Print Assumptions Closed; targeted pinned Coq compile and coqchk; exact 10-state physical machine; empty/nonempty branch is tape-symbol driven; arbitrary base/frame/scratch preserved

s_frame_nv_stage_raw_state_bound + s_frame_nv_stage_raw_well_formed + frame_nv_empty_formula_handoff + frame_nv_nonempty_formula_handoff + frame_nv_stage_exact_run + frame_nv_stage_first_halt + sat_N_frame_nv_stage_exact_run + sat_N_frame_nv_stage_first_halt

Finite physical staging of the encoded num-vars suffix from an exact sat_N_frame. The well-formed 10-state s_frame_nv_stage_raw scans to the right edge, locates the penultimate unary field, copies it right-to-left into arbitrary scratch using only tape transitions, restores every source bit, and returns to the first frame cell. Separate physical handoff lemmas cover a Blank predecessor for an empty normalized formula and a false predecessor for a nonempty terminated formula; the machine transition never invokes parse_3sat, num_vars, or sat_N_value. The total sat_N_frame specialization preserves arbitrary base and the complete frame, appends exactly true^num_vars, proves least-halt/no-early-halt semantics, and is bounded by 8*frame_nv_stage_span^2. Finite handler composition, karp_edge, grid emission, encode_tsp, and the strict capstone remain OPEN.


Print Assumptions Closed; targeted pinned Coq compile and coqchk; exact 7-state physical tally; arbitrary base/frame/scratch preservation; nv wrapper intentionally not claimed

s_frame_false_tally_raw_state_bound + s_frame_false_tally_raw_well_formed + frame_false_tally_exact_run + frame_false_tally_first_halt + sat_N_frame_false_tally_exact_run + sat_N_frame_false_tally_first_halt + sat_N_frame_false_tally_successor_row_len

Preservation-safe physical false tally over an indexed canonical bit-only frame. The well-formed 7-state s_frame_false_tally_raw temporarily blanks one false cell at a time, shuttles to the far scratch end, appends one unary true, restores the false cell, and finally rewinds to the first frame cell. It preserves arbitrary mixed base, the exact frame, and existing scratch; exact and least-halt theorems are bounded by 2*(|frame|+|scratch|+1)^2. The sat_N_frame specialization appends exactly true^(3*num_clauses(parse_3sat w)+2), and proves S(count_false frame)=edge_row_len. The separate encoded-nv suffix reframe remains OPEN, followed by finite karp_edge, grid emission, encode_tsp, and the strict capstone.


Coq-only strict-TM corpus convention; nonempty G and physical reserve premises are load-bearing; malformed-cost and empty-G controls included; Print Assumptions capstones present; coqchk Axioms:<none> required by the live proof gate

s_grid_cost_recycle_state_bound + s_grid_cost_recycle_well_formed + grid_cost_recycle_exact_run + grid_cost_recycle_first_halt + grid_cost_recycle_exact_grid_append + grid_cost_recycle_first_halt_span

Finite physical recycler for one already-emitted grid cost. From the documented nonempty-grid layout, the well-formed 19-state machine parses exactly the two legal grid_cell_bits encodings, erases the old suffix, preserves the arbitrary mixed base, counters, and nonempty source, consumes the physical reserve, appends the same cost to the emitted grid, and returns to counter cell zero. Exact-run, unique-success, least-halt/no-early-halt, linear fuel, and quadratic span results are proven; malformed or missing cost suffixes and the unsupported empty-grid layout do not reach the success state. This is one cell-recycling brick, not pair enumeration, complete grid emission, encode_tsp, or the strict reduction capstone.


Coq-only strict-TM theorem; canonical sat_N_frame specialization is load-bearing; full proof gate 284/284 and coqchk Axioms:<none>

s_grid_counter_init_raw_state_bound + s_grid_counter_init_raw_well_formed + grid_counter_init_first_halt_fuel + grid_counter_init_odometer_handoff + grid_counter_init_first_halt_span

Finite initializer builds the canonical descriptor-counter banks from sat_N_frame and reaches the exact odometer start with least-halt and polynomial-span evidence. The capstone is specialized to the canonical frame; generic phases do not validate arbitrary frames.


Coq-only strict-TM corpus convention; canonical-header producer boundary and strict value<capacity precondition are explicit; Print Assumptions capstones present; coqchk Axioms:<none> required by the live proof gate

s_grid_descriptor_materialize_state_bound + s_grid_descriptor_materialize_well_formed + grid_descriptor_materialize_edge_pair_exact_run + grid_descriptor_materialize_canonical_no_early_halt + grid_descriptor_materialize_canonical_first_halt_span

Finite source-preserving materializer for one canonical edge descriptor. Given the producer-certified ten-bit gdm_header from typed nodes and roles plus four fixed-capacity unary banks satisfying value < capacity, the well-formed 138-state machine restores the complete source and emits exactly edge_pair_word, with exact-run, least-halt/no-early-halt, and quadratic span evidence. The raw ten-bit layout lemma copies header bits opaquely and does not validate arbitrary magic/role/kind patterns; the canonical CUB claim is deliberately limited to grid_descriptor_materialize_edge_pair_exact_run. Blank header cells, malformed bank predecessors/frontiers/guards, and a malformed final separator halt outside the unique success state. Pair enumeration, full grid emission, encode_tsp, and s_poly_reduces L_3SAT L_TSP remain OPEN.


Coq-only strict-TM theorem; valid descriptor and canonical counter premises are explicit; full proof gate 284/284 and coqchk Axioms:<none>

gdo_pair_descriptors_indexes + gdo_pair_step_row_major_successor + s_grid_descriptor_odometer_well_formed + grid_descriptor_odometer_exact_run + grid_descriptor_odometer_first_halt + grid_descriptor_odometer_first_halt_decodes

Finite canonical descriptor odometer enumerates valid descriptor-role pairs exactly once in row-major order and reaches the decoded successor with exact-run, least-halt, and quadratic-span evidence. Valid canonical counter layouts and 0 < nv are load-bearing; this is not an arbitrary-word decoder or total malformed-layout validator.


Coq-only strict-TM theorem; nil-base boundary on the extraction capstone is explicit; full proof gate 284/284 and coqchk Axioms:<none>

s_grid_finalize_state_bound + s_grid_finalize_well_formed + grid_finalize_exact_run + grid_finalize_first_halt_span + grid_finalize_sat_extract_word_reduce + grid_finalize_sat_first_halt

Thirteen-state finalizer removes the prepared workspace with exact-run, least-halt, and quadratic-span evidence. It preserves arbitrary outer base visibly; exact s_extract = word_reduce is claimed only for the nil-base end-to-end start.


