Paid literal raw CRT to binary shuttle boundary

research/raw-crt-binary-shuttle-bridge/FULL.json

@@ -0,0 +1,26 @@
+{
+  "case": {
+    "calls": [
+      {
+        "backing": 3146057,
+        "geometry": [
+          2,
+          1,
+          1024,
+          12
+        ],
+        "mode": "u",
+        "output_sha256": "d5883b3a403ebc5b88d8b9b74d9ace9295bc2b79481fe44acb5bbd263bab7ae3",
+        "steps": 336273602,
+        "volume": 196608
+      }
+    ],
+    "close_steps": 389,
+    "control_factor": 4,
+    "init_steps": 281,
+    "instructions": 119059,
+    "roles": 29,
+    "total_steps": 336274272
+  },
+  "status": "PASS_ACTUAL_RAW_BINARY_SHUTTLE"
+}

research/raw-crt-binary-shuttle-bridge/PROOF.md

@@ -0,0 +1,212 @@
+# Paid raw-CRT to binary-interchange call boundary
+
+## 1. Exact source, model and result
+
+The retained `standalone-elementary-crt-raw/raw.py` has a single data owner
+and two persistent descriptor tuples:
+
+    u=(H,A,G,S)=(2,1,1024,12), t=(2,4,256,12), V=A·4^H·G·S=196608.
+
+`Raw.shuttle` calls its elementary interchange, clears the old data body,
+transfers the returned body into that same object, and clears the return.
+This package supplies a **literal replacement call boundary** for that
+permutation/ownership contract. It does not replace the remaining raw rotations,
+ROM queries, full twelve-call schedule or repair. Original `Raw.shuttle` is not
+patched and the host `Raw` class is not executed by the new machine.
+
+Use the source five-symbol alphabet ZERO=0, ONE=1, LEFT=2, RIGHT=3, BLANK=4.
+RAW is a borrowed/installed owner: LEFT at0, V arbitrary bits, blank tail, head1.
+There are two banks of four canonical LSB-first raw descriptors, each LEFT,
+bits, RIGHT, blank tail, head1. H≥0, A,G,S≥1; zero has one zero bit. All29
+roles are disjoint. The20 encoded child roles are owned, entirely blank, head0,
+with arbitrary finite already-allocated blank backing. Unused caller tapes,
+including any ROM, are outside these roles and are untouched. Correct input
+shape and disjointness are premises, not a promised global validator/rollback.
+
+Each u/t entry returns the exchanged payload in the **same RAW array**, with
+LEFT/head1 and all four fields/spectators in their original order:
+
+    out[a,y,g,x,s] = in[a,x,g,y,s], x,y∈[0,2^H).
+
+Both raw descriptor banks are unchanged/head1. Every encoded cell, including
+markers, is blank and all20 owned heads are0. Array backing is retained.
+A subsequent entry may reuse exactly those banks. The separately supplied
+literal `init_descriptors` and `close_descriptors` entries produce and retire
+both actual source descriptor banks, including their markers and all motion.
+They are not free fixture construction. RAW payload production remains the
+upstream caller's obligation.
+
+The call-entry proof holds for any admitted descriptor values at these ports;
+only the optional descriptor initializer contains the two compiled tuples.
+The actual initializer constants are AST-extracted from the authenticated Raw
+source. Reduced geometries in finite tests replace only these initialization
+constants; they are labelled calibrations, not actual CRT payload executions.
+
+## 2. Binary embedding and finite dispatch
+
+The consumed binary program is generated by the unchanged
+`binary-elementary-interchange.binary_machine.lower` from the unchanged
+4589-instruction source program. Its established encoding is
+
+    ZERO→001, ONE→010, LEFT→011, RIGHT→100, BLANK→000.
+
+The raw machine's unallocated cells are4, while the binary machine's are0.
+Use the injective renaming ρ(0)=4 and ρ(1)=1 on every binary test/write.
+All binary moves and control edges remain unchanged. An unallocated binary0
+then corresponds to an unallocated raw4. A binary head at h is still at h;
+this is symbol renaming, not an unpriced address transformation. Instruction
+induction preserves contents, heads, allocation lengths and instruction counts.
+The child uses the two-symbol subalphabet {4,1}, but the **complete caller
+is five-symbol**, not a purported whole two-symbol raw CRT implementation.
