Tooling: exact frame solver and delivery-rewrite search for gauge44/k8 local words (no new κ)

[mdumitrean]

Summary

Adds research/exact-frame-toolkit/: the search and admission tools behind the companion construction PR #1195 (two
source-holder fusions on #1148's joint-entrance k8 word). No new κ. No selected record, upstream file or existing package is modified.

Revision 2 (2026-10-14) answers the review continuation point
(comment). It also fixes two harness
screen gaps. Details are in the README sections What is certified and Revision 2.

Revision 3 (2026-10-14) makes the toolkit run on Windows, answering woklerx's independent audit
(comment). The platform-dependent
pieces move into compat.py, portability.py checks the Windows code paths on any OS, and the toolkit refuses -O.
frames.py is unchanged. Results are in PORTABILITY.json and the README section Revision 3.

• Frame solver (frames.py). Each solve carries two per-instance certificates:

  • exact optimality for the floored integer surrogate weights floor(2^40 · lo_r(b));
  • with interval=True, a rigorous rational interval for the true per-call moment at b over every assignment of the frame
    model.

  The interval's lower end is a chain-dual (or exact-elimination) bound with outward-floored weights on a 2^-224 grid, plus
  a λ·rank shift that telescopes along every register chain. Its upper end is the engines' upper bound of the returned
  assignment. L/U domain propagation, chain dual decomposition and exact elimination; models monotone chains, target caps,
  cut equality, mutable early tails, and audit_local's helper cones as caps (model.py).

• Pricing harness (harness.py): build_tri-style edits (B deletes/inserts, early tails, FULL prepends). Screens, in order:

  1. the auditor's static program rules;
  2. the B+tail+prepend map mod p;
  3. an exact check that the derived compensation is unchanged;
  4. frames.

  Every negative delta and every returned word is re-checked by the unchanged audit_local.py. With interval=True it also
  returns the true realized delta (realized_delta_units) and a bound on any possible true gain (max_gain_units).

• Searches: read-fusion candidates (fusion.py), joint triangle-hybrid candidates (joint.py), and the multiprocess
  fusion + enlarged-reader repair sweep (repair.py --interval, sites.py).

• Composition: split a slot recipe and price its instances (slots.py); compose slots with fusions (compose.py); put a
  newer word's entrances and ends onto a scalar program and re-solve (transplant.py).

• Exact κ (kappa.py): the certified moment root and the retained 47-constraint outer assembly with PR589, for any T.

• Admission drivers that reuse unchanged package engines: PR635 native chain (native.py), PLAN/SPEC rebinding with
  unchanged widths (rebind.py), unpin.py between discovery and freeze_spec.py, the T16 discovery run
  (t16_discover.py), and per-site negative controls (controls.py).

Pure Python 3.11+ with NumPy, on Linux, macOS and Windows; no C++, Boost, LP/MILP solver or network. Do not run it with
-O: its asserts are checks, so it refuses to start.

Check

python -B research/exact-frame-toolkit/selftest.py      # about 50 s here (Python 3.12 and 3.14); --quick about 25 s
python -B research/exact-frame-toolkit/portability.py   # the Windows code paths on any OS, then the selftest

On a GitHub Actions Windows runner (Windows Server 2025, Python 3.12.10, NumPy 2.5.4) the full selftest and the portability check pass, -O is refused, and the
spawn-mode repair.py --interval sweep of the pre-slot word matches the macOS sweep in all 2,405 records
(run).

It uses only files on main:

• the retained Conditional κ = 0.001672188119205421: improved T16 owner packing on the seven-slot k8 word #1042/Conditional kappa 0.001672660197076918: rare-pattern T16 exchanges #1094 replay archives;
• Conditional kappa 0.001672660197076918: rare-pattern T16 exchanges #1094's REPLAY.json;
• Conditional κ = 0.001661960547713947: T37 whole-owner packing and all-T bound #942's checkpoint and the ASSEMBLY.json it names.

Check	Result
kappa.py on #1094's (T16) and #942's (T37) complex profiles	the selected and checkpoint κ, exactly
surrogate frame optimum of the seven-slot k8 word c2b29430	its published profile (integer certificate)
true-moment interval of that word at b	published frames within 1.48e-11 units of the minimum over the frame model; the surrogate alone bounds this only by 1512 units
control: deliberately worse assignment	interval width = its exact true excess (6763.29 units)
control: exact dual with multipliers of magnitude 2^62–2^90, then a NaN	still a lower bound in Python integers; NaN rejected
control: port written at the end of B, undone in the first early tail	passes the B+tail screen; harness compensation-changed; audit_local endpoint failure
#1018's seven slots on the pre-slot word db2c7cfb	−1788 surrogate units each, −12516 together; certified true gains of −1784.83 each, −12493.80 together
source-holder fusion + full read-set exchange at slot sites X=439, X=444	−3957 each
five slots + both fusions	−16854; audit_local PASS; unchanged interfaces; κ 0.001672756914849856 on #1094's owners

exchange.py also regenerates the published SW4 word from the promoted word, as a self-check of the exchange family.

