R12 Orthogonal Carry Serializer Curriculum Preregistration

Protocol: R12-OCSC-v8-external-bootstrap-permanent-evidence-candidate

Status: qualification-source repair candidate only. Fresh independent exact-byte review may authorize local source inspection and, separately, local or two-host Linux/Lustre qualification of these mechanics. Author tests do not authorize qualification. Bundle publication, consumer integration, fitting, evaluation, H100 or other GPU use, promotion, and scientific claims remain NO-GO. They require separate real, reviewed implementations for a consumer, trainer, evaluator, report validator, parameter ledger, and train/eval exclusion ledger, plus a separate execution preregistration. This repair authorizes no cluster access, remote action, corpus publication, model run, or job submission.

Owned implementation surface:

R12_ORTHOGONAL_CARRY_SERIALIZER_CURRICULUM_PREREG.md
pipeline/generate_orthogonal_carry_serializer_curriculum.py
pipeline/test_generate_orthogonal_carry_serializer_curriculum.py
pipeline/run_orthogonal_carry_serializer_curriculum.py

The generator may read train/digitwise_protocol.py only. It may not modify that file or any other existing file.

The reviewed arithmetic oracle is frozen to exactly:

path    train/digitwise_protocol.py
bytes   8690
SHA-256 37cd76751eb4146f85268d6c0e44d946eb353ee03605ceb25f4bda97e4c00813

The runner file is an ISO C11/Python polyglot. The only authoritative entry is an independently compiled external C executable made from the exact reviewed runner bytes. Before starting Python, that executable opens its own actual executable, the Python interpreter, a reviewed runtime manifest, the pinned checkout root, all five consumed sources, and every held runtime file. Absolute paths and checkout-relative source paths are traversed component by component with descriptor-relative O_NOFOLLOW; no resolve() or realpath() result is used as pre-open authority. Pre-existing symlink aliases, .. escapes, nonregular files, hard links, world-writable files, hash drift, and component identity changes are rejected.

The external executable hashes its own actual bytes, not a caller-supplied launcher string or an imported Python constant. It verifies the exact Python bytes and shohin-ocsc-external-runtime-closure-v1 manifest before any project Python import. Runtime records are sorted exact role<TAB>sha256<TAB>absolute- path lines with roles bootstrap, python, runtime-held, or runtime-inventory. Held code and native-image descriptors survive into Python. The C executable passes a hash-chained attestation through an anonymous retained descriptor, starts the pinned interpreter with -I -S -B -c, and executes the reviewed runner payload from its retained descriptor. The minimal Python launch code is part of the compiled executable and is therefore covered by the actual executable hash; an internal module constant or caller-constructed context has no standing.

Only after that external attestation does the runner import Python helpers, validate every retained descriptor and live component identity, configure the authenticated distribution paths, compile the retained generator bytes, and inject the source/runtime descriptors. Before any oracle byte is compiled, the generator verifies the retained oracle descriptor, live pathname identity, frozen byte length, and frozen SHA-256, then compiles only that snapshot. Source and runtime descriptors are re-read after the action. Direct generator or runner execution is rejected and has no authority. A second decimal state parser, validator, microstep executor, state replay, and terminal-answer reader is implemented independently inside the reviewed generator and replays all 48,000 emitted corpus rows. It does not call the reviewed oracle. Every state, response, local target, carry/borrow, and answer must agree exactly between the imported oracle and independent replay. A coherently wrong mutable oracle therefore cannot certify itself.

1. Fixed evidence and claim boundary

The design is motivated by these observations, not by OCSC results:

1. Original DRS can write and consume local carry or borrow in its grammar.
2. The original 439,865 rows include 39,985 final-answer rows; all 39,985 terminal states have c=0.
3. Terminal-only data restores carry sensitivity but overpredicts c=1.
4. Broad width data harms serializer exactness.
5. In a development-only balanced 16-case field intervention under one-cache, EOS-suppressed continuation, nominal second-state exactness was 5/16. Carry-flip full-target exactness was 7/16, but output changed only 3/16. Six of eight true-carry-one nominal cases were wrong while coincidentally matching the carry-flipped target. Written-result flips changed output 7/16, while full-target exactness was 1/16.
6. On eight carry interventions using frozen weights, full-history continuation with stale S0 retained and generated S1 produced only 1/8 paired causal carry responses. A fresh prompt containing the same S1 but no S0 produced 7/8.
7. Independently replayed four-arm evidence is frozen at artifacts/eval_history/digitwise_factorial_v4_four_arm_replay_v5_de45ace_20260718.json, SHA-256 d08b17a4fdaf031205ca445bb01f72a2983010e5eb929e6f13ab46409fa5c42f. In the WIDTH to TERM+WIDTH state-exact flow, 179 of 249 gains are frozen terminal-carry class 10 (active carry/borrow before the final digit and cleared after it), while 200 of 211 losses are class 00. Subtraction class 00 alone accounts for 158 of 211 losses. The largest signed cells are add width four class 10 at +65/-4, subtraction width four class 10 at +94/-7, and subtraction width four class 00 at +36/-107. Symmetric source-arm field reconstruction places c at the first mismatch in 247 of 249 gains and 207 of 211 losses. Among class-10 gains, c is involved in 177 of 179. Addition width-four class 10 has 65 gains, all c-only; subtraction width-four class 10 splits its 94 gains into 90 c-only, two c+r, and two r-only. Among the losses, c is involved in 196 of 200 class-00 regressions and 155 of 158 subtraction class-00 regressions. Subtraction width-four class 00 splits into 99 c-only, seven c+r, and one r-only first mismatches; addition width-four class 00 splits into 23 c-only and one r-only. Many failures begin before the final digit and therefore are not merely final emission errors. Directional reconstruction shows that 239 of the 249 WIDTH source errors repaired by TERM+WIDTH are expected-carry-one predicted as zero, eight are expected-zero predicted as one, and two preserve the carry prediction while changing another field. In the opposite direction, 196 of 211 TERM+WIDTH regressions are expected-zero predicted as one, 11 are expected-one predicted as zero, and four preserve the carry prediction. TERM+WIDTH thus shifts a carry threshold through the optimum rather than uniformly improving state execution.
8. The superseding direct frozen-parent diagnostic is frozen at artifacts/eval_history/drs_terminal_width_sweep_v2_w2_w10_20260718_mps.json, SHA-256 db6056e66310ed7d56509403d40f7549d016294a014c0c4527173b4005210520, against the same DRS parent d79e9df26caecb9801118d1bf68bd7b85381a06b256f23478acffe40a2108459 under MPS greedy decoding and frozen-protocol oracles. Widths two through ten use matched positive-final-carry and negative/no-final-carry arms with identical lower history within each width; only the final operand digits differ. The positive arm is 0/9 strict-exact transitions and 0/9 exact serializers, but tolerant raw-field reconstruction finds c exact at widths two and three (2/9) and r exact in five of nine. Its failure sets are z-only at widths two/three, c-only at widths four/five/seven, c+r at widths six/eight/nine, and p+c+r+z at width ten. The negative arm has raw c exact 9/9, raw r exact 5/9, strict transition exact 5/9, and serializer exact 5/9; its serializer is exact at widths two through six and then 0/4 at widths seven through ten. Strict-parser nulls therefore cannot be interpreted as every field being wrong. This matched deterministic interaction sweep is a diagnosis, not a benchmark, training result, or broad reasoning claim.
9. The teacher-forced terminal-carry residual-swap diagnostic is frozen at artifacts/eval_history/drs_terminal_carry_residual_swap_w2_w10_20260718_mps.json, SHA-256 4183b8c381e559b23c41b88c8c8cc3b3d0e0b41c03b3dea4786df98a7676590f. At layer 29, positive-versus-negative carry separation is positive in eight of nine widths, with an inversion at width six. The absolute c=1 logit exceeds c=0 only at widths two and three. This shows a broadly present late carry direction with a miscalibrated absolute decision boundary; it is not autonomous reasoning, a benchmark, or a trained intervention.

Observation 5 demonstrates default-carry-zero confounding. Observation 6 shows a large compound history-versus-fresh-prompt sensitivity despite available arithmetic, but it does not identify source presence, cache reset, token position, or framing separately. Consequently, nominal target accuracy, counterfactual target accuracy, raw output change, and paired target-switch are distinct readouts. Raw counterfactual accuracy has no causal authority and cannot compensate for a failed target-switch gate. Local carry supervision alone does not establish robustness to that compound canonicalization package. Source-specific attribution requires SCERT.

