Certify a maximal two-digit compact guard with 64 fewer repairs (no κ)

research/compact-maximal-invariant-guard/PROOF.md

@@ -0,0 +1,152 @@
+# A maximal invariant guard on one complete two-digit quotient
+
+This contribution was produced by Nick Petalas. Claim type: finite optimal-guard
+certificate with a scoped written invariance and repair argument. Apache-2.0.
+
+## Contract
+
+Use the unchanged later-source compact word in Douglas Colkitt's
+`notes/compact-control-movement.tex`, with the explicit packed semantics in
+Arham Tahir's PR1603. Fix
+
+```text
+n=2, K=3, G=1, rho=2, B=2, C=B^n=4, Y=2^((n+1)K-rho)=128.
+s=(y,t,u,c), 0<=y<128, 0<=t,u,c<4.
+```
+
+Here y is the target quotient after removing its two unchanged low bits.
+Both processed source bits are in c, and t,u are the complete compact fields.
+All upper target bits remain. In particular, equality modulo 16, the width
+of the observed selected bits, is insufficient. The full target has nine
+bits, the quotient has seven, and the omitted highest selected bit is retained
+in the comparison. Source spectators and the arbitrary back field retain
+the source note's unchanged swap-sandwich contract.
+
+For two-bit z, define
+
+```text
+m(z) = z_0 + 8 z_1
+p(y) = bit_0(y) + 2 bit_3(y).
+```
+
+The earlier-source map P_z on y,t consists of these four updates, in order:
+
+```text
+y += 2(z_0 t_0 + 8 z_1 t_1)              modulo 128
+t += p(y)                                modulo 4
+y += z_0(1-2t_0) + 8z_1(1-2t_1)         modulo 128
+t -= p(y XOR m(z))                        modulo 4.
+```
+
+Every t digit is read from its current value. At radix two, the control
+parities equal the two-bit integer u and loading c means u+c modulo four.
+Thus S applies P_u and P_((u+c) mod 4), returning u,c unchanged. The intended
+involution is T(s)=(y XOR m(c),t,u,c). Each elementary rotation is independent
+of its destination, so S is a permutation on all 8,192 states.
+
+Write H for PR1603's sufficient carry guard, specialized to this geometry.
+The executable `carry_guard` is the direct specialization of that predicate.
+Its all-size sufficiency and invariance remain predecessor results.
+
+## New guard and exact finite theorem
+
+Define
+
+```text
+B_extra = {s: c=0, t=1, u=2, y odd}
+H_plus = H union B_extra.
+```
+
+On this entire quotient, H_plus is exactly the largest subset on which
+S=T that is invariant under T. It is also the largest S-invariant subset
+of agreement. Its size is 2,432, while H has 2,368 states. B_extra consists
+of exactly 64 states and is disjoint from H. The good fraction increases
+from 37/128 to 19/64. No other geometry or asymptotic optimum is asserted.
+
+### Written proof of the added branch
+
+Take y odd, t=1, u=2, c=0, and put a=bit_3(y). The temporary digits are
+(1,0), and the controls are (0,1). The first target rotation is zero.
+The temporary load is
+
+```text
+t_loaded = 1 + (1+2a) modulo 4 = 2+2a modulo 4.
+```
+
+The second target rotation is therefore -8 if a=0, and +8 if a=1.
+It toggles bit 3 and preserves bit 0. The unload restores t=1 because
+the selected bits of y_new XOR 8 are the original selected bits. Hence
+
+```text
+P_2(y,1) = (y+8(2a-1) modulo 128, 1).
+```
+
+The next P_2 sees 1-a and reverses the displacement exactly, including
+wraparound. Since c=0, these are precisely S's two calls and T is identity.
+Thus S=T on B_extra. T fixes this branch, so it is invariant.
+
+The branch lies outside H: the inactive saturated low temporary digit and
+odd low target produce carry d_1=1 into the active high digit. H excludes
+that carry. At even y the same t,u,c triple is already in H, so dropping
+the odd qualifier from the union changes no accepted state.
