diff --git a/research/halo-copy-enumeration/README.md b/research/halo-copy-enumeration/README.md
new file mode 100644
index 0000000000..0abc1a3c3d
--- /dev/null
+++ b/research/halo-copy-enumeration/README.md
@@ -0,0 +1,339 @@
+# Gaussian halo input-copy enumeration
+
+**Scoped all-size combinatorial implication, independent finite verifier, and an
+explicit physical-cost boundary. No new κ.** The selected conditional record
+remains κ = 0.00302015. On 2026-10-22 the orchestrator replayed the final
+algorithm-seam controls and six-input closure under CPython 3.12.13: metadata,
+normal and optimized registered runs passed. Finite audit evidence is not
+scientific acceptance, a full-tape proof, or selected-result replay.
+
+This answers Nick Petalas's [#4217 open question](../halo-locality-witness-audit/README.md#open-next-questions),
+not his polynomial-locality argument. Its caller is Cinna Davis's
+[GAUSSIAN.md lines 177–226](../unconditional-batched-crt/GAUSSIAN.md) and
+[HALO.md lines 36–94](../unconditional-batched-crt/HALO.md), retained from #4100.
+The new result is the explicit prefix/DFS enumeration, exact copy-volume
+identity, independent destination oracle, and separation of non-output setup
+from output-sensitive work. It neither repeats the locality factor-two note
+nor substitutes exponent arithmetic for a universal algorithm.
+
+## Definition and quantified result
+
+Let g >= 1, integer A > 0, L > 4A, 0 <= b < A, and axis periods S_i = n_i L
+with n_i >= 2. Coordinates are canonical integers modulo S_i. Here b is a
+sufficient input-dependency radius, not a Gaussian conditioning parameter.
+For core c, write local coordinates in [0,L). The kept interior is
+I = [A,L-A); the lower and upper boundary intervals are B_0 = [0,A) and
+B_1 = [L-A,L). All intervals are half-open integer intervals.
+
+For first boundary axis f and side s, the **output rectangle** is
+
+    R(c,f,s) = I^f × B_s × [0,L)^(g-f-1), translated by cL.
+
+Its **input rectangle** E(c,f,s) expands every interval by b on both sides,
+then reduces coordinates periodically. A canonical source is copied once for
+each E containing it, even if it belongs to several destinations. Its full key
+is `(destination core tuple, f, s, lifted local tuple, canonical source tuple)`.
+The signed local tuple records wrap without losing the destination chart.
+Input-copy keys are unique as full keys; source addresses alone need not be.
+Returned output keys are canonical global output coordinates, without f or s.
+
+HALO uses the conservative expansion A. Using b < A is a sufficient tighter
+input set for a tensor whose per-axis dependency bandwidth is at most b; it
+is contained in the source's A-expanded allocation. Thus the volume upper
+bound below also bounds the tighter scheme. This does not silently identify
+A and b: a literal A-expanded implementation can use the same interval proof
+with b=A (half-open expanded interiors then tile rather than have gaps), but
+that variant is outside this verifier's explicitly strict-bandwidth domain.
+No polynomial row locality is proved here. The call-site facts bandwidth
+<p^45 and A=ceil(p^48) are the inherited reason a strict b can be chosen.
+
+**Proposition.** On this domain the source-first prefix/DFS algorithm below
+emits exactly the destination-membership multiset, without duplicate full
+keys. Its admitted face forest has at most g times its number of leaves in
+internal nodes, including roots. There is also O(g) setup per source even
+when there are no leaves. The output rectangles return each discarded output
+exactly once. These are all-size combinatorial statements, proved next;
+the small fixtures do not establish them by induction or extrapolation.
+
+## Proof: choices, prefix AND, and the face forest
+
+Write source x_i=q_i L+r_i, 0 <= r_i < L. Its candidate later-axis cores are
+q_i, also q_i-1 modulo n_i when r_i<b, and also q_i+1 modulo n_i when
+r_i>=L-b. Because 2b<L and n_i>=2, the list has one or two distinct choices.
+These are exactly the cores whose expanded full interval contains x_i.
+An earlier-axis expanded interior contains x_i exactly when
+A-b <= r_i < L-A+b, and its core must be q_i: the expanded interiors are
+strictly separated by a positive gap. Precompute these memberships and the
+expanded lower/upper face memberships from the same at-most-two candidates.
+Every face interval is contained in its expanded full interval, so no face
+choice is missed.
+
+Let prefix[f] be the AND of the interior-membership flags for i<f, with
+prefix[0]=true. Face (f,s) is permitted exactly when prefix[f] and its face
+choice list is nonempty. All suffix full-interval lists are already nonempty.
+Consequently a permitted face defines a Cartesian product with no dead
+branches: the face core choices, then all later-axis core choices. Earlier
+core choices are unique and fixed. Traverse this product by a depth-first
+odometer (a stack of depth/next-choice counters); emit a leaf key using the
+unique periodic lift into its destination interval. Interval widths are
+less than S_i, so there cannot be two such lifts.
+
+Membership in the rectangle is a conjunction of these independent axis
+conditions. This proves both directions of the emitted/oracle correspondence.
+Each candidate list has no repeats, each Cartesian tuple is visited once,
+and distinct face labels or core tuples give distinct destination keys.
+Therefore the **full multisets**, not merely sets or counts, agree.
+For output rectangles, each discarded coordinate has exactly one first
+non-interior axis and exactly one side there. Earlier coordinates are
+interior and later ones unrestricted. This proves unique returned keys.
+
+For one permitted face, the product tree has height h=g-f <= g and at least
+one leaf. At every non-leaf depth each node has a descendant leaf, and
+nodes at that depth have disjoint descendant sets. There are at most C_f
+nodes at each of its h non-leaf depths, hence at most h C_f <= g C_f
+internal nodes, **including the root**, even for unary branches. Summing
+over permitted faces gives N <= g C. There is no hidden 2g root term because
+empty faces are rejected before a root is allocated. Testing those faces is
+not free: scans, prefix ANDs and face tests total O(g) per source.
+
+**Necessary additive term.** A source at the center of every core, farther
+than b from all boundary slabs, emits zero copies but still requires its
+coordinate scan and prefix/face setup. A literal all-work <= g times leaves
+claim is therefore false. The correct operation account is
+
+    O(g V) setup + O(g C) forest traversal + full-key/value emission,
+
+where V is the number of dense records in the group and C the total copies.
+The pinned GAUSSIAN text separately includes its initial scan; this is a
+clarification and exact accounting witness, not a counterexample to its
+already-separated dense-scan row. At a periodic core corner x=(0,...,0)
+with b>0, the first-axis face has two neighboring face destinations in total
+and every later axis has two choices: **2^g copies from that one address**.