+
+The assembler emits only local test/write, unit move, fixed jump and halt.
+It places two static copies of the child word for the two fixed caller port
+sets; both use the same20 encoded banks. This is fixed program memory, not
+runtime data allocation. Child status halts are replaced by single jumps:
+
+    initialized→run, returned→install, installed→close, closed→decode/retire.
+
+Each replacement costs one instruction, just like the replaced halt. No
+runtime callback, numerical PC computation, Python method, decoded geometry
+or host transposition survives. The existing static admission check verifies
+every opcode/role/target and excludes jump-only cycles; the resulting control
+factor is recorded. The old consume entry is unreachable in this path;
+install consumes the returned output before close.
+
+## 3. Literal codecs and owner induction
+
+At an encode-loop boundary raw head j and encoded head3j refer to the same
+source cell. The encoder explicitly writes encoded LEFT at0. For each raw
+bit it tests the scanned symbol, writes the corresponding three-cell code,
+advances three unit steps on the encoded bank and one on the raw bank.
+Payload ends at raw BLANK; numerical words end at RIGHT, whose encoded
+block is also written. A paired backward loop moves the raw head by-1 and
+the encoded head by-3 until the raw LEFT, then restores both to1 and3.
+Thus all borrowed raw bytes/heads survive and every child input has exactly
+its required encoded framing. Destinations are tested blank before writing.
+The five input banks are owned by the bridge, despite being borrowed by the
+child. The fifteen private child banks receive paid three-cell blank origin
+initialization, establishing block alignment before child init.
+
+By the inherited all-width callee theorem and binary refinement, run returns
+an encoded exchanged output; install overwrites its encoded SOURCE and
+consumes output; close erases private markers and leaves their heads3. The
+bridge then decodes that **installed encoded SOURCE**, not a reconstructed
+oracle stream. A literal depth-three decision tree reads a block and restores
+alignment. Codes001/010 write the corresponding bit to the original RAW
+owner and erase the encoded block. Code000 terminates and checks the raw
+blank tail; all other complete codes reject at this boundary. The paired
+rewind restores RAW head1; the encoded LEFT is erased and its head becomes0.
+This proves same-owner installation, not a returned replacement object.
+
+Each encoded descriptor is retired by advancing along the unchanged raw
+word in aligned pairs, erasing its corresponding blocks including RIGHT,
+then rewinding the raw word and erasing encoded LEFT. The raw word is never
+written. The other descriptor bank is never accessed. Finally three paid
+left moves return each child-private head from3 to0. All erased tails remain
+allocated. This establishes the complete entry/return invariant, so induction
+covers arbitrary successful u/t sequences on the same physical bank.
+
+The initializer writes every raw descriptor cell through a blank check,
+including LEFT/RIGHT, then rewinds. For eight words of total bit length J
+its exact cost is6J+65. Terminal descriptor retirement costs7J+137. The
+actual source tuples have J=36, hence281 and389 instructions. Their initial
+backing is supplied blank and charged below. Reinitializing occupied
+raw descriptors is not an admitted entry.
+
+## 4. Complete instruction invoice
+
+Let I=b(H)+b(A)+b(G)+b(S), where b(n)=max(1,bit_length(n)), and
+L=H+I+8. The inherited binary complete init/run/consume/close bound is
+
+    2^23 (H+1)(V+1)(L+1)^2.
+
+To avoid relying on whether an earlier prose bound included installation,
+charge install separately. In the source word, each clear of a V-bit payload
+uses7V+7 instructions, and its copy uses at most15V+7. Install therefore
+costs at most29V+22 plus its halt, below32(V+1). Its binary lowering costs
+at most256(V+1). Charging this on top of the inherited consumption bound
+overcounts the omitted consume, which is safe.
+
+A three-cell write/return costs7 instructions, or10 with blank checks.
+Encoding one n-bit raw port costs at most32(n+2), including its marker,
+terminator when numerical, all alignment motion and raw-head restoration.
+Decoding/installing/retiring encoded payload costs at most32(V+2).
+Descriptor retirement costs at most32(n+2) per word. These bounds follow
+from at most17 encode instructions per bit, at most24 decode/erase instructions
+per bit, at most13 descriptor-retirement instructions per bit, and paired
+rewind cost5(n+1)+4. Origin erasure costs10. Fifteen blank triplets cost150;
+returning their heads costs45. Boundary jumps/halt fit the remaining slack.
