diff --git a/research/g20-joint-capture-flag-bound/PARTITION.json.gz b/research/g20-joint-capture-flag-bound/PARTITION.json.gz
new file mode 100644
index 0000000000..3dcd98fa7b
Binary files /dev/null and b/research/g20-joint-capture-flag-bound/PARTITION.json.gz differ
diff --git a/research/g20-joint-capture-flag-bound/PROOF.md b/research/g20-joint-capture-flag-bound/PROOF.md
new file mode 100644
index 0000000000..e7d84e9183
--- /dev/null
+++ b/research/g20-joint-capture-flag-bound/PROOF.md
@@ -0,0 +1,183 @@
+# A flag bound for simultaneous first-read captures
+
+Jerry Chen (@CubeJerry), with substantial OpenAI Codex assistance. Apache-2.0.
+
+## Statement and scope
+
+Fix the PR5708 word pinned in `SOURCES.json`. The 415 retained helpers are
+non-owned wires with index at least 222: 413 have target rank 8, and
+`P = {465, 684}` have target rank 4. Let `t = 1-C` be the **local BIT** moment
+exponent and assume `99/100 <= t <= 1`.
+
+Choose **any subset H** of helpers. Remove each chosen helper's independent
+public input and target credit, hold it zero before its first ADD-source use
+(dropping incoming writes and making its own queries free), and inject one
+arbitrary native-linear payload immediately before that first read. Afterwards
+keep the word's operations, making a query free only when its payload is zero.
+
+Native-linear means a finite F2 sum of terms `M x_i`, with M a native invertible
+address transformation, as in PR6113's payload model. It does **not** mean an
+unrestricted linear operator that need not preserve constant functions.
+Payloads use retained independent inputs. Grant injection, source access,
+scalar operations, frame preparation, storage, final erasure and restoration
+zero cost, and relax retained endpoint equations. These choices favor capture
+under the inherited nonnegative-charge contract. There are no new contacts,
+changed words, noncoordinate input contracts, later reinjections or jointly
+extended dead intervals. The census checks that no helper has a paid query
+after its last source read, so final erasure gives no additional query saving.
+
+Let Δ be saved paid t-moment minus lost target t-moment and let d8 count the
+chosen rank-8 helpers. Then
+
+\[
+\Delta\leq-\frac5{128}4^t d_8\leq0.
+\]
+
+The first inequality is strict if d8>0. For subsets of P alone it is only a
+non-improvement bound, consistent with the predecessor's neutral helper 684.
+No new κ. This is a written proof with an exact finite certificate, not a
+formalization of the multiplication theorem or enumeration of payload guesses.
+
+## 1. Necessary parity equations
+
+A native address permutation fixes the constant-one function. Evaluation on
+constant input functions therefore sends a finite F2 sum of native terms to
+the parity of its input labels: ADD becomes XOR, Q/ZERO_Q preserve the row,
+and ERASE zeros it. This is the augmentation homomorphism of the native
+operator algebra. Native zero implies projected zero; the converse is unused.
+
+Original owned inputs are zero. The census temporarily gives them independent
+labels and checks that none appears in any of the 2,846 paid query rows, so
+discarding those labels changes none of the certificate rows. Every paid row
+is nonzero. Frame chronology, query ranks and the published paid profile are
+checked, but native operator identities and endpoints are not reproved.
+
+## 2. First reads give a graph kernel
+
+Let V have the 637 original non-owned input labels as basis. Before helper h's
+first source read, its label x_h has never left that wire. Its projected base
+value is `x_h + a_h`, with no still-unread helper label in a_h.
+
+Process captures chronologically. Define L to fix retained inputs. At h's
+capture set `L(x_h)=f_h=w_h+L(a_h)`, where w_h is its projected injected payload.
+All labels in a_h are retained or belong to earlier captures, so f_h uses
+retained inputs only. Outside a chosen helper's held-zero prefix, its modified
+projected value is L of its base value. Indeed, a held-zero helper has no
+outgoing ADD, so dropping its writes affects no other wire; the capture
+equation establishes agreement at first read, and subsequent operations
+preserve it. This induction holds for every subset and payload.
+
+Thus `R=ker L` has basis `{x_h+f_h : h in H}` and projection R→coordinates H
+is an isomorphism. Every removed query outside an owned held-zero prefix has
+its base row in R.
+
+Partition helpers into P, F, O. P is the two partial helpers. F is the 180
+rank-8 helpers with an early own rank-2 query. O is the other 233 rank-8
+helpers. The census checks at most one early own query per helper, of rank 1
+or 2, and none for P. Write dP=|H∩P|, and similarly dF,dO. The graph property
+implies
+
+\[
+\dim R=d_P+d_F+d_O,\quad
+\dim(R\cap\{v_P=0\})\leq d_F+d_O,\quad
+\dim(R\cap\{v_P=v_F=0\})\leq d_O.
+\]
+
+Indeed, projection onto H is injective and the indicated coordinates vanish;
+zeros on retained helper coordinates can only lower these dimensions further.
+These stronger bounds distinguish cheap partial targets and costly early
+frees; an unweighted |H|-only bound does not use them.
+
+## 3. Cover early cross-helper effects
+
+Grant held-zero-prefix savings separately, at most `2^t dF + dO`. This even
+grants an H1 to each of O's 111 helpers without an early query. Other removed
+queries must contain a helper label, since L fixes non-helper inputs.
+
+An early query on an unchosen helper can disappear through a *different*
+chosen helper. Keep an early query in the token census whenever its row
+contains another helper label. These three events (zero-based) qualify:
+
+| Event | Destination | Rank | Helper-label support |
+| --- | ---: | ---: | --- |
+| 6231 | 467 | 1 | 274, 467 |
+| 6291 | 297 | 1 | 297, 465 |
+| 6510 | 464 | 1 | 323, 464 |
+
+Other early own queries can be omitted: if their destination is chosen they
+are already granted free; otherwise L fixes their nonzero row. Double counting
+a cross-helper query in the free allowance and token bound is harmless for an
+upper bound. This leaves **2,216 eligible queries and 1,945 distinct rows**.
+PR6113's printed census had 2,213: the three-query difference is intentional
+coverage, not a claim that its numerical pair results are false. A negative
+control omits event 6291's tokens and must fail exact coverage.
+
+## 4. The finite flag certificate
+
+For query ranks r=1,2,3,4,5,6 use respectively m(r)=17,33,49,64,80,96 copies
+of the row. Throughout the stated interval, `r^t <= m(r)4^t/64`. For r<4,
+`(r/4)^t` is largest at t=99/100; integer inequalities
+`r^99 64^100 <= 4^99 m(r)^100` certify the claim. For r>=4 use
+`(r/4)^t <= r/4 = m(r)/64`. No floating-point acceptance is used.