+The bound charges them as actual leaves, not by assuming constant fanout.
+
+## Exact volume and the claimed cost boundary
+
+Let K=product n_i, V=K L^g. Summing rectangle volumes with multiplicity gives
+
+    C = K sum_(f=0)^(g-1) 2 (L-2A+2b)^f (A+2b) (L+2b)^(g-f-1).
+
+This is a copied-input volume, not a union volume. With b<=A it is at most
+
+    6 V (gA/L) (1+2A/L)^(g-1).
+
+Thus C=O(VgA/L) if gA/L remains bounded (in particular the source's o(1)
+hypothesis). The number of returned outputs is exactly
+K[L^g-(L-2A)^g]. No bounded-multiplicity claim about individual sources is
+needed. Empty centers and exponentially many-copy corners coexist.
+
+The following implication is **conditional on a physical implementation**,
+not a measured cost theorem for this Python program:
+
+1. GAUSSIAN 194–207 supplies g=p^beta, local L with log L=O(log p), and
+   beta+2(1-epsilon)<1. The absolute coordinate width ell and epsilon are
+   defined in [CRT.md lines 20–28](../unconditional-batched-crt/CRT.md) and
+   [PROOF.md lines 19–26](../unconditional-batched-crt/PROOF.md); both are
+   pinned live inputs. With the caller's ell=O(p^(1-epsilon)), the quoted coordinate arithmetic
+   O(g ell^2 polylog p)=o(p) and O(g log L)=o(p) absorb the O(g) setup into
+   one p-bit-record scan. A mere g<=p would not justify this absorption.
+   HALO's g log p=o(p) is also needed for short-field movement.
+2. A destination/core/source key needs O(g ell + g log L + log g) bits,
+   including signed local fields and face labels. This is O(p) under those
+   hypotheses; spectator labels may be retained once, with the inherited
+   complete-record O(p) width. Re-encoding a full key is not O(1) bits.
+   A short-field stack implementation costing O(log L+log g) per traversed
+   edge yields O(g polylog p) control work per leaf, absorbed by O(p) up to
+   polylogs under the same strict beta<1 condition. Copying the p-bit value
+   and complete key still costs O(p) bits per leaf. The node-count proof
+   alone does not establish this stack/head-movement implementation.
+3. Full-key binary radix sorting uses O(p) stable passes, not O(1). Each
+   pass must scan/move O(p)-bit records and preserve all key fields, costing
+   O(C p^2) bit movement (a generous upper bound also in normalized record
+   work). Return sorting has at most C records. Sorting dense V records
+   separately for each face would instead introduce the forbidden gV term.
+   A fixed-tape stable distribution and rewind schedule is still an explicit
+   physical premise, not Python Counter/dict behavior.
+4. Conditional on sequential enumeration and sorting as above, the source's
+   direct per-axis row application costs O(g A^2) record operations per copied
+   record, giving per-group O(V + C[gA^2+p^2]) polylog p. Substituting the
+   copied-volume bound and multiplying by O(d/g) balanced groups gives
+
+       O(V [d/g + d g A^3/L + d A p^2/L] polylog p).
+
+   Local coefficient setup remains an additive S_setup until the HALO 68–74
+   hypotheses apply: fixed polynomial-in-p setup per rectangle/core,
+   g tending to infinity, and at least g-1 long L-O(A) axes. Fixed g fixtures
+   cannot demonstrate that absorption. The costs of actual row generation,
+   arithmetic, exposure, and setup are not certified here.
+
+**Result boundary:** the written combinatorial implication and exact
+conditional accounting are supplied. The complete quoted physical tariff
+is **not independently discharged**: it requires a fixed-number-of-tapes
+encoding and paid stack/candidate-list access, stable radix distribution,
+full-key movement, and the inherited coefficient/application/setup budgets.
+This is a precise implementation obligation, not a claim that the source's
+bound is false. No random-access dictionary operation in the verifier is
+used as evidence for that tariff.
+
+## Finite executable contract and observed evidence
+
+`verify.py` uses integer arithmetic and standard-library Python 3.12. It
+streams canonical addresses; it does not allocate a global value/matrix
+array. Counters retain only small fixture copy keys and output keys. It uses
+no project imports, search, census, huge p, numerical Gaussian coefficients,
+or generated external files. The independent oracle loops destinations
+first and tests absolute lifted half-open intervals directly; it does not
+reuse the source candidate lists, prefix code, DFS, or lift computation.
+
+Three fixed positive fixtures cover `(core counts; L,A,b)`:
+
+- `(2,3; 12,2,1)`: 2D, unequal periodic sides, several destinations and wrap.
+- `(2,2,2; 10,2,1)`: 3D corner with eight copies from one source, unary/deeper
+  branches, several faces, interior zero-copy sources, and wrap.
+- `(2,2; 10,2,0)`: zero bandwidth, genuinely empty emitted lists for interior
+  sources, and no wrap halo.
+
+Every fixture compares the full emitted key **Counters**, requires count one
+for every full key and returned key, and checks exact copied-input and
+discarded-output volume identities. Each admitted forest is checked for
+nonempty leaves and the internal-node bound; the aggregate bound is also
+checked. Direct destination membership is independent of source construction.
+The center check establishes zero emitted copies; the corner requires exactly
+2^g copies for b>0. The written algorithm, rather than a redundant inequality
+g>g*0, explains why zero-copy sources still need additive setup.
+
+Coordinate scans, prefix steps, face tests and candidate tests are **diagnostic
+loop counts** with internal consistency checks. Printed oracle membership-test
+counts are diagnostic too. These counters are not independent evidence of
+physical cost: they do not price tape movement, arithmetic, stack access,
+key rewrites or sorting. Exact membership, volume, output uniqueness and
+forest bounds must not be conflated with those diagnostic counters.
+
+The prior replay passed fourteen comparison/validation controls: omitted first
+lower face, duplicated input key, lost periodic wrap, and dropped inclusive
+lower endpoint on both positive-bandwidth fixtures; duplicate returned output
+on all three fixtures; negative, equal-to-A, and larger-than-A bandwidth.
+These retained controls mutate completed results or validate input domains;
+they do not by themselves exercise an erroneous source algorithm.
+
+The revised harness additionally runs three **algorithm-seam mutants** on each
+positive-bandwidth fixture, using the same source implementation rather than
+a duplicate algorithm:
+
+- omit the preceding neighbor-core choice when r<b;
+- use the unexpanded interior for earlier-axis membership, corrupting the
+  memberships consumed by prefix AND;
+- exclude the inclusive lower endpoint of an expanded upper face.
