cubie-core/src/derived_candidates.rs:2766 in cub_0119_a_denyondecrementfailure_theorem -> cub_0718_one_time_execution_lease; cubie-core/src/derived_candidates.rs:2767 in cub_0119_a_denyondecrementfailure_theorem -> cub_0718_one_time_execution_lease; cubie-core/src/derived_candidates.rs:2772 in cub_0119_a_denyondecrementfailure_theorem -> cub_0718_one_time_execution_lease

reviewed audit contract blocks this file-local evidence from the canonical CUB identity


cubie-core/src/derived_candidates.rs:2769 in cub_0119_a_denyondecrementfailure_theorem -> cub_0719_replay_rejected; cubie-core/src/derived_candidates.rs:2769 in cub_0119_a_denyondecrementfailure_theorem -> cub_0719_replay_rejected; cubie-core/src/derived_candidates.rs:2773 in cub_0119_a_denyondecrementfailure_theorem -> cub_0719_replay_rejected


cubie-core/src/hardened_gate_wiring.rs:77 cub_0765_magic_hamming_distance: no-arg, returns the constant HG_AUTH_PASS ^ HG_AUTH_FAIL; ensures distance == 0xFFFF_FFFF (proven-implication constant over two shipping consts); bare-metal-tests/tests/hardened_gate_direct.rs:25 exercises the distinct hardened_gate.rs const-fn twin, not this wiring witness

Plan Wave 2 / lane rule: a no-arg constant witness with no named consumer is a costume trap; the wiring.rs copy is UNINVOKED and the production pre-gate never calls it. STANDALONE-BY-DESIGN; rebuild-to-read-a-shipping-const is out of scope for this lane.


cubie-core/src/hardened_gate_wiring.rs:92 cub_0766_magic_words_distinct: no-arg, returns HG_AUTH_PASS != HG_AUTH_FAIL; ensures distinct (constant true over the two shipping consts); bare-metal-tests/tests/hardened_gate_direct.rs:43 exercises the hardened_gate.rs const-fn twin

Plan Wave 2 / lane rule: no-arg constant witness, no named consumer, wiring.rs copy UNINVOKED. STANDALONE-BY-DESIGN.


cubie-tools/src/main.rs topology-selftest subcommand (cargo run -p cubie-tools -- topology-selftest); cubie-tools/src/runtime_shadow.rs topology_selftest_fixture() -> cubie_core::cube_topology::cub_0815_zero_state_zero_dims; verus/cubie_bitboard_spec.rs + bare-metal-tests/tests/cube_topology_polytope.rs (test anchor)

Q0 plain candidate (cube_topology.rs): zero-state dimensional count witness is exercised on every topology-selftest run. TEST-ANCHORED host consumption; not admit hot-path.


cubie-tools/src/main.rs output-state-selftest subcommand; cubie-tools/src/runtime_shadow.rs output_state_selftest_fixture() -> cubie_core::output_state_wiring::cub_0844_all_distinct_codes_hamming_8; cubie-core/src/output_state_wiring.rs exec witness (Q2 batch 2); verus/cubie_output_state_spec.rs cub_0844_all_distinct_codes_hamming_8; bare-metal-tests/tests/output_state.rs cub_0844_all_distinct_codes_hd_8_or_more

Q2 WIRE-ELIGIBLE batch 2: pairwise OutputState Hamming >= 8 witness on output-state-selftest face. TEST-ANCHORED advisory only.


file-local theorem numbering in the cited sources collides with this canonical ID; the wiring-audit evidence below describes the file-local theorem, not this record (see the CUB-ID DISAMBIGUATION markers)


cubie-tools/src/main.rs cubieq-selftest subcommand; cubie-tools/src/runtime_shadow.rs cubieq_selftest_fixture() -> cubie_core::cubieq_wiring::cub_0924_catalog_match_purges_memory; cubie-core/src/cubieq_wiring.rs delegates to cubie_core::cubieq::kinetic_token_decision (Q2 batch 2); verus/cubieq_addendum_spec.rs cub_0924_catalog_match_purges_memory

Q2 batch 2 catalog-match purge witness via shipping kinetic_token_decision; TEST-ANCHORED advisory only.


cubie-tools/src/main.rs cubieq-selftest subcommand; cubie-tools/src/runtime_shadow.rs cubieq_selftest_fixture() -> cubie_core::cubieq_wiring::cub_0925_expiration_purges_memory; cubie-core/src/cubieq_wiring.rs delegates to cubie_core::cubieq::kinetic_token_decision (Q2 batch 2); verus/cubieq_addendum_spec.rs cub_0925_expiration_purges_memory

Q2 batch 2 expiration purge witness via shipping kinetic_token_decision; TEST-ANCHORED not production blocking.


bare-metal-tests/tests/cub_ctree_teeth_tests.rs:57 cub_0944_c_tree_base_case_teeth (spec-value pin, closed-form recompute, witness delegation to shipping c_tree(0))

Wave 1 teeth-test anchors c_tree(0) == 1 against the shipping recurrence and geometry consts; runtime wire not claimed.


bare-metal-tests/tests/cub_ctree_teeth_tests.rs:86 cub_0945_c_tree_depth1_teeth (spec-value pin, depth-1 recurrence step, closed-form recompute, witness delegation)

Wave 1 teeth-test anchors c_tree(1) == 55 against the shipping recurrence and geometry consts; runtime wire not claimed.


bare-metal-tests/tests/cub_ctree_teeth_tests.rs:114 cub_0946_c_tree_depth2_teeth (spec-value pin, depth-2 recurrence step, closed-form recompute, witness delegation)

Wave 1 teeth-test anchors c_tree(2) == 2971 against the shipping recurrence and geometry consts; runtime wire not claimed.


bare-metal-tests/tests/cub_ctree_teeth_tests.rs:144 cub_0948_omega_tree_exponent_depth0_teeth (definitional identity omega_tree_exponent(0) == c_tree(0) recomputed, cross-witness agreement)

Wave 1 teeth-test anchors omega_tree_exponent(0) == 1 against the shipping c_tree recurrence; runtime wire not claimed.


bare-metal-tests/tests/cub_ctree_teeth_tests.rs:170 cub_0949_omega_tree_exponent_depth1_teeth (definitional identity omega_tree_exponent(1) == c_tree(1) recomputed, closed-form recompute, cross-witness agreement)

Wave 1 teeth-test anchors omega_tree_exponent(1) == 55 against the shipping c_tree recurrence; runtime wire not claimed.


cubie-platform/src/cycle_counter.rs:229 cub_1017_admission_latency_fits_u64: no-arg; ensures result == (MAX_ADMIT_CYCLES <= u64::MAX), a trivially-true bound flagged absurd_extreme_comparisons (:227)

Plan Wave 2 no-arg-const rule: the bound MAX_ADMIT_CYCLES <= u64::MAX is true by type; recomputing it writes zero request-specific information. STANDALONE-BY-DESIGN; a rebuilt non-trivial latency bound is out of scope for this lane.


cubie-platform/src/capacity.rs:1137 weighted_seam_distance (proper metric, WEIGHTED_SEAM_MAX == 28; VERUS-BOUND, UNINVOKED on the admit path); bare-metal-tests/tests/v3_interop.rs:173/:180/:187 cub_1027 zero-self-distance, symmetry, and bounded-by-28 teeth-tests

Plan Wave 6 capacity v3 cluster: the weighted-seam-distance metric witness is anchored by real metric-property teeth-tests; runtime shadow wire is Wave 6 future work, not claimed. TEST-ANCHORED.


cubie-platform/src/capacity.rs:584 topology_bloom_probe and :618 bloom_insert (TOPOLOGY_BLOOM geometric-memory fast path; VERUS-BOUND, UNINVOKED on the admit verdict path); bare-metal-tests/tests/admit_batch4_test.rs:342-375 scalar bloom_insert + topology_bloom_probe vs accel_bloom_insert equivalence teeth-test (both-branch present/absent)

Plan Wave 6 capacity v3 cluster: the geometric-memory bloom fast-path insert/probe pair is anchored by a real scalar-vs-accel equivalence teeth-test; runtime shadow fast-path activation is Wave 6 future work, not claimed. TEST-ANCHORED.


cubie-core/src/replay.rs:75 payload_hash_matches(stored_hash, recomputed_hash): request-varying tamper predicate (result == (stored == recomputed); mismatch forces deny), VERUS-BOUND but UNINVOKED on the admit path; bare-metal-tests/tests/replay.rs:63/:71 cub_1040_payload_hash_match and cub_1040_payload_hash_mismatch both-branch tamper teeth-tests

Lane per-CUB read: the payload-hash tamper predicate is request-varying and anchored by a real both-branch tamper-detection teeth-test; its runtime wire is the Wave 6 sequence_check_and_update replay lane (not this lane). TEST-ANCHORED, no runtime call site claimed.


cubie-platform/src/admit.rs:563 fast-deny comment binding (vertices_all_pass agreement with fast_evaluate_topology); bare-metal-tests/tests/cub_1047_vertex_fast_deny.rs:45,59,92 property tests (solved state, random adversarial, one face broken); bare-metal-tests/tests/cub_corner_consensus_real_proof.rs:68,79,86,168 corner-consensus completeness tests

Adversarial review corrected the FUNCTION-IMPL anomaly: CUB-1047 is comment-bound to the live fast-deny path plus test-anchored, NOT a phantom. The scraped named_fn value cub_1047_ comes from the goodput.rs declared-range note (reconciled in the same change), not from a real fn definition.


cubie-platform/src/capacity.rs capacity_shadow_byte reads the live DimensionalBaseline via dimensional_regression_alert and packs it into DIMENSIONAL_REGRESSION (bit7), behind capacity_shadow_state; cubie-platform/src/admit.rs record_capacity_shadow_for records the byte (verdict-neutral tail) when the feature is on; bare-metal-tests/tests/capacity_shadow.rs shadow_stateful_bits_are_dynamic_after_training: bit7 is constant-0 fresh (run 1) and 100/200 after training (run 2)

Wave 6a shadow (opt-in): CUB-1054 dimensional-baseline regression recorded shadow-only, reading the EXISTING baseline store (no new cell). Two-run dynamism proven. PROVENANCE-WIRE; not new coverage.


cubie-platform/src/capacity.rs:1495 dimensional_baseline_observe (EMA-blended per-adapter dimensional baseline; VERUS-BOUND, UNINVOKED on the admit path); bare-metal-tests/tests/v3_interop.rs:533-625 dimensional_baseline_observe / dimensional_baseline_get teeth-tests (observation update, per-adapter isolation)

Plan Wave 6 capacity v3 cluster: the dimensional-baseline observation witness is anchored by real observe/get teeth-tests; runtime shadow wire is Wave 6 future work, not claimed. TEST-ANCHORED.


