Split genus-3: carry the full adjugate, +1M -12A at all six sites

[salindne]

Carries the full adjugate of the 3x3 matrix T in the genus-3 split addition and doubling and applies it as a matrix-vector product, where the formulas previously built only its first column and reduced vt*q mod up by Karatsuba twice.

+1M -12A at every one of the six sites, +6M -72A in total, accepted comfortably by the thesis's own 1M : 3A rule.

	addition	doubling
arb	65/3/87/12 → 66/3/75/12	73/3/101/19 → 74/3/89/19
nch2	65/3/85/0 → 66/3/73/0	72/4/97/0 → 73/4/85/0
ch2	65/3/80/0 → 66/3/68/0	71/4/86/1 → 72/4/74/1

No other shape moved in any of the twelve families. That is the acceptance test, not a remark: the trade is confined to the generic path it targets.

The finding is that the adjugate is free, which is not what was predicted

The plan expected the extra multiplication to be paid at the T block, on the reasoning that nine adjugate entries must cost more than three, and hand-counted the block conversion as losing 2M 1A. My own independent hand count said 0M. The measurement says the block costs 15M 0S 9A either way.

The reason is structural. Column 3 of T is x times column 2, reduced modulo the modulus, and adj(T) is itself a multiplication matrix, so it inherits that shift structure. The bottom row is the cross product of columns 1 and 2 and needs no third column at all; the remaining six entries are then shifts of that row at one multiplication each rather than 2x2 minors at two:

m5 = m9 + w2*m8      m2 = -w0*m7      m1 = m5 + w1*m7
m4 = m8 + w2*m7      m6 = m2 - w1*m8  m3 = -w0*m8

Three minors plus six shifts is exactly what three minors plus the now-unneeded t3, t6, t9 used to cost. A further multiplication falls out of t7*m3 = t2*m8, so the determinant expands along T's first column reading m8 in place of m3, and m3 is left to the generic path that alone consumes it — no degenerate leaf pays for it.

So the whole trade is downstream, where applying the matrix costs 12M 8A against Karatsuba's 11M 20A, and there is no reduction step because applying the multiplication matrix is the reduction.

verification/adjugate.py settles this by executing both routes from their real .mag text: split_q_col1 at 15M 0S 9A for four entries, split_q at 15M 0S 9A for seven. The pre-C4 route is kept as a candidate rather than deleted, so the comparison keeps scoring what this work measured itself against.

Established before the edit, not after

• Six shift identities and both determinant forms verified over 5,000 trials on GF(10007), with t1, t4, t7 and the modulus free, so one check covers the additions (modulus up) and the doublings (modulus u) rather than assuming one transfers to the other.
• The shared prefix feeds a 1,600-line degenerate block, so before deleting anything: t9 shown never to appear below the prefix, t3 and t6 shown to be reused temps whose every read is preceded by its own local assignment, m5/m6/m9 shown to be unused names, and every Karatsuba temp t0–t5 shown reassigned before being read. Only m7's prefix value is consumed downstream, and the new arrangement still computes it.
• Negative control: breaking the target gave 117 whitebox mismatches, so the corpus can see this edit. That check exists because a green gate on an edit to a published formula carried no information until PR38 — which is exactly what reverted the ADD29/ADD33 saving the first time.

Six published cells move, adjudicated

33ADD n=0,0 and 3DBL n=0 across all three families. Per the standing rule, opcount measures the new figures by execution and a hand count of the changed region reproduces the same +1M -12A — two methods sharing no code.

Thesis/ERRATA.md E-T10 records it and the cells are updated in Thesis/chapter6.tex. This is not an error in the thesis: the published counts were correct for the formulas as published, and the formulas moved under them. ThesisPublished/ is untouched, verified.

verification/selftest.py's published pins are superseded with the reason inline; every other pinned cell still matches its published value.

C5 is dropped, and its result is recorded rather than lost

The redundant 2x2 system was scoped into this PR and taken out of it. Not refuted — unfinished, and worth little: the leaf sits three zero-tests deep and is reached about once in ten thousand inputs, so its 11M 6A is a raw count on a path almost never taken, and it moves no published cell.

The mathematics was settled on the way out and is in ERRATA.md E24. The closed form is proportional to the true S*dw2^-1 mod unp in 400 of 400 constructed trials, which is stronger than the finding originally carried. What blocks it is that the file's (b1, b0) is not that quantity up to any scalar, 0 of 400, so its normalisation is unknown. The entry carries the two leads, the nine unexamined sibling sites, the measured fact that the corpus can see the leaf, and a warning not to re-attempt the Python reproduction whose transcription is precisely what is in doubt.

NEW_WORK.md N33 states the general rule, which outlives the leaf: wherever a formula computes r = a mod b and later needs the Bezout cofactor of b modulo a, the quotient discarded by that division already is that cofactor, up to lc(r). The ramified model exploits this and split does not, and the reason is inversion scheduling rather than oversight — split must invert late because its f is non-monic of degree 2g+2, which is how it holds to a single inversion, and late inversion means every upstream quantity is weighted.

A gate hazard found by tripping over it

ERRATA.md E23. The gates provoke their own guards by editing formula files in place and restoring them. Two runs at once are not safe: a second selftest restored a file while the first held it mutated, leaving the ramified ADD missing the ledger comment adjugate.py anchors on — a file neither run was testing. It surfaced as a gate failure naming a file nothing had edited, which is a confusing signal whose natural first hypothesis is wrong.

The same applies to Magma, which loads those files as each tester starts. Not fixed, because the provocations must edit the real path to locate their targets by content. Recorded so the symptom is recognised rather than debugged as a phantom formula defect, with the rule: run the gates serially, never alongside Magma, and check git status before believing a failure that names a file you did not touch.

Gates

Per formula commit: opcount as tabled, hand count, whitebox 7,043/7,043, driver --strict 55,236/55,236, dominance clean on 39 files, adjugate, selftest 19/0/0, and Magma 30 testers, 0 failures, 0 skips — three separate full suite runs, 5m13s, 5m22s and 4m51s.

Docs commit touches zero .mag files: readme-paths 94/94, check_paths --strict 259/259, ruff clean on CI's ruleset, opcount re-confirming all six README figures as written.