Coq-only strict-TM theorem; exact reserve equality is explicit; full proof gate 284/284 and coqchk Axioms:<none>

s_grid_init_cleanup_raw_state_bound + s_grid_init_cleanup_raw_well_formed + grid_init_cleanup_first_halt + s_grid_init_tail_raw_state_bound + s_grid_init_tail_raw_well_formed + grid_init_tail_first_halt_prepared + grid_counter_finalize_exact_loop_handoff

Finite cleanup and tail-copy adapters transform the seeded canonical counter layout into the exact prepared-loop start, preserving source regions and proving least halt. Exact reserve equality is load-bearing; this module neither allocates reserve nor accepts arbitrary raw layouts.


Coq-only pure schedule theorem; in-range index premise is load-bearing; full proof gate 284/284 and coqchk Axioms:<none>

gdo_pair_schedule_nth_error + gdo_pair_schedule_step_nonlast + gdo_pair_schedule_step_last + gdo_pair_schedule_reserve_step

Pure finite schedule/index and reserve-accounting algebra for the row-major descriptor-pair stream. Claims apply only at bounded indices; no executable tape machine, grid emission, or runtime scheduling claim.


Coq-only quantitative theorem; prepared-layout scope and complete-encoder degree are explicit; full proof gate 284/284 and coqchk Axioms:<none>

karp_edge_machine_bound_uniform + grid_prepared_cell_bound_polynomial + grid_prepared_schedule_bound_polynomial + grid_prepared_schedule_bound_strict + grid_prepared_loop_first_halt_strict_octavic

Pure quantitative bridge proving uniform degree-eight bounds for valid Karp cells and the canonical prepared-grid schedule. It starts from the prepared layout; the complete encoder's degree remains 110 because of the existing sat_N_frame stage.


Coq-only strict-TM theorem; prepared-layout and reserve premises are load-bearing; full proof gate 284/284 and coqchk Axioms:<none>

sat_grid_stream_word_reduce_stream + s_grid_prepared_loop_state_bound + s_grid_prepared_loop_well_formed + grid_prepared_cell_reaches + grid_prepared_prefix_reaches + grid_prepared_loop_first_halt

Finite 11265-state prepared-layout loop emits the exact row-major word_reduce grid stream with cell, prefix, and exact first-halt theorems. It assumes the canonical prepared layout and adequate reserve; no arbitrary-layout validation or raw-input polynomial capstone is claimed here.


Coq-only strict-TM theorem; canonical frame and physical reserve semantics are explicit; full proof gate 284/284 and coqchk Axioms:<none>

s_grid_seed_raw_state_bound + s_grid_seed_raw_well_formed + grid_seed_exact_run + grid_seed_sat_first_halt + grid_seed_sat_fuel_degree_eight + sat_N_frame_grid_seed_padded_handoff

Finite physical reserve seeder specialized to canonical sat_N_frame, producing exactly 3*N^2 work cells with exact-run, least-halt, degree-eight fuel, and padded downstream handoff. This is not a host allocator or general malformed-input recognizer.


Coq-only strict-TM theorem; producer-certified counter boundary is explicit; full proof gate 284/284 and coqchk Axioms:<none>

s_grid_workspace_materialize_state_bound + s_grid_workspace_materialize_well_formed + grid_workspace_materialize_run + grid_workspace_materialize_first_halt_fuel + grid_workspace_materialize_first_halt_span

Finite canonical workspace materializer preserves source regions, emits the exact descriptor workspace, and establishes the padded Karp-edge handoff with exact-run, least-halt, and quadratic-span evidence. It assumes producer-certified descriptor counters and is not a general external-workspace parser.


item-4 iterate controller: s_iter, a fixed finite STM that runs a body a DATA-DEPENDENT S n times off a unary tape counter with a genuine loop-back per pass (state 0 CHECK -> 1 OUT -> 2 BACK -> 0), halting when the counter is exhausted. Proven correct + content-preserving by the fold-over-the-counter induction: s_iter_onestep (one self-similar iteration = 3 steps), s_iter_run (S n iterations), s_iter_computes/halted/extract (halts; s_extract = repeat true (S n), the counter preserved). Body is the trivial excursion; the reduction's real n-times loops splice a real body machine into states 1-2 via stm_seq. 0 axioms; coqchk Axioms: <none>.


Print Assumptions capstones present; exact 9254+3+27=9284 state partition; arbitrary-base and checked false-output controls; Coq-only strict-machine lane; live proof gate is the verification source of truth

s_karp_edge_state_bound + s_karp_edge_well_formed + karp_edge_machine_first_halt + karp_edge_machine_value_correct + karp_edge_first_halt

Finite canonical descriptor-workspace Karp edge machine. The fixed well-formed 9284-state single-tape product physically reads the ten-bit descriptor header, dispatches into one of twelve non-fallthrough finite handler families, normalizes represented or virtual trailing Blank padding, and erases the workspace to one Boolean under the head with only trailing Blanks. karp_edge_machine_first_halt is total over every source word, typed descriptor/role pair, and arbitrary mixed-symbol base, with no-early-halt semantics and the explicit local bound karp_edge_machine_bound. Under the load-bearing descriptor-validity premises, karp_edge_machine_value_correct and karp_edge_first_halt identify that tape result with the existing numbered karp_edge at the two edge_unode_id values. No parser, coordinate projection, literal table, or semantic edge predicate selects a transition. Scope is the canonical descriptor workspace: this does not provide an independent decoder from arbitrary externally supplied numbered vertices. The four-state cost-cell adapter, eighteen-state workspace copier, and finite role/unary cycles are closed support bricks, not executable N-by-N descriptor materialization. Total grid emission, encode_tsp, and s_poly_reduces L_3SAT L_TSP remain OPEN.


Print Assumptions Closed; targeted pinned Coq compile and coqchk; exact 9-state adapter and 261-state product; arbitrary base/header preserved

s_edge_literal_finish_state_bound + s_edge_literal_finish_well_formed + edge_literal_finish_exact_run + edge_literal_finish_first_halt + s_edge_literal_call_state_bound + s_edge_literal_call_well_formed + edge_literal_call_first_halt_span

Terminal physical adapter around the total raw parser-faithful literal machine. The 9-state s_edge_literal_finish preserves an arbitrary mixed base and header, scans the exact returned frame/query layout, erases the temporary query block, writes the resulting accumulator into the frame/output separator, physically rewinds the complete frame, and halts on the header. Its exact fuel is 2*|frame|+2*i+2*j+10. Composing it with the existing 252-state total raw query gives the exact well-formed 261-state s_edge_literal_call, with a parser-faithful least halt bounded by 70*clause_seek_span^2 for every w,i,j,pos,acc and arbitrary base. This is a terminal call interface; descriptor coordinate preparation, encoded-nv staging, finite karp_edge, grid emission, encode_tsp, and the strict capstone remain OPEN.