Belnap knowledge lattice + CUB-1221f knowledge-complement De Morgan (Wave 13B)

Coq+Lean+Verus verified-locally (Wave 13B correction)


0 axioms (Lean 4.30.0 #print axioms: propext only, no sorryAx; Coq text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Gap.v; coqc/coqchk not run in this workspace)

Coq PENDING-COQ-KERNEL; Verus PENDING-VERUS-KERNEL; Lean kernel-checked 4.30.0


0 axioms (Lean 4.30.0 #print axioms: no axioms, no sorryAx; Coq text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Gap.v; coqc/coqchk not run in this workspace)


0 axioms (Lean 4.30.0 #print axioms: no axioms at all, no sorryAx; Coq text scan: no Axiom/Admitted in coq/CubieDriveMathV1_3Gap.v; coqc/coqchk not run in this workspace)


0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1679_interface_count: does not depend on any axioms; no sorryAx


0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1680_interface_dominates: does not depend on any axioms; no sorryAx


0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1681_bexar_pow_le_pow_base: depends on axioms: propext; no sorryAx


0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1682_witness_64_byte_atomic: does not depend on any axioms; no sorryAx


0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1683_belnap_idem: does not depend on any axioms; no sorryAx


0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1684_belnap_top_unit: does not depend on any axioms; no sorryAx


0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1685_belnap_assoc: does not depend on any axioms; no sorryAx


0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1686_vn_symmetry: depends on axioms: propext; no sorryAx


0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1687_surface_spoofing_kill: does not depend on any axioms; no sorryAx


0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1688_seam_requires_lineage: depends on axioms: propext; no sorryAx


0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1689_goodput_no_overcommit: depends on axioms: propext, Classical.choice, Quot.sound; no sorryAx


0 axioms (text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieBexarMetalV1_4Omega.cub_1690_ha_fail_closed: depends on axioms: propext, Quot.sound; no sorryAx


0 axioms (text scan: no Axiom/Admitted in coq/CubieDriveMathV1_3Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieDriveMathV1_3Omega.cub_1709_two_pow_pos: depends on axioms: propext; no sorryAx


0 axioms (text scan: no Axiom/Admitted in coq/CubieDriveMathV1_3Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieDriveMathV1_3Omega.cub_1710_n_lt_two_pow: does not depend on any axioms; no sorryAx


0 axioms (text scan: no Axiom/Admitted in coq/CubieDriveMathV1_3Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieDriveMathV1_3Omega.cub_1711_drive_pow_le_pow_base: does not depend on any axioms; no sorryAx


0 axioms (text scan: no Axiom/Admitted in coq/CubieDriveMathV1_3Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieDriveMathV1_3Omega.cub_1712_geometric_complexity_futility: does not depend on any axioms; no sorryAx


0 axioms (text scan: no Axiom/Admitted in coq/CubieDriveMathV1_3Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieDriveMathV1_3Omega.cub_1713_hypercontraction_decay: does not depend on any axioms; no sorryAx


0 axioms (text scan: no Axiom/Admitted in coq/CubieDriveMathV1_3Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieDriveMathV1_3Omega.cub_1714_fano_error_lower_bound: depends on axioms: propext, Quot.sound; no sorryAx


0 axioms (text scan: no Axiom/Admitted in coq/CubieDriveMathV1_3Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieDriveMathV1_3Omega.cub_1715_kl_zero_leak_no_advantage: depends on axioms: propext, Quot.sound; no sorryAx


0 axioms (text scan: no Axiom/Admitted in coq/CubieDriveMathV1_3Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieDriveMathV1_3Omega.cub_1716_topological_entropy_exponential: does not depend on any axioms; no sorryAx


0 axioms (text scan: no Axiom/Admitted in coq/CubieDriveMathV1_3Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieDriveMathV1_3Omega.cub_1717_power_law_monotone: does not depend on any axioms; no sorryAx


0 axioms (text scan: no Axiom/Admitted in coq/CubieDriveMathV1_3Omega.v; not kernel-checked in this workspace) | Lean 4.30.0 print axioms Centillion.CubieDriveMathV1_3Omega.cub_1718_holevo_accessible_bounded: does not depend on any axioms; no sorryAx


none (Lean 0 sorry/0 axiom; Coq coqc pass)

Page-CUSUM per-cell recurrence (TEP FAR=0 detector)


V6.0 Omega Holographic Exhaustiveness (closed)


feature-gated signed-movement admit path: proof/runtime wiring exists, but do not count as deployable until the exact Coq mirror hash is kernel-checked and the signed movement gate is enabled for release


Lean not assessed in 2026-07-02 import; Coq none (coqchk 2026-08-13)


opt-in derived-candidate completeness probe


0 axioms (Lean 4.30.0 print axioms: propext only, no sorryAx; Coq text scan: no Axiom/Admitted in coq/CubieBexarMetalV1_4Gap.v; coqc/coqchk not run in this workspace)


propext (Lean); Coq Axioms:none expected (Print Assumptions)


SF-024 fail-closed OTT verification (SF #4)

Coq PENDING-COQ-KERNEL; Lean verified-locally


Corrected Belnap dual-operator negation laws (Wave 13B)


ported from cubie-research (PR #756, renumbered from 3122 collision)


none (Coq Print Assumptions: closed under global context x4; Lean #print axioms: no axioms x4)

host-sim (std;mock) patch soundness: CUSUM channel non-interference


Coq Axioms:none (coqchk 8.18 + Print Assumptions closed); propext (Lean)

WWT gateway classifier priority chain (alias CUB-CLASSIFIER-PRIORITY-001)


none (Coq Print Assumptions: closed under global context x3; Lean #print axioms: propext only x6)

WHERE face tenant-boundary detection: soundness + reachability + placement + CUSUM non-interference


none (Coq Print Assumptions: closed under global context x9; coqchk Axioms:<none>; Lean #print axioms: core-only propext/Classical.choice/Quot.sound + 2 axiom-free; no sorryAx)

wwt-gateway sliding-window per-key rate limiter (proofs-first; no runtime change)


none (Coq Print Assumptions: closed under global context x3; coqchk 8.18 Modules successfully checked; Lean #print axioms: propext + Quot.sound only; no sorryAx)

Epoch-rotation SHIPPING core mask at offset CC=0 (resolves audit P2-#14)


2 abstraction axioms Seam+SeamValid (coqchk context clean; Lean #print axioms: SeamValid only)

Seam validity: append decomposition (re-keyed from flat CUB-1940 seam-validity family)


Seam validity: prefix (firstn) preservation (re-keyed from flat CUB-1941 seam-validity family)


Seam validity: suffix (skipn) preservation (re-keyed from flat CUB-1942 seam-validity family)


1 abstraction axiom SeamValid (Seam is Inductive; coqchk context clean; Lean #print axioms: SeamValid only)

Seam validity: singleton characterization (re-keyed from flat CUB-1943 seam-validity family)


1 abstraction axiom SeamValid (Seam is Inductive; coqchk context clean; Lean #print axioms: propext + SeamValid)

Seam validity: reversal preservation (re-keyed from flat CUB-1944 seam-validity family)


none (coqchk Axioms: <none>; Lean #print axioms: propext + Classical.choice + Quot.sound, core omega footprint)

Wraparound-safe sequence freshness (wave3 lane C repair of the replay.rs u64::MAX acceptance, P3-#553)


none (coqchk: Closed under the global context; Lean #print axioms: none)

Shared MCP and pre-inference gateway canonical binding, including explicit RuntimePlan, ShadowCubie, and mirror commitments


none (coqchk closed; Lean #print axioms: none)

Runtime bare-metal V2 attestation coherence


Live QEC observation matches V2 attestation bytes


OpenVINO shadow screening is observable and verdict-neutral


Metadata proof requirements fail closed for declared artifacts and routes


Agent detector syndrome and anomaly coherence


Datacenter detector syndrome and anomaly coherence


Workflow capacity must be explicitly nonzero


TDX ingress gates admission and fails closed


Epoch descriptor runtime gates form one fail-closed readiness decision


OSCAL civil-date conversion ends at RFC3339 year 9999


TDX report type accepts only a zero 64-bit REPORTTYPE field


Governance preserves allow only with a healthy precondition


Governance policy hash equality is byte-complete and fail-closed


Identity temporal coherence is symmetric and bounded


Trusted VLAN routing requires the full sentinel gate


Orchestrator step masks enforce shift bounds before proof invocation


A denied ephemeral mint emits no key or quote bytes


Checked GRG recurrence rejects excessive work and arithmetic overflow


Four-gate constant-time mask is one iff every gate passes


Meta-cube shatter latches exactly at its bounce threshold


consumed during keyed precompile and independently recomputed when the signed compiled-sticker store loads; the request ledger carries the resulting receipt digest

abstract mirrors plus exact runtime observations, not executable theorem calls; invalid bundle/digest/observation refuses store activation before request forwarding

K_lower is the minimum shard count and no placement fits below it


The K_lower shard bound is achievable in the abstract lattice (fits at k=K_lower)


Canonical shared-metric alias resolution: consistent references to one metric resolve to one version


Placement grade never exceeds total and is complete iff every item is realised


Any mismatch among the recomputed commitment fields implies not-verified (divergence)


PASS requires supported+approved+non-contradictory; unsupported forbids PASS


none (coqchk Axioms: <none>; Lean core omega footprint)

Assume-guarantee lease composition: child narrows parent scope AND sum(sibling budgets) <= parent budget => tree-wide containment; runtime LeaseTree::add_child fail-closes scope-widening/over-budget children


Belnap evidence-fusion monoid (Omega join): associativity/commutativity/idempotence, identity TAMPER, absorber FLUID


Gauge invariance (PASS/FAIL channel-swap automorphism) + knowledge-order monotonicity of the fusion join


Finite-class scenario certificate predicate cert(C n en ed dn dd) := C*(ed-en)^n*dd <= dn*ed^n: reflection (boolean = integer inequality) + monotonicity in samples and eps; PAC out-of-sample probability interpretation is cited provenance NOT a proved theorem


Unified admission capstone: V(cells)=fold-fuse join (order-independent, monotone, gauge-invariant); LEMMA U0 the majority-3 vote is inadmissible (non-monotone) so the join replaces it by necessity; total deterministic 4-way AdmissionDecision projection; Admit gated on clause-4 risk (CUB-3198) + clause-5 lease (CUB-3195) witnesses


Present-value runtime cell equals the abstraction projection of the transformed field (PASS/FAIL only; never FLUID/TAMPER)


TransformV1::apply is a total panic-free fixed-point: clamp stays in range and is idempotent, Offset saturates and is monotone, zero denominator degrades to identity


AbstractionV1::apply is a total deterministic projection to a cell state; ThresholdGe and ThresholdLt are exact complements at every value


Verdict composition is the TAMPER>FAIL>FLUID>PASS max-lattice: PASS only if every cell passes, any FLUID/TAMPER forbids PASS, composition is monotone


Decision receipt is a deterministic, order-sensitive, program-hash-binding commitment over the program hash and ordered cell outcomes


Delta-fold coherence + streaming/batch representation independence: fold_left(fuse,l,acc)=fold_right(fuse,acc,l); V_from(acc,l++d)=fuse(V_from(acc,l),V(d)); verdict invariant under ANY evidence-list permutation (full S_n, extending CUB-3199's adjacent-swap generator); appending a delta never lowers knowledge; FLUID is a stream trap state


OperatorResource hot-gate tighten-only + MMIO enforce authorization


Anti-upgrade cell meet bound to shipping snap


Empty witness set / empty cell fold cannot PASS; shipping evidence_nonempty + compose gate


VerifiedStickerProgram capability; evaluate requires verify_into_capability/compile_verified


TransformV1::scale rejects den==0 (NonZeroI64); invalid policy fails construction


consumed only when OperatorResource receipt assembly executes; the runtime and its kill switch can disable that path

receipt and logical container bind the bundle; invalid integrity degrades to Unavailable; ProofStatusV1 stays NotBound/NotVerified


Canonical topology domain membership bound to CanonicalTopologyState::new


Resolution authority: PASS meet requires a PASS witness operand


Placement cell-domain safety + typed placement boundary


Verdict-fold generality: order-independent reduction with empty=NoEvidence


Seven-lane LaneReceiptSetV2 retains one slot per lane without pairwise overwrite


Sticker lane consumes sticker compiler/runtime evidence digests


Versioned domain-separated DecisionReceiptV2 binds request/policy/schema/compiler/evidence/freshness/signer


Independent verify recomputes digests and rejects tamper/replay/stale epoch


Production provenance verify(VerificationContext, LiveEpochKeyStore, ReplayStore)


ObservationSnapshotV1 unbound default projects Fluid never PASS-from-absence


Authoritative LogicalWorkContainerV1 identity fields from authenticated sources only


Admit record path is bounded nonblocking enqueue without filesystem I/O


consumed only when the signed-context admission backend executes; HostSim and classifier-only paths do not consume it

signed-context only; invalid bundle fails closed; HostSim remains advisory and does not consume or control the receipt

Tool-origin authority/preemption or explicit override evidence is blocked without making user-origin text satisfy the indirect-instruction predicate


The selected prefix min(input_len cap) is within both limits and maximal among all feasible prefixes


Canonical slot opposite-axis seam rejection and center-cell identity under Order B faces


Dependency-free reference carrier only; does not prove provider validity, replay sensitivity, FAR, authorization, or product runtime consumption.

Bounded TEP specialist-attribution bits occupy only logical syndrome bits 21 through 23; zero specialist input is non-interfering with the base syndrome.


Dependency-free coordinate carrier; excludes ontology, source-field, unit, provider-authority, UI, and production-activation claims.

coordinates::translate_cell + typed wrappers (crates/cubie-tep-reference/src/coordinates.rs)

The typed 54-cell TEP placement-to-semantic coordinate map is a bounded permutation with an inverse on its declared carrier.