+
+Each mutant must complete, then its **full emitted multiset** is compared with
+the unchanged destination oracle. Internal exceptions are outside the rejection
+wrapper and cannot masquerade as successful oracle detection. All rejection
+checks use explicit exceptions and remain active with `-O`. Both modes rejected
+all six algorithm mutants and fourteen comparison/validation controls.
+They detect enumeration errors, not Gaussian-operator defects or physical costs.
+
+The final replay reproduced these exact fixture counts:
+
+| Fixture | Sources | Copies | Returned outputs | Maximum source fanout |
+|---|---:|---:|---:|---:|
+| `two_dimensional_wrap` | 864 | 1,152 | 480 | 4 |
+| `three_dimensional_corner` | 8,000 | 19,456 | 6,272 | 8 |
+| `zero_bandwidth` | 400 | 256 | 256 | 1 |
+
+Both final runs reported `PASS_HALO_COPY_ENUMERATION`, twenty passed
+rejecting controls, and six live source pins. The refreshed canonical launcher
+at `624de9dc66858af0945e5f8a0942488d62280d43` also replayed both modes successfully.
+An independent read-only agent reviewer re-derived the interval, forest, volume
+and conditional cost algebra and reported no blocking mathematics defect. This
+is scoped agent review, not human acceptance or formal proof-kernel verification.
+
+## Reproduce
+
+From the repository root, with full Git history and Python 3.12:
+
+```sh
+python3.12 -B scripts/research_package.py --package research/halo-copy-enumeration --check-only
+python3.12 -B scripts/research_package.py --package research/halo-copy-enumeration
+python3.12 -B research/halo-copy-enumeration/verify.py
+python3.12 -O -B research/halo-copy-enumeration/verify.py
+```
+
+The registered commands completed within their 30-second timeouts. The final
+refreshed-launcher shell took 1.26 seconds including environment activation;
+this is not a precise verifier benchmark. The observed terminal marker was
+`PASS_HALO_COPY_ENUMERATION`, with twenty control names and six live inputs.
+CPython 3.12.13 was used; no Python LSP was configured. Metadata validation
+checked Git provenance and the exact copied card. Every live input is declared
+in VERIFY and pinned by base Git blob and SHA256 in SOURCES. All pins resolve
+at the package base, so no unmerged PR object is required. No selected-result
+or full-tape proof replay was performed.
+
+## Boundary and obligation ledger
+
+| Boundary | Established here | Not established here |
+|---|---|---|
+| Source identity | Exact base/blob/SHA256 metadata and six-input replay passed | Selected-result replay |
+| First-face geometry | All-size interval/partition proof; independent read-only agent re-derivation | Gaussian locality or conditioning; human/formal acceptance |
+| Enumeration | Written all-size product-tree implication; final normal/`-O` replay and algorithm-seam controls passed | Human/formal acceptance of the all-size proof |
+| Complexity | O(gV)+O(gC) short-operation account and conditional key/pass algebra; loop counters diagnostic only | Complete fixed-tape scheduling/cost theorem |
+| Finite evidence | Three exact fixtures and twenty rejecting controls passed in both modes | Independent human or formal scientific acceptance |
+| Multiplication | No frontier, ledger or supplier change | CRT repair, rounding, recovery, unconditional theorem |
+
+## Open next questions
+
+1. **Can a fixed-tape implementation realize the short-field stack and full-key
+   radix schedule with the stated scan/leaf invoice?** It would close the
+   remaining physical enumeration boundary. First implement a bounded symbolic
+   tape trace for one face forest, explicitly charging candidate-list access,
+   stack pushes/pops, key rewrites, distribution and rewinds; then prove its
+   all-size schedule. Blocked by no additional mathematical input, but not
+   supplied by Python's random-access containers.
+2. **Can the local coefficient setup and g axis exposures be bound to that same
+   copy layout without an extra dense scan per face?** This is required to
+   promote the conditional invoice to the full HALO tariff. First specify the
+   page generation, ownership and tape-order interface for one destination
+   rectangle, retaining S_setup until g grows. Blocked by the unreviewed
+   physical schedule and inherited row-generation/application hypotheses.
+
+These questions are also structured in `TASK.json`; neither calls for another
+finite locality replay or a parameter/exponent census.
+
+## Provenance, overlap and credit
+
+Base: `b58ad9ef4d4e861b0eaa5dba41742bdc072dca51`, priority revision 7.
+The original `uniform-transfer-audit` card is copied exactly; the assignment
+refines it to one Gaussian copy-enumeration implication. The parent refreshed
+upstream to `624de9dc66858af0945e5f8a0942488d62280d43` and reported an exact diff:
+guidance, catalogue, selected record, and all scientific sources were unchanged;
+only `scripts/research_package.py` changed among the inspected infrastructure.
+The scientific base and source pins remain at `b58ad9ef4d4e861b0eaa5dba41742bdc072dca51`.
+
+The refreshed parent-provided overlap on 2026-10-22 covered 299 remote open-PR
+records at 19:49:07Z, 3,721 Discussion records at 19:49:40Z with complete
+pagination, and all 5,860 tracked local notes plus the two new package notes.
+Exact terms `source-driven enumeration`, `halo-copy-enumeration`,
+`f7-l22-receipt-domain`, and `f7-l22-deep-shard-census` matched predecessors
+and the new notes only; no competing remote match was found. Arbitrary diffs
+and closed-only unmerged PRs were not covered. This records a refresh, not a
+novelty proof or an independent search by this agent. Local-only coordination
+is retained; a parent posting attempt had unknown outcome and no matching
+claim was found on its read-only follow-up. No successful public claim or
+publication is asserted. No commit or publication was made here.
+
+Cinna Davis authored #4100 (submitted head
+`337d04939571a637aeab54a0f58f54fde811663a`), including the prefix/odometer
+proposal, halo tariff and Gaussian caller. Nick Petalas authored #4217
+(submitted head `d2479b3606beeb745c19210219acdd96967bf8eb`), explicitly
+excluding enumeration from his locality audit and asking this question.
+The present package is an independent implementation and accounting refinement
+of their retained text, not an invention of the first-face idea. The #4100
+[NOTICE](../unconditional-batched-crt/NOTICE.md) preserves the broader lineage,
+including Douglas Colkitt/OpenAI's tape framework, Vlado Vojdanovski/PR1673's
+Gaussian layout work, and Chafik Boukhalfa/PR1758/1786's constructions.
