",
+    "research/physical-complex-controller/bank_packets.py",
+    "research/physical-complex-controller/cohort.py",
+    "research/physical-complex-controller/cover.py",
+    "research/physical-complex-controller/fixture_binding.py",
+    "research/physical-complex-controller/grid_boundary.py",
+    "research/physical-complex-controller/machine.py",
+    "research/physical-complex-controller/monomial_packets.py",
+    "research/physical-complex-controller/native_program.py",
+    "research/physical-complex-controller/parking.py",
+    "research/physical-complex-controller/root_layer.py",
+    "research/physical-complex-controller/root_plan.py",
+    "research/physical-complex-controller/root_streams.py",
+    "research/physical-complex-controller/scalar_packets.py",
+    "research/physical-complex-controller/scalar_program.py",
+    "research/physical-complex-controller/selected_binding.py",
+    "research/physical-complex-controller/selected_source.py",
+    "research/physical-gaussian-leaf/PROOF.md",
+    "research/physical-gaussian-leaf/SOURCES.json",
+    "research/physical-gaussian-leaf/axis_stream.py",
+    "research/physical-gaussian-leaf/coefficient_engine.py",
+    "research/physical-gaussian-leaf/inputs/pr3087.tar",
+    "research/physical-gaussian-leaf/leaf_sources.py",
+    "research/physical-gaussian-leaf/signed_linear.py",
+    "research/physical-scalar-stream/scalar_engine.py",
+    "research/physical-scalar-stream/scalar_words.py",
+    "research/pr589-five-helper-hosting/PROOF.md",
+    "research/pr589-five-helper-hosting/verify.py",
+    "research/qq16-all-depth-producer-grid/PROOF.md",
+    "research/qq16-caller-install/ADMISSION.json",
+    "research/qq16-caller-install/BILL.json",
+    "research/qq16-caller-install/COMPILATION.json",
+    "research/qq16-caller-install/CONTINUATION.md",
+    "research/qq16-caller-install/COST.md",
+    "research/qq16-caller-install/DECODER.md",
+    "research/qq16-caller-install/EXECUTION.json",
+    "research/qq16-caller-install/LIFECYCLE.md",
+    "research/qq16-caller-install/PACKET.md",
+    "research/qq16-caller-install/PREDECESSORS.json",
+    "research/qq16-caller-install/PRODUCER.md",
+    "research/qq16-caller-install/PROOF.md",
+    "research/qq16-caller-install/README.md",
+    "research/qq16-caller-install/RESULT.json",
+    "research/qq16-caller-install/REUSE.json",
+    "research/qq16-caller-install/REVIEW.json",
+    "research/qq16-caller-install/SOURCES.json",
+    "research/qq16-caller-install/TASK.json",
+    "research/qq16-caller-install/VERIFY.json",
+    "research/qq16-caller-install/auth.py",
+    "research/qq16-caller-install/connection.py",
+    "research/qq16-caller-install/continuation.py",
+    "research/qq16-caller-install/cost.py",
+    "research/qq16-caller-install/decoder-fixture.py",
+    "research/qq16-caller-install/decoder.py",
+    "research/qq16-caller-install/inputs/PR3055-PROOF.md",
+    "research/qq16-caller-install/inputs/PR3380-PROOF.md",
+    "research/qq16-caller-install/inputs/PR3464-PROOF.md",
+    "research/qq16-caller-install/inputs/PR3464-bank_packets.py",
+    "research/qq16-caller-install/inputs/PR3464-machine.py",
+    "research/qq16-caller-install/inputs/PR3464-parking.py",
+    "research/qq16-caller-install/inputs/PR3464-selected_binding.py",
+    "research/qq16-caller-install/inputs/PR3607-PROOF.md",
+    "research/qq16-caller-install/inputs/PR3619-PROOF.md",
+    "research/qq16-caller-install/inputs/PR3993-PROOF.md",
+    "research/qq16-caller-install/inputs/PR4106-WORD.json",
+    "research/qq16-caller-install/inputs/PR4114-README.md",
+    "research/qq16-caller-install/inputs/PR4129-COST.md",
+    "research/qq16-caller-install/inputs/PR4129-NATIVE.md",