+
+Combining this branch with the credited invariance and sufficiency of H
+proves the improvement in writing. Its maximality is the finite theorem below.
+
+### Finite completeness argument
+
+Let E={s:S(s)=T(s)}. For any involution T, its largest invariant subset
+contained in E is E intersect T(E). This general observation is already in
+PR1603 and is not a new theorem claimed here. Equivalently, retain exactly
+the complete cycles of the permutation S that lie inside E. Every
+S-invariant subset is a union of complete S cycles. On a retained cycle,
+S=T, so that cycle has length one or two and is T-invariant. This proves
+that this cycle algorithm computes the unique largest admissible core.
+
+The verifier builds S by ten literal rotations on full nine-bit targets.
+It executes all 32,768 full-target states, including all four low-bit lifts
+of every quotient state, and compares every output field to a separate
+quotient implementation. Both S and T are checked to be permutations.
+The cycle algorithm partitions all 8,192 quotient states. Its retained
+bitmap equals the explicit H_plus predicate entry for entry. Every added
+state is checked to have the displayed four field conditions, and the
+entire explicit branch is present. This establishes finite maximality
+without a conjectured extrapolation or a census of predecessor results.
+
+The generated receipt hashes the core bitmap in the order
+`index=(((c*4+u)*4+t)*128+y)`, with the lowest index in the low bit of each
+byte. The bitmap is not handwritten. Normal verification writes no files.
+
+## Current-address repair consequence
+
+Since S and T preserve H_plus and agree there, the correction T S^-1 fixes
+H_plus and permutes its complement. The retained extract/sort/reinsert
+algorithm therefore has exactly 5,760 quotient records to repair, rather
+than 5,824 with H. The finite checker installs a distinct payload tag at
+every state, applies S, constructs all current-address keys T(S^-1(q)),
+sorts all exceptional records and verifies every final destination tag.
+It also checks that a wrong key T(q) produces an incorrect complete map.
+
+With the predecessor notation V=MP, address width L and payload width P,
+the declared repair bound stays
+
+```text
+O(V + M L^3 + delta M L(P+L)).
+```
+
+For this complete rectangle, delta changes from 91/128 to 45/64. The
+64-record reduction is an exact counting consequence, not a measured
+runtime saving. Every one of the twelve compact swaps, ten rotations,
+source accesses, back-field returns and highest-bit completion remains paid.
+The new predicate adds a constant number of field comparisons to H. The
+finite sort replay is a logical record permutation, not a physical tape
+implementation or a supplier admission.
+
+## Limits
+
+Maximality is proved by exhaustion only for the stated n=2 geometry. The
+written branch argument also concerns precisely those parameters. No
+all-n carry automaton, production predicate change, complete compiler,
+native interface, recursive stock, precision, physical routing, analytic
+transfer, new kappa or selected-frontier change is supplied. Independent
+human and formal proof-kernel review are unclaimed.

research/compact-maximal-invariant-guard/README.md

@@ -0,0 +1,138 @@
+# Maximal invariant two-digit compact-control guard
+
+This contribution was produced by Nick Petalas. Apache-2.0.
+Claim type: finite optimal-guard certificate and scoped written repair proof.
+
+For the unchanged later-source compact word at
+`n=2, K=3, G=1, rho=2`, the exact largest invariant agreement guard is
+
+```text
+H_plus = H from PR1603 OR (c=0 AND t=1 AND u=2 AND y is odd).
+```
+
+Here y is the full seven-bit target quotient, t,u are the complete two-bit
+compact fields, and c contains the two processed source bits. The entire
+quotient has 8,192 states. All nine physical target bits, including the two
+low spectator bits and every upper bit, are accounted for.
+
+| Same complete quotient | PR1603 carry guard H | Maximal guard H_plus |
+|---|---:|---:|
+| Accepted states | 2,368 | 2,432 |
+| Good fraction | 37/128 | 19/64 |
+| Exceptional repair records | 5,824 | 5,760 |
+
+The 64 added states form one exact cancellation branch. An inactive
+saturated low temporary digit sends a carry into the active high digit.
