Bound QQ16 inventory control under a sequential-handle contract

research/qq16-finite-handle-charge/PROOF.md

@@ -0,0 +1,118 @@
+# Conditional sequential-handle control bound
+
+JoyboyBrian, with substantial OpenAI Codex assistance. Apache-2.0.
+
+This is a bound for a new executable metadata kernel, conditional on a source
+encoding contract. It is not a claim that CPython pointers, dictionaries or
+reflection are tape primitives. The original #4790 scientific sources and guards
+are unchanged. The kernel consumes exact snapshots of those sources and must
+agree with them.
+
+Let K bound the sum of vertices, traversed edges and inspected object attributes
+of the three current owner graphs, all supplied role-list lengths, plus one.
+Every distinct physical Tape receives a positive stable handle at most K.
+Non-Tape vertices have local handles. Tape bodies are opaque. Source field
+classification/omission follows exactly the authenticated `owned_tapes` skip
+alphabet. A producer/service lifetime must supply this complete encoding at
+every check; a constructor-only graph bound does not suffice.
+
+The kernel uses at most Q=64K words of w=bit_length(Q) bits. Every graph pointer,
+Tape handle, array address, count and cursor fits this width. It implements
+visited sets by encoded flags and follows encoded adjacency, rather than using
+Python identity hashes as unit-cost membership. It explicitly checks cached
+engine membership/uniqueness, engine disjointness, producer separation, ordered
+external roles and the storage/acquisition/external exclusivity predicate.
+
+## Addressed bit model
+
+The macro simulator's host list indexing only fast-forwards a fully charged
+sequential scan. For each word read or write, reset a w-bit scan index; scan all
+Q words; compare all w address bits at each word; branch; copy the selected
+word bit by bit; advance the head; execute a padded eight-instruction-per-bit
+increment; test the loop; rewind the entire store; halt. It costs exactly
+
+`A(Q,w) = Q(12w+3)+3w+1`
+
+in the stated bit-instruction model: reset w, per word compare 2w+1 (zero difference bit, then XOR and OR for every
+address bit), branch-on-zero 1,
+forward movement w, padded increment 8w, loop branch 1; the unique selected
+copy costs 2w, complete rewind costs Qw, and halt costs 1. Selected copy reads or writes
+only the current head cell and immediately advances one cell per bit; unselected
+words perform the same forward moves without copying. No offset cell lookup
+is part of the bit machine. Each increment bit pays carry initialization (only
+on the first bit; otherwise NOP), old-bit copy, XOR, AND, digit assignment,
+carry assignment and two NOPs: exactly eight instructions per bit. Fixed-width
+bit loops are unrolled in the compiled control, whose frontend belongs to F. Fixed registers are
+bits/Booleans, compiled for this fixed K; no unbounded integer is free. The
+independent checker expands these instructions on small stores and checks
+values, addresses, preserved cells, restored head and exact prices.
+
+Other bounded-word comparisons, copies, arithmetic and branches are charged
+16w+16 per scalar macro, sufficient for two full w-bit scans, fixed-width
+increment/subtraction and branch bookkeeping. Source payload operations are
+outside this metadata kernel and retain their earlier R/W/move tariff. This
+model does not choose the repository's physical-machine compiler or its source
+frontend. A physical embedding must provide this bit-register/store interface,
+including its additional control storage; no zero-tape-space claim is made.
+
+The simulator charges Q accesses for initial zero fill and Q accesses for full
+retirement, even though its Python storage omits unused padding. Each imported
+metadata word pays one source read and one owned write. Thus metadata copying,
+workspace initialization and cleanup are included; producing a trustworthy
+source encoding remains a separately stated embedding condition.
+
+## Counting bound
+
+DFS pops exactly e+1 stack entries (including repeats). There are at most g
+first visits and e pushes. A first visit reads four header words, sets one flag,
+and either appends one opaque Tape handle or pushes children in reverse order.
+The stack has e+1 cells. Both imported graph words and returned handle words
+are charged. Three walks use fewer than 96K accesses and 192K scalar macros.