+    "research/qq16-caller-install/inputs/PR4129-PREDECESSORS.json",
+    "research/qq16-caller-install/inputs/PR4129-PROOF.md",
+    "research/qq16-caller-install/inputs/PR4129-README.md",
+    "research/qq16-caller-install/inputs/PR4129-RESULT.json",
+    "research/qq16-caller-install/inputs/PR4129-SOURCES.json",
+    "research/qq16-caller-install/inputs/PR4129-TASK.json",
+    "research/qq16-caller-install/inputs/PR4129-bridge.py",
+    "research/qq16-caller-install/inputs/PR4129-construction.py",
+    "research/qq16-caller-install/installer.py",
+    "research/qq16-caller-install/integrated-fixture.py",
+    "research/qq16-caller-install/lifecycle.py",
+    "research/qq16-caller-install/packet.py",
+    "research/qq16-caller-install/physical.py",
+    "research/qq16-caller-install/producer-fixture.py",
+    "research/qq16-caller-install/producer.py",
+    "research/qq16-caller-install/runtime.py",
+    "research/qq16-caller-install/test_verify.py",
+    "research/qq16-caller-install/verify.py",
+    "research/qq16-complete-cost/inputs/PR4172.tar",
+    "research/qq16-line-normalized-decoder/PREDECESSORS.json",
+    "research/qq16-line-normalized-decoder/PROOF.md",
+    "research/qq16-line-normalized-decoder/RESULT.json",
+    "research/qq16-line-normalized-decoder/SOURCES.json",
+    "research/qq16-line-normalized-decoder/vendor/pr2681/PROOF.md",
+    "research/qq16-line-normalized-decoder/vendor/pr2681/README.md",
+    "research/qq16-line-normalized-decoder/vendor/pr2681/RESULT.json",
+    "research/qq16-line-normalized-decoder/vendor/pr2681/SOURCES.json",
+    "research/qq16-line-normalized-decoder/vendor/pr2681/WORD.json",
+    "research/qq16-line-normalized-decoder/vendor/pr2681/references/PR2540-PROOF.md",
+    "research/qq16-line-normalized-decoder/vendor/pr2681/references/PR2540-README.md",
+    "research/qq16-line-normalized-decoder/vendor/pr2681/verify.py",
+    "research/qq16-line-normalized-decoder/verify.py",
+    "research/qq16-nonterminal-c8-tree/README.md",
+    "research/qq16-nonterminal-c8-tree/RESULT.json",
+    "research/qq16-protected-return-caller/README.md",
+    "research/qq16-protected-return-caller/RESULT.json",
+    "research/qq16-protected-return-caller/SOURCES.json",
+    "research/qq16-protected-return-caller/TASK.json",
+    "research/qq16-protected-return-caller/VERIFY.json",
+    "research/qq16-protected-return-caller/adapter.py",
+    "research/qq16-protected-return-caller/verify.py",
+    "research/qq16-return-inventory-audit/README.md",
+    "research/qq16-tagged-cover-routing/PROOF.md",
+    "research/qq16-tagged-cover-routing/oracle.py",
+    "research/qq16-tagged-cover-routing/router.py",
+    "research/qq16-tagged-cover-routing/verify.py",
+    "research/r437-leaf-dispatch/retained/selected-result.json",
+    "research/recursive-parking-boundary/README.md",
+    "research/selected-bit-local-ring-sweeps/PROOF.md",
+    "research/selected-bit-recursive-closure/PROOF.md",
+    "research/selected-complex-layer-closure/PROOF.md",
+    "research/selected-complex-layer-closure/arithmetic.py",
+    "upstream/build/sections/02-streams.tex"
+  ],
+  "commands": [
+    {
+      "argv": [
+        "{python}",
+        "-I",
+        "-B",
+        "{package}/verify.py"
+      ],
+      "timeout_seconds": 240,
+      "checks": "Actual source caller with independently charged sequential-handle inventory kernel, bit microchecks and source/cap/field controls."
+    },
+    {
+      "argv": [
+        "{python}",
+        "-I",
+        "-O",
+        "-B",
+        "{package}/verify.py"
+      ],
+      "timeout_seconds": 240,
+      "checks": "Same exact source and kernel checks under optimization, with explicit guards."