Starts after term construction and quantization; excludes source-float lowering, full residual/replay parity, and product invocation. Schema-v3 checked mixed-scale folding is scoped separately by CUB-3255.

predictor::marginal_ar3 + predictor::conditional_poly_var3 (crates/cubie-tep-reference/src/predictor.rs)

The declared three-term marginal and six-term conditional already-quantized predictor descriptors equal their sequential left-fold reference semantics.


Includes the recovered negative-coefficient Q16-zero and higher-scale witnesses. Does not prove the host compiler's ties-even or greatest-safe-scale selection algorithm, provider completeness, or product authority.

For every declared fractional width 0 through 61, checked mixed-scale coefficient application equals arithmetic floor division and accepts exactly when the shifted result fits signed i64; signed i64 products fit i128.


The reference validator accepts exactly 50 data-bearing cells; mappings to sentinel variables 52 and 53 remain inactive while logical cells 52->37 and 53->38 remain eligible. Excludes provider parsing and replay parity.

active_mask::effective_active + active_mask::effective_mask (crates/cubie-tep-reference/src/active_mask.rs)

The effective TEP active mask is requested AND in-carrier AND data-bearing; it is a subset of the requested mask and preserves requested data-bearing pairs, including relocated logical cells 52 and 53.


Reference arithmetic carrier for schema-v3 folds; excludes coefficient recovery, float/model parity, complete-provider existence, replay parity, and product invocation.

predictor::checked_q16_mul + predictor::checked_left_fold (crates/cubie-tep-reference/src/predictor.rs)

Checked signed addition and arithmetic-shifted Q16 multiplication accept exact in-range results, reject overflow, and compose as the declared six-term sequential left fold when every prefix fits i64.


Reference tests separately exercise freshness, same-cell streaks, and confirmed-cell-only reset; the theorem itself proves only crossing/delay arithmetic and does not establish empirical calibration, FAR, coverage, or production readiness. Distinct from CUB-CUSUM-MIXED-001.

Under sustained positive drift, the strict Page-CUSUM crossing occurs first at floor(h/delta)+1; a separately bound c-sample same-cell confirmation policy yields the arithmetic index floor(h/delta)+c.


Versioned domain-separated ExecutionSettlementV2 binds receipt digests/dispatch/capacity/route/forecast-observed/telemetry/cache/timing/kill-switch/proof-runtime-registry


Independent V2 verification recomputes the receipt link and rejects legacy schema/domain bytes plus tamper/replay/stale independent receipt or settlement epochs


LogicalWorkContainerV2 is immutable and excludes route/capacity grant refs


Normalized capacity observations never invent absent measurements


Forecast vs Granted vs Unavailable; HMAC shared-key; Forecast is not a receiver grant; capacity signals never security deny


Sharded prefill/decode/colocated queues with idle reclaim; schedule recommendation actuator off in Shadow


Topology-aware RoutePlanV1 records would_route vs actual upstream; disaggregate only when isolation beats KV/network cost


Signed pressure notices with TTL/hysteresis/recovery; congestion vs health-fault; would_defer/would_reroute never authorization failure


Arity unification: sticker count = arity = blast radius; Belnap 2-bit meet PASS meet FAIL = TAMPER corner coherence


CMI Turing-machine model plus the class DEFINITIONS P and NP over a binary alphabet. Class_P was machine-checked VACUOUS in its loose form and was tightened (fixed budget + required halting); Class_NP was NOT vacuous and got the same form for consistency. Both confirmed satisfiable (not over-tight). Definitions only -- proves nothing about P vs NP.


Binary serialization of a TSP decision instance and the TSP decision language L_TSP (a CMI Language). Definition only. (compute_tour_cost fixed: a v::_ as t match parsed as tail-of-tail and summed alternating pairs -- a latent bug nothing constrained; now a clean head-carrying helper summing consecutive edges.)


Executable poly-time NP-RELATION checker for TSP (Hamiltonicity + budget) -- Verus companion to L_TSP. Verus-verified: panic-free/in-bounds/terminating and postcondition BUDGET-SOUNDNESS (is_valid => cost <= budget). Structural checks execute but are NOT lifted into the spec; NOT a proof that L_TSP in NP.


canonical contract repair; canonical_poly_reduces_is_strict is reflexive; no semantic erasure bridge

Canonical polynomial-time many-one reduction relation poly_reduces over the faithful finite STM: TapeSym has distinct Blank and Bit bool constructors, reachable states are bounded by s_num_states, one (k,c) is fixed up front, execution uses the exact polynomial budget, and the machine must have halted. The former Boolean-tape Blank=false relation is preserved only as legacy_poly_reduces because word_reduce is proven trailing-false-sensitive.


3-CNF syntax/semantics/total binary parser and the 3-SAT decision language L_3SAT. Definition only.


NP_Hard/NP_Complete DEFINITIONS over the real L_3SAT/L_TSP. Cook-Levin and TSP-completeness are STATED as open; the sole THEOREM is conditional (L_TSP NP-complete IF poly_reduces is transitive). No Admitted; 0 axioms.


Boundary marker separating easy-sub-family from P vs NP. PROVEN (0 axioms): all-accepting and all-rejecting languages are in Class_P -- so Class_P membership of a restricted/finite/structured TSP variant says NOTHING about the general L_TSP. tsp_in_P_open := Class_P L_TSP is STATED open (a P=NP resolution is exactly its proof; its negation is P<>NP). Refutes the wreath/RG easy-sub-family = P=NP error inside the kernel.


Binary serialization + syntax/semantics of the Directed Hamiltonian Cycle decision language L_DHC (structural mirror of L_TSP). Infrastructure for the Karp chain L_3SAT <=p L_DHC <=p L_UHC <=p L_TSP. Definition only; the reductions (NP-hardness Karp 1972) are in progress. Not P vs NP.


Karp Phase 2 node-tripling DHC->UHC PROVEN as a 0-axiom IFF (dhc_to_uhc_correct: dhc_instance_solvable d <-> uhc_instance_solvable (dhc_to_uhc_instance d); v -> in=3v mid=3v+1 out=3v+2; directed edge u->v -> undirected out_u--in_v). FORWARD (dhc_to_uhc_forward) via tripled_path (removelast p). BACKWARD (dhc_to_uhc_backward): traversal-forcing FULLY MECHANISED -- mid degree-2 inversions (mid_neighbor_inv/'), mid_flanked + junction_next_mid force each block, front-peel induction forward_reconstruct proves a forward-started valid UHC walk IS a tripled walk, orientation dispatched (mid0_dispatch + is_valid_uhc_rev via matrix symmetry), tripled_edges_to_chain + chain->nth bridges + project yield is_valid_dhc. NP-hardness (Karp 1972) not P vs NP.


many_one reduction algebra (poly_bound output-length + membership-preserving map): reflexivity; non-vacuity; TRANSITIVITY with the composed budget (k1*k2; c2*(c1+1)^k2) -- discharging UNCONDITIONALLY the reduction-transitivity that CUB-COMPLEXITY-005 leaves as a hypothesis; at the many_one (output-length) level which is STRICTLY WEAKER than poly_reduces (no TM required). Capstone tsp_nphard_via_many_one derives L_TSP NP-completeness from the concrete reduction with NO transitivity assumption. The stronger poly_reduces/s_poly_reduces transitivity stays gated on the item-4 word_reduce machine. 0 axioms; coqchk Axioms: <none>.


instance chain closed in this module; canonical poly_reduces close is phase4_poly_reduces in proofs/coq/ComplexityStrictEncodeTsp.v

karp_chain_solvability_closed + threesat_to_dhc_reduction + word_reduce_correct

Capstone composing the Karp chain at instance-solvability level. PROVEN (0 axioms): threesat_to_dhc_reduction, dhc_to_uhc_reduction, uhc_to_tsp_reduction, and karp_chain_solvability_closed discharge all three instance phases. word_reduce_correct packages the total membership-preserving Word map. The canonical finite-machine Phase-4 wrapper is discharged downstream by CUB-COMPLEXITY-STRICT-ENCODE-TSP. NP-hardness (Karp 1972), not P vs NP.


concrete instantiation of the many_one algebra: many_one L_3SAT L_TSP is now a 0-axiom THEOREM via word_reduce. The content is poly_bound 4 (7*72*72) word_reduce -- output length <= 36288*(|w|+1)^4 -- proven from the UNARY-parser size lemmas (split_clauses_length; decode_len; formula_maxvar via trues-conservation -> num_clauses/num_vars <= O(|w|)) chained through karp_g_size_poly + word_reduce_length. Discharges the reduction premise of tsp_nphard_via_many_one; the premise-lighter capstone tsp_nphard_via_many_one_concrete needs ONLY Cook-Levin + TSP-in-NP (both open). LENGTH side only -- poly-TIME poly_reduces/s_poly_reduces still needs the item-4 machine. 0 axioms; coqchk Axioms: <none>.


Resolution propositional proof system (literals/clauses/CNF + the resolution rule) with a PROVEN soundness theorem (a refutation deriving the empty clause => the CNF is unsatisfiable; 0 axioms). Soundness is a CORRECTNESS property NOT a lower bound. Haken 1985 (Resolution refutations of PHP_{N+1,N} have size 2^Omega(N)) is STATED over the concrete generator generate_PHP_CNF and the resolution_size metric as open obligation haken_resolution_lower_bound_open NOT proven. Proof-complexity infrastructure; does not approach P vs NP.


coqchk Axioms:<none>; 34 Qed; coq-only proof-complexity corpus, no Lean/Verus mirror

php_unsatisfiable + php_refutation_contains_every_axiom + php_resolution_cubic_lower_bound + php1_refutation_min_size

first brick toward Haken 1985 over generate_PHP_CNF. php_unsatisfiable: PHP_N unsatisfiable for every N (constructive finite pigeonhole no_injection + hole-function extraction). php_refutation_contains_every_axiom: minimal unsatisfiability -- every Resolution refutation of PHP_N contains every axiom clause (derivation_avoid filtering + resolution_soundness + explicit matching-assignment witnesses php_minus_pigeon_sat/php_minus_hole_sat). php_resolution_cubic_lower_bound: 2*size >= 4 + 2(N+1) + N^2(N+1), an Omega(N^3) size lower bound for all N>=1. php1_refutation_min_size: PHP_1 refutations need >= 5 lines (tight). HONEST SCOPE: Omega(N^3) is polynomial -- haken_resolution_lower_bound_open (exponential) remains OPEN; next brick = width bound via matching-restricted entailment measure (Ben-Sasson--Wigderson route).


coqchk Axioms:<none>; coq-only proof-complexity corpus

pmatching + pm_assign + entails_m + hole_axioms_entailed

Haken chain brick 1/4: matching-assignment layer over generate_PHP_CNF. pmatching + pm_wf (partial injection pigeons->holes, total on holes: |M|=N) + pm_assign (induced assignment via phi encoding) + entails_m (matching-restricted entailment). Lemmas: total_matching_exists (id_matching wf), hole_axioms_entailed, entails_m_weaken, pm_assign_true_iff.


covers + mu_at_most + mu_subadditive + mu_empty_clause_hard

Haken chain brick 2/4: the mu measure in predicate form. covers N S C (every wf matching satisfying pigeon axioms of S satisfies C) + mu_at_most N k C (exists covering pigeon-set of size <= k). mu_hole_axiom (<=0), mu_pigeon_axiom (<=1), mu_subadditive (resolvent covered by S1++S2, deduped), mu_empty_clause_hard (~mu_at_most N N empty_clause via skip_matching construction).


covers_b_iff + mu_at_most_b_iff + mu_at_most_dec

Haken chain brick 3a/4: decidability by finite enumeration -- the constructive excluded-middle the IVT walk needs (repo forbids classical axioms). sublists (2^n) + sublists_complete; covers_b + covers_b_iff (full two-directional reflection); mu_at_most_b + mu_at_most_b_iff; mu_at_most_dec.


ivt_medium_mu + derivation_first_failure + mu_at_most_mono_k

Haken chain brick 3b/4: the IVT walk. derivation_first_failure (generic decidable first-failure over a derivation: failing line is axiom or resolvent of two passing lines) + ivt_medium_mu: every refutation of PHP_N (N>=3) contains a clause C with ~mu_at_most N (N/3) C and mu_at_most N (2*(N/3)) C -- exact constant 2*(N/3), tighter than 2*(N/3)+1.