Usage

The README covers the modules, a workflow (price → search → compose/transplant → admit), and the model and pitfalls, e.g.:

• the unpin step that freeze_spec.py needs after a word change;
• emit_allcold.py reading SPEC.data.plan_sha256 directly;
• evidence/local in the gauge44 T16 packages being historical Gauge44 factory and whole-family assignment for conditional κ = 0.001649483702558979 #645 files.

On the pre-slot k8 word, repair.py --workers 6 sweeps 2,405 fusions in about 6 minutes; the only negative surrogate
deltas are the two sites above. With --interval (about 8 minutes), no other priced candidate can gain more than 3.3e-11
units at b. REVISION2-REGRESSION.json compares both revisions on this sweep.

Scope

Search output is nomination data. A construction exists only after the unchanged package chain admits it, as in #1195.

The certificates are per-instance statements at the stated endpoint b. Neither the global recursive moment root nor κ is
inferred from cost units: both are recomputed by kappa.py and the package chains.

The inherited all-size compiler, common-label/mutable-source realization, whole-call hosting, precision/tape,
analytic-transfer and bit H1–H5 assumptions remain. This is not a formal proof of the multiplication theorem.

Attribution

Imports or ports, unchanged in substance, the following (credits in NOTICE.md):

• chafreaky's frame-domain model and engines;
• the k492/multicold moment and outer engines;
• icekylinx's Gauge44 factory and whole-family assignment for conditional κ = 0.001649483702558979 #645 audit_local.py;
• Tekalign's independent recount;
• BRoute's SW4 exchange;
• NewBArch's Conditional κ = 0.001661948695165034: eight triangle-hybrid B deliveries in block 0 on PR799's word #869 build_tri semantics;
• Rohan Arun's Conditional κ = 0.001662039077758742 — U10 (two new triangle-hybrid slots) on PR942's T37 owners #987 slot search and the Conditional κ = 0.00167166528321877: seven triangle-hybrid slots (PR987 search) on the k8 leaver word #1018 recipe (Jeremy Kothe, MineB);
• PR635's native chain;
• Hao Yan's Research: T16 owner concentration raises conditional κ to 0.001661642255531641 #858 T16 package.

Revision 2 follows the maintainer's review (Mister-Meeseeks). Revision 3 follows woklerx's independent audit.

Prepared by Marius-Paul Dumitrean with substantial AI assistance (Anthropic Claude, via Claude Code). Apache-2.0.

[Mister-Meeseeks]

100-PR batch review at 9254a3cc610a72e9c4600da089d5cdbcab996b9c.

This remains open after scoped triage. Next review step: The frame certificate optimizes floored, scaled integer lower-bound costs. Qualify minimum true recursive moment claims or supply an interval-separation proof; also certify bounds before float64/int64 conversion in the exact dual path. Selftest alone cannot establish those general claims.

This is a specific continuation point, not a rejection or a request to redo already recorded checks. Completed local evidence is retained separately from outstanding whole-head obligations.

Batch review, attribution and evidence. Thank you for the contribution.

[mdumitrean]

Revision 2 is pushed (3855fd41) for the continuation point above. Thank you for the review.

Optimality claims: qualified, and backed by an interval-separation certificate. frames.moment_interval
(optimal_frames(..., interval=True)) proves a rational interval for the minimum of the true per-call moment at b,
Σ_e T_rank(e)(b), over every assignment of the frame model.

• Lower end: a chain-dual (or exact-elimination) bound with outward-floored weights floor(2^224·(lo_r − λr)), computed in
  Python integers, plus λ·(total rank). Ranks telescope along every register chain, so the shift adds the same constant to
  every assignment.
• Upper end: the engines' upper bound of the returned assignment.
• On the seven-slot word c2b29430 the width is 1.48e-11 cost units. The integer certificate alone bounds it only by 1512
  units.

The README now separates the two statements. It also says the claims hold per instance, not in general, and that neither the
global root nor κ is ever inferred from cost units.

Bounds before conversion.

• Costs checks that every weight is below 2^53 before building the float64 image.
• dual_bound_exact takes unary and edge costs from the integer tables and works only in Python integers.
• Multipliers are converted exactly (Fraction(float)) after a finiteness check. No int64 casts remain.
• A selftest control uses multipliers of magnitude 2^62–2^90 (still a lower bound) and a NaN (rejected).

Surrogate vs true deltas. A #1018 slot is −1788 surrogate units but −1784.83 true units; all seven slots are −12516 vs
−12493.80. Several earlier negative sweeps used the surrogate: #1195 and #1337 (mine), #1288 and #1338, and #620 §9. For
those, gains below the rounding of the compared profiles remain open; this is listed under Open next questions.
repair.py --interval re-certifies such a sweep: on the pre-slot word, no candidate without a surrogate gain can gain more
than 3.3e-11 units.