+    }
+  ]
+}
diff --git a/research/qq16-finite-handle-charge/check_bits.py b/research/qq16-finite-handle-charge/check_bits.py
new file mode 100644
index 0000000000..6f8dab190b
--- /dev/null
+++ b/research/qq16-finite-handle-charge/check_bits.py
@@ -0,0 +1,68 @@
+"""Independent expansion of the sequential access macro into bit instructions."""
+
+def ensure(ok,why):
+    if not ok:raise ValueError(why)
+
+
+def serial_access(words,width,address,replacement=None):
+    ensure(words and width>0 and 0<=address<len(words),'bit test domain')
+    ensure(all(0<=x<2**width for x in words),'bit test width')
+    tape=[(word>>bit)&1 for word in words for bit in range(width)]
+    index=[0]*width;wanted=[(address>>i)&1 for i in range(width)]
+    register=[0]*width;head=0;steps=0
+    # Initialize each finite index bit explicitly.
+    for bit in range(width):index[bit]=0;steps+=1
+    for position in range(len(words)):
+        difference=0;steps+=1
+        for bit in range(width):
+            test=index[bit] ^ wanted[bit];steps+=1
+            difference=difference | test;steps+=1
+        steps+=1  # branch on the finite difference bit being zero
+        if difference == 0:
+            for bit in range(width):
+                if replacement is None:
+                    symbol=tape[head];register[bit]=symbol
+                else:
+                    symbol=(replacement>>bit)&1;tape[head]=symbol
+                steps+=2
+                head+=1;steps+=1
+        else:
+            for bit in range(width):head+=1;steps+=1
+        for bit in range(width):
+            # Eight explicitly priced finite-register instructions per bit.
+            # The first padding slot initializes carry for bit zero; later
+            # words are compiled fixed-width loops, not decoded host indices.
+            if bit == 0:carry=1
+            steps+=1  # carry initialization or NOP
+            previous=index[bit];steps+=1
+            digit=previous ^ carry;steps+=1
+            next_carry=previous & carry;steps+=1
+            index[bit]=digit;steps+=1
+            carry=next_carry;steps+=1
+            steps+=2  # two NOPs
+        steps+=1  # bounded loop branch
+    while head:head-=1;steps+=1
+    steps+=1  # halt
+    output=[sum(tape[j*width+i]<<i for i in range(width)) for j in range(len(words))]
+    return output,sum(register[i]<<i for i in range(width)),head,steps
+
+
+def verify(access_price):
+    checks=0
+    for length in range(1,13):
+        width=max(1,length.bit_length())
+        values=[(i*3+1)%(1<<width) for i in range(length)]
+        for address in range(length):
+            after,read,head,count=serial_access(values,width,address)
+            ensure(after==values and read==values[address] and head==0,'serial read endpoint')
+            ensure(count==access_price(length,width),'independent read instruction count')
+            replacement=(values[address]+1)%(1<<width)
+            after,_,head,count=serial_access(values,width,address,replacement)
+            expected=values.copy();expected[address]=replacement
+            ensure(after==expected and head==0,'serial write endpoint')
+            ensure(count==access_price(length,width),'independent write instruction count')
+            checks+=2
+    # Address movement cannot be omitted: even address zero pays the full scan.
+    _,_,_,count=serial_access([0]*8,4,0)
+    ensure(count>4*8 and count!=1,'random access tariff rejected')
+    return checks
diff --git a/research/qq16-finite-handle-charge/kernel.py b/research/qq16-finite-handle-charge/kernel.py
new file mode 100644
index 0000000000..7e13d6d421
--- /dev/null
+++ b/research/qq16-finite-handle-charge/kernel.py
@@ -0,0 +1,186 @@
+"""Conditional finite-handle inventory kernel; no native pointer-cost assumption.
+
+JoyboyBrian, with substantial OpenAI Codex assistance. Apache-2.0.