+The old guard excludes it. With zero processed source bits, the two actual
+subcalls reverse each other's displacement on this branch. The intended
+map is identity there. [PROOF.md](PROOF.md) gives this calculation, the
+finite maximality argument and the retained repair bill.
+
+This answers one small multi-digit instance of Arham Tahir's PR1603 open
+question. Aaron Wang's PR1823 counts raw agreement; woklerx's PR1856 reduces
+that census with a full-modulus carry defect. Those results are credited
+context. Their mathematical executables are neither imported nor replayed.
+The general involution-core observation is also credited prior work. The
+new result is the explicit maximal multi-digit guard and its strict
+64-record reduction on this complete quotient.
+
+## Evidence and reproduction
+
+From the repository root, with CPython 3.12 and its standard library:
+
+```sh
+/Users/nick/git/integer-mult-bounds/.venv/bin/python3.12 -I -W error -B research/compact-maximal-invariant-guard/verify.py
+/Users/nick/git/integer-mult-bounds/.venv/bin/python3.12 -I -O -W error -B research/compact-maximal-invariant-guard/verify.py
+/Users/nick/git/integer-mult-bounds/.venv/bin/python3.12 -B scripts/research_package.py --package research/compact-maximal-invariant-guard
+/Users/nick/git/integer-mult-bounds/.venv/bin/python3.12 -B scripts/check_research_commit.py --package research/compact-maximal-invariant-guard --check-source-history
+```
+
+Substitute another CPython 3.12 executable elsewhere. Direct replay prints
+`PASS_COMPACT_MAXIMAL_INVARIANT_GUARD` in generated JSON stdout. The receipt
+binds every package file by SHA256 and includes the exact accepted-set bitmap
+hash. No receipt is handwritten and normal replay writes no files.
+
+The bounded check executes all 32,768 full-target cases and compares every
+field with a separate quotient implementation. It partitions the complete
+raw permutation into cycles and retains exactly those wholly in agreement.
+This algorithm, which does not use the explicit guard formula, agrees with
+H_plus on all 8,192 states. Every extra state is classified, both invariances
+are checked and all 8,192 distinct payload tags reach their intended output
+after repairing precisely the 5,760 exceptional records.
+
+Controls reject agreement without invariance, removal of each of the three
+extra-branch field conditions and incorrect current-address repair keys.
+The new branch is required by a positive witness, the even-parity overlap
+with H is retained, and seven invalid inputs fail in both Python modes.
+The source note and PR1603 proof are authenticated live text inputs, without
+executing predecessor code. The registered runner checks the remaining
+historical catalogue and selected-record pins.
+
+Local CPython 3.12.15 on macOS 27.0.1 arm64 passes both direct commands
+and the registered package replay. The direct checks took 0.105 and 0.104
+seconds, within their 60-second caps. These durations establish local
+timeout headroom and are not a speedup claim. Normal and optimized receipts
+agree byte for byte. In-memory compilation and whitespace checks pass.
+
+## Limits and relevance
+
+Maximality is finite and specific to the displayed geometry. The extra
+branch has c=0. This does not establish an improvement on nonzero processed
+source slices or on production parameter families. The wider all-n symbolic
+agreement problem remains open. The card's changed scope to a written
+descriptor interface result is explicit in TASK.json.
+
+The inherited complete repair bound retains
+`O(V + M L^3 + delta M L(P+L))`; only this rectangle's exact delta changes
+from 91/128 to 45/64. No runtime speedup is claimed. All twelve compact
+swaps, ten rotations and the separate highest-bit completion remain paid.
+The payload replay is a logical permutation. Physical tape execution,
+compiler, native supply, ownership/stock, precision and analytic transfer
+are unproved here. No selected cold replay, Lean, Docker, new kappa or
+selected-frontier change is claimed. Independent human and formal
+proof-kernel review are unclaimed.