Two harness screen gaps, also fixed. Neither could admit a false construction, since audit_local and the package chains
check the whole program; both could make a search list an invalid program as ok.

1. A port written in B and undone in an early tail passes the B+tail map screen but changes the derived compensation
   (7208 → 7209 gates on c2b29430). Revision 1 priced it ok (+6763), and audit_local fails it with an endpoint
   failure. It is now compensation-changed.
2. The auditor's static program rules were not applied. On the pre-slot sweep, nine neutral fusions were counted as
   feasible although audit_local rejects them ("non-target reads target"). They are now rule: rejections.

Every negative delta and every returned word is now re-run through audit_local.

Evidence.

• selftest.py passes on Python 3.12.13 / numpy 2.5.4 and on Python 3.14.7, in about 50 s, with every revision-1 value
  unchanged.
• REVISION2-REGRESSION.json records the side-by-side repair.py sweep:
  • the same two −3957 gains;
  • the same 3763 evaluations;
  • 1009 vs 1000 feasible fusions, where the nine differences are the audit-rejected programs above.
• The README now names every main-branch input of the selftest. That includes the ASSEMBLY.json that frontier942.json
  points to, which the isolated fixture run lacked.

Prepared with substantial AI assistance (Claude Code).

[woklerx]

Cross-check exact frame optimization and dual bounds against exhaustive small models

Intentional independent review of PR1186 at 3855fd413a3ccfc31988033801b9648c25aee783, starting from main 0b1cccf86e2f5132ed286a26ef0a681a495740ea.

The original exact variable-elimination and chain-dual routines are extracted without edits from the SHA256-pinned frames.py AST. A separate exhaustive oracle enumerates valid assignments over all 16 subspaces of F2^3. Across 60 three-variable chain models, five signed/large cost tables and four domain restrictions, 5,610 feasible assignments agree with the exact optimum and 240 integer dual bounds remain valid, including multipliers of magnitude 2^80. Changing the cancelling multiplier sign produces an invalid lower bound, and NaN multipliers are rejected.

This covers the exact VE and dual core, not graph construction, the true-moment wrapper, every supplier word or floating heuristic convergence. The full upstream selftest cannot run on this Windows host because harness.py imports Unix-only resource. The exact core audit runs on Windows Python 3.12.7 with NumPy 2.2.6; no full upstream pass is claimed.

Reproduce: python -O -B research/frame-solver-independent-audit/audit.py. Source head: 3855fd413a3ccfc31988033801b9648c25aee783.

Marius-Paul Dumitrean, PR1186 revision 2; chafreaky frame-domain model and other authors credited in the original NOTICE. AST execution tests the actual upstream algorithms; the oracle is independent.

Prepared by woklerx with substantial OpenAI Codex assistance.

Exact committed audit artifact. Commit b7f41f7654d6c014723bb9a5f6a3bb8ca2923a8e; base 0b1cccf86e2f5132ed286a26ef0a681a495740ea. Coordinated batch, round 20.

[mdumitrean]

@woklerx thank you for the independent audit. Revision 3 is pushed (c37dfb07) for the gap you found: the selftest
now runs on Windows.

Cause. harness.py imported the Unix-only resource module, and its per-pricing timeout used SIGALRM, which Windows
also lacks. repair.py also forced the fork start method.

Fix. The platform-dependent pieces are now in compat.py:

• the deadline uses SIGALRM on POSIX, and elsewhere a watchdog thread that interrupts the main thread (a real Ctrl+C
  still raises KeyboardInterrupt);
• peak memory is read in the right unit per OS, which also fixes a Linux bug: the 6 GiB worker-recycle flag compared KiB
  as bytes, so it never fired there;
• sweeps use fork where available, else spawn;
• text output is UTF-8 with LF line endings, and subprocesses run without PYTHONOPTIMIZE.

The toolkit also refuses to start under -O now, since its asserts are checks: the outer constraints in kappa.py, the
recount and the archive pins.

Unchanged. frames.py is byte-identical to the revision you audited, so your check of the elimination and dual
routines applies as is. No search result, price, interval or certificate changes.

Checks (PORTABILITY.json):

• Windows (GitHub Actions windows-latest: Windows Server 2025, Python 3.12.10, NumPy 2.5.4;
  run):
  • full selftest PASS, all 14 checks;
  • portability.py PASS;
  • -O refused;
  • repair.py --interval with the spawn start method on the pre-slot word: 2,405 fusions, 1,000 feasible, the same 2
    gains and 3,763 evaluations, largest true-gain bound 3.29e-11 units. All 2,405 records are identical to the macOS
    sweep.
• macOS (Python 3.12 and 3.14):
  • selftest PASS;
  • portability.py PASS: it hides resource and SIGALRM and offers only spawn. Of 300 blocks ending around their
    deadline, 149 timed out, no interrupt leaked, and the SIGINT handler was restored;
  • a spawn-mode sweep identical to revision 2's fork-mode sweep in all 2,405 records.

Prepared with substantial AI assistance (Anthropic Claude, via Claude Code).