Audit paid-query composition at the actual QQ16 bridge

research/qq16-paid-bridge-composition/PREDECESSORS.json

@@ -0,0 +1,66 @@
+{
+  "schema_version": 1,
+  "canonical_source_base": "20ecf2891d80b5acf18d980b2164fb44ea7faa90",
+  "retained_pending_sources": [
+    {
+      "pr": 3952,
+      "head": "996ff698d3efd0bdce606e240f3b00e6ab91e7fc",
+      "source_path": "research/qq16-f17-demand-projection/WORD.json",
+      "local_path": "vendor/pr3952/WORD.json",
+      "sha256": "f513d235b8206211a4716d013a6dacf34aaebda6839da721b0231981cb8b905e",
+      "git_blob": "c23da2f205170b11f40299c5ec1dcab45b134861",
+      "purpose": "Exact owned output/temporary boundary of112-H1 projection. Only data is retained; no pending executable or Git object is needed during replay. Package-local invalidation covers this snapshot."
+    }
+  ],
+  "predecessors": [
+    {
+      "source": "research/joint-query/source_data.py and frozen certificate",
+      "credit": "Ali Romman / QQ16, centre-encoding campaign and portable clean-J reconstruction; retained lane/source notices",
+      "role": "Already removed all8H8 per orientation, with paid dirty-state correction. Reimplemented independently, not new retirement."
+    },
+    {
+      "pr": 2707,
+      "head": "efa51a6c7ffec6edd556a98deedfe9deeba65809",
+      "credit": "ywz65",
+      "role": "Literal full decoder/checkpoint and suffix. Source is a pinned canonical input; no executable imported."
+    },
+    {
+      "pr": 2681,
+      "head": "ea96706295631be10d92ae149b63c3e24acaeabc",
+      "credit": "Arham Tahir",
+      "role": "Complete logical inverse lineage."
+    },
+    {
+      "pr": 2512,
+      "head": "851dd3486a2d0549b51e85978a65ccb4eec619c0",
+      "credit": "ywz65",
+      "role": "Actual96-output F17 demand; inherited via3952."
+    },
+    {
+      "pr": 2346,
+      "head": "653520d7f18f686ea3a274b4963981f5be563477",
+      "credit": "alephnan",
+      "role": "Retained global ordinary bridge/terminal boundary; pinned canonical scope map."
+    },
+    {
+      "pr": 2470,
+      "head": "1b2eee3bf1ec67e68c0b0fa7f47c7b2a66febe56",
+      "credit": "thakrarsagar",
+      "role": "Retention census and constant-cover counterexample methodology; no executable imported."
+    },
+    {
+      "pr": 3963,
+      "head": "82c812c45fbc2bc2751e5a0d02a3631af25c3cba",
+      "credit": "Clear1nsight and user-requested agent audits",
+      "role": "Exact bridge and missing-query obstruction; predecessor package read as reference, no executable imported."
+    }
+  ],
+  "additional_credit": [
+    "ywz65 PR2492/2468 native read lineage",
+    "starship-s and Ross Richardson decoder/record lineage",
+    "Douglas Colkitt and Sagar Thakrar supplier/coverage lineage",
+    "retained gauge44,T16 and source notices"
+  ],
+  "license": "New work Apache-2.0. Retained source notices unchanged; snapshot is prior Clear1nsight package data.",
+  "new_result": "Constructive104-field paid bridge contract and exact literal/native fusion audit; no source bridge work retired."
+}

research/qq16-paid-bridge-composition/PROOF.md

@@ -0,0 +1,173 @@
+# Paid query augmentation at the first ordinary bridge
+
+## Boundary and exact question
+
+The actual hosted replica-0 prefix is F0, B1, pair-1 idle preparation, the
+positive bridge from pair 1 to pair 0, then F2. The bridge is physical
+`source_event=3`, after idle `source_event=2`, in the pinned
+`t16/global/hosted/GLOBAL-TEMPLATE.json.gz`. Its ordinary Y leg is
+
+    Y_pair1,p <- Y_pair1,p - Y_pair0,p,       p in U (96 ports).
+
+The companion X leg is unchanged. The selected provider in that template is
+still gauge44. This package tests a proposed QQ16 replacement boundary; it
+does not silently admit that replacement or identify new physical families.