+
+`PARTITION.json.gz` partitions all **64,274 tokens into 108 colors**:
+
+| Colors (zero based) | Count | Allowed rows |
+| --- | ---: | --- |
+| 0–63 | 64 | unrestricted |
+| 64–91 | 28 | zero on P |
+| 92–107 | 16 | zero on P and F |
+
+Each color is F2-linearly independent. Rows are reconstructed from the word;
+every token multiplicity and flag is checked, and independence is checked by
+both highest-pivot and lowest-pivot elimination. IDs are the increasing integer
+order of distinct eligible rows. The witness suffices; no optimality or search
+completeness claim is made about the discovery algorithm.
+
+An independent set meets a subspace in at most its dimension. Summing the
+three graph-kernel dimension bounds across colors yields
+
+\[
+\text{non-prefix savings}\leq4^t
+\left(d_P+\frac{92}{64}d_F+\frac{108}{64}d_O\right).
+\]
+
+This single certificate covers all `2^415` ownership sets. They are not
+enumerated, and 108 is not asserted to be the minimum number of colors.
+
+## 5. Optimistic complete budget
+
+Lost target credit is `4^t dP + 8^t(dF+dO)`. Add prefix savings and subtract
+that debit:
+
+\[
+\Delta\leq4^t\left[
+\left(\frac{92}{64}+2^{-t}-2^t\right)d_F+
+\left(\frac{108}{64}+4^{-t}-2^t\right)d_O\right].
+\]
+
+Exact integer powers establish, on the full interval,
+`2^t > 127/64`, `2^(-t) < 65/128`, and `4^(-t) < 33/128`.
+For example the first is checked at the lower endpoint by
+`2^99 64^100 > 127^100`; the reciprocal inequalities are checked similarly.
+Both coefficients are strictly below -5/128:
+`184+65-254=-5` and `216+33-254=-5`. This proves the statement. Charging actual
+setup, source reads, frame changes, copies, erasure, restoration or recursive
+children cannot reverse this failed optimistic budget if they add nonnegative
+charges without changing the stipulated word or contract.
+
+## Limits and evidence status
+
+This closes the larger-set question for **individual first-read schedules on
+this exact word**, including both partial helpers. Joint deadness can permit
+later capture after a helper has influenced other wires; then a single entry
+substitution need not apply. Changed words, other input subspaces, unrestricted
+non-native-linear payload operators and other exponents remain outside scope.
+
+The projection implication and triangular argument are written mathematics,
+not Lean proofs. Seven deterministic payload/subset fixtures exercise the
+lemma but do not prove it. Two row representations and opposite elimination
+pivots reduce implementation dependence; they are not external peer review.
+The native/adjoint endpoint and complete caller were not replayed. No recursive
+supplier was built, and the selected theorem's native, owned-erasure, compiler,
+precision/tape and analytic-recovery assumptions remain unchanged.
diff --git a/research/g20-joint-capture-flag-bound/README.md b/research/g20-joint-capture-flag-bound/README.md
new file mode 100644
index 0000000000..f759de119a
--- /dev/null
+++ b/research/g20-joint-capture-flag-bound/README.md
@@ -0,0 +1,118 @@
+# All-subset bound for G20 first-read helper captures
+
+**No new κ.** On the exact PR5708 word, simultaneous first-read capture of
+**any subset of all 415 retained helpers** cannot improve the local BIT signed
+moment for `0 <= C <= 0.01` (`t=1-C`). This includes the 180 helpers with an
+early rank-2 query and both partial rank-4 helpers. Every captured rank-8
+helper loses strictly more than `(5/128)*4^t` in the optimistic bill. Subsets
+containing only partial helpers have gain at most zero.
+
+The result grants arbitrary native-linear injected payloads and free setup,
+source access and restoration. It closes a fixed-schedule larger-set question
+left by [PR6113](https://github.com/CrocSwap/integer-mult-bounds/pull/6113), so
+further work on this mechanism must change that schedule or another stated
+premise. It is a scoped negative result, not an improved supplier or a general
+impossibility theorem.
+
+## Evidence and what is new
+
+[PROOF.md](PROOF.md) reduces capture to an entry substitution on constant-input
+parities. Its kernel projects injectively onto captured coordinates. A new
+**flag-constrained weighted partition** respects three different helper tariffs:
+64 unrestricted independent colors, 28 avoiding partial-helper coordinates,
+and 16 also avoiding early-rank-2 coordinates. This prices all subsets without
+enumerating their payloads. Exact integer powers extend the comparison over
+the full exponent interval; there is no floating-point acceptance decision.
+
+[PARTITION.json.gz](PARTITION.json.gz) covers 64,274 tokens from 2,216 queries
+and 1,945 rows. In particular it includes three cross-helper early queries
+(6231, 6291, 6510) that cannot simply be excluded from a uniform token census.
+[RESULT.json](RESULT.json) records the exact counts and row digest.
+
+PR6113 supplied the native-payload/individual-capture model, single/pair census
+and an unweighted token bound, but explicitly left larger sets with multiple
+rank-2 frees open. Its numerical pair findings are not contradicted here.
+PR5604's entry-subspace capacity bound concerned a different, static model
+and older word. This package adds a dynamic first-read graph-kernel argument,
+a tariff-sensitive certificate covering all helper sets, and exact uniform
+moment inequalities. No predecessor implementation is imported.
+
+## Reproduce
+
+From the repository root, using Python 3.12 and only its standard library:
+
+```sh
+python3.12 -B scripts/research_package.py --package research/g20-joint-capture-flag-bound
+```
+
+Both normal and explicit isolated optimized runs must print
+`PASS_G20_ALL_SUBSET_FIRST_READ_FLAG_BOUND`. Each run authenticates the three
+live inputs, checks all 14,794 events, compares integer-mask and set replays,
+checks every token and both Gaussian-elimination directions, verifies seven
+entry-substitution fixtures, and rejects eight corruptions: omitted tokens,
+duplicate/dependent color rows, both wrong flags, omitted cross-helper event
+6291, a forged query rank and changed source bytes. The fixtures support the
+written lemma; they are not a proof by exhaustive testing.
+
+The optional deterministic discovery command is separate from verification:
+
+```sh
+python3.12 -B research/g20-joint-capture-flag-bound/discover.py /tmp/g20-partition.json.gz
+```
+
+It stops at the first verified 108-color partition, a 1,200-second deadline,
+or exhaustion of its augmenting-path search. A timeout/failure is not an
+impossibility claim. Reproduction compares decompressed JSON, not gzip bytes.
+The successful discovery used 2,062 augmentations after the greedy stage.
+The verifier requires neither discovery nor any third-party solver.
