R12 Addressed Categorical Workspace Preregistration

Status: REVISION 5 PREREGISTRATION; TRACK S PUBLIC PILOT V6 IS PRE-RESULT. PCPT v3 is closed process/algebra evidence, while the learned ACW lane remains unscored. No Shohin fit, H100 job, capability claim, or novelty claim is authorized until the exact canonical-runtime pilot, its different-node replay, the post-result Git artifact anchor, and the CPU gates below pass unchanged. A CPU pass establishes only the frozen empirical conjunction; any novelty claim requires a separate documented prior-art review.

Working name: Addressed Categorical Workspace (ACW), trained with Counterexample-Guided Broadcast Refinement (CGBR).

1. Decision being tested

Shohin's raw 300k transformer does not reliably preserve or update a compact state, and existing SFT/trace/recurrence variants have not established causal transport. The next test therefore changes the architecture itself. It adds a small, explicit, recurrent state channel whose contents and writes can be intervened on exactly.

The claim under test is narrow:

On structured systems whose true transition changes one latent register per event, a hard addressed categorical workspace can learn an approximately causally sufficient source-deleted predictive state on at least 90% of depth-64 held-out histories from rank-limited terminal supervision, with a measurable advantage over parameter-, label-, and update-count-matched recurrent controls.

This is a learnability and dynamic-sparsity hypothesis. It is not an expressivity claim: dense recurrence and finite transformers can realize the same bounded functions. It is not a claim that categorical memory, recurrence, active counterexamples, predictive state, or workspace routing is new.

2. Two capability tracks

The experiment keeps memory and control separate.

Track S: scheduled state transport

The environment provides the event and destination address. The learned system must encode the source, update a compact packet, delete all source/KV access, and answer a late query from the packet. Passing Track S establishes learned durable state only. It cannot establish reasoning because an external schedule still chooses the operation and address.

Track C: autonomous packet controller

Only after Track S passes may a controller receive the packet, current observation, and goal; select an operator and read/write address; invoke the tied updater; and select HALT or CONTINUE. No externally supplied execution schedule is available. A reasoning claim requires Track C plus fresh direct interaction. Track C is not authorized by this document.

3. Mathematical object

Let the packet be

p = (p_1, ..., p_d) in [K]^d

with K=17. A scheduled event is (e, a), where a in [d] is the one register allowed to change. The architecture must implement

r = U_theta(onehot(p), onehot(c_theta(e)), onehot(a)) in [K]
p'_a = r
p'_j = p_j for every j != a.

The unchanged registers are copied byte-identically. The updater cannot write them. The source writer and event coder each emit d x K logits and use a straight-through hard categorical choice during training. All evaluation, intervention, and publication paths use literal integer symbols.

A late reader receives only (p, q). It may not receive source tokens, source hidden states, prior attention K/V, event history, a replay buffer, or a hidden continuous state. Process instrumentation must account for every dynamic byte.

Minimal-packet theorem used as a gate

Let the event/query relation be totalized with an explicit inadmissibility answer. Histories h and g are residual-equivalent exactly when every common finite continuation c and late query q has the same answer. For a closed deterministic relation with N reachable residual classes, assume a deterministic history-to-packet encoder, exact compositional packet updates, and exact observations for every totalized continuation/query after source deletion. Packet equality then cannot merge distinct residual classes. Therefore K^d >= N. If K^d = N, the reachable packet is a bijection with the causal quotient and every packet update is conjugate to the residual derivative.

Proof: if two distinct residual classes had the same packet, deterministic packet updates and reads would give equal answers for every common future, contradicting their separation. Equality of finite cardinalities then gives the bijection; composing through it gives the conjugate update.

This is the standard minimal-state argument in packet coordinates, not a new state ontology.

CGBR finite bound

When two histories collide in a hard packet but differ in residual behavior, an oracle returns one separating continuation/query. That witness is applied to the entire collision block and retained permanently. A complete separator oracle requires at most N-1 strict partition refinements to split N residual classes. This is not an optimization-convergence or label bound: one refinement can add many labels. For witnesses w with answer alphabets A_w, the information lower bound is

sum_w log2(|A_w|) >= log2(N).