+CRT.md and PROOF.md bind the ell/epsilon definitions used in the conditional
+cost algebra, and NOTICE.md binds this lineage; their exact base blobs and
+SHA256 digests join GAUSSIAN.md, HALO.md and the #4217 README in SOURCES.json.
+All six are declared live inputs in VERIFY.json.
+New artifacts prepared by the Astra research contribution agent with substantial
+OpenAI assistance under the user-authorized parallel assignment. Apache-2.0.
+No independent human review or formal proof-kernel certification is claimed.
diff --git a/research/halo-copy-enumeration/SOURCES.json b/research/halo-copy-enumeration/SOURCES.json
new file mode 100644
index 0000000000..c88f588444
--- /dev/null
+++ b/research/halo-copy-enumeration/SOURCES.json
@@ -0,0 +1,58 @@
+{
+  "schema_version": 1,
+  "base_commit": "b58ad9ef4d4e861b0eaa5dba41742bdc072dca51",
+  "files": [
+    {
+      "path": "docs/research/agent-task-catalog.json",
+      "usage": "provenance",
+      "git_blob": "f126dd2e2dad2b669e75d1d0d0bd05c600725602",
+      "sha256": "f7a48bfa2659b88378282a8eee7d9fe52cdf505594124c4d1686b58510fffd72"
+    },
+    {
+      "path": "certificates/selected-result.json",
+      "usage": "provenance",
+      "git_blob": "c35482cd9035843b15a634cc8276a7e1e40e8395",
+      "sha256": "6fe0a099b89aa2aed796a13c3a21dafc63f3388ebf397464e44e0451893b9375"
+    },
+    {
+      "path": "research/unconditional-batched-crt/GAUSSIAN.md",
+      "usage": "input",
+      "git_blob": "adfb28c93e6b06178c901caaac39ede41a9e541b",
+      "sha256": "2f63c91c58f2d1cf31294812c75970ea390c61866a8da7ed700d4316a033a242"
+    },
+    {
+      "path": "research/unconditional-batched-crt/HALO.md",
+      "usage": "input",
+      "git_blob": "5f601b3c8ac368aa79aa1007effe5933a360237b",
+      "sha256": "a2adcf18614983e9255def6d3f5e59be0018a392e418d65e94323722838289cc"
+    },
+    {
+      "path": "research/unconditional-batched-crt/CRT.md",
+      "usage": "input",
+      "git_blob": "d98dd8e368431cac33d5fc1c8c336696663641d6",
+      "sha256": "02c3a1e38cbee25aefe2640cc72676da62ba10eb7519fbcb9adb9d48b74eff2b"
+    },
+    {
+      "path": "research/unconditional-batched-crt/PROOF.md",
+      "usage": "input",
+      "git_blob": "406eb561cc8d6041ea3fba1a849653b654f2198c",
+      "sha256": "689fc7b01c5f04f77019ff02d1b79cb4f7020bd98e05b1052020bad295dec060"
+    },
+    {
+      "path": "research/unconditional-batched-crt/NOTICE.md",
+      "usage": "input",
+      "git_blob": "886a8fdee275f01b459cbd68ae2815dc9269502f",
+      "sha256": "924109837e71c52392191710d49c9deb42780878d1094f0b01e8690dbe799461"
+    },
+    {
+      "path": "research/halo-locality-witness-audit/README.md",
+      "usage": "input",
+      "git_blob": "03b244baf61b427edbccd29698a05583b5405dd6",
+      "sha256": "fc87657cb3e89a74b9462483cc15713f0122256a623fefa65c887e2118f81276"
+    }
+  ],
+  "attribution": [
+    {"author": "Cinna Davis", "pr": 4100, "submitted_head": "337d04939571a637aeab54a0f58f54fde811663a", "binding": "Retained GAUSSIAN.md, HALO.md, CRT.md, PROOF.md and NOTICE.md bytes at package base, not a dependency on a floating PR head; NOTICE.md retains the broader predecessor lineage."},
+    {"author": "Nick Petalas", "pr": 4217, "submitted_head": "d2479b3606beeb745c19210219acdd96967bf8eb", "binding": "Retained README.md at package base; explicit open enumeration question at lines 126-128."}
+  ]
+}
diff --git a/research/halo-copy-enumeration/TASK.json b/research/halo-copy-enumeration/TASK.json
new file mode 100644
index 0000000000..5d9a9c7193
--- /dev/null
+++ b/research/halo-copy-enumeration/TASK.json
@@ -0,0 +1,106 @@
+{
+  "schema_version": 1,
+  "task_id": "uniform-transfer-audit",
+  "priority_revision": 7,
+  "base_commit": "b58ad9ef4d4e861b0eaa5dba41742bdc072dca51",
+  "original_card": {
+    "id": "uniform-transfer-audit",
+    "question": "Does one quantified step of the proposed #4100 all-size construction hold at its actual caller?",
+    "starting_points": [
+      "docs/research/research-family-status.md",
+      "certificates/selected-result.json",
+      "research/unconditional-batched-crt/README.md"
+    ],
+    "methods": [
+      "Prove one missing implication with explicit quantified hypotheses.",
+      "Find an exact counterexample at the claimed interface boundary."
+    ],
+    "acceptance_gate": "Identify the proposition and what would change downstream; do not equate a finite replay with a universal proof.",
+    "first_step": {
+      "command": ["python3", "-B", "scripts/research_baseline.py"],
+      "expected": "PASS_RESEARCH_BASELINE_BINDINGS_ONLY",
+      "inspect": "Read PROOF.md and AUDIT.md in #4100. Select one distinct obligation: CRT total repair, native/free-algebra lifting, precision/conditioning, or complete fixed-tape cost. This is an author-submitted proof, not an accepted unconditional theorem.",
+      "scope": "Source-binding orientation only; no scientific replay, theorem acceptance or supplier admission. Budget any heavy replay separately."
+    },
+    "first_experiment": "Check live handoffs; name one proposition, its caller, quantified domain and dependency closure. Independently prove the implication or exhibit a precise gap/counterexample. Prioritize CRT.md total repair or COMPLEX.md free-algebra lift only if unclaimed. Stop at the chosen obligation; do not substitute finite samples or root arithmetic for an all-size proof, or launch the complete package by default.",
+    "bottleneck_link": "Finite supplier improvements are useful only under the retained transfer obligations.",
+    "allowed_variations": [
+      "One CRT repair, native lift, precision/conditioning or tape-cost proposition, with its exact caller."
+    ],
+    "scope_change_triggers": [
+      "Replacing a quantified obligation with another finite smoke test.",
+      "Treating archive intake, an author PASS receipt or a finite composed fixture as discharge of the universal hypotheses."