+"""
+
+def need(ok, why):
+    if not ok:
+        raise ValueError(why)
+
+
+def access_cost(words, width):
+    return words * (12 * width + 3) + 3 * width + 1
+
+
+def bounds(size):
+    need(type(size) is int and size > 0, 'positive contract size')
+    capacity = 64 * size
+    width = capacity.bit_length()
+    access = access_cost(capacity, width)
+    return dict(capacity=capacity, width=width,
+                accesses=1024*size, scalar=4096*size,
+                bits=1024*size*access+4096*size*(16*width+16))
+
+
+class Store:
+    """Macro simulator: each word access pays a full sequential padded scan.
+
+    Host indexing only fast-forwards that declared scan; it is not charged as
+    one random access. The independent checker expands the bit instructions.
+    """
+    def __init__(self, size, width=None):
+        self.limit = bounds(size)
+        self.width = self.limit['width'] if width is None else width
+        need(self.width >= self.limit['width'], 'handle width covers addresses')
+        self.cells = []
+        self.accesses = self.limit['capacity']  # initial complete zero fill
+        self.scalar = 0
+
+    def tick(self, count=1):
+        self.scalar += count
+
+    def allocate(self, values):
+        values = list(values)
+        need(len(self.cells)+len(values) <= self.limit['capacity'], 'metadata capacity')
+        start = len(self.cells)
+        for value in values:
+            need(type(value) is int and 0 <= value < 1 << self.width, 'encoded finite handle')
+            self.cells.append(value)
+            self.accesses += 2  # read source word and write owned word
+            self.tick(2)
+        return start, len(values)
+
+    def read(self, location):
+        need(type(location) is int and 0 <= location < len(self.cells), 'bounded address')
+        self.accesses += 1
+        self.tick()
+        return self.cells[location]
+
+    def write(self, location, value):
+        need(0 <= location < len(self.cells) and 0 <= value < 1 << self.width, 'bounded write')
+        self.accesses += 1
+        self.tick()
+        self.cells[location] = value
+
+    def finish(self):
+        self.accesses += self.limit['capacity']  # complete owned cleanup
+        self.cells[:] = [0]*len(self.cells)
+        bits = self.accesses*access_cost(self.limit['capacity'], self.width)
+        bits += self.scalar*(16*self.width+16)
+        need(self.accesses <= self.limit['accesses'] and self.scalar <= self.limit['scalar'],
+             'source-count upper bound')
+        need(bits <= self.limit['bits'], 'bit-charge upper bound')
+        return dict(accesses=self.accesses, scalar=self.scalar, bits=bits,
+                    capacity=self.limit['capacity'], width=self.width)
+
+
+def walk(store, graph):
+    """Run a DFS over encoded nodes; word-addressed visited flags are charged."""
+    rows = graph['rows']; edges = [] ; headers = []
+    need(rows and graph['root'] == 0, 'canonical graph root')
+    for tag, tape, children in rows:
+        need(tag in (0,1) and (tag == 0 or not children), 'opaque tape body')
+        need(all(type(c) is int and 0 <= c < len(rows) for c in children), 'graph child handle')
+        headers.extend((tag, tape, len(edges), len(children)))
+        edges.extend(children)
+    h, _ = store.allocate(headers); e, _ = store.allocate(edges)
+    seen, _ = store.allocate([0]*len(rows))
+    stack, _ = store.allocate([0]*(len(edges)+1))
+    out, _ = store.allocate([0]*len(rows))
+    top=1; count=0
+    while top:
+        store.tick(8); top-=1; node=store.read(stack+top)
+        if store.read(seen+node):
+            continue
+        store.write(seen+node,1)
+        tag,tape,first,length=(store.read(h+4*node+i) for i in range(4))
+        if tag:
+            store.write(out+count,tape); count+=1
+        else:
+            for j in range(length-1,-1,-1):
+                store.tick(8)
+                need(top < len(edges)+1, 'bounded DFS stack')
+                store.write(stack+top,store.read(e+first+j)); top+=1
+    return [store.read(out+i) for i in range(count)]
+
+
+def validate(snapshot, size, width=None):
+    """Execute complete cached engine/external/storage membership predicates."""