For one fixed alphabet A, it implies at least ceil(log_|A|(N)) scalar outcomes in the best case. Every oracle call, witness byte, and added answer label is charged.

The affine F_17^d board needs exactly d independent linear witnesses. Its coordinate basis is already optimal, so success there is a correctness control, not evidence for a new method. The learnability hypothesis is tested only when the distinguishing basis and answer recoding are hidden.

4. Architecture frozen for a Shohin sidecar

The base remains byte-identical and frozen at 125,081,664 parameters.

source hidden [576] -> source projector -> 4 x 17 logits -> hard packet
event hidden  [576] -> event projector  -> 4 x 17 logits -> hard event code
[packet 68, event 68, address 4] -> MLP 140 -> 64 -> 17 replacement logits
packet one-hot [68] -> bias-free bridge 68 -> 64 -> q_delta

Parameter ledger:

The sidecar is 0.07431% of the frozen base. The packet's semantic capacity is log2(17^4) = 16.35 bits and its ideal packed width is 20 bits or three bytes. Actual persistent evaluation storage is four uint8 values (32 bits/four bytes) or four int64 values (256 bits/32 bytes), depending on the frozen runtime. Training uses a 68-element BF16 straight-through one-hot (1,088 bits/136 bytes) plus a separate 68-element BF16 transient logit tensor of the same size. Every arm reports semantic capacity, actual persistent bytes, transient bytes, and dtype separately. During a Shohin test, the bridge adds q_delta only to head zero of the final transformer block. Query tokens and the frozen language decoder remain available; source and event K/V do not.

The two projectors are deliberately separate and counted. Tying them is a smaller ablation, not the treatment. Any parser, schedule, cache, or external executor must be listed in the resource ledger. Track S may receive the destination address; Track C may not.

5. CPU falsifier domains

A. Exact affine control

Use F_17^d for d in {2, 3} with events

x_i <- alpha*x_i + beta*x_j + gamma mod 17.

Exhaustively test widths d-1, d, and d+1. Width d-1 must exhibit a certified collision. The literal coordinate packet at width d must pass every state, event, query, donor swap, and output recoding. Failure rejects the board and evaluator before neural training.

B. Hidden-basis sparse systems

Generate a closed family from the same sparse latent transitions, but hide the state basis behind a seeded GL(3, F_17) recoding, render source and event IDs as fixed opaque features, and independently permute every answer alphabet. The destination schedule is visible only in Track S. The learner receives no packet, state, intermediate, basis, or update-target labels.

Each source receives exactly two distinct terminal scalar consumers before CGBR. This rank-thinning prevents one example from directly spelling out the whole state. The frozen generator contract is:

The static Keychain commitments in revision 1 are retired. They prove only that a value matches a digest, not that project operators lacked the value while developing the experiment. The generator now rejects every confirmation identity with disabled_pending_future_nist_beacon_v2; the old preimages cannot produce a canonical dataset through either the CLI or the public generation function. No scored confirmation run is authorized until the future-pulse opener below is implemented, reviewed, committed, and replay-tested.

The replacement confirmation protocol is commit-then-reveal with public future entropy:

1. After all development checkpoints and the exact arm-selection record freeze, write one hash-bound authorization containing their complete file and metadata bindings, every scientific/runtime path, the exact KDF, and one canonical NIST Beacon chain/index/timestamp at least 48 hours in the future.
2. Require the authorization commit to equal origin/main, not merely be its ancestor. Publish a deterministic witness in a public transparency log before the target pulse. The witness must bind the repository, exact commit, authorization SHA-256, pulse URI, and target timestamp.
3. After the target time, fetch only that committed URI. Verify the deployed Beacon 2.0 cipher-suite-0 serialization, certificate identifier, RSA-4096 / SHA-512 signature, recomputed outputValue, exact chain/index/timestamp, previous-output link, and prior precommitment reveal. pipeline/acw_nist_beacon.py and its archived pulse fixture are the minimum verifier regression.
4. Derive three 32-byte seeds from the public outputValue, authorization hash, exact commit, pulse URI, and domain index. Never seed from localRandomValue. Serialize the authorization hash, pulse payload hash, and seed commitment in every identity; do not accept a caller-supplied label.
5. Generate and score all three domains. Network failure retries the same URI; invalid cryptographic evidence aborts and publishes a failure receipt; a valid poor result is final; code changes require a new future authorization.