+Consequently the complete single shuttle, from blank encoded banks through
+same-owner return and full encoded retirement, is bounded by
+
+    2^23(H+1)(V+1)(L+1)^2 + 256(V+1) + 128(V+I+16).
+
+Add6J+65 for descriptor production and7J+137 for terminal descriptor disposal,
+once per caller descriptor-bank lifetime. Input payload creation/replacement,
+ROM and other raw operations remain separate. Every test, zero write, unit
+move and jump is charged; this is an intentionally conservative literal
+instruction bound, not a runtime fit or a claimed speedup. No recursive
+profile is repriced and no signed gain or new κ is asserted.
+
+## 5. Retained backing of all banks
+
+A read/move beyond the explicit array does not allocate; a write does, even
+when it writes BLANK. Neither erasure nor close shrinks an array. The retained
+source per-private-role capacity c_r(g) is the table in
+`interchange-retained-backing/PROOF.md`; its proof is an explicit dependency.
+The binary refinement gives3c_r(g) for each of the15 child-private banks.
+Bridge blank initialization is within their three-cell origin allowance.
+All codec writes are aligned complete blocks, so their exact requirements are
+
+    E_SOURCE: 3(V+1),       E_X: 3(b(X)+2), X=H,A,G,S.
+
+The RAW owner needs V+1 cells. The two persistent raw descriptor banks each
+need b(X)+2 cells per word. They are initialized even when only one mode is
+used. Byte-for-byte retained private storage is therefore determined by
+**separate per-role maxima** of these quantities and each role's old backing.
+This also bounds every intermediate write, because arrays never shrink.
+Source install does not exceed the encoded SOURCE prefix already produced.
+
+For arbitrary finite successful histories let Vmax bound all call volumes,
+and w=b(Vmax). Each active descriptor's bit length≤w, and the retained
+source-private grant is4Vmax+8w+23. Thus20 owned encoded banks have the
+conservative fresh grant
+
+    3(4Vmax+8w+23) + 3(Vmax+1) + 12(w+2)
+      = 15Vmax + 36w + 96.
+
+When both persistent descriptor tuples also have volume≤Vmax, adding RAW
+and all eight raw words yields16Vmax+44w+113 cells. With arbitrary preexisting
+backing, add its total K0; this loose sum safely retains old blank tails.
+If an unused initialized descriptor tuple has larger volume, its actual eight
+raw-word extents must instead be added separately; call-only Vmax cannot
+bound an unrelated unused descriptor. External input replacement may not
+allocate unaccounted padding or retain additional old objects for free.
+These are logical retained cells, not CPython heap/RSS or a global allocator.
+
+For the two actual source tuples, each separate fresh shuttle (with both raw
+banks initialized) retains3,146,057 total cells. A u→t history on one bank
+retains3,146,075: encoded PRE/OUTER add12 cells and encoded A adds6, while
+older GAP/BETWEEN/G backing remains. The extra18 cells falsify max-of-total
+accounting. The shared original RAW owner is counted once, encoded SOURCE
+and child OUTPUT separately. This is an arithmetic application to t if only
+the source-sized u case was executed; exact observed coverage is in FULL.json.
+
+## 6. Evidence, scope and credit
+
+Small complete rectangles, all16 independent H2 input columns, H0 identity,
+shrinking/growing histories, exact per-role backing and two separately written
+interpreters corroborate the proof. Wrong decoded writes and skipping install
+are falsifying controls. The source-sized actual u case uses all196608 bits;
+its execution is recorded separately, never inferred from a calibration.
+No full twelve-shuttle/ROM/rotation/repair composition, binary lowering of
+that whole caller, current native supplier, precision/outer multiplication or
+selected-frontier change is claimed. Failed-input rollback is excluded.
+
+Jose Manuel and retained PR2809/2753 authors supply the elementary lineage;
+JoyboyBrian/PR5162 and PR5188 supply the actual raw owner and literal callee;
+Ali Romman supplies binary lowering; Hiroki KUMAZAKI/PR5286 supplies retained
+backing. Cinna Davis, Hiroki KUMAZAKI, Douglas Colkitt/OpenAI and retained
+notices retain CRT attribution. New bridge/proof/controls: JoyboyBrian with
+substantial OpenAI Codex assistance, Apache-2.0. No human/kernel acceptance.