+
+PR3963 proved that PR3952's earlier y1_U output cannot alone supply this
+current-Y read. We change that observation contract: retain the eight current
+query components along with the 96 projected outputs. The new local theorem
+assumes both current source Y and mutable other-pair target B are presented
+in their common-label port frame F17 C_qp^-1. The source is borrowed; the
+target is authorized to change as the bridge destination. Pair-1's actual
+physical placement and delivery into this boundary remain a global obligation.
+
+## Ordered operator sufficiency
+
+Let D_p be the actual chart-1 owner action. Define
+
+    a_k = sum_p R[k,p] D_p Y_p,
+    (K_U a)_p = (1/4) sum_k R[k,p] D_p^-1 a_k,
+    h_p = Y_p - (K_U a)_p,                   p in U.
+
+For the conserved B1 equations, a is the old selected-T query ell_1 x1 and
+h=y1_U. These source identities are inherited from the pinned QQ16 note.
+For this composition only the displayed identities on arbitrary current Y
+are needed. They imply, with all operator products ordered,
+
+    B_p - h_p - (K_U a)_p = B_p - Y_p.       (1)
+
+Thus (h,a), comprising 104 full-cover values, suffices for this bridge leg.
+No commutation of distinct D_p is used. The verifier checks the complete
+operator over 208 independent source/target fields, not just constants or
+random values. Its coefficients carry the full 73-column owner matrices.
+
+The eight-component augmentation is a constructive choice, not a lower bound
+of eight new physical families. It may be streamed or hosted differently in
+a different schedule. This construction explicitly allocates eight owned
+query output arrays and pays their clears/copies/return.
+
+## Legal augmented producer
+
+The retained 1,410-event PR3952 WORD is authenticated by exact head, Git blob
+and SHA256 and independently regenerated from R and the port partition. Its
+112 owned W arrays are cleared from arbitrary dirt, copied from borrowed Y,
+normalized by C_qp, and aligned into common F17. All eight query rows are
+formed in owner-private F fields before changing any ordinary W.
+
+The augmentation allocates eight owned Q_k outputs, clears them in F17, and
+copies each completed F_k into Q_k inside that same owner body. This adds
+eight full-cover CLEARs and eight unit ADDs. The original producer then
+subtracts K_U a, returns ordinary W to its original owner coordinates, clears
+the sixteen selected W temporaries, and clears its private fields before
+moving to another owner. At the new boundary W_U=h in F17 and Q=a in F17.
+All borrowed Y values/frames are untouched; no early record or X read is used.
+
+## Legal consumer and cleanup
+
+For every ordinary p, apply the source-derived affine map M_p to W_p, where
+
+    M_p F17 = F17 D_p.
+
+At the common frame, add R[k,p] Q_k/4 for each nonzero row coefficient.
+Then apply M_p^-1. The result is logical Y_p in F17. Apply C_qp^-1 to return
+that owned value to the target's frame F17 C_qp^-1, and subtract it from B_p.
+Clear the consumed W_p and every Q_k to zero in identity frame.
+
+Every ADD is between equal complete modulo-four phase polynomials. A map
+uses the actual involutive owner matrix and the unique derived even-linear
+translation; its inverse transports that translation by the owner action.
+Omitting the shift or inverse line is rejected at a scalar frame boundary.
+The native positive line is a wrapped H1 with a basis beginning at q_p.
+The inverse line uses a q_p translation in the left wrapper. All 112 positive
+and 96 negative signed kernels are checked on all 512 local basis columns:
+106,496 exact Gaussian columns, with common denominator two. Tensor products
+and the full phase identity extend the statement to all positive tensor
+depths under the inherited recursive H1 contract. This does not establish
+physical tape execution or a precision guarantee.
+
+The 120 full-cover workspace fields are 112 W plus eight Q, all exclusively
+owned and initially arbitrary. All finish zero/I. The eight F fields exist
+only during one owner-private body, finish zero/I there, and are never used
+across an owner move. Peak private workspace is eight. No borrowed field is
+cleared or used as an output alias. Allocation and movement are not free.
+
+## Complete local operation invoice
+
+| Charge | Augmented producer | Consumer | Serial composition | Direct Y bridge |
+|---|---:|---:|---:|---:|
+| H1 children |112|96|208|0|
+| Native monomial wrappers |224|192|416|0|
+| Full-cover maps |208|192|400|0|
+| Unit ADDs |568|96|664|96|
+| Quarter ADDs |384|384|768|0|
+| CLEARs |152|104|256|0|
+| Real scalar primitive allowance |9,456|5,584|15,040|768|
+
+The scalar allowance is 8 per unit ADD, 12 per quarter ADD, and 2 per CLEAR.