+
+## Open next questions
+
+Can a symbolic multi-digit carry calculation characterize an invariant
+enlargement that includes nonzero processed source slices? First use the
+complete-map and full-target-modulus tests on one additional geometry, then
+prove a bounded carry-state description. No extrapolation from this one
+finite cancellation branch is justified. The state bound, physical guard
+implementation and complete caller bill remain blockers.
+
+## Credit and provenance
+
+Arham Tahir / Arham-Tahir64, PR1603, supplies H, its all-n invariance proof
+and the explicit multi-digit open question. Aaron Wang / navinor, PR1823,
+supplies the raw-agreement census context. Woklerx / PR1856 supplies the
+full-target-modulus warning and integer-lift context. Douglas Colkitt
+supplies the unchanged compact word and exceptional-record repair contract.
+Credit Hanson Sun / bbMisk, PR1247/1219; Sagar Thakrar / thakrarsagar,
+PR1475; John-Michael Smith / jp3isme, PR763; martinxxx9 / PR1108; and the
+retained compact-control lineage. Their source files and credit lines are
+unchanged. No general literature-priority claim is made for elementary
+permutation or involution facts.
+
+Canonical base is `7c49fe32c55de02c2c873655c804b16e4c3fef0a`, priority revision 8.
+The selected source-binding baseline passed with selected PR6030 unchanged.
+Live open PRs, recent account contributions, merged searches, main README
+searches and Discussion claims were checked before reservation. The overlap
+snapshot covered 387 open PRs, 6,322 Discussion records and all 8,917 tracked
+README/TASK/ledger notes. Arbitrary diffs and unpublished work remain outside
+that text coverage. Absence of a match is not a novelty certificate.
+
+Advance claim:
+https://github.com/CrocSwap/integer-mult-bounds/discussions/1166#discussioncomment-19362365
+
+## Verifier bounds
+
+All mathematical loops have fixed bounds from the 8,192-state quotient,
+four low-bit lifts, two digits, four phases and a fixed control list.
+Permutation traversal uses an explicit 8,192-step cap per cycle and visits
+each state once. There is no recursion, subprocess, network operation,
+runtime code generation or external mathematical implementation.
+Functions fit within 60 physical lines. Explicit failures remain active
+under optimized Python. Python dynamically allocates integer and collection
+objects; fixed-size domains bound these allocations, rather than providing
+a static-memory guarantee. The registered commands enable warnings as errors.

research/compact-maximal-invariant-guard/SOURCES.json

@@ -0,0 +1,30 @@
+{
+  "schema_version": 1,
+  "base_commit": "7c49fe32c55de02c2c873655c804b16e4c3fef0a",
+  "files": [
+    {
+      "path": "certificates/selected-result.json",
+      "usage": "provenance",
+      "git_blob": "d59b5035e7b4cbaa9d688a1d32dd0d6eb79c466a",
+      "sha256": "9b8d0eea95b3bf0dfcb7938a732a6439b87a2685dec2a5ab9e525b3b34debbfa"
+    },
+    {
+      "path": "docs/research/agent-task-catalog.json",
+      "usage": "provenance",
+      "git_blob": "3404fbdd5e7529a0674eef26114b5071e4586cec",
+      "sha256": "ead6cdc9d0af6d58e8a49744d8ec8c7c15e13d2ba93c276c434bcf9b51b93a81"
+    },
+    {
+      "path": "notes/compact-control-movement.tex",
+      "usage": "input",
+      "git_blob": "06b6a9ef24245ac7b724c53a204635415b402357",
+      "sha256": "b963c3d2f4e1b7059aa289bb4b4ac89b688920bcf42f5b20d7698cdef0132cc6"
+    },
+    {
+      "path": "research/compact-late-carry-guard/PROOF.md",
+      "usage": "input",
+      "git_blob": "89f39f3b557b2bb0c1c26d2d7d255121f6db8fb5",
+      "sha256": "1cc589e40f94fa64add255f81c381720ddef933c7cfa7d07ef6263c2cf1e8b85"
+    }
+  ]
+}