+    ],
+    "overlap_terms": ["uniform transfer", "all-size", "precision", "4100", "unconditional-batched-crt"],
+    "existing_checks": [
+      {
+        "scope": "PR #4100: proposed unconditional construction and finite checks, without independent acceptance.",
+        "evidence": "research/unconditional-batched-crt/README.md",
+        "remaining": "Independent proof audit of one caller-bound all-size implication; all other premises remain explicit.",
+        "status": "author-checked",
+        "source_commit": "337d04939571a637aeab54a0f58f54fde811663a",
+        "selected_record_sha256": "bb2eaa58647b353f88d0aec2eafb9d30df1be53589231b23e12ceef3e4bad129"
+      }
+    ]
+  },
+  "scope_status": "refined",
+  "actual_scope": "Prove the first-boundary-face source-driven prefix-AND/DFS input-copy enumeration implication and its setup-versus-leaf count; independently compare complete key multisets on small periodic 2D/3D grids; identify the precise remaining physical-tape cost obligations at GAUSSIAN.md lines 177-226 and HALO.md lines 36-94.",
+  "scope_change_reason": "The user assigned the explicit open enumeration question in Nick Petalas's retained #4217 README lines 126-128. This is one complete fixed-tape-cost sub-obligation of the original card, not a new locality, exponent, CRT, rounding or conditioning audit.",
+  "bottleneck_link": "The proposed #4100 halo tariff needs output-sensitive copying even when a rare source has exponentially many destinations; a combinatorial count alone does not pay physical stack, key or sorting movement.",
+  "budget_minutes": 60,
+  "stop_rule": "Deliver the all-size combinatorial proof, exact independent finite verifier and explicit physical accounting boundary; stop without claiming the complete multiplication theorem or complete halo tariff.",
+  "outcome": "completed",
+  "evidence": "Written interval/partition and product-tree proof; exact copied-volume formula; zero-copy center and corner fanout checks. Independent read-only agent review re-derived interval, forest, volume and conditional cost algebra and reported no blocking mathematics defect; no human or formal review implied. Final orchestrator replay on 2026-10-22 passed metadata and registered normal/-O commands under CPython 3.12.13, including the refreshed canonical launcher at624de9dc66858af0945e5f8a0942488d62280d43. Fixture tuples (sources,copies,outputs,maxfanout): (864,1152,480,4), (8000,19456,6272,8), (400,256,256,1). Twenty rejecting controls passed per mode, including six source-algorithm mutants, and six live source pins matched. Each command completed within30seconds; aggregate refreshed-launcher shell1.26seconds included environment activation and is not a precise benchmark. No Python LSP, full-tape proof or selected-result replay. Physical tariff remains conditional on the explicit README ledger.",
+  "evidence_status": "author-checked / orchestrator-replayed final revision",
+  "review_corrections": {
+    "algorithm_controls": "Three test-only seams in source_enumeration: omit preceding neighbor core, use strict unexpanded earlier interior, and exclude an upper face's inclusive lower endpoint. Each runs on both positive-bandwidth fixtures and must complete before its full multiset is rejected against the unchanged independent oracle; internal exceptions cannot count as detections.",
+    "preserved_coverage": "All original positive fixtures and comparison/validation controls retained; explicit exceptions remain active under -O; registered timeouts remain 30 seconds.",
+    "claim_cleanup": "Removed redundant center inequality. Scan, prefix, face and candidate counters are diagnostic loop-accounting checks, not evidence proving physical cost; exact membership, volumes, output uniqueness and forest bounds remain distinct.",
+    "source_closure": "Added base Git blob/SHA256 pins for CRT.md and PROOF.md (ell/epsilon) and NOTICE.md (lineage), declared all six live inputs in VERIFY.json, and updated the source-count check. Original card, base commit, existing pins and frozen sources unchanged.",
+    "remaining": "Final normal/-O replay exercised all algorithm controls and six live pins successfully. Physical implementation and human/formal acceptance remain outside scope."
+  },
+  "author": "Astra research contribution agent, user-authorized parallel research assignment",
+  "ai_assistance": "Substantial OpenAI Astra assistance in all new artifacts; independent human and formal proof-kernel review unclaimed.",
+  "no_new_kappa": true,
+  "selected_conditional_kappa": "0.00302015",
+  "overlap": {
+    "source": "Parent-provided fresh overlap; no independent search by this agent",
+    "checked_at": "2026-10-22T19:49:40Z",
+    "open_prs_checked_at": "2026-10-22T19:49:07Z",
+    "open_prs": 299,
+    "discussion_records": 3721,
+    "discussion_pagination": "complete",
+    "local_notes": 5860,
+    "additional_own_notes": 2,
+    "terms": ["source-driven enumeration", "halo-copy-enumeration", "f7-l22-receipt-domain", "f7-l22-deep-shard-census"],
+    "result": "Exact-term hits were predecessors and our own notes only; no competing remote match. All tracked local notes were covered. This refresh is not a novelty proof.",
+    "limitations": "Arbitrary diffs and closed-only unmerged PRs were not covered.",
+    "upstream_refresh": {
+      "commit": "624de9dc66858af0945e5f8a0942488d62280d43",
+      "evidence": "Parent-reported exact diff: guidance, catalogue, selected record and all scientific sources unchanged; only scripts/research_package.py changed among inspected infrastructure.",
+      "scientific_base_retained": "b58ad9ef4d4e861b0eaa5dba41742bdc072dca51"
+    },
+    "coordination": "Local-only. Parent public-post attempt had unknown outcome; no matching claim found on read-only follow-up. No successful public claim or publication asserted."
+  },
+  "boundary_ledger": [
+    {"boundary": "Combinatorial all-size enumeration", "status": "written scoped proof; independently re-derived by read-only agent reviewer", "remaining": "No human or formal proof-kernel acceptance; finite execution cannot substitute for the proof."},
+    {"boundary": "Finite exact evidence", "status": "final metadata and normal/-O PASS on 2026-10-22: three fixtures, twenty controls, six live inputs", "remaining": "Finite evidence is not human/formal scientific acceptance or an all-size proof."},
+    {"boundary": "Physical enumeration tariff", "status": "explicit conditional implication", "remaining": "Fixed-tape stack access, candidate-list access, key movement and stable full-key radix schedule."},
+    {"boundary": "Complete halo tariff", "status": "not discharged", "remaining": "Inherited row-generation/application, axis exposure and eventual setup-absorption budgets."},
+    {"boundary": "Frontier and multiplication theorem", "status": "intentionally unchanged", "remaining": "All selected and proposed-construction assumptions remain; no new kappa, CRT repair, locality or rounding claim."}
+  ],
+  "open_questions": [
+    {
+      "question": "Can a fixed-tape implementation realize the short-field stack and full-key radix schedule with the stated scan/leaf invoice?",
+      "why_it_matters": "The all-size internal-node bound does not itself price candidate-list access, head movement, stack operations or full-key rewrites.",
+      "first_step": "Implement one bounded symbolic face-forest tape trace charging candidate-list access, pushes/pops, key rewriting, stable distribution and rewinds, then prove its all-size schedule.",
+      "blocked_by": "No additional mathematical input; the physical schedule is not supplied by this Python verifier."