Print Assumptions Closed; targeted coqchk exit 0; arbitrary context preservation closed; total raw literal-table product closed separately; clean-pad/edge/grid stages open

s_serialized_lit_or_raw_serialized_run + s_serialized_lit_middle_or_raw_state_bound + s_serialized_lit_middle_or_raw_well_formed + s_serialized_lit_middle_or_raw_serialized_run + slm_total_fuel_quadratic + s_serialized_lit_middle_or_raw_first_halt_poly

RAW serialized-literal query machines. The 36-state adjacent core preserves its tally/index/polarity fields and OR-updates only the accumulator. The 39-state s_serialized_lit_middle_or_raw generalizes the exact run to every TapeSym left base, arbitrary Bit-only frame suffix between the tally delimiter and scratch, and arbitrary Bit-only post-index metadata; every surrounding cell is restored and the output is acc OR serialized_lit_is(repeat true k,i,pos). It is well formed, has a least halt/no-early witness, and runs within 16*(k+i+|middle|+|meta|+2)^2. This remains a raw internal-Blank brick. Clause positioning, the in-range three-tally product, the parser-default cycle, the range marker, and their total physical router are closed separately. Canonical clean padding, finite karp_edge/grid machines, encode_tsp, and the strict capstone remain open.


item-4 first loop-back brick: s_rewind, a genuine BIDIRECTIONAL finite STM (state 0 marches right over a unary block; on Blank turns; state 1 marches left back to the block start; on Blank halts) -- the head revisits earlier tape cells; unlike every prior single-pass 1-state scan atom. Correct on a DATA-DEPENDENT block length by the fold-over-count induction (s_run_plus + march_right/march_left): s_rewind_run (exact halt config), s_rewind_halted, s_rewind_extract (content preserved = repeat true (S m)). It is the rewind-to-start primitive the stage machines need. NOT yet the full iterate-body-k-times combinator. 0 axioms; coqchk Axioms: <none>.


coqchk Axioms:<none>; coq-only strict-TM corpus (Complexity* convention), no Lean/Verus mirror

s_map_prepend_clean_pad + mp_run + mp_no_early

FIRST real clean stage atom: s_map_prepend g (4-state, 2|w|+3 flat steps) computes w -> false :: map g w as a genuine s_clean_transduces_pad transducer (k=1 c=4), realizing the adopted stage architecture end to end -- scan-relabel (mp_scan, the s_scan_map invariant), rewind (mp_rewind left-march fold; the first Blank read IS cell -1, the left-edge corollary made to work), and the rewind-finish dance (write false delimiter at the probed cell, step back, halt blank-padded canonical). Never-halts-early via per-phase SHAPE invariants (mp_scan_state / mp_rewind_state existential-shape trick, state stays < 3). Design Compute-verified first (mp_check_cons / mp_check_nil committed regressions). Composes at a single polynomial budget via stm_seq_clean_pad_computes_poly / _preserves_poly. Stage BODIES (counting/max/grid) remain open; strict wrapper OPEN. NP-hardness (Karp 1972) not P vs NP.


coqchk Axioms:<none>; finite state bound and exact runs

Five-state canonicalizer for the exact Run18 halt layout. s_maxclean erases the false scratch tail and Blank gap, preserves the unary max, halts, and produces blank_padded output for both zero and positive maxima; s_maxerode_halt_layout exposes the physical handoff.


coqchk Axioms:<none>; the file's own content (definition + well-formedness + 5 kernel-checked Compute falsifiers) is proven; the run-level computes theorem landed later as s_maxerode_computes (Run14-18) + budget packaging (Run19-20); status normalized from non-schema 'design-compute-verified' 2026-07-13; coq-only strict-TM corpus

s_maxerode_well_formed + me_check1-5 (Compute)

EROSION MACHINE design brick (s_emit precedent: Compute-certified design first, march-fold proofs next brick): s_maxerode (8 states) defined + well-formedness PROVEN + behavior certified by FIVE kernel-checked full-run falsifiers (single group; tallies 2,1; empty groups; the all-empty zero-max boundary -- the no-true pass halts immediately, max_pos_iff's exactness in action; staggered exhaustion 3,2,1) -- each run halts with s_extract = repeat true (max_tally w) ++ repeat false (|w|), the target function, by reflexivity. State plan: A0/A1 pass scan with productivity bit, B true-run, C/D local back-up-erode-resume (eroded cells become Bit false never Blank -- Blank=end survives), E rewind to the -1 gap, F/G emit one output true per productive pass across the gap. NOT yet proven: pass invariant (one pass = map pred on tallies), march-folds, fold to EROSION_IS_MAX, budget wrapper -- s_maxerode is NOT yet claimed to compute anything. Strict wrapper OPEN. NP-hardness (Karp 1972) not P vs NP.


coqchk Axioms:<none>; honest range-restricted middle stage

Thirteen-state product of delimiter-domain max erosion and the five-state cleaner. s_maxpipeline_clean_pad_on_terminated proves a whole-product least halt, canonical unary max_tally output, and explicit 23*|w|^2+23 budget while keeping the termination predicate load-bearing.


EROSION_IS_MAX + max_pos_iff + max_tally_le_length

the EROSION = MAX spec pinning the num_vars machine (item-3 pattern: spec first, machine shaped by it; pure Coq, no TM built): EROSION_IS_MAX -- counting productive map-pred passes over group tallies computes exactly fold max -- with fold_max_pred (one pass = pred of the running max), max_pos_iff (the termination test is EXACT: a pass finds a true iff max still positive), max_le_sum + max_tally_le_length (fuel/budget hooks: max <= sum of tallies <= |w|), max_tally defined over split_clauses tallies. PINNED OBLIGATION (stated not built): the erosion-pass STM -- erode one true at each group's right edge per pass (local back-up-rewrite-continue, no interior Blanks so Blank=end survives), productivity in finite control, emit one output true per productive pass across a one-Blank left gap, fuel |w| passes. Strict wrapper OPEN. NP-hardness (Karp 1972) not P vs NP.


UNARY MULTIPLY: s_mult (8-state STM) = the s_copy-style outer counter loop nesting the s_padd source-preserving add (states 0-5) as its per-unit body, joined by the state-4->6 BACK-EDGE (no forward composition / stm_seq gives a data-dependent loop -- confirmed with an advisor). Layout counter(b)|gap|source(a)|gap|output(o), head at the counter frontier state 6; per counter unit (consumed right-to-left Bit true->Bit false), the inner add appends a copy of the PRESERVED source to the output; after b passes output := a*b + o. Design Compute-verified on 4 cases (2x3=6, 3x2=6, 4x1=4, 1x5+2=7) BEFORE proof. Proven 0-axiom: inner mult_m1/m2/m3/m5, mult_out, mult_cycle, mult_copy_phase transfer verbatim from s_padd; new mult_unmark (reframed to halt on the left-gap Blank), mult_add (=s_padd_run over a non-empty left frame), mult_m7/mult_m6skip (outer marches over Bit-false marks), mult_ostep (one outer cycle, unified via hd/tl for recurse+halt), recursive-fuel fold mult_orun. s_mult_run: config level, output region = (S k)*(S bp)+o; s_mult_halted. STATED AT CONFIG LEVEL not a clean whole-tape s_extract (source preserved + counter marks remain on tape); scratch-clearing deferred to the composition layer. coqchk Axioms: <none>.