coqchk Axioms:<none>; coq-only proof-complexity corpus; 351 lines

php_width_lower_bound + minimize_cover + swap_flip_literal

Haken chain brick 4/4 -- THE WIDTH LOWER BOUND (Ben-Sasson--Wigderson stepping stone to Haken 1985). php_width_lower_bound: every resolution refutation of generate_PHP_CNF N (N>=3) contains a clause of width > N/3 (strict; K=3, the full textbook constant). Engine: minimize_cover (constructive minimal covering set via covers_b reflection), witness_unmatched, swap_flip_literal (total-matching swap flip), dichotomy count (every p in S0 mentioned => width >= |S0| > N/3; some p unmentioned => every eligible swap edge yields a distinct literal => width >= N-|S0|+1 > N/3). HONEST SCOPE: the exponential haken_resolution_lower_bound_open remains OPEN -- the missing step is the size-width tradeoff.


coqchk Axioms:<none>; coq-only strict-TM corpus (Complexity* convention), no Lean/Verus mirror

s_phase4_from_stage_machines + stm_seq_clean_computes_poly + stm_seq_clean_preserves_poly + s_bounded_halt_has_first

single-polynomial BUDGET WRAPPER closing the composition layer (the item-(i) gap bricks 6/7 left open): machine-intrinsic output bound (clean_output_length -- tape grows <=1 cell per step via s_step_tsize; s_extract <= tape; s_init <= |w|+1 cells; so |f w| <= |w|+1+budget with NO poly_bound hypothesis); explicit budget algebra seq_K=(k1+1)*(k2+1) and seq_C=2*(c1+c2+c2*(2c1+1)^k2)*2^seq_K (seq_budget; (n+1)-power basis + pow_base_succ_le conversion keep nia on small symbolic terms); stm_seq_clean_computes_poly (clean o computes = genuine s_computes_in_poly_strict at the explicit budget -- brick 6 upgraded); stm_seq_clean_preserves_poly (clean o clean = clean at the explicit budget; composite halt time pinned <=t1+t2 by never-halts-early minimality -- brick 7 upgraded); s_bounded_halt_has_first derives the least/never-early halt witness from any bounded halt; s_clean_implies_computes; capstone s_phase4_from_stage_machines: two clean transducers g1 g2 + a computer g3 with g3(g2(g1 w)) = word_reduce w discharge s_poly_reduces L_3SAT L_TSP outright. Does NOT build any stage machine; strict wrapper remains OPEN reduced to exactly the three stage machines. NP-hardness (Karp 1972) not P vs NP.


coqchk Axioms:<none>; wrong-halving and missing-successor Fail controls included

s_ceilhalve_run + ch_total_fuel_quadratic + s_ceilhalve_clean_pad

Ten-state total fused unary halve-plus-successor. s_ceilhalve_clean_pad computes repeat true (S (halve (bit_to_nat w))) for every word with first-halt minimality, canonical blank padding, and budget 6*|w|^2+6; unary specialization is the terminal num_vars arithmetic.


coqchk Axioms:<none>; coq-only strict-TM corpus (Complexity* convention), no Lean/Verus mirror; closure theorems live in proofs/coq/ComplexityStrictCellClose.v (ComplexityStrictCell.v itself byte-unchanged)

word_reduce_bit_form + s_encode_tsp_computes_bit_form + strict_cell_premise + strict_cell_residual_closed + strict_cell_residual_closed_canonical

{1,2}-cell reduction of strict Phase-4: word_reduce_stream's grid cells are 1 (edge) or 2 (non-edge) per the UHC->TSP cost gadget, budget B=N. word_reduce_stream_bit restates the emission as enc_nat N (twice) ++ an N*N grid of edge-bit-selected 2/3-bit constants; strict_phase4_reduced_to_edge_decision shows a strict machine for that form closes s_poly_reduces (via s_phase4_from_stream). Narrows the SOLE open residual from 'compute an arbitrary nat per cell' to 'decide one edge bit karp_edge = uhc_matrix(dhc_to_uhc(threesat_to_dhc2(parse_3sat w))) u v'. This module does NOT build that decider. CLOSED by proofs/coq/ComplexityStrictCellClose.v (2026-08-12): word_reduce IS the {1,2}-cell emission (word_reduce_bit_form), so the s_encode_tsp witness of CUB-COMPLEXITY-STRICT-ENCODE-TSP discharges the exact existential premise (strict_cell_premise) and strict_cell_residual_closed derives strict s_poly_reduces L_3SAT L_TSP through strict_phase4_reduced_to_edge_decision itself. NP-hardness (Karp 1972), not P vs NP.


Print Assumptions Closed; targeted pinned Coq compile and coqchk Axioms:<none>; exact 269-state product and 70*span^2 least-halt bound; malformed-record semantics intentionally unspecified; descriptor/edge stage remains open

sat_literal_query_word_span + s_literal_query_unpack_state_bound + s_literal_query_unpack_well_formed + literal_query_unpack_exact_run + literal_query_unpack_first_halt + s_literal_query_pack_state_bound + s_literal_query_pack_well_formed + literal_query_pack_exact_run + literal_query_pack_first_halt + s_sat_literal_table_clean_state_bound + s_sat_literal_table_clean_well_formed + sat_literal_table_clean_first_halt_span_base + sat_literal_table_clean_first_halt_span + sat_literal_table_clean_extract

Canonical clean-word packaging for the total parser-faithful literal-table machine. The canonical bit-only record is false :: sat_N_frame(w) ++ [false] ++ true^i ++ [false] ++ true^j ++ [false;pos;acc], whose exact length is clause_seek_span(w,i,j). A well-formed 9-state physical unpacker converts only its marker and three serialized separators to distinct Blank cells, preserving arbitrary metadata behind the frame/base sentinel and landing at the existing selector-ready raw layout. The unchanged well-formed 252-state total raw machine executes, and a well-formed 8-state physical packer restores every serialized separator and the leading marker. Their well-formed 269-state composition has a least halt within 70*(clause_seek_span w i j)^2 for every w,i,j,pos,acc and arbitrary TapeSym base, preserves the complete frame/query/base, and changes only acc to acc OR serialized_literal_table(sat_N_frame w,i,j,pos). For base=[] the result is exactly blank_padded and extracts to the canonical output word. Controls execute default and in-range branches, polarity mutation, partial-clause parsing, nonzero fields, exact early nonhalt, arbitrary mixed base preservation, and rejected wrong accumulator/marker/separator layouts. This is an indexed canonical-record theorem, not a decoder or acceptance claim for arbitrary malformed Words. Finite descriptor encoding/comparison, karp_edge, grid emission, encode_tsp, and the strict reduction capstone remain OPEN.


the FIRST machine-to-parse bridge, closing the Div3 brick's recorded honest-scope gap: split_len_terminated (on delimiter-terminated encodings -- last w false = false, [] included via the default -- #parts = #false exactly; the dangling-true divergence is precisely what termination excludes), decode_len_div3 (clauses consume three parts at a time = floor division, fuel-indexed depth-3 induction), num_clauses_parse (num_clauses (parse_3sat w) = #false(w)/3 on terminated w). HEADLINE clause_counter_counts_clauses: on every delimiter-terminated encoding the strict machine clause_counter HALTS within its proven polynomial budget with s_extract = repeat true (num_clauses (parse_3sat w)) -- a strict finite machine provably producing a parameter of the PARSED formula. Two Symbol-vs-bool elaboration traps resolved (forall w : Word annotation; conversion-change over rewrite for mixed @cons elaborations). Stage bodies num_vars/N/grid remain; strict wrapper OPEN. NP-hardness (Karp 1972) not P vs NP.


Print Assumptions Closed; exact 18-state default body; total raw routing closed in CUB-COMPLEXITY-STRICT-CLAUSE-ROUTER; clean-pad interface remains open

tally_bits_right_same + s_clause_default_scan_raw_state_bound + s_clause_default_scan_raw_well_formed + clause_default_scan_exact_run + clause_default_scan_first_halt + s_sat_clause_default_cycle_raw_state_bound + s_sat_clause_default_cycle_raw_well_formed + sat_clause_default_cycle_first_halt_span + sat_clause_default_cycle_literal_table_first_halt_span

Standalone parser-default clause-query cycle. The well-formed 10-state s_clause_default_scan_raw walks the selector-ready SAT frame and unary i/j query fields, preserves every cell, and computes sticky acc OR (i=0 AND pos) at the far-right Blank in exactly |sat_N_frame w|+i+j+5 steps. Hstate0 is the exact existing qrf_start_cfg; composition with the 8-state reframe gives the well-formed 18-state s_sat_clause_default_cycle_raw. Its whole-product first halt returns the exact selector-ready layout within 2*clause_seek_span for every i and j. Under num_clauses(parse_3sat w)<=j, the output is exactly acc OR serialized_literal_table(sat_N_frame w,i,j,pos). Executable controls cover empty/default-positive, one-step-early nonhalt, sticky accumulator, and a rejected wrong output. This remains the standalone default branch body; the parser-faithful range marker and physical router now compose it with the in-range product as a total raw machine. No |w|-only bound is claimed for arbitrary external unary j. Canonical clean padding, karp_edge, grid emission, encode_tsp, and the strict capstone remain OPEN.


coqchk Axioms:<none>; total formula-plus-clause machine closed; two-field joint-frame semantics pinned; payload-preserving num_vars/N/grid/final reduction open

s_clauseframe_raw_clean_pad + s_clauseframe_clean_pad + sat_parameter_frame_parse + sat_parameter_fields_exact

Total payload-preserving clause-field appender and parser-safe joint-frame specification. The 28-state s_clauseframe_raw preserves every input bit and appends enc_nat(count_false(w)/3), with first-halt minimality, canonical blank padding, and budget 24*|w|^2+24 on every word. The 41-state s_clauseframe precomposes normalization and emits normalize_complete_clauses(w) ++ enc_nat(num_clauses(parse_3sat w)) under one seq_K/seq_C budget. sat_parameter_frame proves that exactly two suffix fields, num_vars then num_clauses, preserve parse_3sat and are physically recoverable; appending a third field is an executable negative control. The payload-preserving num_vars machine needed to compute that two-field target remains open.


coqchk Axioms:<none>; Route B total normalizer; negative mutation control included

Thirteen-state total parser-preserving complete-clause normalizer. normalize_mod3_correct identifies the executable machine specification with normalize_complete_clauses; s_clause_normalize_clean_pad proves first-halt minimality, canonical blank padding, and budget 3*|w|+3 for every word.


Print Assumptions Closed; pinned Coq compile; whole-product halt minimality and explicit quartic input budget; one-tally in-range raw brick

s_sat_clause_first_query_raw_state_bound + s_sat_clause_first_query_raw_well_formed + sat_clause_seek_literal_init + sat_clause_first_query_first_halt_span + sat_clause_first_query_first_halt_strict_quartic + slm_done_direct_reentry_halted

IN-RANGE first-literal operational composition. The 61-state s_sat_clause_first_query_raw is the finite product of the 22-state preservation-safe clause selector and the 39-state arbitrary-middle query. The exact selector halt is physically identical to the query start; the whole product has a least halt within 20*(frame+i+j+6)^2, and under grid-range premises within the explicit strict quartic constant (20*900*16)*|w|^4+(20*900*16). Its final tapes exactly encode acc OR the selected clause's first tally. A checked negative control proves direct query reentry halts on the far-right Blank, so a real reframe/reselect adapter is required before later tallies. The complete in-range three-tally product is closed separately; total out-of-range behavior, clean padding, karp_edge, grid emission, encode_tsp, and the strict capstone remain OPEN.


