[unpaidmoon]

Change and mathematical scope

On PR #6335 head d34b84f1e1d9fb4bdcf26eda8817c3603fea3051, the published W2/W4 source identities do not close dependency N1.

The identity record selects two drafts and those selections match a fresh parse:

• W2 bounded_serialization.py, SHA-256 fdeeb791c6cb0c03a5ab15903d51c3eb4cc5ff2a945c50d7f550acfe11376f3d, 23844 bytes. Direct imports omit sys. Line 490 is info["status"] = "FAILED_EVIDENCE_RETAINED".
• W4 parent_readback_v3_DRAFT_v2.py, SHA-256 6fc0577690c3865c1d67b4c288f860e5c81c8aebb3cffab18ab8a2269b12a572, 29105 bytes. Direct imports include decimal and re, and omit _decimal.

source_adopted is false, matching N1's closing sentence. Launcher admission and receipt producers are recorded as not implemented, so N2 stays open.

N1 still requires the F05 hash-and-line trace if F05 is selected, the decimal/_decimal Context/signals/re closure, all original controls, and the exact authentic inputs. The identity object has no F05 selection bit. The trace that targets line 490 is sys.settrace in unselected new_failure_controls.py (742f1de31551d43c2665ad6166577c104a0acc746b3503cc60c5f11798c9a24d), whose TARGET_SHA256 is the W2 hash and whose PRIMARY_STATUS_LINE is 490. The W4 draft imports Context, localcontext, and the nine Context traps, but the identity import field does not list those names or _decimal.

This is a scoped interface certificate. It is not source adoption, a runtime seal, a W5 admission, a measured gain, or a change to selected κ 781451/250000000.

Task and overlap

Base commit: 626e936ce4d61f2584316914fc71baf96940c512. Audited head: d34b84f1e1d9fb4bdcf26eda8817c3603fea3051.

Task card: supplier-boundary-audit (priority revision 8). Scope status: refined. The card asks for one latest uncovered candidate and one resolved gap, and says not to transfer the #5719 certificate onto #5718. This package answers discussion #1166 comment 19330344, the N1 review requested after the W1–W4 archive. It does not repeat the #5717 owned-lifetime audit.

Nearest work:

• Chris R / Clear1nsight, PR Archive O03 W1-W4 source repair and retained timing-review history #6335: the archive under review. It states that no source is adopted and that W5 is unadmitted. This package checks the published selection against N1 instead of archiving another copy of that round.
• PR Add authentic H25 serializer sources and retain first runtime authentication failure #6332: the retained authentic-serializer startup failure. Locale acquisition remains N3 and is not performed here.
• PR Extract bounded H25 serializer with 140 finite controls and retained failure evidence #6326 and PR Tooling: reuse same-call inventory SHA with retained checks #6328: the bounded serializer and inventory-digest archives named as predecessors. Different components.

The five inputs are byte copies of the PR #6335 paths. pinned/PINNED.json records the commit and hashes. Predecessor attribution stays in NOTICE.md.

Validation

CPython 3.12, standard library only. From the repository root:

python3 -B research/h25-w2-w4-selection-gap/verify.py
python3 -O -B research/h25-w2-w4-selection-gap/verify.py
python3 scripts/research_package.py --package research/h25-w2-w4-selection-gap --check-only
python3 scripts/research_package.py --package research/h25-w2-w4-selection-gap

Both verifier modes print PASS_H25_W2_W4_SELECTION_GAP and n1_closed=false. The package checker prints PASS_PACKAGE_METADATA_AND_PINS and PASS_REGISTERED_RESEARCH_PACKAGE. On this machine the five vendored files also matched git show d34b84f1e1d9fb4bdcf26eda8817c3603fea3051:<path>. A clone without that object still checks the vendored SHA-256 constants and reports upstream_blobs_absent=5.

Four in-process mutants are required to fail the corresponding fact: an added sys import, source_adopted=true, a rewritten N1 sentence, and PRIMARY_STATUS_LINE = 491.

python3 -B scripts/research_selected_baseline.py printed PASS_RESEARCH_BASELINE_BINDINGS_ONLY. That is binding orientation only. No serializer, Lean, Docker, or selected-frontier replay was run.

Credit

The W2 draft, W4 draft, identity record, and N1 text are Chris R / Clear1nsight, PR #6335, with the retained Douglas R. Colkitt / CrocSwap lineage cited there. Apache-2.0.

Prepared by unpaidmoon with substantial Cursor Grok assistance.

Open next questions

• Is F05 selected? If yes, add new_failure_controls.py, the sys.settrace admission, and target hash fdeeb791c6cb0c03a5ab15903d51c3eb4cc5ff2a945c50d7f550acfe11376f3d before any control run. If no, close N1's conditional trace clause with an explicit reject bit. Blocked by a separate integration assignment.
• What _decimal extension and Context trap closure does the intended interpreter load? The import field does not record them. Blocked by N3 provider acquisition. Source freezing is not a runtime seal.
• Which trusted request and receipt producers satisfy N2? None are selected, and W5 stays unadmitted.

Workflow feedback (optional)

The released handoff named the two JSON records and N1 directly, which made a one-gap audit possible without rerunning the failed serializer. A link to discussion #1200 is enough; no separate session report.