This protocol still trusts NIST's beacon operation, RSA/SHA-512, the public timestamp service, and the frozen local verifier. It does not claim that NIST itself lacked the beacon's internal randomness. Those residual assumptions must be reported with the result.

Train on event depths 0..8; test exact depths 8, 16, 32, 64, and the one-step-beyond horizon 65. Freeze the writer/updater before the confirmer opens final new consumers, continuations, and answer recodings. Only a new reader may train on those frozen packets.

Splits constrain source and endpoint states only. Intermediate trajectory states may cross buckets and therefore are not claimed as state-disjoint; each artifact reports train/adaptation/evaluation bucket visits at every position. The post-freeze reader task contains exactly eight new seeded affine covectors with eight new independent 17-label permutations. Its 1,024 adaptation histories provide all eight labels (8,192 records). Each 2,048-history evaluation depth provides all eight labels (16,384 records per depth). The writer, event coder, updater, and packet bridge remain frozen for all 500 reader updates.

C. Process roles and CGBR algorithm

The generator/oracle sees latent truth for public development data. It serializes public features, event addresses, query IDs, recoded answers, and immutable history IDs. A separate, non-scored curriculum pilot with seed 2026071600 is the only model whose hard packets are shown to the oracle. It produces one frozen CGBR curriculum before any scored arm starts. The trainer runs on Stokes from a hash-bound bundle containing only public records, the frozen curriculum, model/trainer code, and the allowed arm ID. It does not contain confirmation preimages. The confirmer remains sealed until arm selection and model freeze; it permits no collision queries, architecture changes, checkpoint selection, or CGBR.

The pilot implementation and canonical configuration must be committed and pushed before execution. One canonical command owns the complete run: it starts from absent canonical paths, generates and byte-replays the public pilot domain, launches two distinct measured child processes with the exact frozen hyperparameters, and requires byte-identical schedules and reports. The freezer holds both children alive on inherited parent-release pipes after atomic output, reconciles their real PID/PPID identities with the live Slurm allocation, then independently reruns all 3,400 updates from the registered data while both children remain live. It compares the tensor-state hash, loss transcript, schedules, report, and regenerated arrays before releasing the children and requiring zero exits. Every later canonical report load inside the exact pinned canonical runtime repeats this recomputation; copied or locally rehashed reports therefore have no standing. Cross-runtime consumers must validate the separately committed artifact registry and may not claim to have independently reproduced the float training trajectory. Execution receipts bind positive wall time and peak RSS, process/host/runtime identity, allocated CPU count, numeric Slurm job ID, and a hash-bound live scontrol show job snapshot. Exact working scientific files must equal their HEAD blobs, and HEAD must equal origin/main before, during, and after the run. Any divergence blocks the lane; additional identical replays may audit but may not select among schedules. After each 200-update curriculum-pilot round, the oracle receives only hard packet tuples and history IDs for the public oracle pool. It groups in ascending packet order, keeps groups containing multiple residual states, and sorts them by decreasing number of residual classes then packet tuple then minimum history ID. For at most 512 groups, it scans only queries unused by every member, in ascending ID, and selects the first query maximizing distinct answers. If the common-unused intersection is empty, the group is recorded as witness-exhausted and receives no selected witness. If every common-unused query has only one distinct answer, the group is recorded as query-bank-unresolved and likewise receives no selected witness. Every history receives exactly one new unused query that round: the separating query for its selected collision group or its seeded uniform unused filler query otherwise. Records are deduplicated and serialized in (history_id, query_id) order. This fixes multiplicity and prevents collision-block size from becoming a label-count side channel. Zero eligible cross-residual collisions stops witness selection, not training: deterministic filler-only rounds continue through round 12 so every history has exactly 14 labels and the primary endpoint always uses 57,344 labels. Round zero contains the two initial labels per history (8,192 total); rounds 1 through 12 contain exactly one new label per history (4,096 each). Every candidate (collision group, query) inspected during the scan is charged as an oracle candidate evaluation, whether selected or not.