Print Assumptions Closed; exact 212-state in-range product; total raw routing closed in CUB-COMPLEXITY-STRICT-CLAUSE-ROUTER; clean-pad stage remains open

ci_third_query_frame_reconstruct + s_sat_clause_third_cycle_raw_state_bound + s_sat_clause_three_query_raw_state_bound + s_sat_clause_three_query_raw_well_formed + sat_clause_three_query_out_correct + sat_clause_three_query_literal_table_first_halt_span + sat_clause_three_query_literal_table_first_halt_strict_quartic

Complete IN-RANGE three-literal table query product. The well-formed 212-state s_sat_clause_three_query_raw composes three selector/query/reframe cycles: 69 states for tally one, 71 for tally two after one delimiter, and 72 for tally three after two delimiters. Its whole-product least halt returns the exact selector-ready SAT frame within 63*(clause_seek_span)^2, with the sticky accumulator equal to acc OR serialized_literal_table(sat_N_frame w,i,j,pos). Under grid-range premises the explicit strict quartic constant is 63*900*16 = 907200. Third-prefix reconstruction proves the physical Blank frame/base sentinel remains load-bearing. A checked halted-machine counterexample at j=num_clauses directly disagrees with the serialized parser table, so this standalone selector cannot decide range. The parser-default body, range marker, and physical router are closed separately as the total raw literal-table product. This theorem remains the raw internal-layout, j-in-range branch result; canonical clean padding, finite karp_edge, grid emission, encode_tsp, and the strict capstone remain OPEN.


Print Assumptions Closed; targeted pinned Coq compile and coqchk; exact 71-state cycle; in-range three-query product closed separately

stm_seq_first_halt_layout + ci_second_query_frame_reconstruct + sat_clause_second_query_reframe_start + s_sat_clause_second_cycle_raw_state_bound + s_sat_clause_second_cycle_raw_well_formed + sat_clause_second_cycle_first_halt_span

Complete in-range second-literal query cycle. The reusable stm_seq_first_halt_layout theorem composes arbitrary internal-layout stages from least-halt and exact Hstate0 contracts without pretending they are clean s_init transducers. The well-formed 71-state s_sat_clause_second_cycle_raw is selector -> one-delimiter skip -> 39-state literal query -> 8-state reframe. Its whole-product first halt returns the exact selector-ready SAT frame with accumulator updated by tally two within 21*(clause_seek_span)^2. The second-query prefix/base reconstruction proves the Blank sentinel remains load-bearing and recovers the original sat_N_frame exactly. A sticky-accumulator control and false dropped-accumulator statement are checked. This cycle remains explicitly j-in-range; the combined in-range first/second/third product is closed separately. The total out-of-range default branch, clean padding, karp_edge, grid emission, encode_tsp, and the strict capstone remain OPEN.


Print Assumptions Closed; exact 19-state total range marker and 5*span^2 internal-layout budget; total raw router closed in CUB-COMPLEXITY-STRICT-CLAUSE-ROUTER

s_clause_range_raw_state_bound + s_clause_range_raw_well_formed + clause_range_core_exact_run + sat_clause_range_exact_run + sat_clause_range_exact_first_halt + sat_clause_range_fuel_span_quadratic + sat_clause_range_first_halt_span + clause_range_done_Hstate0

Total parser-faithful range marker for canonical SAT clause queries. The well-formed 19-state s_clause_range_raw counts Bit-false delimiters modulo three across the exact sat_N_frame, cancels one unary j bit per complete clause, restores every temporary frame and query mark, and replaces only the frame-boundary Blank with Bit(j < num_clauses(parse_3sat w)). The exact theorem quantifies over every w, i, and j; the least halt is bounded by 5*(clause_seek_span w i j)^2. The two enc_nat suffix fields are load-bearing and independently cross-checked by count_false(sat_N_frame w)/3 = num_clauses(parse_3sat w). Executable controls cover empty input, equality and greater-than bounds, multiple clauses, a partial clause, a one-bit completion that flips the flag, full restoration with a nonempty base, one-step-early nonhalting, and a rejected wrong flag. This remains the standalone internal-layout marker; the physical router and total raw literal-table product are closed separately. Canonical padding, karp_edge, grid emission, encode_tsp, and the strict capstone remain OPEN.


Print Assumptions Closed; pinned Coq compile; exact physical reframe and selector-ready handoff; in-range internal-layout brick

s_clause_query_reframe_raw_state_bound + s_clause_query_reframe_raw_well_formed + qrf_exact_run + qrf_first_halt + qrf_slm_done_start + sat_clause_first_query_reframe_selector_ready + sat_clause_first_query_reframe_fuel_grid_quadratic + sat_clause_first_query_reframe_first_halt_span

IN-RANGE first-query reframe brick. The well-formed 8-state s_clause_query_reframe_raw starts at the literal-query far-right Blank, preserves every tape cell while crossing the flag, metadata, index, and serialized-frame regions, then uses the explicit frame/base Blank sentinel to turn right and halt in the selector-ready layout with the updated OR accumulator. Its exact fuel is |sat_N_frame w|+i+j+7 = S(clause_seek_span), with least-halt/no-early evidence and the explicit bound 31*(|w|+1)^2 under grid-range premises. The sentinel is load-bearing because generic slm_done_cfg base/k parameters are not uniquely recoverable. A checked wrong-accumulator negative control prevents restoration of the stale input accumulator. Delimiter skips and all three in-range cycles are closed separately; the total out-of-range branch, clean padding, karp_edge, grid emission, encode_tsp, and the strict capstone remain OPEN.


Print Assumptions Closed; targeted pinned Coq compile and coqchk; exact 233-state physical router and 252-state total raw product; 69*span^2 least-halt bound; clean-pad interface remains open

s_clause_query_router_raw_state_bound + s_clause_query_router_raw_well_formed + sat_clause_query_router_true_rewind_exact + sat_clause_query_router_false_rewind_exact + sat_clause_query_router_true_first_halt_span + sat_clause_query_router_false_first_halt_span + sat_clause_query_router_literal_table_first_halt_span + s_sat_literal_table_raw_state_bound + s_sat_literal_table_raw_well_formed + sat_literal_table_raw_first_halt_span

Total parser-faithful raw serialized-literal-table machine. The 19-state range marker writes the physical Boolean j<num_clauses(parse_3sat w). The well-formed 233-state router reads only that tape marker, erases it to Blank, physically rewinds across the complete preserved sat_N_frame to its explicit Blank sentinel, and dispatches through disjoint finite slices: states [3,215) execute the existing 212-state in-range three-literal query and states [215,233) execute the existing 18-state parser-default cycle; malformed Blank marker starts halt closed. The well-formed 252-state s_sat_literal_table_raw composes marker and router for every w, unary i and j, polarity, incoming accumulator, and arbitrary base. Its first halt is bounded by 69*(clause_seek_span w i j)^2 and returns the exact selector-ready layout with accumulator acc OR serialized_literal_table(sat_N_frame w,i,j,pos), with no clause-range or delimiter premise. Executable and Fail Example controls cover both branches, empty/partial/complete formulas, greater out-of-range indices, sticky accumulation, polarity, arbitrary nonempty base, one-step-early nonhalting, malformed markers, wrong output, and wrong branch. This closes only the total RAW internal-layout stage; canonical clean padding, finite karp_edge, grid emission, encode_tsp, and the strict reduction capstone remain OPEN.


Print Assumptions Closed; targeted pinned Coq compile; default tally 1 parity control; selector is not a total literal-table transducer

s_clause_seek_raw_state_bound + s_clause_seek_raw_well_formed + ci_full_exact_run + ci_full_safe_run + sat_clause_seek_safe_first_halt_strict_cubic + ci_done_literal_init + sat_target_clause_or + sat_N_literal_table_out_of_range

IN-RANGE preservation-safe serialized clause selector and literal-query handoff. The 22-state s_clause_seek_raw is finite and well formed; ci_full_exact_run and ci_full_safe_run move across an explicit clause prefix, restore every skipped clause and query field, and halt with the target first tally under the head. SAT-frame glue proves a least halt within 424*|w|^3+424 when i and j are in range, identifies the selected three-tally OR with serialized_literal_table, and proves that resetting the halt state yields the existing 39-state slm_init_cfg with identical tapes. The parser's out-of-range value and positive-x0 default representation are pinned as pure semantics. The in-range three-tally product is closed separately; the total out-of-range branch, clean padding, karp_edge, grid, encode_tsp, and strict capstone remain OPEN.


Print Assumptions Closed; targeted pinned Coq compile; exact delimiter crossings; in-range three-query product closed separately

s_tally_skip_raw_state_bound + s_tally_skip_raw_well_formed + tally_skip_exact_run + tally_skip_first_halt + s_tally_skip_two_raw_state_bound + s_tally_skip_two_raw_well_formed + tally_skip_two_exact_run + tally_skip_two_first_halt + sat_clause_seek_skip_to_second_query_reentry + sat_clause_seek_skip_to_third_query_reentry + sat_clause_skip_two_fuel_le_span

Preservation-safe clause-tally adapters. The well-formed 2-state s_tally_skip_raw scans one unary tally, crosses exactly one Bit-false delimiter, preserves every tape cell, and halts on the next tally in exactly k+1 steps. The well-formed 3-state s_tally_skip_two_raw directly crosses the first two delimiters after fresh reselection and lands on tally three in exactly (a+1)+(b+1) steps. Both have least-halt/no-early witnesses; resetting their halt states gives the exact existing literal-query starts. SAT specializations connect an in-range selector halt to either the second- or third-query start, and the two-skip fuel is bounded by clause_seek_span. Empty/nonempty controls and intentionally false over/under-skip results are checked. The complete in-range selector/query/reframe product is closed separately; the total out-of-range branch, clean padding, karp_edge, grid emission, encode_tsp, and strict capstone remain OPEN.


item-4 the s_iter x s_emit HANDOFF: s_copy (5-state) drives an s_emit-style output write once per counter unit -- UNARY ADDITION across a gap (counter b | gap | output o -> output := b + o; counter consumed to Blanks). Proven 0-axiom by the fold-over-the-counter induction s_copy_run (recursive-fuel shadow of the run) built on copy_cycle (one full cycle: consume + copy_out output round-trip + refind frontier) reusing four march-folds copy_m1-4. s_copy_run/extract: s_extract = repeat true (S k + o). UNARY MULTIPLY is this nested with a source-preserving s_emit body. coqchk Axioms: <none>.


unary FLOOR-DIVISION BY 3 as a single right scan: s_div3 (3-state; the finite control IS the mod-3 counter via the explicit finite match st3 -- no Nat.modulo in the machine) keeps the true completing each triple, erases other trues + every false to Blank, halts on Blank. Proven via the spec fold div3_cells + the 6-case value lemma div3_cells_value: s_div3_computes = w -> repeat true (bit_to_nat w / 3), k=1 c=1, |w|+1 steps. Composed through the closed stack: clause_counter := stm_seq (s_map_prepend negb) s_div3 computes repeat true (#false(w)/3) at the explicit (seq_K 1 1, seq_C 1 4 1 1) budget (clause_counter_computes) -- on the false-terminated 3SAT literal encoding that is NUM_CLAUSES IN UNARY: the first full parse-parameter machine. Honest scope: computes #false/3 of the RAW input; the #parts-vs-#false trailing-true adjustment lemma equating it to num_clauses(parse_3sat w) is a pure-Coq successor, not claimed. Design falsifiers div3_check1/2 committed. Strict wrapper OPEN. NP-hardness (Karp 1972) not P vs NP.


Print Assumptions Closed; division/modulo eliminated from the machine-facing evaluator; pure semantic bridge only

edge_exit_entry_successor_short_circuit + edge_row_last_from_sat_N_frame + edge_clause_positive_slot_unary + edge_clause_negative_slot_unary + edge_program_machine_eval_correct + edge_program_machine_eval_sat_correct

Division-free semantic bridge for the physical edge handlers. Valid exit/entry operands reduce cyclic successor to ordinary successor or the unique nv wrap; the last row is the physically measurable false tally of sat_N_frame; clause slots are three unary copies of j plus fixed two/three-cell suffixes; and edge_program_machine_eval contains neither mod nor edge_row_len. Under valid operands and the exact frame tally it equals edge_program_eval and therefore edge_unode_adj. This row is a proof specification for later finite handlers, not a tape machine.


Print Assumptions Closed; targeted pinned Coq compile and coqchk; exact 2-state finisher and 13-state product; arbitrary base/header/meta preserved

s_edge_compare_finish_state_bound + s_edge_compare_finish_well_formed + edge_compare_finish_exact_run + s_edge_compare_call_state_bound + s_edge_compare_call_well_formed + edge_compare_call_first_halt + edge_compare_call_exact_bounded_run + edge_compare_call_bound_square + edge_compare_call_first_halt_square

Physical marker handoff around preservation-safe unary equality. The two-state s_edge_compare_finish moves from the restored first operand to the equality marker without altering tape data. Its exact well-formed composition with the 11-state comparator has 13 states, preserves arbitrary mixed base, header, both canonical unary operands, separators, and arbitrary mixed metadata, and halts with the head directly on Bit(Nat.eqb a b) so a later finite router can branch on the physical tape. Exact least-halt and bounded-run theorems give unary_eq_fuel(a,b)+1 <= (a+b+2)^2+1, including both zero and mismatch. Operand preparation, handler routing, finite karp_edge, grid emission, encode_tsp, and the strict capstone remain OPEN.