+    },
+    {
+      "question": "Can local coefficient setup and g axis exposures use the same copy layout without an extra dense scan per face?",
+      "why_it_matters": "Only that binding promotes the conditional copy invoice to the complete HALO tariff.",
+      "first_step": "Specify page generation, ownership and tape-order interfaces for one destination rectangle, retaining an explicit setup term until g tends to infinity.",
+      "blocked_by": "The unreviewed physical schedule and inherited row-generation/application hypotheses."
+    }
+  ]
+}
diff --git a/research/halo-copy-enumeration/VERIFY.json b/research/halo-copy-enumeration/VERIFY.json
new file mode 100644
index 0000000000..f7024484e0
--- /dev/null
+++ b/research/halo-copy-enumeration/VERIFY.json
@@ -0,0 +1,60 @@
+{
+  "schema_version": 1,
+  "status": "ready",
+  "python": "3.12",
+  "requirements": [],
+  "inputs": [
+    "research/unconditional-batched-crt/GAUSSIAN.md",
+    "research/unconditional-batched-crt/HALO.md",
+    "research/unconditional-batched-crt/CRT.md",
+    "research/unconditional-batched-crt/PROOF.md",
+    "research/unconditional-batched-crt/NOTICE.md",
+    "research/halo-locality-witness-audit/README.md"
+  ],
+  "evidence_status": "author-checked / orchestrator-replayed final revision",
+  "replay_receipt": {
+    "revision_scope": "Final algorithm-seam controls and six-input closure; replay also passed with canonical launcher624de9dc66858af0945e5f8a0942488d62280d43.",
+    "date": "2026-10-22",
+    "observer": "parent orchestrator",
+    "environment": "CPython 3.12.13; no Python LSP configured",
+    "metadata": "PASS",
+    "registered_normal": "PASS_HALO_COPY_ENUMERATION",
+    "registered_optimized": "PASS_HALO_COPY_ENUMERATION",
+    "live_source_pins": 6,
+    "passed_failure_controls_per_mode": 20,
+    "fixture_count_fields": ["sources", "copies", "outputs", "maxfanout"],
+    "fixture_counts": {
+      "two_dimensional_wrap": [864, 1152, 480, 4],
+      "three_dimensional_corner": [8000, 19456, 6272, 8],
+      "zero_bandwidth": [400, 256, 256, 1]
+    },
+    "timing": "Each registered command completed within30seconds; refreshed-launcher parent shell1.26seconds including environment activation, not a precise verifier benchmark.",
+    "portable_commands_from_repository_root": [
+      "python3.12 -B scripts/research_package.py --package research/halo-copy-enumeration --check-only",
+      "python3.12 -B scripts/research_package.py --package research/halo-copy-enumeration",
+      "python3.12 -B research/halo-copy-enumeration/verify.py",
+      "python3.12 -O -B research/halo-copy-enumeration/verify.py"
+    ],
+    "boundary": "Finite exact audit and separate read-only AI proof review; no full-tape proof, selected-result replay, independent human acceptance or formal certification."
+  },
+  "review_corrections": {
+    "execution_status": "PASS: all six algorithm mutants rejected by the independent oracle in normal and optimized modes",
+    "independent_review": "Read-only agent reviewer re-derived interval, forest, volume and conditional cost algebra; no blocking mathematics defect reported. No human or formal proof-kernel review implied.",
+    "algorithm_controls": ["omit-neighbor-core", "strict-earlier-interior", "open-upper-face-lower-endpoint"],
+    "oracle_contract": "Each mutant runs source_enumeration to completion before expect_rejection compares its full key multiset against the unchanged destination oracle; internal exceptions do not count as successful controls.",
+    "source_closure": "Six live inputs declared, including CRT.md and PROOF.md for ell/epsilon and NOTICE.md for lineage; exact base blobs and SHA256 digests in SOURCES.json.",
+    "diagnostic_boundary": "Coordinate, prefix, face and candidate loop counts are diagnostic consistency checks only; neither these nor oracle membership-test counts measure physical tape cost. The redundant center inequality was removed."
+  },
+  "commands": [
+    {
+      "argv": ["{python}", "-B", "{package}/verify.py"],
+      "timeout_seconds": 30,
+      "checks": "Six exact live source hashes; independent source-first prefix/DFS versus destination-first full membership key multisets; output partition uniqueness; per-forest node/leaf and exact copied-volume identities; zero-copy center and many-copy corner; test-only source algorithm mutants for neighbor omission, earlier membership and lower endpoint; retained result-corruption and invalid-bandwidth controls. Scan/prefix/face/candidate counters are diagnostic loop counts, not physical-cost evidence."
+    },
+    {
+      "argv": ["{python}", "-O", "-B", "{package}/verify.py"],
+      "timeout_seconds": 30,
+      "checks": "Repeat the complete deterministic audit with optimization enabled: all failures use explicit exceptions, not removable assertions."
+    }
+  ]
+}
diff --git a/research/halo-copy-enumeration/verify.py b/research/halo-copy-enumeration/verify.py
new file mode 100755
index 0000000000..a6e0d35eb3
--- /dev/null
+++ b/research/halo-copy-enumeration/verify.py
@@ -0,0 +1,391 @@
+#!/usr/bin/env python3
+"""Exact finite enumeration audit; no matrix payloads or theorem acceptance.
+
+Prepared with substantial OpenAI Astra assistance. Apache-2.0.
+All rejecting checks are explicit and remain active under python -O.