The PID/Slurm record is operational provenance, not cryptographic remote attestation. It trusts the committed parent process, Stokes kernel, Slurm controller, and filesystem during execution. The result's durable numerical standing comes from mandatory fresh deterministic recomputation by every canonical consumer, not from treating a historical receipt as a signature. A malicious same-UID process that can substitute executable or runtime bytes during a scientific process and restore them before the process rechecks those bytes is explicitly outside this trust boundary. No software-only receipt in that same account is represented as measured boot or remote attestation.

Cross-runtime data portability and canonical float-runtime amendment

The first otherwise-complete public execution (740053, generator v2) is not a canonical pilot result. Independent replay on macOS reproduced all 59 integer/state/query arrays exactly but found one-ULP differences in all eight float32 feature arrays. The random projection matrices were byte-identical; BLAS-dependent reduction order in one-hot matrix multiplication caused the drift. Same-runtime replay is insufficient for this protocol because canonical consumers must regenerate the dataset on an independent runtime.

Generator v3 therefore constructs every event feature by adding its five selected projection rows in fixed semantic order, and every source feature by adding its three selected rows in coordinate order. Each addition is an explicit float32 elementwise operation; no BLAS reduction is permitted. Golden SHA-256 tests bind the complete 48-event bank and the source rendering of all 17^3 = 4,913 states. Independent Mac generation and Stokes job 740071 produce the same 68 files, all 67 registered arrays, and manifest payload SHA-256 3294a0d12d277f46ea8c0cbf50142be14816447c15bc3792f6e4df7e77e2ba33 without tolerance.

That data fix does not make float neural optimization cross-runtime. Stokes job 740077 completed pilot v4 from the exact portable dataset, with two byte-identical child fits and an independent parent recomputation. A fresh Mac recomputation nevertheless produced a different model tensor and changed 43,451 of 57,344 ordered CGBR schedule positions; only 24,726 rows were common at the same positions. The uniform schedule stayed byte-identical. This is a material learned-trajectory difference, not a one-ULP artifact and not a result that tolerance may repair. Pilot v4, including job 740077, is therefore diagnostic-only and cannot be anchored, consumed by a scored arm, or cited as learned evidence.

Pilot v5 separated the two contracts. The dataset remained independently cross-runtime reproducible and was additionally pinned to the exact payload hash above. Float training and all fresh numerical report replay were canonical only on the Stokes Xeon Gold 6130 compute class under glibc 2.28, Linux x86_64, CPython 3.13.13, NumPy 2.5.0 with forced-runtime configuration SHA-256 6a202deb5035843d719b04dbfca97b3fe4191603e5884fac2f9af5659555419b, and PyTorch 2.6.0+cu124 with forced-AVX2 configuration SHA-256 51bcbe59eb176362dc969b0341d85ca88416e37bd0f10de4b19350d07898e330. The numerical process required deterministic algorithms, one Torch compute thread, 32 interop threads, no CUDA, and an exact environment that forced PyTorch, oneDNN, MKL, and OpenBLAS to AVX2/Haswell with one compute thread.

The first v5 execution, job 740215 on ec51, passed all 114 warning-strict tests and generated the 68-file dataset plus two byte-identical four-file held replays. It then failed closed during the parent's mandatory numerical recomputation, before final publication, verification, or registry creation. The initial runtime fingerprint had 92 executable mappings; a later socket.getfqdn() call in hostname/Slurm validation lazily loaded /usr/lib64/libnss_files-2.28.so, so the next fingerprint correctly rejected the changed process. Job 740215 is therefore process-diagnostic evidence only, not a pilot result. Its 76 files are quarantined under artifacts/r12/rejected/740215 and verify against a locally mirrored SHA-256 manifest whose own SHA-256 is ebec7084fd14d382347786bc9d48a7cf55e8db5900357ece8c16a04107aae9f5.