research/raw-crt-binary-shuttle-bridge/README.md

@@ -0,0 +1,70 @@
+# Literal raw CRT shuttle to the binary callee
+
+The actual `Raw.shuttle` owner uses numeric LEFT/BLANK framing, while the
+completed binary elementary interchange expects aligned three-bit ports.
+This package supplies the paid literal bridge: encode payload and descriptors,
+initialize and dispatch the existing binary program, install its output,
+decode into the same raw owner, and retire every encoded bank.
+
+The29 fixed roles include RAW, both actual u/t descriptor banks and20 encoded
+callee roles. Runtime instructions are only local tests/writes, unit moves,
+fixed jumps and halts. No host encoder, decoder, transpose or allocation callback
+survives. The binary child uses {raw BLANK4,ONE1}; the enclosing caller remains
+explicitly five-symbol. [PROOF.md](PROOF.md) states the all-width port contract,
+complete instruction tariff and retained-bank proof.
+
+The source initializer constants are extracted from unchanged Raw code:
+u=(2,1,1024,12), t=(2,4,256,12), each196608 payload bits. Their eight raw
+words are literally initialized/retired at costs281/389 instructions.
+Each separate actual call has3,146,057 retained cells including raw input and
+both descriptor banks. A shared u→t history requires3,146,075 cells: the extra18
+falsify max-of-standalone-total accounting. The t history figure is derived
+from the source per-role theorem; FULL.json records the historical actual u execution; the publication refresh
+replays only the light checks and preserves that receipt unchanged.
+
+Small tests include H0 identity, growing/shrinking histories, all16 independent
+H2 columns, a separately written sparse interpreter, exact retained capacities,
+wrong decoded-bit and missing-install controls. Default replay is read-only;
+`--write` authors only a missing typed receipt. Source and receipt corruption
+controls remain effective with assertions disabled.
+
+```sh
+python3.12 -B scripts/research_package.py --package research/raw-crt-binary-shuttle-bridge --check-only
+python3.12 -I -B research/raw-crt-binary-shuttle-bridge/verify.py
+python3.12 -I -O -B research/raw-crt-binary-shuttle-bridge/verify.py
+# Source-sized science needs a reserved heavy slot:
+python3.12 -I -B research/raw-crt-binary-shuttle-bridge/verify.py --full
+```
+
+This is an executable replacement call boundary, not a patch to the original
+Raw class or a complete twelve-shuttle/rotation/ROM/repair execution. Upstream
+payload production, full binary caller lowering, global allocation, native
+supplier, precision and outer multiplication remain outside scope. No recursive
+invoice/frontier changes or new κ. Error rollback is not promised.
+
+## Open next questions
+
+Compose one remaining literal raw rotation/current-y ROM boundary on these
+actual owners, with complete production and restoration costs. The current
+source raw word is not fully lowered. A whole two-symbol implementation also
+needs its upstream raw/ROM representation and stock invoice; the child-only
+binary theorem does not provide those. Structured questions are in TASK.json.
+
+## Credit
+
+JoyboyBrian with substantial OpenAI Codex assistance; Apache-2.0.
+Jose Manuel and retained PR2809/2753 authors supply the elementary lineage;
+JoyboyBrian/PR5162/5188 supply raw and literal sources; Ali Romman supplies
+binary lowering; Hiroki KUMAZAKI/PR5286 supplies retained backing. Cinna Davis,
+Hiroki KUMAZAKI, Douglas Colkitt/OpenAI and retained notices retain CRT credit.
+All original sources remain unchanged. No human or formal-kernel acceptance.
+
+[Resumed canonical claim](https://github.com/CrocSwap/integer-mult-bounds/discussions/4709#discussioncomment-19233740);
+[original released claim](https://github.com/CrocSwap/integer-mult-bounds/discussions/4709#discussioncomment-19173365).
+
+Publication was resumed on canonical main
+`721c03822c421b7f7fcbb2598993b947c4d88419`, priority revision8, selected
+PR6030. All eight live scientific inputs are unchanged. The original revision7
+card and source pins remain frozen; this result makes no claim about the new
+selected construction. The registered hook includes the source-sized `--full`
+command and will require its separate resource budget when run in hosted CI.