Research audit: independent owner-map check of all 15 open T16 claims on the seven-slot k8 word (no new kappa)

[JosieElliston]

Status: research audit / independent verification. No new κ. The selected result is unchanged. No counterexample was found.

• Track: 60–74 (adversarial audit), OS-random seed 67
• Base: abdc6a70. PR heads are pinned in SOURCES.json, snapshot 2026-10-13 18:40 UTC.
• Adds: only research/t16-owner-audit-seed67/

Why

Fifteen open PRs claim κ ≈ 0.001672. Each one puts a new frozen sixteen-replica owner map on #1018's seven-slot k8 word. Two parts of these claims already have independent audits:

• Research audit: independent check of PR1005/1018 mutable-leaver cells (no new kappa) #1049 audits the local word.
• Independent verification: code-disjoint pricing of all 16 pending kappa claims; every one has deficit W - 64N (no new kappa) #1069 and Independent verification: code-disjoint T37 moment endpoints and kappa reduction (no new kappa) #1051 audit the arithmetic from the committed profile to κ.

The step in between had no independent check: is each frozen OWNERS.json.gz a legal whole-helper hosting that yields the claimed idle profile? Until now it was checked only by lift16.py and indep16.py. Both are #858's code with generic-R edits, and both ship inside the audited packages.

What was checked

A new standard-library verifier re-implements the hosting rules of research/complex-double-replica-owners/PROOF.md from that text. It imports and runs nothing from the audited packages. Owner maps, plans and specs are read as git blobs at pinned ids. The verifier has three other inputs:

• Source-event stream: main's vendored ROUND20 parent template.
• Idle-child pending axes: main's PR558 DATA-PHASES.json.
• Helper widths: derived as span(final) − span(start) from the seven-slot word c2b29430…. The file is copied from Research audit: independent check of PR1005/1018 mutable-leaver cells (no new kappa) #1049, and its content hash equals Conditional κ = 0.00167166528321877: seven triangle-hybrid slots (PR987 search) on the k8 leaver word #1018's pin.

Each role is checked against these rules:

• R1: 144 invocations in the two-group interleave, with each replica's 30 source events in order.
• R2: each invocation hosts helpers 0..479 exactly once, each at the width derived from the word.
• R3: the physical family identity holds, the family is in the live namespace, and it is not the caller's active pair.
• R4: each family hosts at most one helper per invocation.
• R5: the invocation lies strictly inside the owner's actual window. The window is rebuilt from events and runs from the last local or bridge touch of the pair to the idle sweep.
• R6: slices are within capacity, disjoint, and form a prefix.
• R7: the idle remainders and the full profile are recounted and compared with SPEC, PLAN and RESULT. The deficit must be 5120 and the halving guard must hold.

Two checks go beyond the audited checkers:

• X1: the rebuilt windows must equal each package's committed PLAN windows, including all time lists. The same builder must also reproduce the T8 PLAN.
• X2: distinct idle children of one physical family must have disjoint pending axes. This is load-bearing: in each map, about 8,400 of the roughly 11,800 host families hold slices of two or more children.

Result

All 15 maps pass: #1022, #1028, #1031, #1042, #1050, #1053, #1055, #1056, #1061, #1063, #1065, #1068, #1074, #1082 and #1087. The shared #1018 T8 map also passes. That is 1,036,800 T16 roles plus 34,560 T8 roles. Every recounted idle profile and full profile equals the committed claim, and every rank mass is 1,041,408 = 73·14,336 − 5,120. The per-PR table is in the README.

Combined with #1049 (local word) and #1069 (pricing), the chain from frozen owner data to κ has now been checked with independently written code. The inherited interfaces in that chain remain unaudited.

Negative controls

There are 11 controls, run on #1074. Each must be rejected by the rule it targets:

• dropped role (R1)
• narrowed width (R2)
• duplicated helper (R2)
• private-namespace family (R3)
• consistent role on the caller's active pair (R3)
• two helpers on one family in one invocation (R4)
• role moved past its owner's idle sweep (R5)
• overlapping slices (R6)
• prefix gap (R6)
• tampered claimed idle profile (R7)
• truncated committed PLAN window (X1)

Reproduce

python3 -I -B research/t16-owner-audit-seed67/verify.py --fetch

This takes about 4 s plus the fetch of 15 PR refs. The receipt is compared byte for byte with RESULT.json. Expected last line:

PASS_INDEPENDENT_T16_OWNER_AUDIT claims=15 roles=1036800 t8_roles=34560 controls=11

The command passed on macOS with CPython 3.14.7, both in the worktree and in a fresh clone with --fetch. scripts/verify_selected_result.py passes. No repository-wide make verify was run, because no existing file changes.

Reviewer note (not a defect)

In the jeremykothe2 gauge44-slots-t16 packages, evidence/local, evidence/global and evidence/audit are byte-identical to #645's R = 492 files. Their OWNERS-AND-PROFILE.json reports 35,424 roles and deficit 2,560. The inherited README's line 116 says these are historical. However, its later "Proof and evidence" list still describes evidence/audit/ as the actual controller and invoice. The only committed T16-specific receipt is RESULT.json.

Scope

This PR covers owner admission and the idle-remainder recount only. It does not cover:

• the 73-axis chart and route step;
• the emitted controller;
• invoices and prefix/row reserves;
• moments and the outer assembly;
• the local word's admission;
• any inherited assumption: all-size/compiler, common-label/mutable-source realization, whole-invocation hosting, precision/tape, analytic, or PR589 bit H1–H5.

The window semantics are #858's and are not re-proved here. This is a finite check of stated rules on stated files.

Credit and disclosure

• Owner maps: Jeremy Kothe (Conditional κ = 0.001672081255752945: sixteen-replica owner controller on the seven-slot k8 word #1022–Conditional κ = 0.001672651218919025: improved T16 owner packing on the seven-slot k8 word #1074, Conditional κ = 0.001672654541898561: improved T16 owner packing on the seven-slot k8 word #1087) and Rohan Arun (Conditional kappa 0.001672267698427438: whole-helper exchanges on the T16 owner map #1056, Conditional kappa 0.001672285678298543: neutral T16 reshuffles and whole-helper exchanges #1063, Conditional kappa 0.001672653061493085: targeted T16 whole-helper repacking #1082).
• Controller, window semantics and rules: Hao Yan's Research: T16 owner concentration raises conditional κ to 0.001661642255531641 #858, with Conditional κ = 0.001661956299899884: PR858's sixteen-replica owner controller on the U8 word #870's adaptation.
• Word: Conditional κ = 0.00167166528321877: seven triangle-hybrid slots (PR987 search) on the k8 leaver word #1018, built on rohanarun's Conditional κ = 0.001662039077758742 — U10 (two new triangle-hybrid slots) on PR942's T37 owners #987, Conditional κ = 0.001671387264390146: all eight mutable-leaver all-K cells, U8 hybrids and frame re-optimisation on PR799's word #1005, NewBArch's Conditional κ = 0.001661948695165034: eight triangle-hybrid B deliveries in block 0 on PR799's word #869 and the Gauge44 factory and whole-family assignment for conditional κ = 0.001649483702558979 #645/Conditional κ = 0.001660339298410333: four entrance promotions and 72 cold ends #685/Conditional κ = 0.001661202643272239: eight B-frame coalescences after SW4 #741 lineage.
• Pinned word file: copied unchanged from Sagar Thakrar's Research audit: independent check of PR1005/1018 mutable-leaver cells (no new kappa) #1049 under Apache-2.0.

Prepared by Josie Elliston with substantial assistance from Anthropic Claude (Claude Code).

🤖 Generated with Claude Code