Print Assumptions Closed; coqchk Axioms:<none>; total clean polynomial N stage closed; frame-to-grid pure spec closed; executable edge/grid/encode/final reduction open

nfp_raw_honest_run + s_nreplace_raw_clean_on + s_sat_N_frame_clean + s_sat_N_frame_computes_strict + s_sat_N_frame_stage_exists_with_state_bound + karp_edge_descriptors_from_sat_N_frame + karp_descriptor_grid_frame_direct + karp_direct_grid_length

TOTAL parser-safe Karp city-count strict-machine stage. The 71-state s_nreplace_raw replaces the honest parameter frame's clause-count suffix with unary N, handles both the empty normalized formula and every nonempty delimiter-terminated formula without conflating physical Blank with Bit false, and has an exact run bounded by 376*|x|^4+376. Composition with the total 78-state s_parameter_frame yields the 149-state s_sat_N_frame, total over every input word with least-halt minimality, canonical blank padding, and one explicit seq_K/seq_C polynomial. The frame also instantiates the serialized literal oracle and descriptor painter: karp_descriptor_grid_frame_direct equals the direct row-major Karp grid and karp_direct_grid_length proves N squared cells. Those latter theorems are pure specifications; finite query/edge/grid machines, encode_tsp, and s_poly_reduces L_3SAT L_TSP remain OPEN.


coqchk Axioms:<none>; total clean polynomial num_clauses stage closed; joint nv/nc/formula frame and N/grid/final reduction open

s_clausecount_clean_pad + s_numclauses_clean_pad + s_numclauses_computes_strict + s_numclauses_stage_exists_with_state_bound

TOTAL num_clauses strict-machine stage. The 13-state s_clausecount_clean counts false delimiters modulo three, compacts the unary result, and first-halts blank-padded for every word within 14*|w|^2+14. The 26-state s_numclauses precomposes the parser-preserving complete-clause normalizer and outputs repeat true (num_clauses (parse_3sat w)) for every input under one explicit seq_K/seq_C budget. A joint parameter frame retaining the normalized formula remains open before N/grid construction.


coqchk Axioms:<none>; total clean polynomial num_vars stage closed; N/grid/encode_tsp/final reduction open

s_numvars_clean_pad + s_numvars_computes_strict + s_numvars_stage_exists_with_state_bound

TOTAL num_vars strict-machine stage. The 36-state s_numvars composes the parser-preserving normalizer, range-scoped erosion/cleanup, and clean halve-successor. s_numvars_clean_pad quantifies over every word and outputs repeat true (num_vars (parse_3sat w)) with first-halt minimality and canonical blank padding under one fixed seq_K/seq_C polynomial; s_numvars_computes_strict proves the exact-budget strict predicate. The final L_3SAT-to-L_TSP reduction remains OPEN.


s_phase4_from_stage_machines_pad + no_clean_append_false + s_prepend_false_clean_pad

H3 hazard FOUND + REPAIRED: exact output-canonicity (s_clean_transduces) is UNSATISFIABLE at the tape edges -- the tape never shrinks (s_step_tsize_mono) and every write moves, so from the 1-cell s_init [] no machine reaches the 1-cell s_init (f []); proven concretely by no_clean_append_false (the delimiter-append stage function w++[false] -- s_append_false's own function -- admits NO exact clean transducer). REPAIR: blank_padded / s_clean_transduces_pad (output exact up to trailing Blanks); pad_rel is a full BISIMULATION of s_step/s_run preserving halting + s_extract (pad_rel_step/run/halted/extract), so trailing Blanks are semantically inert. Budget-closed composition layer re-proven over the repaired predicate reusing seq_K/seq_C/seq_budget (stm_seq_clean_pad_computes_poly, stm_seq_clean_pad_preserves_poly, capstone s_phase4_from_stage_machines_pad); clean_implies_pad retains everything prior. FIRST nontrivial clean witness: s_prepend_false (4-state, 3-step overshoot-absorb) is s_clean_transduces_pad for false::w (k=1 c=3) -- the repaired road is WALKABLE. Stage machines NOT built; strict wrapper remains OPEN. NP-hardness (Karp 1972) not P vs NP.


source-preserving unary ADD sub-machine for unary MULTIPLY: s_padd (6-state) appends a COPY of a unary source(a) block to a DISTANT output(o) -- output := o + a -- while PRESERVING the source, using Bit false as a temporary mark on each source true (flipped back in a final unmark pass). States 1-3 are identical to s_copy's output round-trip; state 5 marches source-left to the Bit-false mark; state 4 is the unmark. Proven 0-axiom: padd_m1/m2/m3/m5 march-folds, padd_out round-trip, padd_cycle (2c'+2o+5 per cycle), padd_copy_phase (fold over the source), padd_unmark_nil, ttb_run_gap. s_padd_run: source(S k)|gap|output(o) -> source(S k) INTACT | gap | output(S k + o); s_padd_halted; s_padd_extract = repeat true (S k) ++ repeat true (S k + o). This is exactly the source-preserving body unary multiply nests inside the s_copy counter loop. coqchk Axioms: <none>.


FIRST LIVE PIPELINE: delim_counter := stm_seq (s_map_prepend negb) s_erase_false -- a genuine two-stage product machine proven (delim_counter_computes) to compute the UNARY COUNT OF THE INPUT'S FALSE DELIMITERS (repeat true (length (filter negb w))) at the single explicit budget (seq_K 1 1, seq_C 1 4 1 1), via stm_seq_clean_pad_computes_poly + the value identity filter_id_map_negb, with zero further glue. Both a real parse-body sub-quantity (the #parts counter core; num_clauses = #parts/3 is the div-3 successor brick) and the end-to-end integration witness that the clean-pad atoms + padding bisimulation + budget algebra compose. Stage bodies remain open; strict wrapper OPEN. NP-hardness (Karp 1972) not P vs NP.


coqchk Axioms:<none>; reusable range/strict composition infrastructure

s_clean_transduces_pad_on + stm_seq_clean_pad_preserves_range_poly + s_clean_transduces_pad_computes_strict

Honest composition through a proved intermediate range: s_clean_transduces_pad_on keeps a following stage's domain predicate explicit; stm_seq_clean_pad_preserves_range_poly turns a total clean first stage plus a range proof into an ordinary total clean composite. s_clean_transduces_pad_computes_strict lifts any clean-pad package to the exact-budget strict computation predicate.


item-3 streaming spec: re-expresses the OPEN strict obligation from compute-word_reduce to compute-word_reduce_stream -- an EXPLICIT doubly-nested count-n loop (outer u; inner v over 0..num_cities) whose body emits one unary field enc_nat(adj_matrix u v); preceded by enc_nat(num_cities) and enc_nat(max_bound). word_reduce_stream_eq proves it equals word_reduce; s_computes_in_poly_strict_ext + s_phase4_from_stream transfer a machine for the streaming form to s_poly_reduces L_3SAT L_TSP. Pure Coq (no TM built); pins the iteration the iterate combinator must realize. 0 axioms; coqchk Axioms: <none>.


