[JoyboyBrian]

PR4739 leaves its fixed ROM loop under host control, while PR4192's written cost argument already charges scalar lowering. This follow-up supplies one executable uniform query component: the same 752-instruction program reads canonical binary h, s, offset and target on ten tapes, validates their relations, selects the bit from an externally supplied s·2^h-bit ROM, erases all private scratch and returns every head. No decoded parameter, host array length or loop index is available to the program.

For every h≥1, 2≤s≤2^h, offset<s and target<2^h, PROOF.md proves correctness and the complete instruction bound

T ≤512(s·2^h+1)(h+bit_length(s)+2)^2.

The proof lists static paths and iteration counts for every counter, comparison and cleanup loop, including the binary-h countdown and s=2^h endpoint. Measured executions use bits plus L/R/blank markers and include equality, Boolean branches, finite-register assignments, jumps and tape operations. A separate explicit three-bit local lowering gives

T_binary ≤65536(s·2^h+1)(h+log2(s)+1)^2.

That binary bound is proved, not measured by a binary emulator. Input framing, ROM/header preparation, serialization from the source key, CRT reconstruction and the complete repair/compiler/E tariff remain external. No new kappa or selected-frontier change follows.

Validation on Python 3.12.2:

• 169 accepted queries: all h=1 ROMs/addresses; all h=2 parameter tuples under two ROMs; larger boundary cases; six exact source-query epochs. The independently interpreted complete traces contain 7,215,065 instructions. Source h=5,s=17 calls use 309,005 or 322,303 instructions, with the same six answer bits.
• 16 rejected records, including large encoded h=65/127 paths without exponential ROM execution; seven instruction/ownership/answer fault controls.
• Metadata, normal registered replay, direct isolated optimized replay, committed-byte/source-history checks and deterministic export integrity pass. Git-free optimized replay passes in approximately 4.3 seconds; program-source, fixture and frozen-receipt corruption reject, with all ten export files restored exactly.

Only research/crt-uniform-rom-query/ is added. The small derived ROM fixture records PR4739's exact source receipt and checks its ROM hash; it does not import or rerun the producer. Exact predecessors are #4739 26ccde014218f7d906d1251dc295fbc1437ede8a, #4192 519d811cc48693ad9969d6d7994bef3940167005, and #4716 d9913fe24f119f9d431f324dbbe7d90de409a856. The existing research/crt-address-streams is acknowledged as encoded-arithmetic prior art. All heads were live-checked at claim time; cached overlap covered 506 open PRs, 3,650 Discussion records and 5,860 local notes on canonical b58/priority 7, with complete listed pagination, not a novelty certificate.

Canonical investigation. Open next questions specify a paid descriptor adapter and actual ROM-production/cache costs before a complete evaluator comparison. No full historical suite, Lean, Docker or complete repair replay was run.

Prepared by JoyboyBrian with substantial OpenAI Codex assistance; author/AI-checked evidence, not independent human or formal acceptance. Apache-2.0. Credit Cinna Davis, ToikY, Hiroki KUMAZAKI, unpaidmoon, Ryanson Jonathan, Jose Manuel, John-Michael Smith and Douglas Colkitt's predecessor CRT/physical-repair work.

Submission checkpoint: canonical main was fetched again and remains b58ad9ef4d4e861b0eaa5dba41742bdc072dca51, priority revision 7. The refreshed complete inventory (2026-10-22 19:10:08 UTC) covers 512 open PRs, 3,673 Discussion records and 5,860 base local notes. Scoped search and live predecessor heads were rechecked; no competing result was identified in this stated coverage. Closed PR diffs, arbitrary nested code and unpublished work remain outside it.
A separate read-only Codex review independently checked the finite program, boundary cases and instruction-count proof without finding a blocker; this is not human or proof-kernel acceptance.