Pilot v6 closes that discovered lazy-load boundary. Runtime warmup resolves the fully qualified hostname before any mapping fingerprint, and the exact 54,360-byte NSS library is pinned at SHA-256 3505f4d12bb803562270855de55c49aee3f63e5bd33fcd458d365c5cc99e441b. The closure now binds all 93 executable mappings, three complete code-tree summaries, 599 imported external files, nine external executable tools, one path-independent generated module, the exact five-entry sys.path, startup .pth files, and native payload SHA-256 2c0605b4e60ecaf3d1a708c7124954b6f3c8405b0b23e75d59839588b32c2585. Fresh probes 740225 on ec51 and 740224 on ec52 produced byte-identical 23,901-byte logs at SHA-256 708b7fc2165cf952389e4c9b07d1980c89af7cda3324995dcddd1035df81f7f9 and structured runtime identity SHA-256 0e91de0e3dbca24ea4f04b9b03398a91486b93b31eff5a3ba4574dd43eaa677f. A clean pushed-candidate validator must still recompute this identity twice per node and require exact equality to the compiled pin before a replacement pilot.

The admissible namespace advances to dataset acw_pilot_domain_v3_runtime_v2, pilot/comparison v6, independent verification v3, and registry R12_ACW_PILOT_ARTIFACT_REGISTRY_V2.json; canonical paths reject symlink components and symlink leaves. The first successful v6 pilot must be followed by a fresh full recomputation in a separate Slurm job on a different Stokes node with the same pinned runtime. Only then may the exact artifact registry be committed. The verifier writes its canonical receipt and builds the registry in one process; the registry loader must receive the exact receipt object and bytes still held in that process, and no standalone registry builder command exists. Both publications are byte-compared and strict-canonical-JSON reopened. The trust chain remains three separately pushed commits: scientific result commit S, registry-only direct child A, then activation direct child E, where E literally pins S, A, and the raw registry hash. Pilot/training identity equality is forbidden. Cross-runtime consumers validate the anchored byte registry and structural bindings; they do not pretend that float optimization is portable.

The resulting ordered (history_id, query_id) curriculum is frozen and replayed identically to ACW, dense categorical, addressed continuous, GRU, packet-token, answer-motor, and source-retained scored arms. No scored arm has an arm-native collision oracle. Uniform-query ACW instead receives a separately committed seeded-uniform query curriculum with identical history IDs, per-history multiplicity, round boundaries, and 57,344 final labels; differing query choice is the controlled treatment. Direct-state ACW receives the frozen CGBR curriculum plus its declared state auxiliary labels and is diagnostic only.

6. Arms and resource matching

All primary scored architecture arms use identical source/event features, histories, frozen CGBR labels, optimizer evaluations, seeds, and stopping rule. Uniform-query and direct-state ACW differ only in the declared curriculum or auxiliary labels above and are not included in the identical-label comparison.

1. ACW treatment: hard K^d packet and one-register write.
2. Dense categorical recurrence: same hard symbols and parameter budget, but every event may rewrite all registers.
3. Addressed continuous single-write: same supplied address and exact copy mask, three float32 registers, one scalar replacement, parameter matched.
4. Continuous GRU: favorable 39-float state and parameter-matched update.
5. Packet-token transformer: three recurrent packet tokens, one 24-wide, four-head block with FFN width 128.
6. Uniform-query ACW: same architecture and final label count, but no collision-conditioned witness selection.
7. Direct-state ACW: favorable diagnostic with packet/state supervision. It must pass; it cannot support the main claim.
8. Compiled sparse-register realization: literal coordinate packet and affine update, with every external arithmetic operation charged. This is the known compilation and must pass; it cannot support neural learnability.
9. Answer motor: equal/favorable parameters trained only to reproduce the current consumers. It diagnoses answer-specific shortcuts.
10. Source-retained reader: diagnostic upper bound with source/KV access; source 96 -> 128, GRUCell(99,128), retained-source readout [state128,source96,query16] -> 256 -> 17, 166,801 parameters. It is not a valid source-deleted comparator.

For the CPU domain, the shared reader is query embedding 24 x 16, followed by 48 -> 64 -> 17. Exact frozen core widths and trainable parameters are:

The compiled sparse realization and source-retained diagnostic are not parameter-matched claims. Every valid control receives the same supplied destination address, features, batch schedule, optimizer evaluations, label/oracle cap, and stop rule. No hyperparameter search is permitted in the canonical run.