+
+## Pins, boundaries and coordination
+
+Scientific and branch base: `721c03822c421b7f7fcbb2598993b947c4d88419`.
+[SOURCES.json](SOURCES.json) pins the exact word, frames and local invoice by
+Git blob and SHA256. Historical predecessor heads are PR5708
+`829d01fc031f7323ffcfa423fdfd1f24dcbe3190`, PR6113
+`f6712095d07d555969b6e67b792a0e98e8eea8d3`, and PR5604
+`b7c27a263b9e57d4e04b5e2dcb7b3199cc8c4170`. PR6113 is a credited research
+lead, not a live executable dependency. The selected certificate at the base
+is PR6030, conditional κ=781451/250000000; no selected record is changed.
+
+Only first-read individual capture schedules, coordinate ownership, native
+permutation-linear payloads and this exponent interval are covered. Later
+joint-dead captures, changed words and other input contracts remain open.
+Native/adjoint endpoints, the complete caller and recursive construction were
+not replayed. The selected theorem's native, owned-erasure, compiler,
+precision/tape and analytic-recovery assumptions are unchanged. This is an
+exact certificate plus a written proof, not a formal theorem audit.
+
+[TASK.json](TASK.json) records seed 08 (bit supplier), three candidate tasks,
+scope selection, checkpoint freshness and overlap limits. The local overlap
+inventory covered 8,348 research records; connected GitHub reads covered the
+latest 100 open PR bodies, focused searches and predecessor heads. Visible
+handoff posts were checked, not all discussion pagination or PR code diffs.
+No pinned sprint issue was found. The available connector cannot post to
+Discussions and the browser was signed out; an advance claim was recorded
+locally at 10:39 UTC rather than represented as a public reservation.
+
+## Open next questions
+
+- Can a jointly dead interval support a **later** reinjection whose complete
+  target and paid bill improves? Start with a triple extending PR6113's five
+  joint-dead pairs; emit an exact changed word and native endpoint before a
+  large search. The present graph-kernel proof does not apply after propagation.
+- Can this flag-certificate technique bound a different changed word? First
+  recompute early tariffs, query rows and projection flags on its exact source.
+  The current witness cannot be transferred by matching aggregate profiles.
+
+Structured first steps and blockers are in [TASK.json](TASK.json).
+
+## Credit
+
+Jerry Chen (@CubeJerry), with substantial OpenAI Codex assistance in research,
+proof drafting, implementation and verification. No subagents. Apache-2.0.
+Credit Matarener for PR6113 and its explicit larger-set handoff; Ali Romman for
+PR5604, PR5679 and the PR5708 word; ai-nanachi for PR5512's G20 construction;
+and Dugongue for the underlying refinements and late-binding work. The source
+packages and their original notices are unchanged. Binary matroid partition
+and augmentation are standard methods; the source-specific flag allocation,
+all-subset proof and finite witness are this contribution.
diff --git a/research/g20-joint-capture-flag-bound/RESULT.json b/research/g20-joint-capture-flag-bound/RESULT.json
new file mode 100644
index 0000000000..80a1c4a8b8
--- /dev/null
+++ b/research/g20-joint-capture-flag-bound/RESULT.json
@@ -0,0 +1,162 @@
+{
+  "status": "PASS_G20_ALL_SUBSET_FIRST_READ_FLAG_BOUND",
+  "wire_count": 685,
+  "event_count": 14794,
+  "helper_count": 415,
+  "full_helpers": 413,
+  "partial_helpers": [
+    465,
+    684
+  ],
+  "rank_two_early_helpers": 180,
+  "paid_profile": {
+    "1": 1281,
+    "2": 1338,
+    "3": 58,
+    "4": 57,
+    "5": 102,
+    "6": 10
+  },
+  "query_count": 2846,
+  "eligible_queries": 2216,
+  "distinct_rows": 1945,
+  "tokens": 64274,
+  "color_limits": [
+    64,
+    92,
+    108
+  ],
+  "color_sizes": [
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    637,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    634,
+    454,
+    454,
+    448,
+    421,
+    396,
+    374,
+    354,
+    337,
+    326,
+    320,
+    312,
+    312,
+    312,
+    312,
+    311,
+    311
+  ],
+  "cross_helper_early_queries": [
+    6231,
+    6291,
+    6510
+  ],
+  "query_rows_sha256": "8e72818d9a2f7d6838b4c087dd2c3db05138b6aff36b045d82aa7d7a08a9307d",
+  "t_interval": [
+    "99/100",
+    "1"
+  ],
+  "full_helper_loss_lower_bound": "(5/128)*4^t",
+  "substitution_fixtures": 7,
+  "negative_controls": [
+    "omitted token",
+    "duplicate token in color",
+    "distinct dependent row",
+    "partial helper in restricted color",
+    "rank-two helper in restricted color",
+    "omit cross-helper early query 6291",
+    "forged query rank",
+    "changed source bytes"
+  ],
+  "kappa_change": false
+}
diff --git a/research/g20-joint-capture-flag-bound/SOURCES.json b/research/g20-joint-capture-flag-bound/SOURCES.json
new file mode 100644
index 0000000000..09837bb20f
--- /dev/null
+++ b/research/g20-joint-capture-flag-bound/SOURCES.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": 1,
+  "base_commit": "721c03822c421b7f7fcbb2598993b947c4d88419",
+  "files": [
+    {
+      "path": "certificates/selected-result.json",
+      "usage": "provenance",
+      "git_blob": "d59b5035e7b4cbaa9d688a1d32dd0d6eb79c466a",
+      "sha256": "9b8d0eea95b3bf0dfcb7938a732a6439b87a2685dec2a5ab9e525b3b34debbfa"
+    },
+    {
+      "path": "docs/research/agent-task-catalog.json",
+      "usage": "provenance",
+      "git_blob": "3404fbdd5e7529a0674eef26114b5071e4586cec",
+      "sha256": "ead6cdc9d0af6d58e8a49744d8ec8c7c15e13d2ba93c276c434bcf9b51b93a81"
+    },
+    {
+      "path": "research/g20-conjugation-admission/LOCAL-RESULT.json",
+      "usage": "input",
+      "git_blob": "29cd42b8baa531f2598b9b8894fd514c754ed17c",
+      "sha256": "ec37bf5ddf743caf6a415bd4ce6fcd9c0f40922f0066ea79f6d2321ee0f18e96"
+    },
+    {
+      "path": "research/g20-conjugation-admission/WORD.json.gz",
+      "usage": "input",
+      "git_blob": "3877a72d8a15adb03f6492f7d2fd8fa902ecb639",
+      "sha256": "8dd441fdb9c8923df06eb5ebfda37d03e4539f2305763e688d8c7025d196c4b1"
+    },
+    {
+      "path": "research/g20-conjugation-admission/prior/prior/prior/source/vendor/g20/inputs/FRAMES.json",
+      "usage": "input",
+      "git_blob": "9edf8d95b45a9c9c766a956bfcd3c19cf07bc13c",
+      "sha256": "0d99fc6b8f45c03dfba5252a03dd9e7fe23be3a7593dfe15368e34da6629a654"
+    }
+  ]
+}
diff --git a/research/g20-joint-capture-flag-bound/TASK.json b/research/g20-joint-capture-flag-bound/TASK.json
new file mode 100644
index 0000000000..e626443ac3
--- /dev/null
+++ b/research/g20-joint-capture-flag-bound/TASK.json
@@ -0,0 +1,157 @@
+{
+  "schema_version": 1,
+  "task_id": "bit-helper-contract",
+  "priority_revision": 8,
+  "base_commit": "721c03822c421b7f7fcbb2598993b947c4d88419",
+  "original_card": {
+    "id": "bit-helper-contract",
+    "question": "Can a changed G20 helper path or independent-target split improve the complete BIT moment without losing its physical endpoint?",
+    "starting_points": [
+      "docs/research/current-priorities.md",
+      "docs/research/research-family-status.md",
+      "certificates/selected-result.json",
+      "docs/research/pr-intake-evidence/pr5599-completion/PROOF-REVIEW.md",
+      "research/g20-helper-split/README.md",
+      "research/g20-conjugation-admission/README.md"
+    ],
+    "methods": [
+      "Construct and independently check one source-bound instance of the stated first experiment.",
+      "Seek an exact counterexample or target-specific complete-budget obstruction to that same proposed change."