+    need(set(snapshot) == {'graphs','saved','external','auxiliary','storage','acquired'},
+         'complete snapshot fields')
+    need(len(snapshot['graphs']) == 3 and len(snapshot['saved']) == 2, 'three exact owners')
+    total = sum(len(g['rows'])+sum(len(r[2]) for r in g['rows'])+g['attributes']
+                for g in snapshot['graphs'])
+    total += sum(map(len,snapshot['saved']))
+    total += sum(len(snapshot[k]) for k in ('external','auxiliary','storage','acquired'))+1
+    need(total <= size, 'bounded source graph contract')
+    store=Store(size,width)
+    store.tick(32*total)  # complete finite input/shape/range bookkeeping
+    current=[walk(store,g) for g in snapshot['graphs']]
+    lists=[*current,*snapshot['saved'],snapshot['external'],snapshot['auxiliary'],
+           snapshot['storage'],snapshot['acquired']]
+    need(all(type(x) is int and x > 0 for row in lists for x in row), 'positive tape handles')
+    largest=max((x for row in lists for x in row),default=0)
+    need(largest <= size, 'bounded tape handle universe')
+    marks,_=store.allocate([0]*(largest+1))
+    def clear():
+        for i in range(largest+1):store.tick(2);store.write(marks+i,0)
+    def insert(row, unique):
+        at,n=store.allocate(row)
+        for i in range(n):
+            store.tick(6); x=store.read(at+i)
+            old=store.read(marks+x)
+            need(not unique or not old,'distinct physical inventory')
+            store.write(marks+x,1)
+    def same(left,right):
+        need(len(left)==len(right),'same engine cardinality')
+        clear();insert(left,True)
+        at,n=store.allocate(right)
+        for i in range(n):
+            store.tick(6); x=store.read(at+i)
+            need(store.read(marks+x)==1,'complete engine membership')
+            store.write(marks+x,0)
+    for i in range(2):same(snapshot['saved'][i],current[i])
+    combined=snapshot['saved'][0]+snapshot['saved'][1]
+    clear();insert(combined,True)
+    at,n=store.allocate(current[2])
+    for i in range(n):
+        store.tick(6);need(store.read(marks+store.read(at+i))==0,'producer separated')
+    expected=combined+snapshot['auxiliary']; external=snapshot['external']
+    need(len(expected)==len(external),'complete external length')
+    a,_=store.allocate(expected);b,_=store.allocate(external)
+    for i in range(len(expected)):
+        store.tick(4);need(store.read(a+i)==store.read(b+i),'ordered external binding')
+    clear();insert(snapshot['storage']+snapshot['acquired']+external,True)
+    return store.finish()
+
+
+def exchange(roles, old, new, size):
+    """The actual cache substitution, with every lookup/copy charged."""
+    need(len(roles)+3 <= size and old != new, 'bounded exchange domain')
+    store=Store(size); at,n=store.allocate(roles); out,_=store.allocate([0]*n)
+    found=0
+    for i in range(n):
+        store.tick(8); value=store.read(at+i)
+        need(value != new,'replacement absent')
+        found += value == old
+        store.write(out+i,new if value == old else value)
+    need(found==1,'one replaced handle')
+    result=[store.read(out+i) for i in range(n)]
+    return result,store.finish()
+
+
+def complete_bound(size, gamma, returns_per_gamma=511014, service_per_gamma=336):
+    need(type(gamma) is int and gamma>0, 'positive cover size')
+    need(returns_per_gamma==511014 and service_per_gamma==336, 'complete source census')
+    c=returns_per_gamma*gamma; s=service_per_gamma*gamma
+    # Constructor check + before/after at every return. No test-only final check.
+    checks=1+2*c
+    exchanges=c+s  # one native exchange always; service exchange on service calls
+    u=bounds(size)['bits']
+    # One paid finite installation/dispatch/rebinding budget per return and init.
+    binding=(c+1)*u
+    return dict(validations=checks, cache_exchanges=exchanges,
+                residual_binding_budgets=c+1,
+                control_upper=(checks+exchanges+c+1)*u,
+                tape_saving_coefficient=11*c,tape_saving_constant=4*c)
diff --git a/research/qq16-finite-handle-charge/observer.py b/research/qq16-finite-handle-charge/observer.py
new file mode 100644
index 0000000000..7259fcdea3
--- /dev/null
+++ b/research/qq16-finite-handle-charge/observer.py
@@ -0,0 +1,73 @@
+"""Read-only source encoder and observer for the actual inherited caller."""