Print Assumptions Closed; targeted pinned Coq compile and coqchk; exact 11-state machine; arbitrary base/meta preserved; malformed unary fields intentionally outside the indexed contract

s_unary_eq_marker_raw_state_bound + s_unary_eq_marker_raw_well_formed + ueq_one_round + ueq_match_n + ueq_finish_A + ueq_finish_B + unary_eq_marker_exact_run + unary_eq_fuel_square + unary_eq_marker_first_halt_square

Preservation-safe equality over two indexed canonical unary fields. The well-formed 11-state s_unary_eq_marker_raw starts on Blank;base;true^a;Blank;true^b;Blank;meta, uses Bit false only as temporary crossing marks, restores both operands and every separator, preserves arbitrary TapeSym base and meta regions, and replaces only the left Blank sentinel with Bit(Nat.eqb a b). The exact run uses unary_eq_fuel(a,b)=2*a*m+m^2+2*a+5*m+4 for m=min(a,b), has a least halt/no-early-halt witness within (a+b+2)^2, and exposes exact state and transition-range proofs. Executable controls cover empty/equal/asymmetric operands, mixed base/meta preservation, one-step-early nonhalting, and rejected wrong marker/restoration layouts. This is an indexed canonical-unary theorem, not a validator for malformed fields containing false bits. Descriptor-field staging, frame tally staging, literal-query adaptation, finite karp_edge, grid emission, encode_tsp, and the strict reduction capstone remain OPEN.


Print Assumptions Closed; targeted pinned Coq compile and coqchk; exact 6-state machine; arbitrary base and bit-only middle preserved

s_unary_stage_raw_state_bound + s_unary_stage_raw_well_formed + unary_stage_cycle + unary_stage_copy_phase + unary_stage_exact_run + unary_stage_fuel_quadratic + unary_stage_first_halt

Source-preserving unary staging across an arbitrary bit-only middle. The explicit well-formed 6-state s_unary_stage_raw uses false marks and one temporary Blank delimiter to copy true^n to the far scratch end, restores the complete source/middle/boundary, preserves arbitrary mixed base, and halts at the source's left Blank sentinel with scratch length n+o. Exact execution and least-halt semantics include n=0 and are bounded by 3*(n+|middle|+o+2)^2. A separate finite cleanup restores a fixed predecessor and exposes the copied scratch. Descriptor locators, frame-derived nv staging, finite karp_edge, grid emission, encode_tsp, and the strict capstone remain OPEN.


Print Assumptions Closed; targeted pinned Coq compile and coqchk; exact 4-state cleanup and 10-state composition; fixed predecessor is finite-control data

s_unary_stage_cleanup_state_bound + s_unary_stage_cleanup_well_formed + unary_stage_cleanup_exact_run + unary_stage_cleanup_first_halt + s_unary_stage_clean_state_bound + s_unary_stage_clean_well_formed + unary_stage_clean_exact_run + unary_stage_clean_first_halt

Canonical cleanup around source-preserving unary staging. A fixed finite-control predecessor bit parameter drives the 4-state cleanup: restore the predecessor, scan to the virtual tail, find the copied scratch from the right, rewrite its false boundary to Blank, and halt on the scratch start, including zero. Composing it with the 6-state raw stager gives an exact well-formed 10-state product over arbitrary base and bit-only middle. It preserves the source and middle, produces true^(n+o), has exact least-halt semantics, and is bounded by 3*(n+|middle|+o+2)^2. Dynamic xa predecessor selection still requires an upstream finite physical kind branch; finite edge field locators, nv staging, karp_edge, grid emission, encode_tsp, and the strict capstone remain OPEN.


Print Assumptions Closed; coqchk Axioms:<none>; direct totalization plus semantic normalizer composition; coq-only strict-TM corpus

s_varframe_raw_clean_pad + s_varframe_clean_pad + s_parameter_frame_clean_pad + s_parameter_frame_stage_exists_with_state_bound

total payload-preserving num_vars annotation and joint SAT parameter frame. The 37-state s_varframe_raw directly handles every word, including a final unterminated group at physical Blank, preserves w, appends enc_nat(S(halve(max_tally w))), halts first within 34*|w|^2+34, and finishes blank_padded with empty left tape. Precomposition with the parser-preserving 13-state normalizer gives the 50-state s_varframe computing nv_annotated w = normalize(w)++enc_nat(num_vars(parse_3sat w)). Composition with the 28-state raw clause appender gives the 78-state s_parameter_frame computing normalize(w)++enc_nat(nv)++enc_nat(nc). All packages are total, finite-state, least-halt minimal, canonical, and polynomial. N assembly, karp_edge, N-by-N grid emission, encode_tsp, and s_poly_reduces L_3SAT L_TSP remain OPEN.


coqchk Axioms:<none>; total pure specification only, no finite normalization machine claimed; coq-only strict-TM corpus

normalize_complete_clauses_parse + normalize_complete_clauses_terminated + normalize_complete_clauses_aligned + normalize_complete_clauses_max_tally + MAXVAR_IS_HALVED_PARSED_MAXTALLY + num_vars_from_normalized_maxtally

TOTAL PARSED-PREFIX MAX contract plus the original aligned raw-max theorem (pure Coq, no TM): complete_clause_parts drops exactly the one- or two-part suffix ignored by decode_to_3sat_formula; normalize_complete_clauses canonically re-encodes that prefix and is parser-preserving, delimiter-terminated, 3-aligned, and tally/max preserving for every word. TOTAL HEADLINES: MAXVAR_IS_HALVED_PARSED_MAXTALLY and num_vars_from_normalized_maxtally prove num_vars(parse_3sat w)=S(halve(max_tally(normalize_complete_clauses w))) with no premise. The original MAXVAR_IS_HALVED_MAXTALLY/num_vars_from_maxtally remain scoped to 3-aligned words. The finite clean-pad normalization machine and terminal physical compaction remain OPEN; strict wrapper OPEN. NP-hardness (Karp 1972) not P vs NP.


s_varidx_computes + kept0_is_varindex + vi_group

the per-literal VARIABLE-INDEX transducer: s_varidx (3-state) rewrites every false-delimited group of k trues to (k-1)/2 trues -- decode_literal's OWN index arithmetic Nat.div2 (Nat.pred k) -- preserving delimiters, in one |w|+1-step scan (k=1 c=1). Finite control = per-group phase counter (drop 1st true, keep every 2nd), reset by each delimiter: the reset-on-false generalization of s_div3. Proven via spec fold vi_cells + scan invariant s_varidx_scan, joint closed forms kept1 k = k/2 & kept2 k = (S k)/2, kept0_is_varindex (phase 0 IS div2 (pred k)), group lemma vi_group (tail closes BY CONVERSION -- the false-branch ignores the phase, no tracking argument needed), s_varidx_computes. Produces ALL per-part var indices in one pass; the MAX over halved groups (num_vars = 1 + max) is the still-open overlay/erosion machine. Strict wrapper OPEN. NP-hardness (Karp 1972) not P vs NP.