+    ],
+    "acceptance_gate": "A full boundary contract and paid profile; unchanged scalar counts alone are insufficient. A scoped local result may be retained without a complete supplier. Expanding it into further construction rounds requires the family-level budget and obligation gate in research-family-status.md; an optimistic passing relaxation alone is not acceptance.",
+    "first_step": {
+      "command": [
+        "python3",
+        "-B",
+        "scripts/research_selected_baseline.py"
+      ],
+      "expected": "PASS_RESEARCH_BASELINE_BINDINGS_ONLY",
+      "inspect": "Read revision 8, the selected review and live exact-source handoffs. Then follow this card's bounded first_experiment.",
+      "scope": "Source-bound orientation only, not a supplier replay or theorem proof."
+    },
+    "first_experiment": "First read #5679/#5708 and their audits as pending component proposals. Choose one uncovered helper group/cut on an exact word; compare arbitrary-input native action, targets, owned storage, both orientations and full signed bill. Stop if the gain is only a scalar count or repaid by lost targets. Do not rerun the frozen #5609 common-frame domain without changing its hypothesis.",
+    "bottleneck_link": "Judge the actual current supplier contract and complete signed target/paid bill; frozen-profile ceilings require an applicability proof.",
+    "allowed_variations": [
+      "One exact source head, helper/cut region or quantified proposition and changed hypothesis; check live handoffs first. Different seeds are not different scopes."
+    ],
+    "scope_change_triggers": [
+      "Changing source head, helper/cut domain, operation alphabet or caller boundary without recording the new scope.",
+      "Treating an archived proposal or local numerical pass as complete supplier admission."
+    ],
+    "overlap_terms": [
+      "G20",
+      "helper split",
+      "5679",
+      "5708",
+      "independent target"
+    ],
+    "existing_checks": [
+      {
+        "scope": "Selected PR5599: complete helper-subspace construction and independent caller replay; five framework assumptions remain.",
+        "evidence": "docs/research/pr-intake-evidence/pr5599-completion/PROOF-REVIEW.md",
+        "remaining": "The next experiment must identify uncovered source-specific work. Successor archive intake does not transfer this admission.",
+        "status": "reviewed",
+        "source_commit": "09dd0965711ca7eeb169057a420abab1c9052137",
+        "selected_record_sha256": "2a0220e866417774606e0f991e41b9c1d26b1f43b97857238cf478dbc7d330b5"
+      }
+    ]
+  },
+  "scope_status": "refined",
+  "actual_scope": "Rule out profitable simultaneous first-read captures of any subset of the 415 retained helpers on the frozen PR5708 word, with arbitrary native-linear payloads and an optimistic complete target/paid moment comparison for 99/100 <= t <= 1.",
+  "scope_change_reason": "Follow PR6113’s explicit larger-set handoff with a graph-kernel flag certificate. This is the card’s scoped obstruction alternative, not a new supplier. Extend the same certificate to all 415 helpers, including the two partial targets; do not reopen a frozen common-frame search.",
+  "bottleneck_link": "A helper saving that loses more productive target moment cannot improve this local BIT supplier. Closing the individual first-read ownership family redirects construction effort to later joint-dead captures or changed words. No claim is made about the global selected frontier.",
+  "budget_minutes": 120,
+  "stop_rule": "Orientation within 24 minutes; stop this investigation when a complete exact certificate is found, or at 12:00 UTC for verification and handoff. One refinement from full helpers to all helpers is within the same capture hypothesis. Do not claim an impossibility from a failed partition search. Hard session end 12:30 UTC.",
+  "outcome": "negative-result",
+  "evidence": "PROOF.md gives the all-subset graph-kernel argument; PARTITION.json.gz partitions every eligible token into 108 flag-constrained independent colors; RESULT.json and verify.py record exact replay, interval inequalities and eight rejection controls.",
+  "author": "Jerry Chen (@CubeJerry)",
+  "ai_assistance": "Substantial OpenAI Codex assistance in task selection, mathematics, proof drafting, coding, verification and packaging. No subagents.",
+  "open_questions": [
+    {
+      "question": "Can later reinjection in a jointly dead interval improve a complete G20 helper bill?",
+      "why_it_matters": "It changes the first-read premise used by this obstruction and is a remaining mechanism-level route to BIT savings.",
+      "first_step": "Take one triple extending a joint-dead pair from PR6113, emit its exact capture word, and certify retained native endpoints and all paid and target changes before enlarging the search.",
+      "blocked_by": "No implemented later-capture construction or complete invoice; the graph-kernel proof need not survive prior propagation."
+    },
+    {
+      "question": "Does another changed G20 word admit a comparable tariff-sensitive partition?",
+      "why_it_matters": "The certificate method can screen a different exact mechanism without enumerating all ownership subsets.",
+      "first_step": "Pin that word, independently derive early tariffs and query rows, and attempt the corresponding weighted flag partition.",
+      "blocked_by": "The present source-specific certificate cannot transfer from aggregate profiles; new source rows and native assumptions require review."