+
+There are four complete mark-array clears (two engine comparisons, combined
+inventory, and storage exclusivity). The mark universe is at most K. Every
+source role-list element is scanned a bounded number of times: saved engine
+lists at most six, current lists at most three, and external/auxiliary/storage
+lists at most four. All encodings, result buffers and duplicate imported lists
+fit 64K words. Conservatively allowing 128K accesses for initialization and
+retirement, 128K for all imports, 96K for walks, and 128K for all remaining
+list scans gives less than 1024K accesses. The corresponding loop, branch,
+scalar bookkeeping is less than 4096K. `Store.finish` checks both independent
+ceilings on every executed kernel call. Therefore
+
+`U(K)=1024K A(64K,w)+4096K(16w+16)`
+
+is a conservative bit-instruction upper bound per validation. The same envelope
+also covers an exchange (one scan/copy of a role list), including its own zero
+fill/import/cleanup. This intentionally does not optimize metadata reuse.
+
+## Source sites and whole lifetime
+
+Put C=511014Γ and S=336Γ, from #4166/#4790's inherited complete successful root
+census. #4790 performs one constructor validation and exactly two validations
+per adopted return: **1+2C**, each traversing three owner graphs. Its native cache
+exchange runs C times and its service cache exchange S times: **C+S**. The test
+harness's final `check_inventory` is not an algorithmic site and is excluded.
+
+Reserve one further U(K) binding budget for initialization and one per return
+for remaining fixed dispatch, the credited #4167 finite packet/private/parked
+rebinding, and rebuilding external tuples. This last budget is conditional on
+the same K contract covering those finite lists and scalar fields; it does not
+charge payload clearing again. Copying/clearing common payload intervals retains
+the predecessor's cancellation premise. The fixed number of comparisons and
+list scans is below the same conservative 1024K/4096K ceilings. The source AST
+anchors and actual cache-exchange counts are checked independently of this sum.
+
+Hence this encoded-control realization has additional metadata charge at most
+
+`B(K,Γ) = (4C+S+2) U(K)`.
+
+Let F include any compilation/frontend/encoding-embedding charge not discharged
+by this kernel contract and any remaining positive control difference outside
+these intervals. Then the sufficient matched D* versus frozen D condition is
+
+`F + B(K,Γ) < C(11v+4)`.
+
+Equivalently v must exceed `(F+B−4C)/(11C)`. F is **not zero** by default. No
+uniform production K or physical embedding is established by reduced logs.
+The full D* versus B* ledger has additional unmatched costs and remains open.

research/qq16-finite-handle-charge/README.md

@@ -0,0 +1,159 @@
+# Conditional bounded-graph charge for QQ16 return control
+
+This package gives an executable, explicitly charged **metadata controller**
+for #4790's inventory checks and cache substitutions. It checks the actual
+unchanged installed caller, including initialization and all return sites.
+The cost theorem is conditional on a complete bounded source encoding; it
+is not a production graph bound or a new physical QQ16 implementation.
+
+For a contract size K, put Q=64K, w=bit_length(Q), and
+
+```
+A(Q,w) = Q(12w+3)+3w+1,
+U(K)   = 1024K A(Q,w) + 4096K(16w+16).
+```
+
+Every word access pays a complete sequential Q-word scan with explicit w-bit
+address comparison, selected bit copy, head movement and rewind. No Python
+pointer, hash-table lookup or reflection is declared a unit-cost tape primitive.
+Initialization, input-word copying and complete owned-store retirement are
+charged. [PROOF.md](PROOF.md) states the model, elementary counts, source
+encoding contract and remaining physical-embedding obligations.
+
+Let C=511014Γ and S=336Γ be #4166/#4790's credited complete caller census.
+The actual source has **1+2C validations**, **C+S cache exchanges** and a
+conservative additional **C+1 finite binding budgets**. The first term includes
+initialization; the final test-harness audit is excluded. The resulting bound is
+
+```
+B(K,Γ) = (4C+S+2) U(K).
