Complete the admitted R437 fibre Count with one radix validation

research/r437-admitted-count-power/PROOF.md

@@ -0,0 +1,104 @@
+# Original admitted NODE through the complete fibre Count
+
+JoyboyBrian, substantial OpenAI Codex assistance, Apache-2.0. Adapted verification
+setup from JoyboyBrian #4987. Original caller, cardinality, physical words and
+stock/compiler mechanisms retain the credit in README.md and predecessor notices.
+
+## Exact contract and changed implementation
+
+Inputs are a valid immutable source Ring with modulus q^w, compiled integer
+q>=2 and w>=1, an encoded nonnegative exponent Word E, and an owned canonical
+Count V. Borrowed words enter at the original caller's agreed canonical heads.
+The Ring/modulus/exponent and all unrelated dirty state are borrowed.
+Count.multiply_small(q), source Counter and Word division are the actual
+original primitives; the radix loop retains its original arithmetic and guards
+with corrected opt-in cleanup on a rejected intermediate quotient. Runtime Word.inspect or decoding of E,w,V is forbidden.
+The required endpoint is V_out=V_in*q^(w E), with borrowed bytes/heads restored
+and all owned cache/Counter/numerical backing erased. This is a positive valid-
+context contract. Initial Tape/Counter/Word construction and the underlying
+primitive-owned allocation contracts must succeed; resource exhaustion and
+primitive internal allocation failures are not a general rollback guarantee. It does not roll back partial output Count writes if the
+original Count primitive itself fails.
+
+The original multiply_atom_power traverses radix_power(ring,q) for every one
+of E iterations. Each traversal divides the same unchanged modulus by q until
+one, validates the exact remainder and copies/frees its own numerical operands.
+No iteration modifies the borrowed Ring/modulus/exponent. Its yielded length is
+therefore exactly w on every traversal. The original Count modification word is
+precisely w*E repetitions of multiply_small(q), in that order.
+
+The adapter performs the original radix_power division/validation loop once and writes one ONE marker per yielded
+step on an owned sequential Tape, followed by RIGHT. It never decodes w into
+host control. An actual source Counter copies E. For each Counter iteration,
+the cache is read sequentially, each ONE invokes the unchanged Count primitive,
+and RIGHT causes a rewind and original Counter decrement. Induction on the
+Counter iterations proves the identical full Count modification word and the
+required endpoint, for every valid finite input. Source q/carry finite-control
+assumptions remain inherited; no new unit-cost arithmetic claim is introduced.
+
+The owned cache is created before the try and cleared in its finally. The source
+Counter is assigned only after successful creation and closed in the same finally.
+The opt-in validation loop also releases quotient/remainder if the original
+prime-power guard rejects: the frozen original generator checks that guard
+before freeing those two new Words. Its copied modulus/divisor are released
+in finally. Thus invalid radix validation and a failing Count operation release the adapter's
+cache/Counter. A Count exception may retain its own partial output writes; general
+failure rollback is not claimed. Cached validation is performed even when E=0,
+so malformed contexts may reject earlier than the original no-op branch. This
+is outside the stated valid-context equivalence, and is tested explicitly.
+
+## Actual source binding and completed NODE boundary
+
+The original source is the exact Machine.node in the authenticated R437 source
+closure, inherited through #4987. bridge.py parses its AST and retains every
+statement before the assignment to peeled. Only fresh_rows.quotient is replaced
+by the already credited #4794 opt-in quotient and multiply_atom_power by the
+adapter above. All other globals and statements are unchanged. In particular
+these original statements execute:
+
+    total = Unsigned(self.indices).times_small(self.size, 2)
+    multiply_atom_power(fibre, total, self.context.ring, self.context.q)
+    self.indices.free(total)
+    complete = Count.product(fibre, self.count("suffix"))
+    fibre.close()
+    self.save_count(complete, "fibre")
+
+The AST prefix hash and exact statement count are in RESULT.json. This is a
+literal source cut before payload peel, not a reimplementation of the NODE
+arithmetic. Root checked_entry authenticates original source handle/key, precision,
+field, root size/history and stock before invoking the encoded continuation.
+The context view is tied to that admitted metadata but its expensive full
+Context/codebook constructor is not executed. An authenticated view is not
+claimed as proof that the full constructor/caller has run.
+
+For the unchanged q=2^127-1 root e=n=64,w=2,h=0, original precision is
+L255/I8/Q520213. Unused and leading Counts are 9475, gap=suffix=1. The original
+completed saved Count is exactly 9475*(q^2)^128, of bit length 32526. A read-only observer wrapping the actual call records one invocation, two
+Word divisions and all 256 Count multipliers; these counters never control the
+algorithm and the wrapped methods are restored in finally. All 256
+Count multipliers remain paid. Two actual original Word divisions validate the
+radix once instead of 256 original divisions. The adapter saves the completed
+Count on the original fibre role before the first payload operation. The
+root Count, original Program, old directory and unrelated dirty Count173/Word37
+retain bytes and heads. The actual Count output persists only until explicitly
+owned disposal; no teardown is used to conceal a failed borrowed-state test.
+
+## Costs, evidence and limits
+
+The new cache occupies w marker cells plus terminator/boundary and rewinds for
+each exponent iteration. It pays w original radix divisions once, every source
+Counter action, every original Count multiplier, all unary-cache reads/moves,
+and cleanup. Record/index/residue counters and visited backing are reported
+for the complete source prefix and fixture construction/disposal separately.
+No huge integer is read as a runtime arithmetic oracle. Independent host integer
+arithmetic observes completed outputs only; fixture construction and the inherited
+large quotient divisor preparation remain explicit separate costs.
+
+This is source-bound semantic completion and finite admitted execution. It does
+not provide a total fixed binary-TM tariff, a runtime asymptotic improvement,
+full Context/GL64 directory construction, payload, original peel, stock/precision
+admission for all descendants, compiler or supplier/outer admission. The old
+#4987 90.505-second interruption and this complete run are distinct diagnostics;
+wall times across revisions/environments are not a proved speed comparison.
+The exact reduction from 256 to two original divisions follows from the bound
+source word and immutable valid Ring, rather than measured wall time.