Binary serialization + syntax/semantics of the Undirected Hamiltonian Cycle decision language L_UHC (edges via a clean structural helper). Last language endpoint of the Karp chain. Definition only. Not P vs NP.


Karp Phase 3: PROVEN reduction L_UHC <=p L_TSP (uhc_to_tsp_correct -- an iff 0-axiom theorem). Cost gadget: edge=1 non-edge=2 budget B=N; a tour of cost <= N exists IFF the graph has a Hamiltonian cycle. Pure topological mapping (NO Turing-machine/poly_reduces wrapper -- that is Phase 4). NP-hardness (Karp 1972) not P vs NP.


coqchk Axioms:<none>; Lean 4.31 core exit 0; Verus 21 verified 0 errors; detection_delay_ceil div-packaging Coq-only (Lean/Verus carry the bound as side condition)

cusum_maxsuffix_identity + subcritical_never_fires + supercritical_rate_fires + observed_27pct_never_fires

mixed-stream Page-CUSUM fire threshold for the deployed encoding S <- max(0, S + x - k), x in {0,1}, k=1/2 (integer-scaled T <- max(0, T + 2x - 1), fire at T >= 2h). Max-suffix identity cusum_maxsuffix_identity: T_t = max over windows of (2*denials - len). (A) subcritical_no_fire/subcritical_never_fires/halfrate_pins_zero: every-window denial density <= 1/2 => never fires. (B) supercritical_fires/denial_burst_fires (N=2h consecutive denials)/supercritical_rate_fires (any rate a/b > 1/2, bound 2hb <= N(2a-b)); detection_delay_ceil N = ceil(2hb/(2a-b)) Coq-only. (C) observed instance: 1272/4772 = 27% subcritical, never fires. CRITICAL RATE PROVED rho* = k = 1/2 -- REFUTES the erosion_e2e_flow.html sketch rho* = k/(1+k) ~ 33% (that formula belongs to a deny:+1/allow:-k encoding, not the deployed one); no-fire verdict unaffected (27% < both).


Verus-only single-kernel row: 18 verified 0 errors under pinned verus 0.2026.06.28, no axioms/assume/admit; Coq/Lean mirrors not yet authored; recovered 2026-08-13 from claude.ai-session Drive artifact (recovered/README.md); not invoked by product code yet - unwired is an integration status, not a validity defect (docs/RECOVERY_CLAUDE_EXPORT_2026-08-13.md).

standalone spec, no product anchor yet (reroute witness calculus)

Belnap four-value meet over 2-bit cells (PASS=0b10, FAIL=0b01, FLUID=0b11, TAMPER=0b00) is bitwise AND: idempotent, commutative, associative, FLUID is identity, TAMPER is absorbing; FAIL resists PASS evidence (meet(FAIL,PASS)=TAMPER), so a reroute witness can never upgrade a failed cell (proof family R1-R10, 18 proof fns by bit_vector).


FLUID not PASS: compiles under pinned Coq 8.18 (coqc EXIT=0) but declares 3 Admitted (M1 arity_is_sticker_count, M2 core_is_nullary, M6 grade_invariant_under_motion; each with a vm_compute discharge plan) + 6 axioms (5 standard-cube table facts + Rokicki 2010 God's Number, cited not proved); deliberately does not claim Rubik legality; recovered byte-exact from claude.ai export 2026-08-13 (recovered/README.md); not gated - lives outside proofs/ until Admitted discharge.

not wired (motion calculus over CUB-TSP-034 placement)

Coq motion calculus M1-M10 over the 54-cell/27-carrier duality: arity is sticker count (8*3+12*2+6*1+1*0=54 over 27 carriers), the core is nullary and the fixed frame, rotation preserves arity and grade, complete placements survive authorized motion, and re-placement is bounded by God's Number 20 (depth-3 bound 60).


FLUID not PASS: V2_1 compiles under pinned Lean 4.31.0 (EXIT=0) with 14 closed theorems and 3 axioms (standard-cube table facts awaiting instantiation); recovered CubieMotionV2.lean retained byte-exact but does NOT compile (Nonempty synthesis failure at opaque act, EXIT=1) - V2_1 is the minimal fix, only the Placement declaration differs; Rubik legality and VRF properties deliberately not claimed; recovered 2026-08-13 (recovered/README.md); not gated - lives outside proofs/ until axiom discharge.

not wired (bridges CubieAuth.rotateOk to LinearHandoff)

Lean motion calculus closing audit P1 tautologies: freshHandoff is unconsumed by construction (non-tautological cub_3141), rotateOk forces an unconsumed handoff via the LeaseBound model invariant (non-tautological cub_3140), consumption revokes rotation authority, rotation preserves arity, completeness survives authorized motion, and depth-3 motion is bounded by 60.


coqchk Axioms:<none>; audit brick -- pins what Haken2e does and does not feed; coq-only proof-complexity corpus

php_initial_width + php_width_bound_met_by_axiom + php_width_bound_no_refutation_gap

the WIDTH-GAP AUDIT: php_width_lower_bound (Haken2e) creates NO width increase over the initial formula, machine-checked. pigeon_clause_width: every pigeon axiom of generate_PHP_CNF N is width EXACTLY N. php_initial_width: initial width = N (a width-N clause exists; every clause <= N), N >= 2. php_width_bound_met_by_axiom: the N/3 < width target is met by an INITIAL clause. php_width_bound_no_refutation_gap: in EVERY refutation the Haken2e bound is witnessed by an axiom clause (via php_refutation_contains_every_axiom). Consequence: a size-width tradeoff (exponent ~ (refutation width - initial width)^2) yields NOTHING exponential from the current theorem on this encoding -- the recorded route 'single remaining step is the size-width tradeoff' is corrected. Honest routes: (A) direct bottleneck counting over generate_PHP_CNF, or (B) a separate clearly-named bounded-width family + its own width theorem + formal tradeoff. haken_resolution_lower_bound_open remains OPEN. NOT P vs NP.


A candidate route is well-formed iff it is a permutation of all supplied city IDs.


Successor/predecessor arrays generated from a route are inverse movement-string views.


A synchronized segment reversal preserves route permutation well-formedness.


An unsynchronized segment reversal creates a detectable shadow mismatch unless the move is identity.


Objective recomputation equals sum of movement-string costs over the cycle.


Segment-reversal delta equals added boundary strings minus removed boundary strings.


Seam binding report is a pure function of caller-supplied geometry/layout/route.


Face centers remain semantic anchors; movement-string rewires do not move them.