+import types
+from kernel import need, validate, exchange
+
+SKIP={'binding','catalogue','group','data','source','native_child','at_fence',
+      'observe','codes','recipes','template','packet','core','events','word'}
+
+
+def snapshot(protocol, Tape, handles):
+    def handle(tape):
+        need(isinstance(tape,Tape),'actual physical Tape')
+        if id(tape) not in handles:handles[id(tape)]=len(handles)+1
+        return handles[id(tape)]
+    def graph(owner):
+        seen={}; rows=[]; attributes=0
+        def visit(value):
+            nonlocal attributes
+            key=id(value)
+            if key in seen:return seen[key]
+            index=len(rows);seen[key]=index;rows.append(None)
+            if isinstance(value,Tape):
+                rows[index]=[1,handle(value),[]];return index
+            if isinstance(value,dict):children=list(value.values())
+            elif isinstance(value,(tuple,list)):children=list(value)
+            elif not isinstance(value,(type,types.ModuleType,types.FunctionType,types.MethodType)) and hasattr(value,'__dict__'):
+                items=list(vars(value).items());attributes+=len(items)
+                children=[v for k,v in items if k not in SKIP]
+            else:children=[]
+            rows[index]=[0,0,[visit(v) for v in children]]
+            return index
+        visit(owner)
+        expected=[handle(t) for t in protocol.owned_tapes(owner)]
+        # DFS node numbering puts first Tape encounters in source traversal order.
+        need([r[1] for r in rows if r[0]]==expected,'complete source graph encoding')
+        return dict(root=0,rows=rows,attributes=attributes)
+    i=protocol.installation; storage=i.storage
+    graphs=[graph(i.service),graph(i.native_child),graph(protocol.parent)]
+    acquisition=storage.acquisition
+    acquired=[] if acquisition is None else [*acquisition.packets,acquisition.output,*acquisition.pool.tapes]
+    return dict(graphs=graphs,saved=[[handle(t) for t in r] for r in i.engine_roles],
+                external=[handle(t) for t in storage.external_roles],
+                auxiliary=[handle(t) for t in protocol.auxiliary],
+                storage=[handle(t) for t in storage.roles],
+                acquired=[handle(t) for t in acquired])
+
+
+class Observer:
+    def __init__(self,size):
+        self.size=size;self.checks=[];self.exchanges=[];self.examples=[];self.handles={}
+
+    def attach(self,adapter,Tape):
+        original=adapter.ReturnProtocol.check_inventory
+        original_exchange=adapter.ReturnProtocol.exchange
+        def check(protocol):
+            data=snapshot(protocol,Tape,self.handles)
+            bill=validate(data,self.size)
+            original(protocol)
+            shapes=[dict(vertices=len(g['rows']),edges=sum(len(r[2]) for r in g['rows']),
+                         attributes=g['attributes'],tapes=sum(r[0] for r in g['rows'])) for g in data['graphs']]
+            self.checks.append(dict(shapes=shapes,bill=bill))
+            if len(self.examples)<2 or shapes != self.checks[0]['shapes']:
+                if len(self.examples)<3:self.examples.append(data)
+        def exchanged(roles,old,new):
+            ids=self.handles
+            need(all(id(t) in ids for t in (*roles,old,new)), 'stable complete lifetime handles')
+            encoded=[ids[id(t)] for t in roles]
+            out,bill=exchange(encoded,ids[id(old)],ids[id(new)],self.size)
+            result=original_exchange(roles,old,new)
+            need(out==[ids[id(t)] for t in result],'exact original cache exchange')
+            self.exchanges.append(bill)
+            return result
+        adapter.ReturnProtocol.check_inventory=check
+        adapter.ReturnProtocol.exchange=staticmethod(exchanged)
diff --git a/research/qq16-finite-handle-charge/verify.py b/research/qq16-finite-handle-charge/verify.py
new file mode 100644
index 0000000000..455fbc35fc
--- /dev/null
+++ b/research/qq16-finite-handle-charge/verify.py
@@ -0,0 +1,149 @@
+#!/usr/bin/env python3
+"""Source-bound conditional control certificate and actual caller observer.