+"""
+
+import json
+from collections import Counter
+from dataclasses import dataclass
+from hashlib import sha256
+from itertools import product
+from math import prod
+from pathlib import Path
+
+
+class Rejected(ValueError):
+    pass
+
+
+def require(condition, message):
+    if not condition:
+        raise Rejected(message)
+
+
+@dataclass(frozen=True)
+class Grid:
+    cores: tuple
+    side: int
+    margin: int
+    bandwidth: int
+
+    def validate(self):
+        require(2 <= len(self.cores) <= 3, "fixture dimension must be 2 or 3")
+        require(
+            all(type(n) is int and n >= 2 for n in self.cores),
+            "at least two cores per periodic axis required",
+        )
+        require(
+            type(self.side) is int
+            and type(self.margin) is int
+            and self.margin > 0
+            and self.side > 4 * self.margin,
+            "require integer L > 4A > 0",
+        )
+        require(
+            type(self.bandwidth) is int and 0 <= self.bandwidth < self.margin,
+            "require 0 <= b < A",
+        )
+
+    def sources(self):
+        return product(*(range(n * self.side) for n in self.cores))
+
+
+def same_multiset(actual, expected):
+    require(actual == expected, "full emitted key multiset mismatch")
+    require(all(n == 1 for n in actual.values()), "duplicate input-copy key")
+
+
+def expect_rejection(label, operation):
+    try:
+        operation()
+    except Rejected:
+        return label
+    raise Rejected("failure control did not reject: " + label)
+
+
+def source_enumeration(grid, *, _mutation=None):
+    """One coordinate scan, prefix AND, then pruned DFS face forests.
+
+    The explicit stack (depth,next-choice) is the depth-first odometer.
+    Roots exist only for permitted faces; all their suffix factors are nonempty.
+    Keys include destination core, face axis/side, lifted local coordinate,
+    and canonical global source. No payload arrays are allocated.
+    _mutation changes one algorithm seam only for negative controls; the
+    destination oracle is unchanged and compares the complete returned keys.
+    """
+    grid.validate()
+    g, L, A, b = len(grid.cores), grid.side, grid.margin, grid.bandwidth
+    keys = Counter()
+    stats = Counter()
+    per_source = Counter()
+    for x in grid.sources():
+        stats["sources"] += 1
+        later, interior, faces = [], [], []
+        for i, (xi, n) in enumerate(zip(x, grid.cores)):
+            stats["coordinate_scans"] += 1
+            q, r = divmod(xi, L)
+            choices = [q]
+            if r < b and _mutation != "omit-neighbor-core":
+                choices.append((q - 1) % n)
+            if r >= L - b:
+                choices.append((q + 1) % n)
+            require(len(set(choices)) == len(choices) <= 2, "bad later choices")
+            later.append(tuple(choices))
+            interior_margin = A if _mutation == "strict-earlier-interior" else A - b
+            interior.append(q if interior_margin <= r < L - interior_margin else None)
+            axis_faces = [[], []]
+            S = n * L
+            for c in choices:
+                stats["candidate_tests"] += 1
+                t = (xi - c * L) % S
+                if t < A + b or (b > 0 and t >= S - b):
+                    axis_faces[0].append(c)
+                lower = L - A - b + (_mutation == "open-upper-face-lower-endpoint")
+                if lower <= t < L + b:
+                    axis_faces[1].append(c)
+            faces.append(axis_faces)
+        prefix = [True]
+        for c in interior:
+            stats["prefix_steps"] += 1
+            prefix.append(prefix[-1] and c is not None)
+        for f in range(g):
+            for side in range(2):
+                stats["face_tests"] += 1
+                if not prefix[f] or not faces[f][side]:
+                    continue
+                factors = [tuple(faces[f][side])] + later[f + 1 :]
+                selected = [0] * len(factors)
+                # Each stack entry denotes an actual non-leaf node.
+                stack = [[0, 0]]
+                stats["forests"] += 1
+                stats["internal_nodes"] += 1
+                forest_nodes, forest_leaves = 1, 0
+                while stack:
+                    depth, choice = stack[-1]
+                    if choice == len(factors[depth]):
+                        stack.pop()
+                        continue
+                    stack[-1][1] += 1
+                    selected[depth] = factors[depth][choice]
+                    if depth + 1 < len(factors):
+                        stack.append([depth + 1, 0])
+                        stats["internal_nodes"] += 1
+                        forest_nodes += 1
+                        continue
+                    core = tuple(interior[:f]) + tuple(selected)
+                    local = []
+                    for xi, c, n in zip(x, core, grid.cores):
+                        t = (xi - c * L) % (n * L)
+                        local.append(t - n * L if b > 0 and t >= n * L - b else t)
+                    key = (core, f, side, tuple(local), x)
+                    keys[key] += 1
+                    per_source[x] += 1
+                    stats["copies"] += 1
+                    forest_leaves += 1
+                require(forest_leaves > 0, "empty admitted forest")
+                require(
+                    forest_nodes <= (g - f) * forest_leaves,
+                    "internal-node versus leaf bound",
+                )
+    stats["empty_sources"] = stats["sources"] - len(per_source)
+    stats["max_copies_per_source"] = max(per_source.values(), default=0)
+    return keys, stats, per_source
+
+
+def destination_oracle(grid):
+    """Independent destination-first rectangle membership on integer lifts.
+
+    Does not call source candidate, prefix, offset or odometer code. For each
+    destination it directly intersects shifted absolute half-open intervals
+    with each canonical periodic source. Unique lifts follow from widths < S.
+    """
+    g, L, A, b = len(grid.cores), grid.side, grid.margin, grid.bandwidth
+    keys = Counter()
+    membership_tests = 0
+    for core in product(*(range(n) for n in grid.cores)):
+        for face in range(g):
+            for side in range(2):
+                intervals = []
+                for i, c in enumerate(core):
+                    if i < face:
+                        lo, hi = A, L - A
+                    elif i == face:
+                        lo, hi = (0, A) if side == 0 else (L - A, L)
+                    else:
+                        lo, hi = 0, L
+                    intervals.append((c * L + lo - b, c * L + hi + b))
+                for x in grid.sources():
+                    membership_tests += 1
+                    local = []
+                    for i, (lo, hi) in enumerate(intervals):
+                        period = grid.cores[i] * L
+                        lifts = [
+                            x[i] + shift * period
+                            for shift in (-1, 0, 1)
+                            if lo <= x[i] + shift * period < hi
+                        ]
+                        require(len(lifts) <= 1, "ambiguous periodic lift")
+                        if not lifts:
+                            break
+                        local.append(lifts[0] - core[i] * L)
+                    if len(local) == g:
+                        keys[(core, face, side, tuple(local), x)] += 1
+    return keys, membership_tests
+
+
+def output_partition(grid):
+    """Enumerate unexpanded outputs and independently classify each hole."""