Parameter differences above 5%, retained-bit differences, actual/transient bytes, mixed precision, extra source bytes, oracle calls, and train/inference FLOPs are reported rather than hidden. "Matched" means parameters, labels, optimizer updates, inputs, and schedules are matched; more-compute controls remain eligible and favorable rather than being excluded. FLOPs and wall time are measured for every arm and cannot be used post hoc to remove the strongest control.

The parameter formulas are part of the contract. All MLPs use SiLU and include biases except the named bridges:

• shared reader: 24*16 + (32+16)*64 + 64 + 64*17 + 17 = 4,625;
• ACW: two 96 -> 51 projectors, 105 -> 80 -> 17 updater, bias-free 51 -> 32 bridge, plus reader = 26,008;
• dense categorical: the same projectors/bridge/reader and 105 -> 64 -> 51 updater = 26,250;
• addressed continuous: 96 -> 3 source, 96 -> 51 hard event code, 57 -> 272 -> 1 addressed replacement, bias-free 3 -> 32 bridge, plus reader = 26,008;
• GRU: 96 -> 39 source, GRUCell(99,39), bias-free 39 -> 32 bridge, plus reader = 26,036;
• packet-token: two 96 -> 51 projectors, shared 17 -> 24 token projection with bias, three 24-wide address embeddings, one four-head 24-wide transformer block with FFN 128, 24 -> 17 requantizer, bias-free 51 -> 32 bridge, plus reader = 25,872;
• answer motor: query embedding 24*16, then commutative [source96, mean_event96, query16] -> 113 -> 17 = 25,939.

The packet-token control re-quantizes all three registers to literal 17-way symbols after every event. Its persistent state is therefore three uint8 symbols; its seven 24-wide float32 packet/event/address tokens consume 672 transient bytes before attention intermediates, which are measured at runtime.

For every learned arm, the resource artifact contains a complete training-step and inference-batch record at batch 256: active event count, wall time, process peak RSS, PyTorch operator-reported FLOPs, largest runtime operator allocation, largest self-operator allocation, and total positive operator allocations. AdamW is included in the training measurement. Unsupported profiler operations are explicitly uncounted rather than imputed, so an operator-reported FLOP total is never represented as an exact hardware FLOP count. The packet transformer's runtime allocation record is the preregistered transient-attention measurement. The exact compiled sparse control separately reports event/query arithmetic, table bytes, and persistent bytes while replaying every source state and event ID; reading stored final state as its prediction is forbidden. It is not a learned arm, and fresh wall time is excluded from the score artifact so the required deterministic evaluator replay remains byte-identical.

7. Causal interventions

The frozen evaluator reports two separate metrics. Scalar accuracy is the fraction of individual (history, query) answers correct; its balanced chance is 1/17. State exactness is the fraction of histories for which all 24 public queries are correct; its independent-uniform reference is (1/17)^24, although empirical shuffled controls are decisive. Seen-depth metrics are reported separately at depth 8; no depths are pooled.

The frozen evaluator performs all of the following:

• replace the packet with a donor packet while holding query and source ID fixed; answers must follow the donor residual state;
• shuffle packets within a batch; performance must fall to chance;
• hold packet fixed while changing source bytes; answers must not follow the inaccessible source;
• append equivalent and non-equivalent event words; equivalent packets must be query-equivalent and non-equivalent packets must admit a separator;
• train a new reader after packet freeze on unseen consumers and a new output recoding;
• evaluate exact depths 8, 16, 32, 64, and 65;
• verify unchanged registers are byte-identical after every addressed update;
• rerun from the same seed and require byte-identical score artifacts.

The donor map is the one-position cyclic roll of the ID-sorted depth-64 evaluation histories. Event-word evaluation uses the first 256 ID-sorted depth-64 histories and the first lexicographic distinct two-event words that produce an equal endpoint, plus the first lexicographic pair with unequal endpoints. The post-freeze reader uses an eight-entry, 16-wide query embedding and [state,query16] -> 64 -> 17, AdamW with the frozen optimizer settings, seed 2026071699, and exactly 500 updates. These choices cannot change after a checkpoint is read.