+    }
+  ],
+  "os_random_draw": 8,
+  "track": "bit supplier",
+  "picker_seed": "00000000000000000000000000000008",
+  "candidate_tasks": [
+    {
+      "task": "bit-helper-contract",
+      "scope": "PR6113 all-subset first-read capture budget on the PR5708 word",
+      "decision": "Chosen: explicit larger-set handoff; seed 8 favors parity/dual certificate over payload enumeration."
+    },
+    {
+      "task": "bit-new-register-model",
+      "scope": "One four-register native BIT identity outside the three-register alphabet; price the smallest completed instance before extending word length.",
+      "decision": "Several recent obstruction claims; broader new-mechanism search."
+    },
+    {
+      "task": "r437-carrier-integration",
+      "scope": "One pooled-compiler request-alignment obligation for the pinned R437 two-window exchange.",
+      "decision": "More extensive source closure than the bounded helper question."
+    }
+  ],
+  "claim": {
+    "kind": "local",
+    "time_utc": "2026-10-28T10:39:00Z",
+    "expected_finish_utc": "2026-10-28T12:30:00Z",
+    "reason": "No pinned sprint issue found. Connector has no Discussion posting operation and browser is signed out. Local claim permitted by donor. No retrospective public reservation claimed."
+  },
+  "overlap": {
+    "local_records": 8348,
+    "local_inventory_complete": true,
+    "remote_scope": "Latest 100 open PR bodies, focused all-state capture/flag searches, exact predecessor heads and recent visible discussion 1166 posts. Review ledger and prior negative records inspected.",
+    "limitations": "find_overlap remote refresh unavailable because gh is absent. Full discussion pagination and every PR code diff were not inspected; no-match is not proof of novelty.",
+    "nearest_sources": {
+      "6113": "f6712095d07d555969b6e67b792a0e98e8eea8d3",
+      "5708": "829d01fc031f7323ffcfa423fdfd1f24dcbe3190",
+      "5604": "b7c27a263b9e57d4e04b5e2dcb7b3199cc8c4170",
+      "5679": "715dda75fc4cefb1e492349fa0e331d5f15d0f53"
+    },
+    "completion_refresh": {
+      "time_utc": "2026-10-28T11:21:00.532149+00:00",
+      "focused_query": "repo:CrocSwap/integer-mult-bounds G20 capture",
+      "results": [
+        6113,
+        5604,
+        5512,
+        2190
+      ],
+      "predecessor_6113_head_unchanged": true,
+      "finding": "No overlapping all-subset flag certificate in the inspected result bodies. The broader first-read/flag search also checked 30 result bodies. Coverage limitations remain."
+    }
+  },
+  "discovery": {
+    "domain": "Fixed pinned word, all 415 coordinate helpers, individual first-read schedule; arbitrary native-linear payloads. Certificate search on 1945 projected rows and 64274 prescribed tokens with limits [64,92,108].",
+    "seed": 8,
+    "randomness_use": "OS draw selects the track and certificate-oriented approach; exploratory tie ordering and replay fixtures use seed 8. The published augmenting-path search is deterministic.",
+    "stopping_rule": "First verified partition, 1200-second search deadline, or exhausted augmenting paths; failure does not certify a mathematical obstruction.",
+    "completed_coverage": "All 64274 tokens assigned after 2062 augmentations. A written graph-kernel argument turns the checked witness into a bound for every ownership subset, not an enumeration of subsets or payloads.",
+    "optimality_claim": false
+  },
+  "checkpoints": [
+    {
+      "time_utc": "2026-10-28T10:39:00Z",
+      "upstream_commit": "721c03822c421b7f7fcbb2598993b947c4d88419",
+      "priority_revision": 8,
+      "selected_kappa": "781451/250000000",
+      "decision": "Initial canonical main and selected source/review orientation recorded in the local claim by this time."
+    },
+    {
+      "time_utc": "2026-10-28T11:16:10.134336+00:00",
+      "upstream_commit": "721c03822c421b7f7fcbb2598993b947c4d88419",
+      "priority_revision": 8,
+      "selected_kappa": "781451/250000000",
+      "decision": "Certificate complete; guidance, selected record, ledger and source unchanged. Preserve frozen inputs and continue verification."
+    }
+  ]
+}
diff --git a/research/g20-joint-capture-flag-bound/VERIFY.json b/research/g20-joint-capture-flag-bound/VERIFY.json
new file mode 100644
index 0000000000..68f2aece7f
--- /dev/null
+++ b/research/g20-joint-capture-flag-bound/VERIFY.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": 1,
+  "status": "ready",
+  "python": "3.12",
+  "requirements": [],
+  "inputs": [
+    "research/g20-conjugation-admission/LOCAL-RESULT.json",
+    "research/g20-conjugation-admission/WORD.json.gz",
+    "research/g20-conjugation-admission/prior/prior/prior/source/vendor/g20/inputs/FRAMES.json"
+  ],
+  "commands": [
+    {
+      "argv": [
+        "{python}",
+        "-B",
+        "{package}/verify.py"
+      ],
+      "timeout_seconds": 120,
+      "checks": "Exact source/row/flag/multiplicity and integer-power checks; independent set replay; seven substitution fixtures and eight negative controls."
+    },
+    {
+      "argv": [
+        "{python}",
+        "-I",
+        "-O",
+        "-W",
+        "error",
+        "-B",
+        "{package}/verify.py"
+      ],
+      "timeout_seconds": 120,
+      "checks": "Same proof-relevant checks in isolated optimized Python; no assert-dependent acceptance."
+    }
+  ]
+}
diff --git a/research/g20-joint-capture-flag-bound/discover.py b/research/g20-joint-capture-flag-bound/discover.py
new file mode 100644
index 0000000000..62cbe8b275
--- /dev/null
+++ b/research/g20-joint-capture-flag-bound/discover.py
@@ -0,0 +1,121 @@
+#!/usr/bin/env python3
+"""Optional deterministic flag-constrained matroid partition search.
+
+Outputs to the requested scratch path. Verification never calls this search.
+Jerry Chen (@CubeJerry), with OpenAI Codex assistance. Apache-2.0.