research/r437-admitted-count-power/README.md

@@ -0,0 +1,78 @@
+# Complete the admitted R437 binary fibre Count
+
+The actual original q=2^127-1 R437 root now executes through its completed
+32,526-bit fibre Count, including the original suffix product and save, before
+payload peel. An owned sequential radix cache validates the immutable modulus
+once, retaining the original encoded Counter and all 256 Count.multiply_small(q)
+calls. Actual original Word divisions fall from 256 to two for this root.
+[PROOF.md](PROOF.md) proves the valid-context source equivalence for all widths.
+
+#4987 already supplied the admitted root/ingress/stock/initial Count boundary.
+Its full exponent diagnostic was interrupted after 90.505 seconds. This package
+answers its first open next question with an actual completed Count output,
+rather than replacing q127 by a tiny fixture. The first full completed run took
+56.104 seconds on local Python 3.12.15; that observation is not a proved runtime
+bound or a controlled baseline speedup. All frozen inputs remain unchanged. A read-only actual-call observer checks
+one adapter invocation, two Word divisions and 256 Count multipliers.
+
+## Boundary and evidence
+
+The source AST is cut before the original assignment to peeled. The original
+ingress, quotient, stock guard, saved leading, initial fibre, exponent, suffix
+product and saved complete fibre run unchanged except the two named opt-in
+adapters. The radix validator retains source arithmetic/guards and additionally
+releases quotient/remainder on a rejected prime-power guard; the frozen original
+guard leaked those two newly allocated Words. Runtime Word.inspect is disabled. The exact output is
+9475*(q^2)^128. Original root precision L255/I8/Q520213, source handle/key,
+Program and numerical admission checks remain bound to the actual root.
+
+Borrowed bytes/heads, dirty Count173/Word37, numerical live sets and erased
+owned backing are checked before fixture disposal. Separate small-domain
+comparisons retain the exact original multiplier word, including zero exponent,
+and reject invalid modulus and injected partial Count-failure leaks. The original malformed
+radix guard is separately confirmed to leak exactly two returned numerical Words. Typed receipt and
+source corruption must reject. Exact counts, AST identity, lane invoices and
+output hashes are in [RESULT.json](RESULT.json).
+
+The context is a structural view bound to admitted metadata. Allocation exhaustion and arbitrary primitive-internal failure rollback are
+outside the tested exception classes. Full codebook and
+Context construction, physical large-divisor arithmetic pricing, original peel,
+complete directory/gather and payload are unrun. Unknown costs are not zero.
+This does not admit a supplier, improve kappa, or change the selected result.
+
+## Reproduce
+
+Use standard-library Python 3.12:
+
+```sh
+python3.12 -B scripts/research_package.py --package research/r437-admitted-count-power
+python3.12 -I -O -B research/r437-admitted-count-power/verify.py
+```
+
+Both full admitted replays are registered with 120-second bounds. No concurrent
+artifact regeneration or whole historical suite is required. The source closure
+and exact historical selected-record projection retain the #4987 loading
+contract; the latter is not substituted as the current selected result.
+
+Family decision: NARROW to #4987's concrete incomplete exponent segment, close
+this Count boundary, then stop before payload. #4981's complete-prefix consumer
+fusion and Nick Petalas #4854's shared-radix quotient remain separate credited
+results. Initial overlap covered 310 open PRs, 4096 Discussion records and all
+6690 tracked local notes; keyword absence is not novelty. Canonical base is
+bee95ce88f9f19802f0613f92838895cd0e14a1f, priority revision 7, selected
+conditional kappa 0.00302015 unchanged. Canonical Discussion: #4682.
+
+## Open next questions
+
+1. Execute the original peel/directory/gather consumer from this exact completed
+   Count output, preserving every borrowed row and actual admitted precision.
+   Full Context/codebook construction and payload scale are blockers.
+2. Replace the inherited compile-time large quotient arithmetic diagnostic by
+   an explicit binary implementation and complete price, retaining all original
+   source/preparation obligations. A Python big integer is not one physical step.
+
+Credit David Arias, Chris R/Clear1nsight, Jose Manuel, Nick Petalas, ToikY,
+codyw912 and the pinned compiler/caller/stock/Count lineage. The copied root
+fixture adapts JoyboyBrian #4987, preserving attribution. New cache/composition
+and checks: JoyboyBrian, substantial OpenAI Codex assistance. Apache-2.0.
+No independent human or formal proof-kernel acceptance is claimed.