Print Assumptions Closed; targeted pinned Coq compile and coqchk; exact 12 states; physical marker dispatch and malformed refusal

s_edge_compare_cleanup_state_bound + s_edge_compare_cleanup_well_formed + edge_compare_cleanup_exact_run + edge_compare_cleanup_first_halt + edge_compare_cleanup_blank_refuses

Finite terminal destruction of compared unary operands. The exact well-formed 12-state machine reads the physical equality marker, stores only that Boolean in finite control, erases both unary fields and separators to Blank cells, restores the marker, and halts on it in 2*a+2*b+6 steps with least-halt semantics. Blank at dispatch refuses rather than selecting a branch.


Print Assumptions Closed; targeted pinned Coq compile and coqchk; exact 10-state physical recycling; arbitrary base/header/meta preserved

s_edge_compare_recycle_state_bound + s_edge_compare_recycle_well_formed + edge_compare_recycle_exact_run + edge_compare_recycle_first_halt + edge_compare_recycle_blank_refuses

Finite reusable recycling of compared unary operands. The exact well-formed 10-state machine reads the physical equality marker, rewrites both unary fields and both separators into Bit-false frame cells, physically rewinds, restores the marker, and halts on it in 2*a+2*b+6 steps with least-halt semantics. Unlike terminal Blank cleanup, the resulting all-bit suffix can be incorporated into another canonical edge frame; Blank dispatch fails closed.


Print Assumptions Closed; targeted pinned Coq compile and coqchk; pure canonical encoding/decoder contract; no finite edge machine claimed

edge_take_unary_enc_nat + edge_take_unary_sound + edge_decode_pair_encode + edge_decode_pair_canonical + edge_pair_encode_injective + edge_pair_word_length + edge_dnode_validb_spec + edge_pair_validb_spec + edge_pair_ids_bound + edge_pair_word_valid_length + edge_pair_eval_some_iff + edge_pair_eval_sat_N_frame

Canonical bit-only serialization contract for division-free edge descriptor pairs. edge_pair_word emits the fixed header 01;role(a);role(b);kind(a);kind(b), followed by four delimiter-terminated unary coordinates. The strict partial decoder rejects invalid role 11, truncated/missing unary terminators, noncanonical non-row y coordinates, and trailing cells. It has both roundtrip and canonical inverse theorems, hence injectivity, an exact length 14+xa+ya+xb+yb, reflected descriptor-range validity, bounded numbered IDs, an evaluator-success iff theorem exposing canonicality plus validity, and a validity-scoped bridge showing evaluation over sat_N_frame equals the existing numbered karp_edge. This file claims a serialization/specification layer only; it does not claim a decoder machine or finite edge machine. The physical selected-field stager, frame false-tally builder, nv-suffix stager, literal-query adapter, finite karp_edge, grid emission, encode_tsp, and strict reduction capstone remain OPEN.


Print Assumptions Closed; targeted pinned Coq compile and coqchk; reusable physical comparison and terminal cleanup products

s_edge_field_selector_state_bound + s_edge_field_selector_well_formed + s_edge_field_pair_compare_raw_state_bound + s_edge_field_pair_compare_raw_well_formed + edge_field_pair_compare_raw_first_halt_polynomial + s_edge_field_pair_state_bound + s_edge_field_pair_well_formed + edge_field_pair_first_halt_polynomial

Finite physical equality products for any compile-time pair of xa/ya/xb/yb descriptor fields. The reusable pre-cleanup product stages the first coordinate, freezes and rewinds, stages the second, rearms the exact unary comparison layout, and halts on the physical equality marker while retaining both operands. Its state count is selector1+selector2+20 and its least halt is bounded by 13*span^2. The terminal product adds exact operand erasure, has selector1+selector2+32 states, returns the marker with Blank cleanup, and is bounded by 15*span^2. Arbitrary base/frame/work bits and zero operands are preserved.


Print Assumptions Closed; targeted pinned Coq compile and coqchk; exact physical result-state handoff and recyclable frame extension; handler work-bit folds remain separate

s_edge_field_pair_recycle_state_bound + s_edge_field_pair_recycle_well_formed + edge_field_pair_recycle_first_halt_terminal + edge_field_pair_recycle_terminal_states_last + edge_field_pair_recycle_terminal_state_decodes + edge_field_pair_recycle_first_halt_polynomial + edge_field_pair_recycle_malformed_refuses

Reusable finite physical equality of any compile-time pair of xa/ya/xb/yb descriptor fields. The product stages and compares both coordinates, reads the physical equality marker, rewrites both operands and separators into false frame cells, resets the marker, and physically rewinds to descriptor cell zero. Its exact state count is selector1+selector2+35; the two distinct final states decode exactly to Nat.eqb of the tape-selected coordinates; the frame grows by exactly x+y+2 false cells; and its least halt is bounded by 16*span^2 for arbitrary base/frame/work bits. Blank marker dispatch fails closed.


Print Assumptions Closed; targeted pinned Coq compile and coqchk; exact state counts 30/22/23/24; physical kb1 branch; arbitrary base/frame/scratch preserved

s_edge_xa_stage_state_bound + s_edge_xa_stage_well_formed + s_edge_ya_stage_state_bound + s_edge_ya_stage_well_formed + s_edge_xb_stage_state_bound + s_edge_xb_stage_well_formed + s_edge_yb_stage_state_bound + s_edge_yb_stage_well_formed + edge_xa_stage_exact_run + edge_xa_stage_first_halt + edge_ya_stage_exact_run + edge_ya_stage_first_halt + edge_xb_stage_exact_run + edge_xb_stage_first_halt + edge_yb_stage_exact_run + edge_yb_stage_first_halt

Finite physical descriptor-coordinate appenders for the canonical bit-only edge workspace. Four well-formed machines start on the ten-bit descriptor header, locate xa/ya/xb/yb by physical scans, preserve the exact descriptor, arbitrary mixed base, arbitrary bit-only frame, work cells, and existing scratch, and append the selected unary coordinate at the far right. xa uses a 30-state router that reads the physical kb1 predecessor and selects one of two finite clean-stager slices; malformed Blank fails closed. The ya/xb/yb products have 22/23/24 states. Every path handles zero, proves exact least-halt/no-early-halt semantics, normalizes the scratch boundary to Blank, returns a common scratch-head layout, and is bounded by 4*edge_field_span^2. Frame-derived operands, handler Boolean routing, finite karp_edge, grid emission, encode_tsp, and the strict capstone remain OPEN.


Print Assumptions Closed; targeted pinned Coq compile and coqchk Axioms:<none>; exact six-state unpadded physical reentry for frame-derived scratch

s_edge_frame_scratch_freeze_raw_state_bound + s_edge_frame_scratch_freeze_raw_well_formed + edge_frame_scratch_freeze_exact_run + edge_frame_scratch_freeze_first_halt_polynomial + edge_false_tally_done_freeze_exact_run + edge_false_tally_done_freeze_first_halt + edge_nv_stage_done_freeze_exact_run + edge_nv_stage_done_freeze_first_halt + edge_frame_scratch_freeze_refuses_unchanged

Finite physical adapter from frame-derived operands back to the canonical unpadded edge workspace. The exact well-formed six-state machine starts on the first frame cell, scans an arbitrary bit-only frame and scratch, converts the prefix/frame, frame/scratch, and virtual-right Blank boundaries into Bit-false cells, and physically rewinds an arbitrary bit-only descriptor/work prefix to its outer Blank sentinel. It has exact least-halt/no-early-halt semantics and runs within twice the local span (hence twice its square). Exact specializations connect both the false-frame tally and encoded-nv stager outputs to edge_field_stage_start_cfg while preserving arbitrary base and every bit. Interior malformed layouts do not satisfy the canonical handoff.


Print Assumptions Closed; targeted pinned Coq compile and coqchk; exact 3073 finite states and 20 physical steps; malformed headers refuse

s_edge_header_router_state_bound + s_edge_header_router_well_formed + edge_header_router_exact_run + edge_header_router_first_halt + edge_header_code_tag_classify + edge_header_router_run_program_tag

Finite physical classifier for the canonical ten-bit edge descriptor header. The exact well-formed 3073-state machine validates magic 01, reads eight role/kind bits into bounded finite control, validates the first coordinate cell, preserves every tape cell, physically rewinds to descriptor cell zero, and halts in one of 256 code-specific states after exactly 20 steps. Pure decoding the terminal state agrees with the constructor tag of edge_program_classify; invalid or malformed Blank header cells fail closed. No coordinate, parser, literal table, or semantic edge predicate appears in the transition function. Handler products, finite karp_edge, grid emission, encode_tsp, and the strict capstone remain OPEN.


Print Assumptions Closed; targeted pinned Coq compile and coqchk; formal impossibility result plus exact 4-state padded and 7-state freeze-plus replacements

edge_operand_exact_unpadded_rearm_impossible + s_edge_operand_rearm_padded_state_bound + edge_operand_rearm_padded_first_halt + s_edge_operand_freeze_plus_state_bound + s_edge_operand_freeze_plus_well_formed + edge_operand_freeze_plus_exact_unpadded + edge_operand_freeze_plus_first_halt

Exact support boundary and finite constant accumulation for edge operands. Explicit single-tape support is monotone, proving that a field-stage halt with a represented trailing Blank cannot equal the original virtual-Blank start layout. The replacement well-formed four-state padded rearm has exact least-halt semantics and one-step operational convergence; the well-formed seven-state freeze-plus family uses a four-constructor finite-control parameter k in {0,1,2,3}, incorporates the operand plus k into an ordinary bit-only extended frame, and returns the exact unpadded canonical workspace. This closes the representational gap without an axiom or hidden RAM.


Print Assumptions Closed; targeted pinned Coq compile and coqchk; exact 3-state freeze and 4-state compare rearm

s_edge_operand_freeze_raw_state_bound + s_edge_operand_freeze_raw_well_formed + edge_operand_freeze_first_halt + s_edge_compare_rearm_raw_state_bound + s_edge_compare_rearm_raw_well_formed + edge_compare_rearm_first_halt

Finite physical preparation of two selected descriptor coordinates for unary equality. A well-formed three-state freeze adapter turns the first live scratch boundaries into false frame bits and rewinds to descriptor cell zero; a well-formed four-state rearm adapter reconstructs exactly the two Blank-separated unary operands required by the existing comparator. Exact and least-halt theorems preserve arbitrary base, descriptor, frame, work bits, and zero/nonzero operands.


Print Assumptions Closed; pure classifier/evaluator contract only; no machine claim

Finite semantic instruction classification for edge handlers. edge_program_classify selects one of nine constructor tags solely from the two node kinds and two role tags, while edge_program_eval states the requested Boolean arithmetic and literal queries. Valid descriptors prove edge_program_eval_correct against edge_unode_adj. This is deliberately a pure specification and does not claim that host-language evaluation is a tape transition; the finite physical header router and handler machines are separate rows.


Print Assumptions Closed; targeted pinned Coq compile and coqchk; exact 5 states; physical result reset and descriptor rewind

s_edge_result_rewind_state_bound + s_edge_result_rewind_well_formed + edge_result_rewind_exact_run + edge_result_rewind_first_halt + edge_result_rewind_state_decodes + edge_result_rewind_field_handoff + edge_result_rewind_blank_refuses

Finite physical Boolean branch handoff after a recycled edge comparison. The exact well-formed five-state machine reads and resets the result marker to Bit false, remembers only that Boolean in finite control, rewinds the complete arbitrary bit word to its explicit Blank sentinel, and halts on word cell zero in distinct true/false terminal states. Its least halt is within |word|+2, the terminal state decodes exactly to the tape-read flag, and normalizing it yields the exact canonical field-stage start with recycled cells appended to the frame. Blank dispatch refuses.


