Research: audit PR #3128's retained aliases across scatter guards and native COPY counts (no new kappa)

[commdata2338]

Change and mathematical scope

Add research/scatter-alias-native-audit, a bounded independent native-boundary audit of PR #3128's retained-helper aliases on the selected PR #589 bit word. The balanced alias appends helper 480 as retained slot 9 and [8,8,9,9] to scatter row 64. It passes actual legality and all 883 five-stage formal columns with NCOPY=10; the selected NCOPY=9 builds reject it. Its complete local invoice retains the extra rank-seven COPY/ERASE pair and two ADDs: rank mass 5,129→5,136, records 27,234→27,238. Five-stage ADDs rise by ten and fresh copies by five; the 93-bit prefix bound is unchanged.

A new unused-slot positive control leaves scatter rows unchanged. Both real simple-scatter entry points accept it, while the selected native copy-count contract rejects it. Thus the guard enforces row support, not retained-list injectivity or the selected COPY count. It correctly rejects the three repeated-row fixtures before output creation and preserves existing artifacts.

This is finite audit evidence, not supplier admission or a new kappa. Frozen inputs, shared code and the selected frontier are unchanged. Physical bank/projector/hosting admission, full nine-stage allocation and supplier moments, all-size compilation, precision/tape and analytic transfer remain unverified here.

Task and overlap

• Task: supplier-boundary-audit; priority revision 6; track adversarial-audit; catalogue scope key dcdb0fa8e49b08a958d0.
• Refined scope: PR3128/balanced-retained-alias/native-copy-count-and-invoice. Take PR Audit retained-helper independence in scatter parity #3128's unrun native-replay obligation from the canonical claim in Discussion #2976. Full task card: research/scatter-alias-native-audit/TASK.json.
• Exact base and final refreshed main: 463113d675af7410ac91d53a4fed51ec6494eb9a. Final completed fetch/pin: 2026-10-17T17:45:23.523776Z; no upstream, priority or selected-source changes. Contribution head: 0438cf1edcda3f68dfae345db87d4d690ab95efa.
• Domain: four predecessor full-size fixtures plus one unused-slot positive control; 661 local dirty-input columns; two native compile-time COPY contracts; 883 global formal columns; three native record mutants. All code/data is pinned by Git blob and SHA-256. No search.
• Milestone/stop rule: close this finite boundary implication and stop. No construction expansion; extra physical consumer/hosting costs remain unknown rather than zero. No savings target.
• Success/falsification: exact fixture bytes and difference supports, full symbolic/native outcome matrix, actual guard behavior, independent event/prefix invoices, and expected semantic/pricing/lifecycle rejections. A changed endpoint, unpaid COPY, source mismatch or unexpected native outcome fails.

Exact dependencies: PR #3128 2bf13e5b55f8318ae74a8f17db36a19447ba8c7f; PR #2977 cd23d242dfe0e7a71cafba0ad5590dc4f2fbf4f2; PR #2992 b31bf0360ad702b1be71dea7a33edc11711084af; PR #3004 ce08d19f6e43bbc6f552858d93154efe3aa98916; selected PR #589 a5afc8c6169ea61ba7c51dfd3cade02cc7b13b46. Executable inputs are the source-bound retained bytes on this base.

Nearest overlap: #2977 discovered the paired mismatch and checked nine-slot native fixtures; #2992 provided the operational guard; #3004 gave independent-slot parity; #3099 replayed scalar actions; #3100 (josecarlosgonzalezroque-design) treats label coercion; #3128 supplied grouped alias semantics but omitted native compilation. This adds native count/lifecycle/column and invoice coverage, not another alias census. The concurrent odd-multiplicity audit, #3210, keeps the nine distinct retained helpers fixed and is complementary.

Offline overlap queried the card, retained-alias/native/NCOPY terms and the predecessor path. Final cache coverage: 251 open PRs at 17:37:12.534077Z and 2,015 Discussion records at 17:39:04.580509Z, complete pagination. The path index was 17:12:31.392684Z, with five unverified newer head/base bindings (#3201–#3205); their cached bodies concern unrelated decoder or complex audits. No path novelty guarantee is claimed. Current main, source notes and every current claim in the canonical thread were inspected.

