Execute complete finite control at the actual CRT repair caller

research/crt-complete-repair-control/PROOF.md

@@ -0,0 +1,151 @@
+# Complete outer control at the actual fixed CRT repair port
+
+## Statement
+
+This is a fixed-geometry finite-symbol program theorem, not an all-size CRT
+or multiplication theorem. Let the six borrowed unary records G,H,K,Y,J,B
+encode (2,2,6,8,2,0), using the retained `< 1^n >` representation with blank
+tail. Let the borrowed ROM be `L F R`, where F is any32-bit Boolean table
+satisfying F[v]=F[v xor4]. Let data contain4096 opaque symbols from the fixed
+alphabet {('R',v):0<=v<4096}, framed by `<` and `>`. The data is the raw
+post-S stream for the retained ten-shear compact map S, with source
+f(y)=F[y mod32]. All roles are physically distinct, heads initially zero,
+all owned roles are initially blank. The program installs each outer `<`
+marker through a charged write, then erases it after the source cleanup. Arbitrary finite blank tails are allowed.
+
+The fixed program returned by `assemble` has no runtime instance parameters.
+It returns data in the ideal T-image order; it preserves the six unary
+records and ROM, erases every consumed/private role, returns every tape
+head, and resets every finite-control register. Each of the2944 bad addresses
+calls the actual key exactly once; good addresses never do. It is a theorem
+for arbitrary payloads in that fixed alphabet and every admitted ROM, not
+an inference from the one canonical numerical fixture.
+
+Raw S preparation and ROM construction are input contracts. This work does
+not execute S, its twelve paid shuttles, a descriptor/ROM producer, a larger
+geometry key, or a complete E(p,ell) evaluator. A marked-role input adapter
+allocates fixed blank owned roles; it does not initialize arbitrary borrowed
+dirty storage. Rejecting malformed executions have no rollback guarantee.
+
+## Source refinement and static compilation
+
+The retained #4208 producer, #4201 scanner and #4637 bridge contain finite
+symbol tests and marker-driven loops, but execute them as Python control.
+#4795 implements the key as explicit instructions while the outer caller
+still has only a cell-action invoice. This package compiles those unchanged
+source ASTs at assembly time and runs none of their Python functions during
+execution. Source hashes are authenticated before assembly.
+
+Each source local has a private finite register at each static inline call
+site. Mutable parameters are copied before entry, preserving call-by-value
+binding while tape-role values still refer to the same physical tape. Locals
+are allocated before compiling conditions or either arm; loop tests and both
+arms therefore name the same assigned register. Source calls are expanded
+statically and recursive source calls are rejected. Each return jumps to a
+static continuation. The key instructions are inserted with relocated static
+PCs, a disjoint register namespace, and a fixed map for counter/stream/ROM
+and its twelve private roles. Its accepting halt becomes a jump to the
+unique split continuation. No runtime call stack or callable exists.
+
+A source assignment becomes a finite-register copy. Comparisons, negation,
+fixed tuple fields and fixed tuples become finite truth-table operations.
+Short-circuit Boolean expressions and conditional expressions become branch
+and copy sequences, preserving both evaluation order and tape-read side
+effects. `while` becomes a static back edge with its test reevaluated each
+time; `break` and `return` become patched static jumps. `for` is accepted only
+on a statically bounded tuple, expanded at assembly time. No data-dependent
+range or numeric induction variable is admitted. Tape.read/write/move become
+single-cell instructions, with move restricted to +/-1. A tape-role register
+ranges over the fixed finite bank; choosing a role is a finite multiplexer,
+not an encoded address into data. Field projections have compile-time indices.
+
+The source record predicate is implemented on the declared finite4096-symbol
+record alphabet. The tuple representation in the emulator is a symbol name;
+its numeric payload never becomes a machine address, arithmetic operand or
+loop bound. Stencil atoms form a fixed finite product alphabet too. This is
+not a literal binary transition table or a unit-price unbounded tuple machine:
+all tuple arities, fields, role values and alphabets are bounded independently
+of the input payloads. A binary encoding and its constants remain unclaimed.
+
+Valid executions of the source producer do not take its exception handlers.