+
+JoyboyBrian, substantial OpenAI Codex assistance. Apache-2.0.
+"""
+import argparse
+import ast
+import copy
+import hashlib
+import json
+from pathlib import Path
+import sys
+import types
+HERE=Path(__file__).resolve().parent
+ROOT=HERE.parents[1]
+sys.path.insert(0,str(HERE))
+from kernel import need,validate,bounds,complete_bound,access_cost
+from observer import Observer,SKIP
+import check_bits
+SIZE=65536
+PRE='research/qq16-protected-return-caller/'
+
+
+def canonical(x):
+    return json.dumps(x,sort_keys=True,separators=(',',':'),allow_nan=False)
+
+
+def authenticate():
+    rows=json.loads((HERE/'SOURCES.json').read_bytes())['files']
+    for row in rows:
+        if row['usage']!='input':continue
+        raw=(ROOT/row['path']).read_bytes()
+        need(hashlib.sha256(raw).hexdigest()==row['sha256'],'source integrity: '+row['path'])
+
+
+def source_sites():
+    tree=ast.parse((ROOT/PRE/'adapter.py').read_bytes())
+    cls=next(n for n in tree.body if isinstance(n,ast.ClassDef) and n.name=='ReturnProtocol')
+    methods={n.name:n for n in cls.body if isinstance(n,ast.FunctionDef)}
+    def calls(name,attribute):
+        return [n for n in ast.walk(methods[name]) if isinstance(n,ast.Call) and
+                isinstance(n.func,ast.Attribute) and n.func.attr==attribute]
+    need(len(calls('__init__','check_inventory'))==1 and len(calls('__call__','check_inventory'))==2,
+         'constructor and both actual return validations')
+    need(len(calls('__call__','exchange'))==2,'native plus conditional service exchange')
+    exchange_nodes=[n for n in ast.walk(methods['__call__']) if isinstance(n,ast.If) and
+                    ast.unparse(n.test)=='caller is i.service']
+    need(len(exchange_nodes)==1 and 'self.exchange(service, old, result)' in ast.unparse(exchange_nodes[0]),
+         'service-only exchange source condition')
+    tree=ast.parse((ROOT/'research/qq16-caller-install/installer.py').read_bytes())
+    owner=next(n for n in tree.body if isinstance(n,ast.FunctionDef) and n.name=='owned_tapes')
+    skip=next(n.value for n in ast.walk(owner) if isinstance(n,ast.Assign) and
+              any(isinstance(t,ast.Name) and t.id=='skip' for t in n.targets))
+    need(ast.literal_eval(skip)==SKIP,'exact source omission alphabet')
+    census=json.loads((ROOT/PRE/'RESULT.json').read_bytes())['source_protocol_census']
+    need(census['complete_per_Gamma']==511014 and census['service_per_Gamma']==336 and
+         census['producer_per_Gamma']==510678 and census['later_producer_per_Gamma']==493097,
+         'complete inherited source census includes suffix')
+
+
+def run_actual():
+    observer=Observer(SIZE)
+    path=ROOT/PRE/'verify.py';raw=path.read_text()
+    anchor="        need(fixture.Tape.__eq__ is object.__eq__, 'retained Tape equality is identity')"
+    need(raw.count(anchor)==1,'one read-only observer insertion site')
+    changed=raw.replace(anchor,anchor+'\n        OBSERVER.attach(adapter, fixture.Tape)')
+    before=ast.parse(raw);after=ast.parse(changed)
+    class Remove(ast.NodeTransformer):
+        def visit_Expr(self,node):
+            if ast.unparse(node)=='OBSERVER.attach(adapter, fixture.Tape)':return None
+            return self.generic_visit(node)
+    need(ast.dump(before,include_attributes=False)==ast.dump(Remove().visit(after),include_attributes=False),
+         'observer preserves complete inherited verifier AST')
+    module=types.ModuleType('authenticated_control_caller');module.__file__=str(path)
+    module.OBSERVER=observer
+    exec(compile(changed,str(path),'exec'),module.__dict__)
+    result=module.case('adopt')
+    expected=json.loads((ROOT/PRE/'RESULT.json').read_bytes())['cases']['adopt']
+    need(canonical(result)==canonical(expected),'unchanged complete actual caller result')
+    need(len(observer.checks)==50 and len(observer.exchanges)==36,'complete observed site census')
+    # Last call is the inherited verifier's final audit, outside the algorithm.