Validation

python3 -B scripts/research_baseline.py
python3 -I -O -Werror -B research/scatter-export-parity-audit/verify.py
python3 scripts/research_package.py --package research/scatter-alias-native-audit --check-only
python3 -B scripts/research_package.py --package research/scatter-alias-native-audit
python3 -I -O -Werror -B research/scatter-alias-native-audit/verify.py --native
python3 scripts/check_research_commit.py --package research/scatter-alias-native-audit

All passed locally on CPython 3.12.3, GCC 13.3.0, Linux x86_64. Registered replay: 11.139 s; explicit native replay: 31.625 s. Observed:

PASS_SELECTED_SCATTER_EXPORT_PARITY_AUDIT columns=661 changed_targets=1 no_new_kappa
PASS_PACKAGE_METADATA_AND_PINS (not a mathematical acceptance check)
PASS_SCATTER_ALIAS_BOUNDARY_AUDIT fixtures=5 columns=661 guard_rejects=3 no_new_kappa
Ran 6 tests ... OK
PASS_REGISTERED_RESEARCH_PACKAGE research/scatter-alias-native-audit outcome=completed
PASS_SCATTER_ALIAS_NATIVE_AUDIT fixtures=5 contracts=2 native_columns=883 controls=3 no_new_kappa
PASS_RESEARCH_COMMIT_BYTES {"commit": "0438cf1edcda3f68dfae345db87d4d690ab95efa", "files": 23, "package": "research/scatter-alias-native-audit"}

RESULT.json and NATIVE.json retain deterministic receipts. Four sequential C++ builds use the pinned checked-128-bit cpp_int stand-in; the independent Python prefix calculation uses unbounded integers. Only validated time/path fields are normalized. The selected baseline exactly reproduces PR #2977's native receipts.

Six behavioral groups pass. Actual native controls distinguish an underpriced COPY (legality rejects, columns pass), a wrong ERASE source (both reject), and an omitted scatter ADD (legality passes, columns reject). Source corruption, full dirty-column controls, record alignment/lifetime failures, guard preservation and saved-invoice tampering are also checked. All 23 package/input publication-byte comparisons and staged whitespace checks pass.

The generic registered hook does not compile native code; the explicit command above does. Native staging has an empty kernel selection and no source owners/donors. Inherited bank-audit flags are not new bank verification. System Boost, full selected cold replay, hosted CI, independent human review and proof-kernel verification were not run.

Credit

Prepared for commdata2338 (@commdata2338), with substantial OpenAI Codex assistance. Apache-2.0; original notices and sources are unchanged.

Sricharan Vagvala (@theon199), PR #3128, supplied the alias theorem and fixtures. Nick Petalas, PR #2977, supplied discovery, native controls and replay precedent; Arham Tahir, PR #2992, supplied the operational guard; Hiroki Kumazaki, PR #3004, supplied the independent-slot characterization; James Reed (@jwr404), PR #3099, supplied scalar corroboration. Credit eumemic and DreamingOfClouds for the bit word/checker lineage, Dylan Crow (PR #370) for the exporter, the staging program and the NCOPY generalisation of the official cohort checkers, Douglas Colkitt for selected bindings and review, and Sagar Thakrar for the checked cpp_int backend. The concurrent odd-multiplicity audit (#3210) is separate work.

AI assistance: submitted by @commdata2338 with substantial AI assistance. OpenAI Codex (GPT-6 Astra) did the derivation, the implementation, the checking and the writing; it was packaged and submitted with Claude Code. No independent human review is claimed.

Open next questions

Review a separately versioned successor's simple-scatter and retained-slot/count contracts together. These fixtures provide the first bounded acceptance test; then bind the successor entry points and run its complete symbolic/export/native and bank/hosting replay. New manifests and complete supplier admission remain blockers. Changing NCOPY alone is not adoption. No construction search is justified by this audit. See the package README and structured open_questions in TASK.json.

Workflow feedback (optional)

The card's existing_checks remains empty although #2992, #3004 and #3128 are retained on main. Adding their exact checked scopes and remaining obligations would help route the next session directly to a missing boundary instead of repeating #2977's already covered scalar mismatch.

🤖 Generated with Claude Code

https://claude.ai/code/session_01X86sCSXdoDd61SDFfC1PKG