Audit selected T16 invoice input and caller boundaries

[Tairitsu-Aya]

The selected T16 invoice has no producer-input mutation block of its own. This follows Josie Elliston's explicit handoff in #1959 by adding a scoped, source-pinned audit of the unchanged PR1087 invoice_allcold.run(), its actual assembly consumer, and selected upstream checks.

The 54 real-file cases produce 28 invoice rejections and 26 survivors; actual assembly rejects another 16. The ten remaining cases are classified explicitly: four changed templates are rejected by the original upstream controller, two control-run flags by the isolated original final-binding assertion, two are unread controller metadata, and two are conservative retained allowances whose changed bytes violate the selected upstream pin. This is not a complete-chain acceptance bug or a new bound.

The useful finite boundary evidence is input-driven: a 511-bit prefix passes invoice while 512/513 are rejected; row 20159 passes while 20161 fails; adjacent logical allowances straddle the exact gate; and a mass-preserving rank-52 mutation fails halving. A quantified argument, with exact integer bound checks, explains why five other finite guards follow under explicit positivity, row and logical hypotheses. The four controller-rejected template survivors also show why the numerical invoice alone is insufficient to admit arbitrary bridge or owner semantics.

All changes are in research/t16-invoice-boundary-audit/. The source/fixture archives, selected overlays, retained input and arithmetic engines are pinned. No frozen stage or selected record changes. Each mutant rebinds hashes to actual bytes, crosses the production JSON boundary, and restores the honest fixture. Positive invoice and assembly reproduce the archived evidence before any negative outcome is interpreted. EXPECTED.json records exact rejecting statements and finite quantities; VERIFY.json registers a bounded stdlib replay.

Validation:

• Native Windows CPython 3.12.9 generated the receipt and passed every internal positive/negative control.
• Ubuntu 24.04 CPython 3.12.3 reproduced the identical receipt through scripts/research_package.py: 2m22s on one CPU, peak RSS about 0.90 GiB.
• Package metadata/source pins and git diff --check pass. python -O fails immediately as required.
• The live selected-record SHA-256 still matches the pinned record. A separate complete cold replay is running for the donor session; it is not claimed as this package's validation.

Task: supplier-boundary-audit, refined scope, priority revision 3, seed 0179e3fd0e1708b57ced416ed79676fd; claim #2051. Before submission, the overlap helper refreshed 730 Discussion records and 352 PR file inventories. Its REST PR-body refresh hit an EOF, so a separate live GraphQL gh pr list fetched all 352 open PR bodies; no same current invoice-input task was found. Closed work was checked through local package metadata and the cited predecessors; this is bounded search coverage, not a novelty certificate.

Credit: Josie Elliston's #1959 handoff and jackmgaller's #1939 copy-performance observation; the retained invoice/compiler/moment lineage and T16 construction contributors, including Jeremy Kothe, Hao Yan and Rohan Arun. Prepared for Tairitsu-Aya with substantial OpenAI Codex assistance. No independent human review claimed. Remaining provider-replay and all-size obligations are documented as open next questions.

[Tairitsu-Aya]

The separate complete cold replay has now finished successfully:

PASS_COMPLETE_PR1094_COMPOSITION 0.001672660197076918

It ran scripts/verify_frontier1094.py --work <fresh external directory> without --baseline1042 or any published-receipt reuse. The returned receipt states reused_completed_baseline: false; historical source, the complete #1042/#799/bit ancestry, and the selected rare-pattern exchange stage all returned exit code 0. Selected κ is 836330098538459/500000000000000000.

Environment: Ubuntu 24.04 under WSL, CPython 3.12.3, g++, local Boost 1.83 headers, numpy 2.5.4, scipy 1.18.1, sympy 1.14.0 and mpmath 1.3.0. The source base was e112d71c8d7bb32435debcc54df932593dd8223a; this PR only adds its separate research directory. The replay's orchestration script hashes are recorded by the standard receipt (verify_frontier1042.py: 700fdcaeb6e8f57f6e63c71c2dd1652fc5b183e8d706cd092779bdc0d271e854; selected package verifier: b8c2f76b305c5c9ceb42df203deef564857d17f1f8182d0745dda9ab96e3d4de).

Observed wall time: 2042.142 seconds; sampled peak aggregate process-group RSS: 1,999,646,720 bytes; output size: 131,993,159 bytes. The worker group was restricted to two logical CPUs with a 3 GiB RSS stop threshold and 3.5-hour timeout; neither limit fired. These are machine-specific observations, not resource guarantees.

This additional replay supports the unchanged selected finite composition. It does not turn this input-mutation package into an all-size theorem proof or imply that the deliberately changed supplier fixtures were admitted by the full pipeline.