+The compiler deliberately maps all raises to rejecting halts, preserving the
+stated successful-domain theorem while making no source exception-cleanup
+or transactional-rejection equivalence claim. Static mutation flags are
+specialized to the normal program. Instrumentation callbacks/meters are
+removed during assembly; the unpaid evaluate_key is replaced by the entire
+literal key program, not by a host result. A verifier observer can inspect
+states but its values never enter execution.
+
+Induction on the supported expressions/statements gives equality of tape
+operations and finite source state at statement boundaries. Loop induction
+then lifts this relation through the retained source algorithms. The inherited
+producer/scanner proof gives the actual owned stencil and mask; the retained
+key theorem gives T(S^-1(q)) from the current counter and ROM; the bridge's
+split/radix/reinsert proof gives the ideal payload endpoint and exact bad-only
+call set. The source ownership proof, the key's cleanup, and the explicit
+control initialization/final reset establish the full successful boundary.
+
+## Complete instruction ledger
+
+Every executed read, write, one-cell move, finite-symbol operation, branch,
+jump and halt costs one. Initial register writes, outer-marker installation/disposal and final reset
+are explicit instructions. The executor's heads, PC, step totals and event observations
+are configuration/observer machinery, never program operands.
+
+Cut outgoing CFG edges at each read/write/move (and halt). The checker rejects
+any cycle in the remaining graph and computes its longest path length D by
+a topological pass. Thus between successive charged cell actions, before the
+first and after the last, the machine executes at most D instructions. For
+any finite execution with C cell actions,
+
+    T <= (D+1)(C+1).
+
+The extra1 is deliberately conservative about whether the ending cell action
+is included. This argument covers every possible branch, including branches
+not taken by the calibration; the observed maximum alone is not the proof.
+A control-only-cycle mutation must be rejected.
+
+For a parameter-only bound in this fixed geometry, write M=4096,L=12,N=2944.
+Exclude all inlined-key actions from the outer cell count. Counter setup has
+at most10(L+1) actions. Each split/address-carry iteration has at most
+20(L+1) actions. A radix pass, including last-bit search, key rotation, both
+bucket rewinds, concatenation and erasure, has at most100N(L+1)+100 actions;
+there are L passes. Reinsertion/counter checking has at most40M(L+1) actions.
+Final erasure traverses at most a constant ten times the total
+M+N(L+1)+L+10 retained cells. These estimates follow by counting the reads,
+writes and one-cell moves in each unchanged source loop; no loop scans past
+its marker. The22 outer-marker lifecycle writes are additional. Producer841 and scanner454830 are exact on the declared unary
+geometry. Summing these charges is less than
+
+    C_outer <= 1000 M (L+1)^2.
+
+The retained key theorem gives T_key<=3,287,110, hence also C_key<=3,287,110,
+for each admitted q,F. All actual key operations, including its append port,
+are counted there; the removed host interface must not be added again. Thus
+
+    C <= 1000 M (L+1)^2 + N*3,287,110,
+    T <= (D+1)*(1000 M (L+1)^2 + N*3,287,110 +1).
+
+This loose bound closes the finite-symbol instruction ledger; it neither
+improves the source asymptotic tariff nor proves full E absorption. Exact
+observed counts are separately frozen in RESULT.json. Physical storage is
+bounded by the fixed source roles: two record buckets each N(L+1)+2,
+keyed bad N(L+1)+2, good M-N+2, data M+2, mask M+2, stencil/counter L+2,
+the eight finite unary work extents and key roles. Reusing four emptied
+producer roles for good/bad/buckets is included; no live role is aliased.
+Finite-control register storage is fixed and separately reset.
+
+## Evidence and remaining questions
+
+The actual canonical middle-layer fixture comes from h3, modulus5,
+offsets[0,2,4,0]. Host arrays only construct declared raw-S/ROM inputs and
+independent expected output; they do not supply the machine's mask, keys,
+branches or traversals. The independent observer checks each current key
+counter, exact returned key, scratch erasure and final caller ownership.
+Finite tests corroborate the written refinement; they are not independent
+human or proof-kernel acceptance.
+
+Open: binary lowering of this complete alphabet; variable-geometry key
+control; actual raw macro with twelve dirty-back shuttles; descriptor/ROM
+production in the same lifecycle; full evaluator/native/precision/outer
+admission. No selected frontier or new kappa is claimed.