+"""
+import argparse
+from collections import deque
+import gzip
+import importlib.util
+import json
+from pathlib import Path
+import time
+
+HERE = Path(__file__).resolve().parent
+SPEC = importlib.util.spec_from_file_location("g20_flag_model", HERE / "model.py")
+model = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(model)
+
+
+def discover(data, seconds):
+    vectors = data["vectors"]
+    colors = [set() for _ in range(108)]
+    bases = [{} for _ in colors]
+    partial = sum(1 << h for h in data["partial"])
+    two = sum(1 << h for h in data["free_two"])
+    deadline = time.monotonic() + seconds
+
+    def limit(x):
+        return 64 if vectors[x] & partial else 92 if vectors[x] & two else 108
+
+    def reduce(index, value):
+        combination = 0
+        basis = bases[index]
+        while value:
+            pivot = value.bit_length() - 1
+            if pivot not in basis:
+                return value, combination
+            row, support = basis[pivot]
+            value ^= row
+            combination ^= support
+        return value, combination
+
+    def add(index, x):
+        value, combination = reduce(index, vectors[x])
+        model.require(value != 0, "discovery inserted dependence")
+        bases[index][value.bit_length() - 1] = (value, combination ^ (1 << x))
+        colors[index].add(x)
+
+    def rebuild(index):
+        members = sorted(colors[index])
+        colors[index], bases[index] = set(), {}
+        for x in members:
+            add(index, x)
+
+    remaining = data["multiplicities"].copy()
+    for index in range(108):
+        for x in sorted(remaining, key=lambda x: (limit(x), -remaining[x], vectors[x])):
+            if index < limit(x) and reduce(index, vectors[x])[0]:
+                add(index, x)
+                remaining[x] -= 1
+        remaining = +remaining
+    print("Greedy remainder:", sum(remaining.values()), flush=True)
+    steps = 0
+    for root in sorted(remaining, key=lambda x: (limit(x), -remaining[x], vectors[x])):
+        for _ in range(remaining[root]):
+            previous, queue, found = {root: None}, deque([root]), None
+            while queue and found is None:
+                if time.monotonic() > deadline:
+                    raise TimeoutError("search stopped; no impossibility conclusion")
+                x = queue.popleft()
+                for index in range(limit(x)):
+                    if x in colors[index]:
+                        continue
+                    value, support = reduce(index, vectors[x])
+                    if value:
+                        found = (x, index)
+                        break
+                    while support:
+                        bit = support & -support
+                        y = bit.bit_length() - 1
+                        if y not in previous:
+                            previous[y] = (x, index)
+                            queue.append(y)
+                        support ^= bit
+            model.require(found is not None, "search exhausted; no mathematical obstruction claimed")
+            x, index = found
+            colors[index].add(x)
+            changed = {index}
+            while previous[x] is not None:
+                y, index = previous[x]
+                colors[index].remove(x)
+                colors[index].add(y)
+                changed.add(index)
+                x = y
+            for index in sorted(changed):
+                rebuild(index)
+            steps += 1
+            if steps % 200 == 0:
+                print("Augmentations:", steps, flush=True)
+    certificate = {"schema": "g20-first-read-flag-partition/v1",
+                   "limits": [64, 92, 108], "groups": [sorted(c) for c in colors]}
+    model.check_partition(data, certificate)
+    return certificate
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("output", type=Path)
+    parser.add_argument("--seconds", type=int, default=1200)
+    args = parser.parse_args()
+    model.require(not args.output.exists(), "refuse to overwrite an existing artifact")
+    data = model.census(*model.inputs())
+    certificate = discover(data, args.seconds)
+    raw = (json.dumps(certificate, separators=(",", ":")) + "\n").encode()
+    args.output.write_bytes(gzip.compress(raw, mtime=0))
+    print("WROTE_VERIFIED_FLAG_PARTITION", args.output)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/research/g20-joint-capture-flag-bound/model.py b/research/g20-joint-capture-flag-bound/model.py
new file mode 100644
index 0000000000..a58d64545d
--- /dev/null
+++ b/research/g20-joint-capture-flag-bound/model.py
@@ -0,0 +1,180 @@
+"""Constant-input necessary conditions for first-read G20 captures.
+
+Jerry Chen (@CubeJerry), with OpenAI Codex assistance. Apache-2.0.
+No predecessor implementation is imported. Native address permutations act
+as identity on constant functions; this is a necessary-condition projection,
+not an exact native interpreter.
+"""
+from collections import Counter
+from hashlib import sha256
+from pathlib import Path
+import gzip
+import json
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parents[1]
+PREFIX = "research/g20-conjugation-admission/"
+WORD = PREFIX + "WORD.json.gz"
+FRAMES = PREFIX + "prior/prior/prior/source/vendor/g20/inputs/FRAMES.json"
+LOCAL = PREFIX + "LOCAL-RESULT.json"
+TOKENS = {1: 17, 2: 33, 3: 49, 4: 64, 5: 80, 6: 96}
+
+
+def require(ok, reason):
+    if not ok:
+        raise ValueError(reason)
+
+
+def authenticate(data, digest, name):
+    require(sha256(data).hexdigest() == digest, "source hash: " + name)
+
+
+def inputs():
+    source = json.loads((HERE / "SOURCES.json").read_text())
+    blobs = {}
+    for row in source["files"]:
+        if row["usage"] == "input":
+            data = (ROOT / row["path"]).read_bytes()
+            authenticate(data, row["sha256"], row["path"])
+            blobs[row["path"]] = data
+    require(set(blobs) == {WORD, FRAMES, LOCAL}, "complete input manifest")
+    return (json.loads(gzip.decompress(blobs[WORD])),
+            json.loads(blobs[FRAMES])["frames"], json.loads(blobs[LOCAL]))
+
+
+def census(word, frames, expected):
+    records, start, final = word["records"], word["start"], word["final"]
+    width = len(start)
+    require(len(final) == width, "boundary width")
+    owned = set(word["owned"])
+    helpers = set(range(222, width)) - owned
+    helper_mask = sum(1 << h for h in helpers)
+    owned_mask = sum(1 << h for h in owned)
+    dims = {int(f): row["dim"] for f, row in frames.items()}
+    targets = {h: abs(dims[start[h]] - dims[final[h]]) for h in helpers}
+    first, last = {}, {}
+    for index, event in enumerate(records):
+        if event[0] == "ADD":
+            first.setdefault(event[2], index)
+            last[event[2]] = index
+    require(helpers <= first.keys(), "every helper has a first read")
+    rows = [1 << i for i in range(width)]
+    state = list(start)
+    queries, eligible, early_cross = [], [], []
+    early = {h: [] for h in helpers}
+    paid = Counter()
+    for index, event in enumerate(records):
+        op, dest = event[:2]
+        require(0 <= dest < width, "destination range")
+        if op == "ADD":
+            _, _, src, frame = event
+            require(0 <= src < width and src != dest, "ADD operands")
+            require(state[dest] == state[src] == frame, "ADD frame")
+            rows[dest] ^= rows[src]
+        elif op in ("ERASE", "INIT"):
+            require(dest in owned, "reset of public input")
+            if op == "ERASE":
+                rows[dest] = 0
+            state[dest] = event[2]
+        elif op in ("Q", "ZERO_Q"):
+            _, _, src_frame, dst_frame, rank = event
+            require(state[dest] == src_frame, "query frame")
+            require(abs(dims[src_frame] - dims[dst_frame]) == rank, "query rank")
+            if op == "ZERO_Q":
+                require(rows[dest] == 0, "nonzero free query")
+            else:
+                row = rows[dest]
+                require(row != 0 and not row & owned_mask, "query input support")
+                paid[rank] += 1
+                before_read = dest in helpers and index < first[dest]
+                query = (index, dest, rank, row)
+                queries.append(query)
+                if before_read:
+                    early[dest].append((index, rank))
+                support = row & helper_mask
+                # If dest is not captured, its early query can still vanish
+                # through ANOTHER captured helper. Keep those queries here.