+```
+
+The credited tape-action saving remains `C(11v+4)`. If F accounts for source
+frontend/compilation/encoding and any remaining positive control charge outside
+the stated kernel contract, a sufficient D* versus frozen D condition is
+
+```
+F + B(K,Γ) < C(11v+4).
+```
+
+**F is not assumed zero.** Neither a uniform production K nor a physical
+embedding is supplied. This does not decide D* versus B*, execute production
+O73 payloads, establish supplier admission or change κ. The bound deliberately
+uses expensive scans and fresh scratch; it is not a performance recommendation.
+
+## Why a constructor census is insufficient
+
+The actual unchanged two-generation case executes 24 original-C calls: twelve
+producer and twelve service calls in total, with the original per-generation
+chronology `4 producer → 6 service → 2 later producer`. It produces 49 algorithmic
+inventory validations, 147 owner traversals and 36 cache exchanges. The retained
+verifier performs one additional final audit; the observer labels it separately.
+All original endpoint bytes, guards, cleanup and the complete typed #4790 case
+receipt remain unchanged.
+
+The source object graph changes across phases. In the initial investigation,
+the three different owners had 2,310 to 2,327 record Tape roles; this range
+compares owners and does not establish tape allocation over time. Their graph
+traversals had 5,017 to 5,054 edges. These are observations from reduced geometry,
+not a universal maximum or a production inventory. The registered verifier
+requires a same-owner vertex/edge/attribute increase over its initial graph,
+furnishing a concrete
+counterexample to replacing every traversal by its constructor-size census.
+In the completed log, the same service owner grows from 5,033 to 5,054 edges
+and 1,403 to 1,404 inspected attributes. Its 2,327 Tape roles remain constant.
+Python object sharing can change vertex counts without changing semantics.
+
+The replay instead enforces the explicit cap **K=65,536** on every complete
+snapshot: the sum of three graph vertex/edge/attribute counts, all supplied
+role-list lengths, plus one. Handles are persistent positive labels throughout the observed caller lifetime,
+at most K; they are not reidentified independently at each check.
+This gives Q=4,194,304 words and w=23 bits. Every current snapshot must satisfy
+the cap; failure is a rejection, not an extrapolated successful invoice.
+The enormous conservative upper bound is intentional and cannot justify a
+speedup on the 512-bit reduced fixture.
+
+## Executable boundary and independent checks
+
+[kernel.py](kernel.py) executes encoded graph traversal with a visited-flag
+array, complete engine membership checks, producer separation, ordered external
+bindings, storage/acquisition exclusivity and finite cache substitution. It
+performs no Tape payload read or numerical operation. Its host arrays simulate
+charged sequential scans; they are not physical memory accesses of cost one.
+The complete control trace includes zero filling, imports and cleanup, and
+checks both the access and scalar-instruction upper bounds.
+
+[observer.py](observer.py) independently encodes the actual three owner graphs.
+It preserves the authenticated source's omission alphabet and checks exact
+Tape encounter order against original `owned_tapes` at every site. The original
+`ReturnProtocol.check_inventory` and exchange still execute after the kernel;
+no source guard is replaced or waived. Current/auxiliary/acquisition fields
+are all included. The one observer hook is inserted in #4790's **test harness**;
+full AST comparison proves its removal recovers the unchanged harness. The
+actual producer, service, native child and numerical sources are unchanged.
+
+[check_bits.py](check_bits.py) is a separate bit-register/store implementation.
+It expands the access path on 156 read/write cases, including address zero and
+last addresses, and checks selected values, preserved other words, restored
+head and exact instruction counts. It neither imports the primary charge
+formula nor obtains counts by evaluating that formula. Twelve negative controls
+cover every omitted snapshot field, an exceeded graph cap, insufficient handle
+width, stale external order, a duplicate cache role, an out-of-range graph edge
+and dropping later returns from the whole-source invoice.
+
+The scalar-macro and residual-binding envelopes are written conservative
+bounds, not independently executed physical lowerings. A producer of the encoded
+source graph must prove that its own cost is included in F or in a separately
+justified bounded acquisition implementation. The kernel cannot authenticate a
+physical graph that its caller omitted. The read-only source observer checks
+that implication only for the executed source case.