research/crt-complete-repair-control/README.md

@@ -0,0 +1,76 @@
+# Complete finite control at the actual CRT repair caller
+
+The #4795 key service prices its instructions, but its real surrounding
+producer/scanner/repair caller still executes Boolean control in Python and
+prices only cell actions. This package lowers the unchanged source ASTs to
+one fixed finite-symbol program and executes the complete actual layer:
+unary geometry, stencil, dense mask, split, 2,944 direct key calls, stable
+12-pass radix repair, reinsertion and disposal. Runtime execution has no
+Python source loop, callable key, AST interpretation or host-generated mask.
+
+The successful-domain theorem covers the fixed u2/t2/y8 geometry, arbitrary
+opaque 12-bit record labels, and any target-independent 32-bit ROM at target
+position 2. The actual canonical fixture has 4,096 records and the source
+h3/modulus5/offsets[0,2,4,0] middle layer. Raw post-S data and the supplied
+ROM remain explicit inputs. No raw compact macro, twelve-shuttle native
+implementation, all-size E(p,ell), binary transition table or new kappa is
+claimed.
+
+`compiler.py` expands finite source calls and relocates the entire retained
+key program into the split continuation. Mutable locals, short-circuit
+conditions, marker loops, fixed role multiplexers and finite stencil/record
+symbols all have explicit instruction semantics. Unsupported syntax is
+rejected, including loop-else and try-finally. On malformed-input errors the
+compiler rejects without claiming the original producer's exception cleanup.
+`machine.py` installs and disposes of owned markers and initializes/resets
+all finite-control registers through charged instructions.
+
+The full static CFG is cut at charged tape operations; its remaining graph
+must be acyclic. Its longest path D bounds every control-only interval, so
+T <= (D+1)(C+1), for any execution with C cell actions. The written proof
+also bounds all outer actions and every retained key call, without re-adding
+the removed host key interface. This completes one local instruction ledger;
+it does not claim an improved asymptotic tariff.
+
+## Reproduce
+
+```
+python3.12 -B scripts/research_package.py --package research/crt-complete-repair-control
+```
+
+`verify.py --light` runs bounded CFG, compiler admission, nested key, radix,
+carry, cleanup and alias controls. Full verification checks every actual key
+against an independent source oracle, the entire repaired payload, exact bad-only
+call set, all borrowed/private roles and heads, and the frozen instruction
+receipt. `--write-result` is explicit authoring mode. Exact source/history,
+normal/optimized, export and corruption evidence is recorded in VALIDATION.md.
+
+The constructor only allocates fixed blank owned roles and verifies borrowed
+object disjointness; it never decodes the unary headers, ROM or payload into
+execution decisions. Verifier callbacks observe execution and cannot supply
+an operand, key or branch. The local theorem assumes correctly framed inputs;
+there is no blanket malformed-input rollback claim.
+
+## Open next questions
+
+1. Lower the whole finite alphabet to binary transitions, with its full constant.
+2. Execute raw compact S and its twelve paid dirty-back shuttles on the same data.
+3. Connect variable-geometry descriptor/ROM/key generation and the full E bill.
+
+TASK.json records concrete first steps and blockers. These obligations remain
+separate from the completed fixed caller and are not automatic continuation.
+
+## Provenance and credit
+
+Base81e9bd69e4a5b00ba9c713a1620e36d576d5522e, priority7. Canonical claim:
+https://github.com/CrocSwap/integer-mult-bounds/discussions/4709#discussioncomment-19142272
+
+Credit Cinna Davis #4100 for the compact CRT construction and source oracle;
+Hiroki KUMAZAKI #4169/#4174 for current-state reverse keys; ToikY #4201/#4208
+for scanner/producer; the #4637 mask bridge, Jose Manuel and Ryanson Jonathan
+for retained repair lineage; unpaidmoon and Douglas Colkitt/OpenAI; and the
+#4795/#4752 finite-key/query predecessors. Their source algorithms and proofs
+are reused, not presented as new. All source files and original notices remain
+unchanged and hash-pinned. JoyboyBrian, with substantial OpenAI Codex assistance.