+The entire source producer F0/B1 and the preceding idle preparation are
+additional unchanged costs; this table prices the proposed replacement of
+the ordinary Y bridge leg. The bridge's ordinary X leg remains 96 unit ADDs
+and is unchanged. Map/wrapper counts are not physical stream tariffs.
+
+The direct column is legal **under the same common-label, same-frame local
+entry premise**: B_p and borrowed Y_p have identical F17 C_qp^-1 frames.
+It must not be read as an unconditional proof of global QQ16 placement or
+an imported selected-template native alignment theorem. The frame checker
+validates this local comparator explicitly.
+
+## Exact fusion and what really disappears
+
+Within the serial composition the producer subtracts K_U a and the consumer
+adds exactly K_U a back. The ordinary producer exit map and consumer entry
+map are inverse; no intervening operation uses the earlier owner position.
+After eliminating this cancellation, the query outputs and their computation
+are dead for a bridge-only demand. The sixteen selected source copies are
+then dead too. The remaining positive/negative C_qp and inverse map pairs on
+ordinary copies cancel. Copy propagation leaves precisely the 96 direct
+bridge ADDs already present in the source schedule.
+
+For an exact external-state comparison the checker also retains all 120
+allocated workspace fields: the fused word is 96 direct ADDs plus 120 CLEARs,
+scalar allowance 1,008. It compares every final value and frame, including
+all initially arbitrary workspace, with the serial word. If those unused
+fields are never allocated, their cleanup disappears and the source bridge
+bill is 768. This avoids treating discarded arbitrary owned dirt as zero.
+
+Fusion removes the added encode/decode work; it does not remove any of the
+96 actual source Y bridge ADDs. Therefore this serial repair closes the
+missing-information boundary but supplies no new saving for this one
+bridge-only continuation. That is the bounded stop result. It is not a
+universal lower bound on bridge implementations, shared queries, a changed
+producer, or a continuation which independently needs h and a elsewhere.
+
+## Obligation ledger and decision
+
+| Obligation | Status |
+|---|---|
+| Actual bridge event and preceding idle placement in source schedule | Proved by pinned template data |
+| Arbitrary-array sufficiency of (h,a) and exact bridge result | Proved in ordered routed algebra |
+| Concrete native word, signed kernels, full frames, ownership, zero return | Constructively verified under inherited native-child contract |
+| Complete local child/map/wrapper/scalar counts | Proved from literal words |
+| No additional source bridge operations eliminated by this fusion | Proved for the displayed words and bridge-only endpoint |
+| Complete QQ16 substitution, actual inter-pair physical owner alignment | Unknown |
+| Hosting 120 full-cover fields, address/control/movement and return costs | Unknown |
+| Intermediate magnitudes, rounded defects and recursive/all-depth admission | Unknown |
+| Invocation/family coverage and supplier moment | Not derived here |
+
+Stop the separate projection-plus-query-plus-reconstitution route at this
+boundary. A different local producer or a shared downstream query use can
+reopen it only with a named source operation that actually disappears. No
+old fixed-pair numerical relaxation is used to reject an actual global rate.
+There are no surviving H8 centre children to retire in the QQ16 core.
+
+## Credit
+
+Credit PR3952 for the projection and exact demand; PR3963 for the actual
+bridge/missing-query obstruction; ywz65 PR2512/2707 and Arham Tahir PR2681
+for the native reconstruction, line normalization and routed inverse;
+Ali Romman and the retained QQ16/source/native/geometry lineage; alephnan
+PR2346 and thakrarsagar PR2470 for the outer-controller boundary. Source
+notices and predecessor scientific claims are unchanged. New contribution:
+the paid 104-field bridge composition, full local invoice and exact
+source-work/fusion audit. Chris R / Clear1nsight with substantial OpenAI
+Codex assistance, Apache-2.0; no independent human review is claimed.

research/qq16-paid-bridge-composition/README.md

@@ -0,0 +1,85 @@
+# A paid query closes the bridge boundary, but repays the saving
+
+PR3963 identified the missing current-Y contribution at the actual ordinary
+bridge after F0/B1 and pair-1 idle preparation. This package augments PR3952's
+96 earlier y1_U outputs with the eight current query components. It gives a
+literal, legal local consumer of that 104-field boundary and verifies the
+complete composition on arbitrary routed arrays.