A branch with valid lower bound LB >= incumbent cannot contain an improving tour.


Invalid lower-bound evidence shatters as TAMPER_SHATTER not PRUNE_SHATTER.


Root solve snap requires valid lower-bound certificate, equality to incumbent, and all inner competitors pruned.


ShadowCubie log is append-only and sequence monotone.


CUSUM drift channels are caller-configured; no dataset constants appear in channel logic.


Inner-cube shatter classification: PRUNE_SHATTER iff valid certificate and lb>=incumbent; the three outcomes are total.


Integer-ceiling lower bound: for integer costs ceil(s/2) is a valid lower bound and dominates the floor.


Certificate-backed prune soundness: a valid branch lower-bound certificate >= incumbent excludes every tour in the branch.


Belnap algebra + 2-bit encoding totality: enc/dec bijection on the 4-value Belnap lattice (dec_enc_id, enc_dec_id, enc_injective), meet = bit-AND is a homomorphism, FLUID identity, TAMPER bottom, De Morgan duality. Triple-kernel bridge from the substantive cubie-tf corpus.


FRESH first proof of upstream stub CUB-1899; meet FAIL^PASS->TAMPER (bit-AND) differs from runtime verdict() safety-dominance -- do NOT cite 018 as backing verdict()

snap_fold (runtime anchor to implement -- wiring queue #1)

Snap AND-fold consensus law: cell-wise AND fold over a window -- append homomorphism, TAMPER sticky/absorbing, FLUID transparent/identity, PASS iff consensus. FIRST SUBSTANTIVE PROOF of upstream stub CUB-1899 (net-new, not a mirror of a proven upstream theorem).


mirrors CUB-1921-d (detection dual); drift premise empirical; scrubbed free of 032 material (grep 0, re-verified all 3 kernels)

CusumChannel over per-iteration bound improvement (TEP->TSP bridge -- wiring queue #2)

CUSUM sustained-drift detection: under a sustained linear drift, the Page/CUSUM statistic grows so the detection delay is finite and bounded (<= h+1). The drift premise is stated as an empirical hypothesis. The detection dual of the CUSUM calibration identities (020).


mirrors CUB-1921-b/f (calibration identities); 1921-c tautology deliberately excluded; scrubbed free of 032 material

CusumChannel calibration (wiring queue #2)

CUSUM calibration identities: per-step non-increase of the reset, monotonicity in the input z, and reset independence -- the structural identities that make the Page/CUSUM statistic well-behaved. The 1921-c tautology is deliberately excluded (not a load-bearing result). The calibration base the detection theorem (019) rests on.


FRESH first proof of upstream stub CUB-1907; concrete table = disjoint corner-band partition (overlapping cell-18 instance NOT fabricated; runtime VERTEX_TRIPLES is the overlapping table, generic law covers it; a future rev may add that instance)

VERTEX_TRIPLES syndrome loop (cubie_evidence.rs:86-95)

Vertex-triple strict span + parity-toggle counting law: the generic counting law over a vertex-triple table (strict span; each toggle flips parity). FIRST SUBSTANTIVE PROOF of upstream stub CUB-1907. The concrete table proved is the DISJOINT corner-band partition; the overlapping cell-18-in-3-triples instance was deliberately NOT fabricated -- the generic law covers it, and the runtime VERTEX_TRIPLES IS that overlapping table.


mirrors CUB-1939/1940/1944; formal twin of the reversal metamorphic fleet test

seam X-parity + measured reversal invariance

Seam validity closure under append + reversal: a valid seam stays valid under append and under segment reversal (seam X-parity preserved). The formal twin of the reversal metamorphic fleet test.


mirrors CUB-1437-1441; refines TSP-004; runtime egress_xor anchor queued (wiring #3)

egress_xor over the 6 FACE_CENTERS on CubieTspEvidence54 (anchor to implement -- wiring queue #3)

Egress mismatch detection + core-mask opacity: XOR-masking the egress boundary bits detects any boundary mismatch (zero iff boundary-equal) while the core mask stays opaque. Refines TSP-004 (the shadow-mismatch detection theorem).


mirrors CUB-1819; verified reflection over the full Z/108 window

InnerCube shatter events (semantic anchor; standalone by house style)

Shatter irreversibility via gcd(7,108)=1: because gcd(7,108)=1 the step-7 rotation is a generator of Z/108, so iterating it sweeps the full window with no fixed point short of a full cycle -- the shatter cannot be reversed. Verified by reflection over the full window.


Move-trace cost reconciliation and monotonicity: final = initial + sum of deltas; an all-improving trace is non-increasing.


Cube-shatter as a sound prove/disprove decider: bounded search snaps (Proven) on a witness and shatters-all (Disproven) otherwise; sound and complete.


Optimality-certificate soundness: a feasible tour attaining a valid lower bound is optimal (backs the Held-Karp berlin52 result: LB 7542 == incumbent => optimal).


End-to-end optimality certificate: feasible tour + recomputed objective + valid lower bound + bound == objective => globally optimal (0 axioms in all 3 kernels).


Branch-and-bound tree size is 2^(#edges) -- EXPONENTIAL not polynomial: size < 2^(k+1) and the full tree attains 2^(k+1)-1 (tight); the solver is NOT O(n^k) and bears nothing on P vs NP.


double_tree_tour (crates/cubie-tsp-verifier/src/double_tree.rs) -- executable discharge, wired as B&B incumbent candidate

Metric shortcutting: under the triangle inequality skipping an intermediate vertex never increases path cost (a pillar of the 2-approximation).


prim_mst (crates/cubie-tsp-verifier/src/double_tree.rs) -- executable discharge; tests assert MST <= published optimum fleet-wide

MST lower bound: Cost(MST) <= Cost(optimal tour); composes with 030 to give the 2-approximation Cost(tour) <= 2*Cost(optimal).


coqchk Axioms:<none>; symmetry of the matrix not needed (schema covers asymmetric TSP); CUB-TSP-032 is IP-guarded/git-excluded so 033 is the next ledgered ID

held_karp_exact (crates/cubie-tsp-verifier/src/lib.rs) + certify step ex_ceil >= incumbent in cubie_tsp_prove_optimal (crates/cubie-tsp-verifier/src/prove_optimal.rs)

Optimality-certificate checker (concrete schema): tour validity = permutation of 0..n-1, tour_cost = consecutive edges + closing edge over a nat->nat->nat matrix; a lower-bound witness (forall valid t, LB <= tour_cost t) attained by a valid tour certifies optimality, and any two certified tours have equal cost (LB values coincide). Discharges CUB-TSP-027's abstract tour type; backs berlin52 CERTIFIED OPTIMAL (HK LB 7542 = incumbent).