8. Frozen pass and kill criteria

The direct-state diagnostic must first reach 99% scalar accuracy and 95% state exactness. If it does not, the implementation or optimization setup is invalid.

Across all three development seeds and at least two of three unopened confirmation seeds, ACW must satisfy all of these. The reported result is the median across the three confirmation seeds, with every seed shown:

1. at least 99% scalar accuracy and 95% state exactness after source deletion at depth 8;
2. at least 99% scalar / 92% state exactness at depth 32, at least 98% scalar / 90% state exactness at depth 64, and at least 97% scalar / 85% state exactness at depth 65;
3. at least 99% scalar donor-following accuracy and shuffled-packet scalar accuracy no more than two percentage points above 1/17;
4. at least 98% scalar accuracy and 90% eight-query state exactness for readers trained after packet freeze on unseen consumers and output recodings;
5. zero illegal multi-register writes;
6. the primary comparative endpoint, median confirmation depth-64 state exactness at exactly 57,344 scalar labels, is at least 90% and at least ten absolute points above the strongest valid equal-label architecture control;
7. the all-three-development / two-of-three-confirmation rule above and all resource ledgers complete.

Any source/KV path, hidden packet supervision in the treatment, post-score seed or threshold change, confirmation leak, illegal write, missing control, or resource-ledger omission invalidates the run. If a matched control ties ACW within three points at equal resources and labels, the claimed resource advantage is rejected even if ACW itself works. No Shohin sidecar fit follows a CPU no-go.

Label efficiency is secondary and cannot rescue a failed primary endpoint. It is reported at the frozen cumulative checkpoints 8,192 + 4,096*r labels for r in 0..12. A CGBR efficiency statement is allowed only if both CGBR and uniform-query ACW cross 90% depth-64 state exactness; the ratio uses the first frozen checkpoint crossing that threshold. Candidate oracle evaluations and witness selections are reported separately and are never treated as zero-cost labels.

The trainer serializes a hash-bound model state immediately after each of the first 12 curriculum rounds at those exact cumulative label counts. The r=12 / 57,344-label state is serialized after its 200 round updates and the frozen 800 final refinement updates, at 3,400 total updates, so it is the same model as the primary endpoint. The frozen evaluator rehashes and scores every state at depth 64. A separate committed adjudicator rejects missing/duplicate seeds, arms, reports, resource fields, or label checkpoints; enforces the direct-state gate, all-three-development and two-of-three-confirmation rules, every per-depth/causal/new-reader threshold, the confirmation median, and the strongest-control margin; and writes one immutable hash-bound decision. Historical Git blobs and the files actually executing must both match the checkpoint scientific identity, with all listed scientific paths clean.

9. Prior-art and equivalence boundary

The causal state is equivalent up to coordinates to a minimal residual machine, predictive-state representation, or deterministic automaton. Hard symbols are vector quantization. The updater is a recurrent state machine. External memory, neural status registers, modular recurrent mechanisms, recurrent-memory transformers, block-recurrent transformers, and workspace routing are known families. Collision-guided refinement is adjacent to active automata learning, counterexample-guided synthesis, and distinguishing-sequence construction.

Accordingly, no component or primitive is called world-first. A CPU pass does not authorize novelty language. The only empirical contribution left open is the measured conjunction: rank-limited terminal supervision plus commit-then-challenge collision refinement plus hard single-write source-deleted state, with a demonstrated label/compute advantage over favorable controls. A sparse-register compilation with the same resource vector rejects even that narrow claim.

10. Shohin admission after a CPU pass

The smallest H100 fit, if authorized, freezes the immutable 300k base and trains only the 92,953-parameter sidecar on frozen, execution-verified transition and reuse data. The data split and every researcher-written evaluation prompt are committed first. The fit output is isolated from all flagship paths.

Promotion requires source-deleted state update, late-query recoding, donor intervention, ordinary-language preservation, and full fresh multi-turn transcripts authored and judged after the checkpoint freezes. Fit loss, synthetic exactness, visible <think> tags, or benchmark movement alone cannot promote it.

If Track S succeeds, a separate Track C preregistration will add an operator, address, and HALT/CONTINUE controller around the same packet. Until that controller chooses and verifies its own computation, the result is durable learned memory, not reasoning.