Audit: mutant coverage of the selected T16 controller/owner audit (no gap found, no new kappa)

[JosieElliston]

Adversarial audit (card supplier-boundary-audit, scope refined), with no κ, certificate, supplier or frontier change. Josie Elliston (JosieElliston), with Claude Code (Claude Opus 5.5) assistance, in a donated session.

Base 0b1cccf86e2f5132ed286a26ef0a681a495740ea; selected record SHA-256 10b9e340…. Chooser nonce 5f419d173f49750373ab915c29fb04d7, priority revision 3. Branch research/t16-audit-coverage-s28, head 6e66ea56. Claim: #1166 (comment)

Question

The selected record's only post-#1042 stage, research/complex-t16-rare-pattern-exchanges/verify.py, runs the frozen PR1087 code/audit_allcold.py (SHA-256 1467a2ac…) through verify_t16.py, with 15 mutation controls. Which of the audit's acceptance predicates do those controls actually reach? For each predicate they miss, is a targeted semantic mutant rejected?

Package research/t16-audit-mutant-coverage/

verify.py is stdlib only and takes about 70 s. The fixture is the selected hosted template archived in research/community-frontier1094-audit/selected-replay.tar.gz, so no cold run is needed. The pinned audit runs unchanged and in-process. The harness executes the shipped control block verbatim, with only def reject renamed, and records the audit_allcold.py line that rejects each mutant.

Mutant set	Count	Rejected	Accepted	Further lines with an assert reached first
Shipped controls	15	15	0	8 of 42
New targeted semantic mutants	35	34	1	20
One-field template census	111	92	19	6

• Positive control. The in-process audit reproduces every field of the archived selected ASYNC-AUDIT.json except the two mutation-run fields.
• Shipped controls are concentrated. Four of the 15 are rejected first by line 94 (the whole provider-registry equality). Three are rejected by line 152 and three by line 159.
• First exercised here. Each of these is rejected at the intended assertion:
  • the idle window from both sides (line 156);
  • the wrong side of the idle pair, and a helper past the child's rank (line 156);
  • overlapping axis cells across calls (line 163);
  • a gap in the pending prefix (line 178);
  • schedule list order and retiming (lines 114, 121, 122 and 129);
  • pooled-slot count, key and field binding (lines 169 to 173).
• Accepted: 19 path mutations.
  • Pooled-slot time: line 172 omits it, so the audit alone accepts changed times.
  • 15 fields audit() never reads, such as cover, m, version, port_restriction, replica_lift, hosting.owner_map_sha256 and hosting.rule. A text search of the PR1087 archive and the maintainer frontier1094 scripts finds no reader of these in the hosted template after emit.
  • Three partial checks: appended text in loop_order (only one sentence is required), and an extra key in hosting or in async_schedule.
• A cross-stage link that no selected stage checks. The audit checks the hosted template, while lift16, independent-t16 and the maintainer composition (PR1091 auditor) check the frozen data/OWNERS.json.gz. The verifier checks that the template's pooled_slots is exactly that owner list: 69,120 roles, with time fields included. It also checks that owner_map_sha256 names the list's gzip. Both hold.
• Unreachable by template-only mutation. Eight of the 42 lines with an assert cannot be reached this way, each for a stated reason. Three depend only on base inputs, and five are implied by earlier assertions or by construction.

Outcome: no missing implication was found for the selected fixture. This is line coverage: a line with a compound condition, such as 94, 152 or 156, does not get one mutant per conjunct. The audit alone would accept changed pooled times. The fixture-level owner binding is a separate check in verify.py.

Checks

• python3 -B research/t16-audit-mutant-coverage/verify.py: EXPECTED.json is byte-identical on CPython 3.10.21, 3.12.14 and 3.14.7 (macOS arm64).
• python3.12 scripts/research_package.py --package research/t16-audit-mutant-coverage, both the check and the replay, passes.
• The 42 research unit tests pass.
• An independent read-only Codex review found no outcome-changing discrepancy in the shipped-control wrapper, the line attribution, the new mutants or the eight unreachable-line claims. Its must-fix (line totals) and two should-fixes (narrower "no reader" wording, separating the fixture binding from what audit() implies) are applied.

Not checked:

• mutations of base inputs (DATA-PHASES, providers, parent);
• the module-level provider checks;
• the invoice, assembly and indep16 stages;
• the Conditional κ = 0.001672188119205421: improved T16 owner packing on the seven-slot k8 word #1042 ancestry;
• Linux or Windows;
• a cold make frontier1094-verify.

Open next questions

1. The same receipt for the nine other audit_allcold.py hashes in the repository (PR1939's handoff).
2. A successor driver binding template pooled_slots to OWNERS.json.gz. This needs a maintainer decision, because the frozen code stays unchanged.
3. Mutation testing for invoice_allcold.py, which carries the prefix and row inequalities and has no mutation-control block of its own.

Credit

• Audited checker: the PR1087 archive's code/, byte-identical to Jeremy Kothe's Conditional κ = 0.001661956299899884: PR858's sixteen-replica owner controller on the U8 word #870 code. Its docstring credits OpenAI Codex, and it includes the T16 edits from Hao Yan's (@FanPUYen) Research: T16 owner concentration raises conditional κ to 0.001661642255531641 #858.
• Selected exchanges and run: Rohan Arun's Conditional kappa 0.001672660197076918: rare-pattern T16 exchanges #1094, with the run archived by the maintainer's frontier1094 audit.
• Copy-cost observation: jackmgaller's PR1939. The harness copies by marshal, following it.
• Interpreter stability of the stage: session 26's PR1824.
• Independent OWNERS recount: PR1091.

🤖 Generated with Claude Code

[Mister-Meeseeks]

Batch review at 6e66ea56138d21c65c0a71c7f5622b9a8b989767.

Merged to main, preserving the original contributor commits and package attribution.

Reviewed scope: Adversarial audit of the pinned T16 checker reproduces its selected receipt, tests shipped and new mutants and binds the template owner list including times to frozen OWNERS. Acceptance of descriptive fields and pooled times by that checker alone is documented; this is selected-fixture coverage, not a cold replay or universal validator proof.

The pinned scoped command passed; the batch ledger contains its command, input hashes, environment and log. This incorporates the research/tooling contribution and does not change the selected κ or discharge the inherited multiplication-theorem assumptions.

Batch review, attribution and evidence. Thank you for the contribution.