+
+## Reproduction and provenance
+
+```
+python3.12 -B scripts/research_package.py --package research/qq16-finite-handle-charge
+python3.12 -I -B research/qq16-finite-handle-charge/verify.py --log /tmp/qq16-control-log.json
+```
+
+The default replay is read-only; `--write` explicitly regenerates RESULT.json.
+`--log` writes only the requested observation file, including every phase's
+shape and charged counters. The receipt accepts a bounded current trace rather
+than requiring incidental Python object-identity sharing to reproduce exactly.
+Normal and optimized registered commands run the same explicit guards.
+
+SOURCES.json binds 144 live inputs. The inherited loader retains its original
+hash checks and exact historical selected-record projection. No selected record
+or frozen source is changed. Exports need no Git or network. No full historical
+suite, production replay, Lean or Docker run is required.
+
+Base `b91956876e5b4122fd89179f1b57557ff8378f15`, priority revision 7.
+[Canonical claim](https://github.com/CrocSwap/integer-mult-bounds/discussions/4744#discussioncomment-19138319).
+Entry overlap covered 317 open PRs, 4,064 Discussion records and all 6,636 base
+local notes. Closed arbitrary diffs and unpublished work are outside that
+coverage. #4949's arrangement audit and #4956's portable integration are credited
+completed work; they are not repeated or superseded by this cost certificate.
+
+## Credit
+
+JoyboyBrian's #4790 supplies the installed-return composition and complete
+source census interface; Mihir Srivastava's #4949 supplies the independent
+ownership audit; #4956 supplies the portable-replay follow-up. Chris R /
+Clear1nsight's #4166/#4167/#4172/#4177 supply the actual caller, return exchange,
+prior tariff and complete-cost lineage. Tekalign's finite-role exchange and
+Jose Manuel's physical controller/Ordinary/Compact sources retain their credit,
+as do all retained QQ16/native predecessor notices. This conditional kernel,
+source observer, bit checker and writing are by JoyboyBrian with substantial
+OpenAI Codex assistance. Apache-2.0.
+
+## Open next questions
+
+- Prove a uniform production graph cap K from the actual controller, Ordinary
+  inventories and lease/context lifetimes. Start at every return phase, since
+  the constructor-only substitution fails. The missing invariant blocks
+  production use of the reduced cap.
+- Implement and price a complete physical source encoder/store interface and
+  its frontend F, including control storage and compilation. The sequential
+  macro price alone does not discharge this embedding.
+- Combine this conditional charge with the complete unmatched D* versus B*
+  native/nonchild ledger. Unknown remaining terms prevent a total sign or κ
+  conclusion; the credited return saving must be used only once.

research/qq16-finite-handle-charge/RESULT.json

@@ -0,0 +1,33 @@
+{
+  "actual": {
+    "algorithm_validations": 49,
+    "cache_exchanges": 36,
+    "constructor_size_not_uniform": true,
+    "contract_size": 65536,
+    "excluded_final_audit": 1,
+    "graph_walks": 147,
+    "returns": 24,
+    "service_returns": 12,
+    "unchanged_complete_receipt": true
+  },
+  "assumption": "Encoded complete bounded graphs; F remains separate and is not assumed zero.",
+  "bit_access_cases": 156,
+  "per_kernel_upper": {
+    "accesses": 67108864,
+    "bits": 78531626279108608,
+    "capacity": 4194304,
+    "scalar": 268435456,
+    "width": 23
+  },
+  "rejection_controls": 12,
+  "scope": "Conditional metadata charge only; no production K, physical embedding, D* versus B* or kappa.",
+  "status": "PASS_QQ16_FINITE_HANDLE_CHARGE",
+  "whole_cover_bill": {
+    "cache_exchanges": 511350,
+    "control_upper": 160549585575251963543552,
+    "residual_binding_budgets": 511015,
+    "tape_saving_coefficient": 5621154,
+    "tape_saving_constant": 2044056,
+    "validations": 1022029
+  }
+}