+    active=observer.checks[:-1]
+    need(len(active)==1+2*24 and len(observer.exchanges)==24+12,'initialization and every source return')
+    # Larger scope/descriptor epochs cannot be bounded by one constructor graph.
+    phase_growth=[(owner,key,active[0]['shapes'][owner][key],max(x['shapes'][owner][key] for x in active))
+                  for owner in range(3) for key in ('vertices','edges','attributes')]
+    need(any(peak>initial for owner,key,initial,peak in phase_growth),
+         'constructor-only graph size counterexample')
+    return observer,dict(returns=24,service_returns=12,algorithm_validations=49,
+                         graph_walks=147,cache_exchanges=36,excluded_final_audit=1,
+                         contract_size=SIZE,unchanged_complete_receipt=True,
+                         constructor_size_not_uniform=True)
+
+
+def reject(action,message):
+    try:action()
+    except ValueError as error:
+        need(message in str(error),'exact negative boundary: '+str(error))
+    else:raise ValueError('negative control accepted: '+message)
+
+
+def controls(example):
+    tests=0
+    for field in ('graphs','saved','external','auxiliary','storage','acquired'):
+        bad=copy.deepcopy(example);del bad[field]
+        reject(lambda:validate(bad,SIZE),'complete snapshot fields');tests+=1
+    reject(lambda:validate(example,1),'bounded source graph contract');tests+=1
+    reject(lambda:validate(example,SIZE,width=1),'handle width covers addresses');tests+=1
+    bad=copy.deepcopy(example);bad['external'][0]=bad['external'][1]
+    reject(lambda:validate(bad,SIZE),'ordered external binding');tests+=1
+    bad=copy.deepcopy(example);bad['saved'][0][0]=bad['saved'][0][1]
+    reject(lambda:validate(bad,SIZE),'distinct physical inventory');tests+=1
+    bad=copy.deepcopy(example);bad['graphs'][0]['rows'][0][2].append(10**8)
+    reject(lambda:validate(bad,SIZE),'graph child handle');tests+=1
+    reject(lambda:complete_bound(SIZE,1,returns_per_gamma=17581),'complete source census');tests+=1
+    return tests
+
+
+def compute():
+    authenticate();source_sites()
+    bit_cases=check_bits.verify(access_cost)
+    observer,actual=run_actual()
+    faults=controls(observer.examples[0])
+    bill=complete_bound(SIZE,1)
+    u=bounds(SIZE)['bits']
+    # Independent integer aggregation; do not call the primary expression again.
+    c=510678+336;s=336
+    independent=(1+2*c)*u + (c+s)*u + (1+c)*u
+    need(independent==bill['control_upper'],'independent complete arithmetic')
+    witness_v=independent//(11*c)+1
+    need(11*c*witness_v+4*c>independent,'conditional F=0 arithmetic witness only')
+    return dict(status='PASS_QQ16_FINITE_HANDLE_CHARGE',actual=actual,
+                bit_access_cases=bit_cases,rejection_controls=faults,
+                per_kernel_upper=bounds(SIZE),whole_cover_bill=bill,
+                assumption='Encoded complete bounded graphs; F remains separate and is not assumed zero.',
+                scope='Conditional metadata charge only; no production K, physical embedding, D* versus B* or kappa.'),observer
+
+
+def main():
+    parser=argparse.ArgumentParser();parser.add_argument('--write',action='store_true')
+    parser.add_argument('--log',type=Path)
+    args=parser.parse_args();result,observer=compute()
+    if args.write:(HERE/'RESULT.json').write_text(json.dumps(result,indent=2,sort_keys=True)+'\n')
+    else:need(canonical(result)==canonical(json.loads((HERE/'RESULT.json').read_bytes())), 'typed complete receipt')
+    if args.log:
+        args.log.write_text(json.dumps(dict(checks=observer.checks,exchanges=observer.exchanges),indent=2)+'\n')
+    print(result['status'])
+
+if __name__=='__main__':main()