+                if support and (not before_read or support & ~(1 << dest)):
+                    eligible.append(query)
+                    if before_read:
+                        early_cross.append(index)
+            state[dest] = dst_frame
+        else:
+            raise ValueError("unknown event: " + op)
+    require(state == final, "final frames")
+    require(dict(sorted(paid.items())) ==
+            {int(k): v for k, v in expected["stats"]["paid"].items()}, "paid profile")
+    require(Counter(targets.values()) == {8: 413, 4: 2}, "target inventory")
+    partial = {h for h in helpers if targets[h] == 4}
+    require(partial == {465, 684}, "partial helpers")
+    require(all(len(q) <= 1 and all(rank in (1, 2) for _, rank in q)
+                for q in early.values()), "early-query tariff")
+    require(all(not early[h] for h in partial), "partial early-query tariff")
+    require(not any(h in helpers and i > last[h] for i, h, _, _ in queries),
+            "no unpriced post-last-read query")
+    free_two = {h for h in helpers if early[h] and early[h][0][1] == 2}
+    vectors = sorted({row for _, _, _, row in eligible})
+    ids = {row: i for i, row in enumerate(vectors)}
+    multiplicities = Counter()
+    for _, _, rank, row in eligible:
+        multiplicities[ids[row]] += TOKENS[rank]
+    return dict(word=word, helpers=helpers, targets=targets, first=first,
+                early=early, partial=partial, free_two=free_two, vectors=vectors,
+                multiplicities=multiplicities, queries=queries, eligible=eligible,
+                early_cross=early_cross, final_rows=rows, paid=paid)
+
+
+def independent(rows, low=False):
+    basis = {}
+    for value in rows:
+        while value:
+            pivot = (value & -value).bit_length() - 1 if low else value.bit_length() - 1
+            if pivot not in basis:
+                basis[pivot] = value
+                break
+            value ^= basis[pivot]
+        else:
+            return False
+    return True
+
+
+def check_partition(data, certificate):
+    require(certificate["schema"] == "g20-first-read-flag-partition/v1", "certificate schema")
+    limits = certificate["limits"]
+    require(limits == [64, 92, 108], "flag capacities")
+    groups = certificate["groups"]
+    require(len(groups) == limits[2], "color count")
+    vectors = data["vectors"]
+    partial_mask = sum(1 << h for h in data["partial"])
+    two_mask = sum(1 << h for h in data["free_two"])
+    seen = Counter()
+    for i, group in enumerate(groups):
+        require(all(type(x) is int and 0 <= x < len(vectors) for x in group), "row ID")
+        require(len(group) == len(set(group)), "duplicate in color")
+        rows = [vectors[x] for x in group]
+        if i >= limits[0]:
+            require(all(not row & partial_mask for row in rows), "partial flag")
+        if i >= limits[1]:
+            require(all(not row & two_mask for row in rows), "rank-two flag")
+        require(independent(rows) and independent(rows, low=True), "dependent color")
+        seen.update(group)
+    require(seen == data["multiplicities"], "complete token coverage")
+    return [len(group) for group in groups]
+
+
+def power_bounds():
+    # Integer powers prove all inequalities on the full 99/100 <= t <= 1
+    # interval, by monotonicity. No floating-point acceptance decision.
+    for r in (1, 2, 3):
+        require(r**99 * 64**100 <= 4**99 * TOKENS[r]**100, "rank token envelope")
+    require(all(TOKENS[r] * 4 == 64 * r for r in (4, 5, 6)), "large-rank envelope")
+    require(2**99 * 64**100 > 127**100, "lower 2^t")
+    require(4**99 * 33**100 > 128**100, "upper 4^-t")
+    require(2**99 * 65**100 > 128**100, "upper 2^-t")
+    # The 108-color bound has uniform positive full-helper margins:
+    require(127 * 2 - 92 * 2 - 65 == 5, "rank-two strict margin")
+    require(127 * 2 - 108 * 2 - 33 == 5, "other strict margin")
+
+
+def read_certificate():
+    return json.loads(gzip.decompress((HERE / "PARTITION.json.gz").read_bytes()))
diff --git a/research/g20-joint-capture-flag-bound/verify.py b/research/g20-joint-capture-flag-bound/verify.py
new file mode 100644
index 0000000000..38a61034d0
--- /dev/null
+++ b/research/g20-joint-capture-flag-bound/verify.py
@@ -0,0 +1,187 @@
+#!/usr/bin/env python3
+"""Exact certificate, independent set replay and failure controls.
+
+Jerry Chen (@CubeJerry), with OpenAI Codex assistance. Apache-2.0.
+"""
+import copy
+import hashlib
+import importlib.util
+import json
+from pathlib import Path
+import random
+
+# Explicit sibling load works under -I and in an exported, Git-free package.
+HERE = Path(__file__).resolve().parent
+SPEC = importlib.util.spec_from_file_location("g20_flag_model", HERE / "model.py")
+model = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(model)
+require = model.require
+
+
+def set_replay(word):
+    """Separate representation: literal sets, not integer row arithmetic."""
+    rows = [{i} for i in range(len(word["start"]))]
+    queries = []
+    for index, event in enumerate(word["records"]):
+        op, dest = event[:2]
+        if op == "ADD":
+            rows[dest] = rows[dest].symmetric_difference(rows[event[2]])
+        elif op == "ERASE":
+            rows[dest] = set()
+        elif op == "Q":
+            queries.append((index, dest, event[-1], frozenset(rows[dest])))
+        elif op == "ZERO_Q":
+            require(not rows[dest], "set replay nonzero free query")
+    return queries
+
+
+def apply_map(row, mapping):
+    out = 0
+    while row:
+        bit = row & -row
+        out ^= mapping[bit.bit_length() - 1]
+        row ^= bit
+    return out
+
+
+def substitution_fixture(data, captured, payloads):
+    """Direct held-zero replay versus one triangular entry substitution.
+
+    These finite fixtures exercise the lemma; PROOF.md gives its argument
+    for every subset and every native-linear payload.