Print Assumptions Closed; coqchk Axioms:<none>; pure specification only; executable query/edge/grid stages open

serialized_literal_table_parse + edge_dnode_adj_correct + edge_unode_adj_correct + edge_unode_descriptors_ids_closed + edge_descriptor_grid_correct

Pure edge-oracle, descriptor, and row-major grid specification. serialized_literal_table_parse proves the parser-faithful serialized literal table, including the default-clause fallback. edge_dnode_adj_correct and edge_unode_adj_correct prove valid division-free descriptors equal the numbered Karp adjacency relation. The canonical descriptor enumeration is valid, duplicate-free, and maps exactly to seq 0 N; edge_descriptor_grid_correct proves the outer-u/inner-v descriptor painter equals the numbered N-by-N grid. No finite serialized-query, edge, or grid machine is claimed; the strict reduction remains OPEN.


Print Assumptions Closed; targeted pinned Coq compile and coqchk Axioms:<none>; exact 18-state physical work-bit fold; handler sequencing remains separate

s_edge_work_store_state_bound + s_edge_work_store_well_formed + edge_work_store_exact_run + edge_work_store_least_halt + edge_work_store_done_reentry + edge_work_store_preserves_other + edge_work_store_fuel_linear + edge_work_store_blank_refuses

Finite physical updater for the two Boolean work cells in the canonical edge workspace. The exact well-formed 18-state machine validates descriptor magic 01, crosses the remaining eight header bits and four delimiter-terminated unary coordinates, applies one compile-time finite set/and/or fold to either out or lit, validates the other work cell, and physically rewinds to descriptor cell zero. It preserves every other cell, has least-halt/no-early-halt semantics, and runs in exactly 32+2*(xa+ya+xb+yb) steps, at most twice the local edge-field span. Blank or malformed magic fails closed. No semantic edge predicate occurs in the transition function.


Print Assumptions Closed; targeted pinned Coq compile; pure physical-layout contract only; no edge machine claimed

edge_workspace_seed_explicit + edge_workspace_query_payload + edge_workspace_marker_cfg_exact + edge_workspace_query_length

Bit-only physical workspace contract for finite edge handlers. edge_workspace_seed places the canonical descriptor, two fixed work bits, the clean literal-query marker, an arbitrary frame, and the first false scratch separator in one exact word. edge_workspace_query proves that after physical coordinate staging the suffix beginning at that marker is exactly sat_literal_query_word, so the existing 269-state clean literal product can preserve the descriptor/work prefix as arbitrary base. Exact seed/query lengths and marker-level SConfig identities are proved. This is layout algebra only; finite descriptor-field locators, nv staging, the edge router, grid emission, encode_tsp, and the strict capstone remain OPEN.


item-4 travel-write-return primitive (single-region core): s_emit1 travels to the data-dependent far end of a unary block, WRITES a new true there (block grows S m -> S (S m)), and RETURNS the head to the start -- the write-at-a-distant-growing-output + return piece that s_iter (monotone march) and s_rewind (content-preserving round trip) do not by themselves provide. Proven 0-axiom by the same march-fold induction as s_rewind plus a writing turn (s_emit1_march_right/left, s_emit1_run/halted/extract; s_extract grows by one). HONEST: single-region; the source-preserving gap-crossing 4-phase variant (invariant Compute-verified) is next, and unary multiply = s_iter counter with an s_emit-across body. coqchk Axioms: <none>.


item-4 SOURCE-PRESERVING travel-write-return: s_emit (4-state) crosses a gap from a source region to a DISTANT output region; appends one true at the output far end; returns the head to the source start leaving the SOURCE INTACT. Proven 0-axiom by four march-fold phases (emit_r0 source-right; emit_r1 output-right; emit_l2 output-left; emit_l3 source-left) glued through the two gap crossings and the writing turn (emit_cross_r1; emit_write_l2_cross; emit_middle handles o=0). s_emit_run: source(S s)|gap|output(o) -> source(S s)|gap|output(S o), head home, in 2*S s + 2*o + 3 steps; s_emit_halted/extract (s_extract = repeat true (S s) ++ repeat true (S o)). This is exactly the body unary multiply drives S b times. coqchk Axioms: <none>.


Coq-only faithful finite-TM theorem; first-halt correctness is modulo existential output padding, with no padding lower/minimality claim; canonical Phase 4 closed without erasing Blank to false; coqchk Axioms:<none> required by the live proof gate

s_encode_tsp_state_bound + s_encode_tsp_well_formed + s_encode_tsp_first_halt + encode_tsp_total_bound_strict + s_encode_tsp_computes_strict + s_encode_tsp_poly_reduces + encode_tsp_poly_reduces + phase4_poly_reduces

Finite 11689-state faithful machine computes word_reduce from every s_init w within one fixed degree-110 budget and establishes both s_poly_reduces and canonical ComplexityReductions.poly_reduces L_3SAT L_TSP. The canonical relation is now definitionally the finite-state distinct-Blank contract; the retired Boolean-tape relation remains available only as legacy_poly_reduces. NP-completeness, arbitrary-layout rejection, and a stronger clean-empty-left transducer remain unclaimed.


coqchk Axioms:<none>; coq-only strict-TM corpus (Complexity* convention), no Lean/Verus mirror

erode_mfalse + erode_dance + erode_rewind + erode_emit

s_maxerode run lemmas PART 1 -- all phase-local march folds proven (the s_rewind/s_copy discipline): M1 erode_mfalse (A-phase skid over delimiters/eroded cells, state 0/1 preserved), M2 erode_mtrue (B-phase true-run), M3/M3' erode_dance/_end (the 3-step C/D back-up-erode-resume at a group's right edge, pure reflexivity -- interior + final-delimiter variants), M4 erode_rewind (E-phase left march over arbitrary Bits to the gap), M5 erode_emit (full F/G output round trip with erode_mF/mG sub-folds, EXACT 2m+3 budget; a draft 2m+4 miscount was compiler-caught). Parts 2/3 remain: single-pass composition (tallies l -> zero-interleaved map pred l), multi-pass induction to EROSION_IS_MAX, s_maxerode_computes -- the machine is still NOT claimed to compute anything. Strict wrapper OPEN. NP-hardness (Karp 1972) not P vs NP.


erode_scan -- the GENERAL A-phase scan over a MIXED group list (zeros allowed), advisor-reviewed. Drops erode_scan_pos's all-positive assumption; the scan every round >=2 needs (next_ts injects empty groups). Over group_word ts followed by a nonempty suffix (the trailing Blank), one sweep: t>0 -> erode_group_interior shaves one true (t+3 steps, state->1); t=0 -> erode_mfalse skids the lone delimiter (1 step, state preserved). Ends at hd suf, deposits map Bit (scan_bits_gen ts) on the left, state = if has_pos ts then 1 else s. Every nonempty group is interior (the suffix guarantees a following cell, so erode_group_final is unneeded). New scan_fuel_gen (empty=1, nonempty=t+3) + scan_state. Feeds E2 canonical pass + E3 fold. Strict s_poly_reduces L_3SAT L_TSP remains OPEN. NP-hardness (Karp 1972), NOT P vs NP.


erode_pass_canon -- ONE canonical erosion pass from the mid-computation shape (any output count m, any tally list, zeros allowed), advisor-reviewed. Multi-round invariant (Compute-confirmed): tape = [gap Blank][m output trues] | group_word ts | [one trailing Blank], head at first cell, state 0; one pass maps it to the same shape with m->m+1 and ts->next_ts ts; exactly one trailing Blank throughout (no accumulation). Composes erode_scan (E1) + state-1-on-Blank entry + erode_rewind_to_gap (leftsuf = the m output trues) + erode_emit m; the eroded left reversed = group_word (next_ts ts) via the general bridge. pass_fuel_canon = scan_fuel_gen ts + length(scan_bits_gen ts) + 2m + 4. erode_pass1_pos (m=0) matches this canonical form, so E3's fold chains round 1 into it. Only E3 (tmax-fold to s_maxerode_computes + false-tail conservation) remains for the erosion capstone. Strict s_poly_reduces L_3SAT L_TSP remains OPEN. NP-hardness (Karp 1972), NOT P vs NP.


cell-count conservation for the erosion capstone's false tail (advisor-recommended smallest first E3 sub-brick, pure list arithmetic). L1 group_word_length: length (group_word ts) = fold_right Nat.add 0 ts + length ts (sum of tallies + number of groups). L2 group_word_length_next_ts: length (group_word (next_ts ts)) = length (group_word ts) -- erosion preserves tape cell count across every pass (t>0 expands to [t-1;0] contributing t+1 cells = same; t=0 stays [0] = 1 cell). These make the final s_maxerode tape's false-tail length = |w| (with the round-1 anchor length (group_word (tallies w)) = |w| for delimiter-terminated w, next). Feeds E3 s_maxerode_computes. Strict s_poly_reduces L_3SAT L_TSP remains OPEN. NP-hardness (Karp 1972), NOT P vs NP.


group_word_tallies_length + sum_tallies_bit_to_nat + trues_plus_falses

the round-1 length anchor for the erosion capstone's false tail. group_word_tallies_length: for delimiter-terminated w (last w false = false), length (group_word (tallies w)) = length w. With L2 (ErodeRun12) the eroded tape's cell count stays |w| across every pass, so the final s_extract false tail is exactly repeat false |w|. Via L1: length = sum(tallies) + #groups = #trues + #falses = |w|. Helpers sum_tallies_bit_to_nat (sum of per-group tally counts = total trues) + trues_plus_falses (#trues + #falses = length); #groups = #falses via the existing split_len_terminated. Feeds E3 s_maxerode_computes. Strict s_poly_reduces L_3SAT L_TSP remains OPEN. NP-hardness (Karp 1972), NOT P vs NP.


group_word_tallies + split_clauses_nonempty + tallies_cons_ne

the round-1 tape identity: group_word_tallies -- for delimiter-terminated w (last w false = false), group_word (tallies w) = map Bit w: the initial tape IS the group_word of its tallies, the content twin of the Run13 length anchor. Puts s_init w into the erosion machine's canonical group_word shape for pass 1. Helpers: split_clauses_true/split_clauses_false reduction equations pinned at @cons Symbol (the Symbol-vs-bool elaboration trap makes bare true::tl rewrites fail), split_clauses_nonempty, tallies_cons_ne. Feeds the s_maxerode_computes assembly. Strict s_poly_reduces L_3SAT L_TSP remains OPEN. NP-hardness (Karp 1972), NOT P vs NP.


erode_scan_end + erode_scan_last + scan_bits_gen_app + has_pos_app

erode_scan_end -- the GENERAL (mixed-group) A-phase scan ending at the PHYSICAL tape end (no materialized trailing Blank), the round-1 twin of erode_scan. One sweep over group_word ts (ts <> [], zeros allowed) from state s in {0,1} deposits map Bit (scan_bits_gen ts) and lands on the fresh end Blank (right tape empty) in state scan_state s ts, with the SAME fuel scan_fuel_gen ts. No new machine induction: snoc-split ts = ts' ++ [tlast], drive ts' with erode_scan (suffix = the last group's word, never empty), finish with erode_group_final (t>0) or the 1-step skid (t=0). Pure-list glue: scan_fuel_gen_app, scan_bits_gen_app, has_pos_app. Strict s_poly_reduces L_3SAT L_TSP remains OPEN. NP-hardness (Karp 1972), NOT P vs NP.


erode_pass1_canon -- the GENERAL (mixed-group) ROUND-1 pass from the initial tape shape (empty left tape, no trailing Blank) into the canonical mid-computation shape at m=1, in pass_fuel_canon ts 0 steps. Round 1 differs from erode_pass_canon at both boundaries: the physical left edge plays the gap Blank and the physical right edge materializes the trailing Blank; the machine mints both during the pass. Composes erode_scan_end -> state-1-on-Blank SL entry -> erode_rewind (boundary) -> erode_emit m=0 -> the Run9 general bridge (eroded tape reversed = group_word (next_ts ts)). Supersedes erode_pass1_pos's all-positive restriction. Strict s_poly_reduces L_3SAT L_TSP remains OPEN. NP-hardness (Karp 1972), NOT P vs NP.