coqchk Axioms:<none>; Print Assumptions x4 closed; Lean core decide-only (no native_decide); Verus 20 verified 0 errors; design record docs/FLUID_PLACEMENT_DESIGN_2026-07-14.md; derived Evidence54 mapping pinned in proofs/coq/CubTsp034Derived.v (10/10 from tools/derive_evidence54_mapping.py, 82 overflow edges FLUID per capacity law); runtime mirror crates/cubie-tsp-rust-optimal/src/placement.rs; arity-3 triples-first re-derivation pinned in proofs/coq/CubTsp034DerivedTriples.v (5 triples + 4 pairs, 9/9; incl. self-referential pairs 020-036 and 034-035 from the same-day wiring)

evaluate_bindings + CubieTspEvidence54 (crates/cubie-tsp-rust-optimal/src/lib.rs)

FLUID PLACEMENT: context-to-cell wiring on the 54-cell cube, triple-kernel. Positional semantics: cell = 9*face + position; position 4 = CENTER (arity-1 anchor), {1,3,5,7} = EDGE (arity-2, realized on one of the 12 seams), {0,2,6,8} = CORNER (arity-3, realized on one of the 8 vertex triples); standard-cube seam/vertex tables kernel-checked (perfect edge matching, corner partition). THEOREMS: grade <= total; grade = total IFF every declared anchor/pairwise/three-way interrelationship is realized (the guess->grade loop acceptance criterion); argmax search over any finite candidate set finds a complete placement whenever one exists (loop soundness). INSTANCES (Coq vm_compute + Lean decide): TSP evidence context (CUB-TSP-027/002/004/006 wiring, grade 10/10) and TEP context (CUB-1921 recursion pair, CUB-1952 h=1.5x-peak pair, CUB-1953 OR-gate pair + output triple, CUB-1954 layout pair; grade 11/11); one misplaced variable caught (grade 10/11); search recovers from a bad seed. Verus carries the full theorem family (20 verified, 0 errors); instances are Coq+Lean. Certifies the placement CALCULUS, not any solver result; capacity honest (12+8 per level, overflow stays FLUID or recurses).


coqchk Axioms:<none>; Print Assumptions x3 closed; Lean decide-only no sorry; Verus 6 verified 0 errors; fixpoint bound exercised in runtime test iterate_reaches_fixpoint_within_total

placement::iterate + placement::best (crates/cubie-tsp-rust-optimal/src/placement.rs)

CONVERGENCE of the iterated guess->grade->restart search, triple-kernel. Abstract core: for any grade g bounded by B and any step satisfying the guess->grade dichotomy (stand still or strictly improve), iteration reaches a FIXPOINT within B - g(p) rounds, hence within B rounds from any start; monotone steps never lose grade. Concrete corollary (Coq, imports CubTsp034): the placement argmax `best` satisfies the dichotomy (best_progress), completeness once reached is stable (complete_stable), iterating converges within total(ctx) rounds, and with a complete placement in the pool EVERY iterate from round 1 is complete; kernel-checked TEP instance (misplaced seed -> complete in 1 round, stable at 2). Kernel scope: Coq = core + corollary; Lean/Verus = core + self-contained non-vacuity instance.


coqchk Axioms:<none>; Print Assumptions x4 closed; Lean decide-only no sorry; Verus 13 verified 0 errors; runtime berlin52 control g=1370 cost units = 89784320 Q16 and stream sum matches; over-bound exact certificate mutation is TAMPER

gap_anchored_k + detect_gap_anchored_stagnation + held_karp_initial_exact_q (crates/cubie-tsp-verifier/src/lib.rs)

THE GAP-ANCHORED-SLACK SEAM THEOREM, triple-kernel. Over the Page recursion (nat clamp; the CUB-TSP-019/020 channel): cusum_ge says the channel dominates aggregate shortfall; silence through budget T implies collected improvement >= k*T-h. If the EXPLICIT stream premise sum<=g holds and g+h<k*T, the detector must fire within that recorded positive budget. The derived minimal allowance k0=(g+h)/T+1 establishes the inequality for T>0; allowance-meeting streams remain silent. Boundary: a fire alone does not prove global/future stagnation or justify lossless early exit. Kernel numeric control g=1284,h=4,T=100 gives k=13. Live receipts instead anchor g to the exact zero-potential Held-Karp 1-tree origin, convert all quantities to Q16.16, and expose origin<=incumbent, nonzero-budget, and sum(improvements)<=g before citing the theorem.

TDX TEP admission TSP complexity topology


coqchk Axioms:<none>; Print Assumptions x3 closed; Lean decide-only no sorry; Verus 5 verified 0 errors; capacity boundary stated (overflow stays FLUID or recurses -- Fabric layer open)

placement::grade + placement::best consumers (crates/cubie-tsp-rust-optimal/src/placement.rs)

EMBEDDING EXISTENCE: every context within capacity admits a complete placement, CONSTRUCTIVELY. If length anchors <= 6, length rels2 <= 12, length rels3 <= 8, and all declared metrics are distinct (NoDup), then `build ctx` -- i-th anchor to i-th center, i-th pair to i-th seam, i-th triple to i-th vertex -- satisfies complete (build ctx) ctx = true (cub_tsp_037_embedding_exists; existential corollary cub_tsp_037_placement_exists). So the fluid loop ALWAYS has a target when the context fits capacity, and CUB-TSP-035 says the search reaches it. Falsifiers: builder reproduces the kernel TEP context (11/11); an over-capacity 13-pair context genuinely fails at the 13th pair (12/13) -- the capacity wall is real. Kernel scope (honest, 035 pattern): Coq = full general theorem (anchors+pairs+triples blocks); Lean = anchors block general + decide-checked instances incl. the over-capacity falsifier; Verus = builder + anchors block general (5 verified 0 errors).


coqchk Axioms:<none>; Print Assumptions x3 closed; Lean decide-only no sorry; Verus 6 verified 0 errors; pair-only/triple-only/empty-axis controls; shared-metric negative boundary

model-only; no runtime shard implementation

SHARDED OVERFLOW EMBEDDING (Fabric brick 1), triple-kernel. Globally occurrence-distinct pair/triple metric families of arbitrary finite cardinality embed across SHARDS. Pairs are chunked in blocks of 12 and triples in blocks of 8; cover_chunks supplies one empty coordinate for a one-sided or empty relation family, so the Cartesian shard list is never vacuous. Every shard is in-capacity and embeds via the 037 builder (cub_tsp_038_shard_embeds); every declared pair/triple has existential witnesses for an ACTUAL complete shard and is realized there (cub_tsp_038_pair/triple_realized_somewhere). The global NoDup(flattened metric soup) premise is load-bearing: shared occurrences such as (1,2),(1,3) are outside this theorem, and anchors are not modeled. The 13-pair context spans 2 shards. Kernel scope: Coq = full shard construction and realized-somewhere result; Lean/Verus = general chunk capacity + lossless reassembly; the over13 executable instance is Coq+Lean only. Honest boundary: relations do not span shards; inter-shard structure is an index, not geometry; portal cells, recursive inner cubes, runtime sharding, physical sticker legality, and global placement optimality remain open.