+Apache-2.0. Separate agent review is not independent human or proof-kernel
+acceptance. Selected frontier and frozen archives are unchanged.

research/crt-complete-repair-control/RESULT.json

@@ -0,0 +1,69 @@
+{
+  "status": "PASS_COMPLETE_CRT_REPAIR_CONTROL",
+  "source_hashes": {
+    "research/crt-unary-stencil-producer/producer.py": "8586d019a0a35390d36b944a2b764ec96682040b1abc42e29d740faf5a830bd0",
+    "research/crt-unary-stencil-producer/PROOF.md": "4076e6041bedce5269c1d4e3d62f0e4213a4b2e790fe270b89b4b4f3363e08aa",
+    "research/crt-dense-guard-scan/machine.py": "1cb27312932914eb631078bd56e85feb1dc6c4191e9d1962b2cc3a7e1cfb8df7",
+    "research/crt-dense-guard-scan/PROOF.md": "c075a3c261bb824884f0da9f99fed227b15f9fac087bbdeb2c2cb861d4091f11",
+    "research/crt-mask-repair-bridge/bridge.py": "573451d94435b6096a88250ca2a9fb75f39bcfa6f0436ffe2363ee07381d8331",
+    "research/crt-mask-repair-bridge/key_subroutine.py": "ffdbb610be71ae20bf974946dac66b6c1b4d43739cbc3b1eb81cbbeab8784b44",
+    "research/crt-mask-repair-bridge/PROOF.md": "c74f93a65f7b28e751a9c93aa37fc7f74f7ce42cd96e31fa3d1212c94991769c",
+    "research/crt-paid-key-service/service.py": "ff06c6305c9f650a694e5c42baa4c7d841decf844a4f44f6776acc10a8400083",
+    "research/crt-paid-key-service/PROOF.md": "1a4ac02653eb6c1b20807033a910f27bf9484cc972bf2629941f589275a87325",
+    "research/crt-uniform-rom-query/machine.py": "46ee6a635251e498ee9a5d4aff8c0e2a7f1ef2ff951e5b6a2a8953316e9cd02d",
+    "research/crt-uniform-rom-query/PROOF.md": "736be5e1af590f2195e8b56b958258f0babe5cd6d2cf6f4f5023410112f4d870",
+    "research/unconditional-batched-crt/check_batched_crt.py": "681e2e3d71fa74c8b9b326f3860104fd9d89590a222e26ae6ee718d1fd40ff2e",
+    "research/unconditional-batched-crt/CRT.md": "02c3a1e38cbee25aefe2640cc72676da62ba10eb7519fbcb9adb9d48b74eff2b",
+    "research/unconditional-batched-crt/NOTICE.md": "924109837e71c52392191710d49c9deb42780878d1094f0b01e8690dbe799461"
+  },
+  "controls": {
+    "rejected": [
+      "try_finally",
+      "while_else",
+      "for_else",
+      "nonempty_tape",
+      "method_extra_arg",
+      "keep_buckets",
+      "skip_pass",
+      "carry_skipped_bit",
+      "control_only_cycle",
+      "borrowed_role_alias",
+      "skipped_nested_key",
+      "borrowed_rom_write"
+    ],
+    "control_factor": 606,
+    "program_instructions": 8242
+  },
+  "actual": {
+    "status": "PASS_ACTUAL_COMPLETE",
+    "program": 8242,
+    "steps": 167388895,
+    "cells": 52900280,
+    "factor": 606,
+    "key_calls": 2944,
+    "phases": {
+      "616": [
+        616,
+        11
+      ],
+      "1532": [
+        2862,
+        852
+      ],
+      "1758": [
+        2637861,
+        455682
+      ],
+      "7625": [
+        167388278,
+        52900269
+      ]
+    },
+    "program_sha256": "ed1893ec1eb99f075fb67b5319cf99e961d3f9bb0daba82c13a84cbe4dfb28bf"
+  },
+  "code_hashes": {
+    "compiler.py": "1186cdefed22890a987c1f289290c6db4c19446a29461c1db46257f318b05156",
+    "machine.py": "afa110ed2fdba62e810fd794e5fd62a07ec4caf18e8919066275523713353cc7"
+  },
+  "instruction_bound": 6294271835487
+}