+    g, L, A = len(grid.cores), grid.side, grid.margin
+    returned = Counter()
+    for core in product(*(range(n) for n in grid.cores)):
+        for f in range(g):
+            for side in range(2):
+                ranges = []
+                for i in range(g):
+                    if i < f:
+                        ranges.append(range(A, L - A))
+                    elif i == f:
+                        ranges.append(range(A) if side == 0 else range(L - A, L))
+                    else:
+                        ranges.append(range(L))
+                for local in product(*ranges):
+                    returned[tuple(c * L + r for c, r in zip(core, local))] += 1
+    expected = Counter()
+    for x in grid.sources():
+        if any(not (A <= xi % L < L - A) for xi in x):
+            expected[x] = 1
+    require(returned == expected, "returned hole multiset mismatch")
+    require(all(n == 1 for n in returned.values()), "duplicate returned output")
+    require(
+        len(returned) == prod(grid.cores) * (L**g - (L - 2 * A) ** g),
+        "exact discarded volume",
+    )
+    return returned
+
+
+def bind_live_sources():
+    package = Path(__file__).resolve().parent
+    root = package.parents[1]
+    sources = json.loads((package / "SOURCES.json").read_text())
+    manifest = json.loads((package / "VERIFY.json").read_text())
+    count = 0
+    for row in sources["files"]:
+        if row["usage"] == "input":
+            require(row["path"] in manifest["inputs"], "undeclared live input")
+            require(
+                sha256((root / row["path"]).read_bytes()).hexdigest() == row["sha256"],
+                "live source hash mismatch: " + row["path"],
+            )
+            count += 1
+    require(count == 6, "unexpected live source count")
+    return count
+
+
+def main():
+    live = bind_live_sources()
+    controls = []
+    fixtures = (
+        ("two_dimensional_wrap", Grid((2, 3), 12, 2, 1)),
+        ("three_dimensional_corner", Grid((2, 2, 2), 10, 2, 1)),
+        ("zero_bandwidth", Grid((2, 2), 10, 2, 0)),
+    )
+    for name, grid in fixtures:
+        actual, stats, per_source = source_enumeration(grid)
+        expected, tests = destination_oracle(grid)
+        same_multiset(actual, expected)
+        if grid.bandwidth:
+            for mutation in (
+                "omit-neighbor-core",
+                "strict-earlier-interior",
+                "open-upper-face-lower-endpoint",
+            ):
+                # Run the real source algorithm with one test-only seam changed.
+                # An internal exception is a failure, not an oracle rejection.
+                mutated, _, _ = source_enumeration(grid, _mutation=mutation)
+                controls.append(
+                    expect_rejection(
+                        name + ":algorithm:" + mutation,
+                        lambda mutated=mutated, expected=expected: same_multiset(
+                            mutated, expected
+                        ),
+                    )
+                )
+        returned = output_partition(grid)
+        g, L, A, b = len(grid.cores), grid.side, grid.margin, grid.bandwidth
+        volume = prod(grid.cores) * sum(
+            2 * (L - 2 * A + 2 * b) ** f * (A + 2 * b) * (L + 2 * b) ** (g - f - 1)
+            for f in range(g)
+        )
+        require(stats["copies"] == volume, "exact copied-volume identity")
+        # Diagnostic loop-accounting consistency, not physical-cost evidence.
+        require(stats["coordinate_scans"] == g * stats["sources"], "dense scan count")
+        require(stats["prefix_steps"] == g * stats["sources"], "prefix setup count")
+        require(stats["face_tests"] == 2 * g * stats["sources"], "face setup count")
+        require(
+            stats["candidate_tests"] <= 2 * g * stats["sources"], "candidate scan bound"
+        )
+        require(stats["internal_nodes"] <= g * stats["copies"], "forest total bound")
+        center = (L // 2,) * g
+        require(
+            per_source[center] == 0 and stats["empty_sources"] > 0,
+            "missing empty-output source",
+        )
+        corner = (0,) * g
+        require(per_source[corner] == (2**g if b else 1), "rare corner copy count")
+        if b:
+            require(
+                any(any(t < 0 for t in key[3]) for key in actual),
+                "missing wrap fixture",
+            )
+            require(stats["max_copies_per_source"] >= 2**g, "missing many-copy fixture")
+            omitted = Counter(
+                {k: v for k, v in actual.items() if not (k[1] == 0 and k[2] == 0)}
+            )
+            controls.append(
+                expect_rejection(
+                    name + ":omitted-face",
+                    lambda omitted=omitted, expected=expected: same_multiset(
+                        omitted, expected
+                    ),
+                )
+            )
+            duplicate = actual.copy()
+            duplicate[next(iter(duplicate))] += 1
+            controls.append(
+                expect_rejection(
+                    name + ":duplicate",
+                    lambda duplicate=duplicate, expected=expected: same_multiset(
+                        duplicate, expected
+                    ),
+                )
+            )
+            no_wrap = Counter(
+                {k: v for k, v in actual.items() if all(t >= 0 for t in k[3])}
+            )
+            controls.append(
+                expect_rejection(
+                    name + ":lost-wrap",
+                    lambda no_wrap=no_wrap, expected=expected: same_multiset(
+                        no_wrap, expected
+                    ),
+                )
+            )
+            boundary = actual.copy()
+            boundary_key = next(k for k in boundary if k[3][k[1]] == -b and k[2] == 0)
+            del boundary[boundary_key]
+            controls.append(
+                expect_rejection(
+                    name + ":open-lower-endpoint",
+                    lambda boundary=boundary, expected=expected: same_multiset(
+                        boundary, expected
+                    ),
+                )
+            )
+        duplicate_return = returned.copy()
+        duplicate_return[next(iter(duplicate_return))] += 1
+        controls.append(
+            expect_rejection(
+                name + ":duplicate-return",
+                lambda duplicate_return=duplicate_return: require(
+                    all(n == 1 for n in duplicate_return.values()),
+                    "duplicate returned output",
+                ),
+            )
+        )
+        print(
+            json.dumps(
+                {
+                    "fixture": name,
+                    **stats,
+                    "oracle_membership_tests": tests,
+                    "returned_outputs": len(returned),
+                },
+                sort_keys=True,
+            )
+        )
+    for b in (-1, 2, 3):
+        controls.append(
+            expect_rejection(
+                "invalid-bandwidth:" + str(b),
+                lambda b=b: Grid((2, 2), 10, 2, b).validate(),
+            )
+        )
+    print(
+        "PASS_HALO_COPY_ENUMERATION "
+        + json.dumps(
+            {
+                "fixtures": len(fixtures),
+                "controls": controls,
+                "live_sources": live,
+                "scope": "finite_exact_keys_and_counts; written_combinatorial_proof_separate; physical_tape_cost_open",
+                "no_new_kappa": True,
+            },
+            sort_keys=True,
+        )
+    )
+
+
+if __name__ == "__main__":
+    main()