+
+The serial composition costs **208 H1, 416 wrappers, 400 cover maps and 15,040
+scalar primitive allowance**, with 120 owned full-cover workspace fields and
+eight owner-private fields. Borrowed current Y is unchanged; the mutable
+other-pair target receives the exact bridge subtraction; all workspace returns
+zero/identity. No early retention is needed.
+
+The result is a scoped stop for this repair. Algebraic/native fusion cancels
+the newly added query subtraction and reconstruction and yields the existing
+96 source bridge ADDs. The augmented interface closes the information gap,
+but no source bridge operation disappears. Under the same common-label
+native entry premise, direct subtraction costs 768 scalar allowance. If all
+120 extra fields remain allocated, their paid cleanup raises that to 1,008;
+this exact external-state variant is also checked.
+
+[PROOF.md](PROOF.md) gives the arbitrary-array equations, source event3,
+complete ownership/frame/cleanup contract, invoices and obligation ledger.
+This is not an admitted complete QQ16 substitution, a global cost rejection,
+or a claim that eight new physical families are necessary. Source placement,
+movement, storage, rounded precision, coverage and recursive admission remain
+open. The existing centre removal is not credited again.
+
+## Reproduce
+
+```sh
+python3 -I -Werror -B research/qq16-paid-bridge-composition/verify.py
+python3 -I -O -Werror -B research/qq16-paid-bridge-composition/test_verify.py
+python3 -B scripts/research_package.py --package research/qq16-paid-bridge-composition
+```
+
+Python 3.12 standard library. Replay is read-only and compares complete typed
+RESULT/WORDS receipts. The checker imports no predecessor executable. It
+authenticates SHA256 and Git blobs for five canonical inputs and the retained PR3952 WORD data, then
+checks 208 independent data fields, 120 independent owned dirt fields, exact
+intermediate h/a outputs, all 73 phase coordinates and 106,496 signed native
+basis columns. Semantic controls reject a wrong query sign, wrong affine
+shift, omitted inverse line and missing query cleanup. Normal replay never writes; explicit generation refuses existing receipts.
+Test/export evidence
+and unrun obligations are recorded in VERIFICATION.json.
+
+## Scope and workflow
+
+Explicit assigned parallel follow-up of PR3963, own focused package/branch.
+Canonical main 20ecf2891d80b5acf18d980b2164fb44ea7faa90, priority 6, with original
+`joint-query-controller` card retained in TASK.json. The [canonical claim](https://github.com/CrocSwap/integer-mult-bounds/pull/3963#issuecomment-6262031944)
+coordinates the distinct bridge, full-recovery and budget audits.
+
+Targeted live searches covered QQ16 bridge/query work, including 3963, 3652,
+2470 and the canonical scope map. Shared Discussion checks covered 2657,
+2617, 2192 and 2205. Coverage is partial; there is no novelty guarantee.
+The new question is a paid 104-field native composition and actual source-work
+comparison, beyond the prior 96-field insufficiency witness. Separate sibling
+results are not executable or scientific dependencies of this package.
+
+## Open next questions
+
+- Can a changed producer deliver the actual current-Y contribution directly
+  while eliminating some existing producer or bridge work? First identify
+  the exact deleted native/scalar operations and their replacement contract.
+- Does another actual continuation independently consume h or a, so this
+  projection/query computation can be shared? Pin its input frames, first
+  and last uses, borrowed-state return and complete physical bill before
+  allocating another query bank.
+- Can the required inter-pair common-label boundary be physically realized
+  with an admitted QQ16 placement? Account for the preceding idle sweep,
+  movement and all family lifetimes rather than importing selected coverage.
+
+These are the bounded reopening conditions in TASK.json. No further separate
+query-encoding optimization for this bridge-only endpoint is justified here.
+
+## Credit
+
+Chris R / Clear1nsight with substantial OpenAI Codex assistance, Apache-2.0.
+Preserve PR3952/3963 demand and boundary audits, ywz65 PR2512/2707, Arham Tahir
+PR2681, Ali Romman's QQ16/source lineage, alephnan PR2346, thakrarsagar PR2470,
+the geometry/native/supplier contributors and retained notices. Exact reuse
+and source pins are in PREDECESSORS.json and SOURCES.json. No independent
+human or proof-assistant review is claimed.