+    """
+    width = len(data["word"]["start"])
+    owned = set(data["word"]["owned"])
+    base = [0 if i in owned else 1 << i for i in range(width)]
+    mapping = [0 if i in captured or i in owned else 1 << i for i in range(width)]
+    dynamic = list(mapping)
+    pending = set(captured)
+    for index, event in enumerate(data["word"]["records"]):
+        op, dest = event[:2]
+        if op == "ADD" and event[2] in pending:
+            h = event[2]
+            require(index == data["first"][h], "capture epoch")
+            require(base[h] & (1 << h), "unit unread diagonal")
+            require(not base[h] & sum(1 << j for j in pending - {h}),
+                    "unread triangularity")
+            mapping[h] = payloads[h] ^ apply_map(base[h] ^ (1 << h), mapping)
+            dynamic[h] = payloads[h]
+            pending.remove(h)
+        if op == "ADD":
+            base[dest] ^= base[event[2]]
+            if dest not in pending:
+                dynamic[dest] ^= dynamic[event[2]]
+        elif op == "ERASE":
+            base[dest] = dynamic[dest] = 0
+        if dest not in pending:
+            require(dynamic[dest] == apply_map(base[dest], mapping),
+                    "first-read substitution identity")
+    require(not pending, "all captures executed")
+    mask = sum(1 << h for h in captured)
+    require(all(not mapping[h] & mask for h in captured), "graph-kernel projection")
+
+
+def rejected(label, operation, expected):
+    try:
+        operation()
+    except ValueError as error:
+        require(expected in str(error), "wrong rejection for " + label)
+        return label
+    raise ValueError("negative control accepted: " + label)
+
+
+def controls(data, certificate, frames, local):
+    names = []
+    bad = copy.deepcopy(certificate)
+    bad["groups"][0].pop()
+    names.append(rejected("omitted token", lambda: model.check_partition(data, bad),
+                          "complete token coverage"))
+    bad = copy.deepcopy(certificate)
+    bad["groups"][0].append(bad["groups"][0][0])
+    names.append(rejected("duplicate token in color", lambda: model.check_partition(data, bad),
+                          "duplicate in color"))
+    bad = copy.deepcopy(certificate)
+    absent = next(i for i in range(len(data["vectors"])) if i not in bad["groups"][0])
+    bad["groups"][0].append(absent)
+    names.append(rejected("distinct dependent row", lambda: model.check_partition(data, bad),
+                          "dependent color"))
+    for name, index, mask, reason in (
+        ("partial helper in restricted color", 64,
+         sum(1 << h for h in data["partial"]), "partial flag"),
+        ("rank-two helper in restricted color", 92,
+         sum(1 << h for h in data["free_two"]), "rank-two flag"),
+    ):
+        bad = copy.deepcopy(certificate)
+        row_id = next(i for i, v in enumerate(data["vectors"]) if v & mask and
+                      (index == 64 or not v & sum(1 << h for h in data["partial"])))
+        bad["groups"][index].append(row_id)
+        names.append(rejected(name, lambda: model.check_partition(data, bad), reason))
+    bad_data = dict(data)
+    bad_data["multiplicities"] = data["multiplicities"].copy()
+    _, _, rank, row = next(q for q in data["eligible"] if q[0] == 6291)
+    bad_data["multiplicities"][data["vectors"].index(row)] -= model.TOKENS[rank]
+    names.append(rejected("omit cross-helper early query 6291",
+                          lambda: model.check_partition(bad_data, certificate),
+                          "complete token coverage"))
+    bad_word = copy.deepcopy(data["word"])
+    first_q = next(e for e in bad_word["records"] if e[0] == "Q")
+    first_q[-1] += 1
+    names.append(rejected("forged query rank", lambda: model.census(bad_word, frames, local),
+                          "query rank"))
+    source = (model.ROOT / model.WORD).read_bytes()
+    damaged = bytes([source[0] ^ 1]) + source[1:]
+    names.append(rejected("changed source bytes", lambda: model.authenticate(
+        damaged, hashlib.sha256(source).hexdigest(), model.WORD), "source hash"))
+    return names
+
+
+def verify():
+    word, frames, local = model.inputs()
+    data = model.census(word, frames, local)
+    expected_sets = [(i, h, r, frozenset(j for j in range(len(word["start"]))
+                                      if row & (1 << j)))
+                     for i, h, r, row in data["queries"]]
+    require(set_replay(word) == expected_sets, "independent set replay")
+    certificate = model.read_certificate()
+    sizes = model.check_partition(data, certificate)
+    model.power_bounds()
+    rng = random.Random(8)
+    helpers = sorted(data["helpers"])
+    cases = [set(), {684}, {465, 684}, {274, 297, 467}, set(data["free_two"]),
+             set(helpers), set(rng.sample(helpers, 32))]
+    for captured in cases:
+        retained = set(range(len(word["start"]))) - captured - set(word["owned"])
+        mask = sum(1 << h for h in retained)
+        payloads = {h: rng.getrandbits(len(word["start"])) & mask for h in sorted(captured)}
+        substitution_fixture(data, captured, payloads)
+    names = controls(data, certificate, frames, local)
+    query_bytes = json.dumps([(i, h, r, hex(v)) for i, h, r, v in data["queries"]],
+                            separators=(",", ":")).encode()
+    result = {
+        "status": "PASS_G20_ALL_SUBSET_FIRST_READ_FLAG_BOUND",
+        "wire_count": len(word["start"]), "event_count": len(word["records"]),
+        "helper_count": len(helpers), "full_helpers": 413, "partial_helpers": [465, 684],
+        "rank_two_early_helpers": len(data["free_two"]),
+        "paid_profile": {str(k): v for k, v in sorted(data["paid"].items())},
+        "query_count": len(data["queries"]), "eligible_queries": len(data["eligible"]),
+        "distinct_rows": len(data["vectors"]), "tokens": sum(sizes),
+        "color_limits": certificate["limits"], "color_sizes": sizes,
+        "cross_helper_early_queries": data["early_cross"],
+        "query_rows_sha256": hashlib.sha256(query_bytes).hexdigest(),
+        "t_interval": ["99/100", "1"], "full_helper_loss_lower_bound": "(5/128)*4^t",
+        "substitution_fixtures": len(cases), "negative_controls": names,
+        "kappa_change": False,
+    }
+    return result
+
+
+def main():
+    result = verify()
+    expected = json.loads((HERE / "RESULT.json").read_text())
+    require(result == expected, "recorded result mismatch")
+    print(result["status"])
+    print("415 helpers; 2216 queries; 64274 tokens; 108 colors; 8 rejected controls")
+
+
+if __name__ == "__main__":
+    main()