erode_fold + erode_fold_fuel + erode_fold_flat + has_pos_false_tmax

erode_fold -- the multi-pass E3 fold over canonical configurations. From the canonical shape (m output trues, group_word ts, one trailing Blank) with pass budget n >= tmax ts, the machine reaches the HALT configuration (state 0 on the terminating Blank) having emitted exactly tmax ts further output trues -- EROSION_IS_MAX at the machine level -- over a final all-zero ts_fin with length (group_word ts_fin) = length (group_word ts) (L2 conservation threaded through every pass). Concrete fuel recursion erode_fold_fuel (one pass_fuel_canon per productive pass + one final unproductive scan). Induction on n glues erode_pass_canon through tmax_next_ts; unproductive tail = erode_scan at [Blank] where A0-on-Blank is SHalt (max_pos_iff exact). Helpers: has_pos_false_tmax, erode_fold_flat. Strict s_poly_reduces L_3SAT L_TSP remains OPEN. NP-hardness (Karp 1972), NOT P vs NP.


s_maxerode_computes + maxerode_fuel + final_extract + flat_extract

s_maxerode_computes -- THE EROSION CAPSTONE. On every delimiter-terminated w (last w false = false) the erosion machine run with the concrete fuel maxerode_fuel w HALTS with s_extract (final) = repeat true (max_tally w) ++ repeat false (length w): EROSION_IS_MAX at the machine level, the PART 2/3 target. Assembly: round-1 tape identity (Run14) -> productive round 1 (erode_pass1_canon, Run16) -> multi-pass fold (erode_fold, Run17); false tail = |w| by cell-count conservation (Run12 L1/L2 + Run13 anchor); unproductive round 1 (all tallies zero, me_check4 boundary) halts directly via erode_scan_end (Run15). Extraction helpers tape_to_bits_app/map_Bit/map_Bit_rev + final_extract/flat_extract + tmax_zero_sum/tmax_zero_scan_bits. NOT yet proven: the polynomial budget wrapper (max_tally_le_length hook) and the s_clean_transduces_pad wrap toward the num_vars stage machine. Strict s_poly_reduces L_3SAT L_TSP remains OPEN. NP-hardness (Karp 1972), NOT P vs NP.


the polynomial budget wrapper for the erosion capstone. maxerode_fuel_quad: for delimiter-terminated w, maxerode_fuel w <= 6*|w|^2 + 13*|w| + 4 (sharp). maxerode_fuel_poly: maxerode_fuel w <= 19*(length w)^2 + 19 -- exactly the c*n^k+c shape ComplexityStrictBudget consumes (k=2, c=19); maxerode_fuel_poly_ex for existential consumers. Route: <= |w| passes via max_tally_le_length, O(|w|) fuel per pass via cell-count conservation (Run12/13). Still open on this axis: the s_computes_in_poly_strict packaging wrap. Strict s_poly_reduces L_3SAT L_TSP remains OPEN. NP-hardness (Karp 1972), NOT P vs NP.


s_maxerode run lemmas PART 2 (first swing): erode_group_interior -- one A-phase traversal of a nonempty group at an INTERIOR delimiter (m+4 steps) erodes the group's last true to Bit false and advances the head to the next group's first cell in state 1, i.e. tally (m+1)->m = pred (the per-group action of ONE erosion pass; fold_max_pred). Composed 0-axiom purely from the PART 1 folds: the entry step (0/1,Bit true)->state 2, erode_mtrue over the true-run, erode_dance at the delimiter. NOT proven: final-group variant (erode_dance_end, right tape empty), the whole-pass induction over the group list, the multi-pass fold to EROSION_IS_MAX, s_maxerode_computes. Strict s_poly_reduces L_3SAT L_TSP remains OPEN. NP-hardness (Karp 1972), NOT P vs NP.


coqchk Axioms:<none>; exact scoped theorems proven; no total clean num_vars stage claimed; coq-only strict-TM corpus

s_maxerode_budget + s_maxerode_budget_first_halt + no_total_num_vars_postprocessor_from_run20_output

s_maxerode_budget -- delimiter-domain BUDGET capstone at 19*|w|^2+19, with exact raw output repeat true(max_tally w)++repeat false(length w). s_maxerode_budget_first_halt now derives the least halting time and never-halts-early clause. A kernel-checked equal-length, delimiter-terminated collision proves no_total_num_vars_postprocessor_from_run20_output: no terminal function of Run20's raw output can compute unary num_vars on every word, because parse_3sat drops incomplete part suffixes. Therefore direct Blank-ended totalization of raw erosion is insufficient; the parse-preserving complete-prefix normalizer from StrictVarMax needs a finite clean-pad machine. Run20's left-tape output canonicalization, physical halve/successor, total composition, and strict s_poly_reduces L_3SAT L_TSP remain OPEN. NP-hardness (Karp 1972), NOT P vs NP.


erosion PART 2 -- the FINAL-group pass step: erode_group_final, the right-tape-EMPTY mirror of erode_group_interior (via erode_dance_end). From A-phase state s in {0,1} at the first true of the LAST group ((m+1) trues + the terminating delimiter, nothing after), m+4 steps erode the group's last true to Bit false and step off the tape end onto the fresh Blank in state 1 -- tally (m+1)->m = pred. Composed 0-axiom from PART 1 folds (entry step (0/1,Bit true)->2, erode_mtrue, erode_dance_end). The single-pass composition (erode_pass), multi-pass fold to EROSION_IS_MAX, and s_maxerode_computes remain. Strict s_poly_reduces L_3SAT L_TSP remains OPEN. NP-hardness (Karp 1972), NOT P vs NP.


tmax_next_ts + has_pos_next_ts + next_ts

the tally-level pass recurrence (PART 3 arithmetic core): the s_maxerode per-pass tally transform is the EXPANSION next_ts = flat_map (fun t => if 0<t then [t-1;0] else [0]), NOT map pred -- eroding a group of tally t leaves (t-1) trues + TWO Bit false (eroded edge-true + the delimiter) = a group of tally (t-1) then a fresh empty group; Compute-certified vs the s_maxerode traces (next_ts [2;1]=[1;0;0;0], next_ts [1;0;2]=[0;0;0;1;0]). HEADLINE tmax_next_ts: tmax (next_ts ts) = pred (tmax ts) -- the bridge the multi-pass fold to EROSION_IS_MAX inducts on; has_pos_next_ts keeps the A0-on-Blank termination test sound and complete after a pass. s_maxerode_computes + the machine-side scan/rewind/emit composition remain. Strict s_poly_reduces L_3SAT L_TSP remains OPEN. NP-hardness (Karp 1972), NOT P vs NP.


erode_pass SCAN phase (all-positive groups): erode_scan_pos -- the A-phase scan of s_maxerode over a delimiter-terminated ALL-NONEMPTY group list, by induction composing erode_group_interior (every group but the last) + erode_group_final (last), eroding one true from EVERY group (map pred at the tally level) in scan_fuel = sum(t_i+3) steps, halting at the terminating Blank in state 1 (productive) and depositing scan_acc_pos (grp_dep per group = two falses over the surviving t-1 trues). group_word_pos exposes a positive group's leading Bit true. Advisor-reviewed: statement faithful, non-vacuous (Forall(>0) load-bearing), composition-ready for erode_rewind/erode_emit. The empty-group (mfalse) generalization, the rewind+emit tail, and the multi-pass fold to EROSION_IS_MAX (via tmax_next_ts) remain. Strict s_poly_reduces L_3SAT L_TSP remains OPEN. NP-hardness (Karp 1972), NOT P vs NP.


erode_rewind_to_gap (advisor-designed): erode_rewind generalized so state 5 marches the Bit prefix and HALTS at an INTERIOR gap Blank. Left tape map Bit bs ++ Blank :: leftsuf, S(length bs) steps, exposing the gap Blank as head in state 5 with leftsuf (the emitted output block) untouched below it and the marched cells prepended to rightsuf. THE rewind lemma that serves EVERY erosion pass (pass 1 boundary = leftsuf []; pass>=2 gap = leftsuf the output trues); erode_rewind_to_gap_boundary corollary recovers the boundary case. Same induction as erode_rewind; gap + suffixes inert. Unblocks the rewind+emit tail of the full pass. Strict s_poly_reduces L_3SAT L_TSP remains OPEN. NP-hardness (Karp 1972), NOT P vs NP.


scan_acc_map_bit + rev_scan_bits_group_word + group_word_app

the two pure-list bridges for the full erosion pass (advisor-reviewed). B0 scan_acc_map_bit: scan_acc_pos ts acc = map Bit (scan_bits ts) ++ acc (generalized accumulator) -- the scan output is map Bit of a bool list, so erode_rewind can consume it. A rev_scan_bits_group_word: for all-positive ts, map Bit (rev (scan_bits ts)) = group_word (next_ts ts) -- the eroded left tape reversed IS the next pass's input encoding; feeds the multi-pass fold. all-positive load-bearing (ts=[1;0;1] gives a length mismatch). Helpers: map_Bit_repeat_true, rev_repeat_bool, repeat_snoc_bool, group_word_app (group_word homomorphism), grp_bits_rev_group_word. scan_bits/grp_bits are the bool twins of scan_acc_pos/grp_dep. s_maxerode_computes + the pass composition (erode_pass1_pos) remain. Strict s_poly_reduces L_3SAT L_TSP remains OPEN. NP-hardness (Karp 1972), NOT P vs NP.


erode_pass1_pos: ONE FULL erosion pass of s_maxerode over an all-positive delimiter-terminated encoding (m=0, the first pass). 0 axioms; advisor-reviewed plan. Composes the proven pieces end to end: erode_scan_pos (scan) -> B0 scan_acc_map_bit (left tape is map Bit) -> the state-1-on-Blank SL entry step -> erode_rewind (march the Bit prefix to the boundary) -> erode_emit m=0 (write one output true, return to cell 0 in state 0). Total fuel scan_fuel ts + length(scan_bits ts) + 4 (scan + 1 entry + rewind + 3 emit). Result stated RAW (scan_bits/rev); lemma A re-expresses it as group_word(next_ts ts) in the fold. THE FIRST full end-to-end erosion pass proven. pass>=2 (erode_rewind_to_gap), the empty-group generalization, and the multi-pass tmax-fold to s_maxerode_computes remain. Strict s_poly_reduces L_3SAT L_TSP remains OPEN. NP-hardness (Karp 1972), NOT P vs NP.


the GENERAL (mixed-group) bridge, advisor-designed: rev_scan_bits_gen_group_word -- map Bit (rev (scan_bits_gen ts)) = group_word (next_ts ts) for ALL tally lists (zeros included), NO all-positive hypothesis. Unblocks the multi-pass fold: from round 2 on the machine's tape always contains empty groups (next_ts injects a 0 after every nonempty group), where the all-positive bridge A (ErodeRun7) is FALSE. grp_bits_gen: empty group t=0 deposits a lone delimiter [false] (not grp_bits' two falses), matching next_ts's expand1 0 = [0] collapse. Per-group grp_bits_gen_rev_group_word holds for all t (reuses grp_bits_rev_group_word for t>0). Prerequisite for E1 empty-group scan, E2 canonical pass, E3 fold. Strict s_poly_reduces L_3SAT L_TSP remains OPEN. NP-hardness (Karp 1972), NOT P vs NP.


emit ONE unary field enc_nat(counter) = (counter) trues ++ [false] at the end of an ARBITRARY bit-string output -- the reusable 'emit one field' primitive the tsp_stream body names (ComplexityStrictStream.v): the encode stage emits enc_nat(num_cities) ++ enc_nat(max_bound) ++ (n^2 grid of enc_nat(adj)), each a s_field emission. s_field (7-state) generalizes s_copy's all-trues emit to a MIXED output -- prior fields carry Bit-false delimiters so state 2/3 cross Bit _ not just Bit true (proven via the map-Bit round-trip lemmas gfield_m2/m3 with rev bookkeeping that cancels in gfield_out) -- then state 0 on Blank REDIRECTS SR 5 to the delimiter phase (gfield_m5 travels to the output end, writes the Bit-false delimiter, halts). Design Compute-verified on 3 mixed cases before proof. CLEAN extract (unlike s_mult): the counter fully consumes to Blanks (dropped by tape_to_bits), so s_field_extract = ob ++ enc_nat(S k) -- prior output bits with the new field appended. Proven 0-axiom via gfield_m1/m4 (counter marches), gfield_cycle/gfield_emit (fold), gfield_m5 (delimiter travel), and tape_to_bits_rev. coqchk Axioms: <none>.