Observation 7 is an almost pure carry-threshold tradeoff, not an aggregate-score target. Any later GPU preregistration must report gains and losses separately by frozen terminal carry class, operation, and width. It must retain genuine class 10 carry/borrow resolution while reducing first-mismatch c-field regressions on matched class 00; a class-10 improvement cannot compensate for a class-00 regression, and an aggregate exactness increase cannot satisfy this gate. The carry-policy gate and serializer-exactness gate are separate and noncompensatory in both directions. OCSC must calibrate matched feasible carry-positive and carry-negative contexts. Additional positive-carry supervision without its matched negative-carry control is contraindicated and cannot be introduced by a later execution preregistration.

Observation 8 separates universal terminal-carry inclusion from length-generalized reverse readout. A candidate must preserve the frozen parent's negative-arm serializer competence at widths two through six while separately repairing positive-arm carry/write behavior and serializer readout at every width. Aggregate width balancing, carry-only improvement, or TERM+WIDTH-only gains cannot compensate for a polarity/width failure. Tolerant raw field-set strata and strict state exactness are both mandatory readouts; neither may be inferred from the other.

Observation 9 localizes a likely calibration problem but does not authorize a residual-edit claim. A future intervention must still pass autonomous strict state and serializer gates; teacher-forced swap direction alone has no promotion authority.

The narrow hypothesis is that a complete feasible local basis, matched prefix interventions, and a shortcut-resistant serializer relation can improve exact DWS execution. Natural-language parsing, ordinary-language arithmetic, composition, autonomous control, and broad transfer remain fully deferred.

2. Exact 24,000-row OCSC corpus

22,500 transition rows
+1,500 serializer rows
=24,000 rows

Widths are exactly 3,4,5,6,7. Each width has 900 transition cells and five contexts per cell, hence 4,500 transition rows.

Initial incoming c=1 and terminal-subtraction outgoing borrow 1 are impossible and are always N/A. Interior cells use enumeration-order round-robin over positions 1..w-2; per-position counts differ by at most one.

2.1 Matched context construction

Every noninitial cell has three reachable anchors at contexts 0,1,2. Contexts 3,4 are clones of contexts 0,1, respectively. A clone changes exactly one already-written r[q], where q<p. Input states and one-step targets differ only at that same r[q]; operation, width, position, carry, operand tapes, terminal flag, active result digit, and outgoing carry are identical. These 7,000 pairs are local_prefix_intervention.

Initial states have no writable prefix. Their 0<->3 and 1<->4 pairs remain solver-reachable and differ at exactly one unprocessed suffix operand digit. They are 2,000 initial_suffix_context_invariance pairs and are never labeled prefix interventions.

All target states are reconstructed with apply_microstep. Reachable rows must equal solver replay; interventional rows may differ from replay only in the written result prefix.

3. Serializer corpus and anti-shortcut contract

Each width has five deterministic translation orbits, ten translations per orbit, and two orientations:

50 reversal pairs x 2 orientations x 3 valid slices = 300 rows/width
300 x 5 widths = 1,500 rows

Valid slices are add_c0, add_c1, and sub_c0. Paired tapes share identical operands, and neither tape is the natural arithmetic result. The generator rejects palindromes, reversal-equivalent orbits, constant-except-one patterns, fewer than three distinct digits when width permits, fewer than two adjacent difference values, affine modular-difference patterns, and insufficient pairwise Hamming separation against translations and reversals. Minimum orbit separation is 1,2,2,3,3 for widths 3,4,5,6,7.

Every width has 100 unique tapes, exact ten-per-digit marginals at every LSF position, ten tapes with an LSF zero, ten with a most-significant zero, and 100 rows in each valid slice. add_c1 answers have length w+1.

The relation graph contains 750 positive reversal pairs and 750 deterministic cross-pair mismatches. Every serializer batch has two positive pairs and two crossed mismatches in the same main forward. Reversal alignment maps tape position p to w-1-p; positions omitted by ordinary-integer leading-zero rendering are explicitly absent. Counterfactual edges retain only aligned positions with different target digits and use a JS margin of 1/10, so a constant or uniform candidate distribution cannot minimize the package.

4. Slot-matched IID control

The IID control also has exactly 24,000 rows: 22,500 newly drawn reachable transitions and byte-identical references to the shared 1,500 serializer rows. Each IID transition is matched one-to-one to an OCSC slot on width, role, position, operation, context index, completion-mask indices, nonpadding-token count, and supervised-position count. IID operands are deterministic draws; they do not enumerate the complete local basis.

B-A is therefore only the slot-matched curriculum contrast. Serializer content, timing, bytes, and dose are identical.

5. Independent [8,256] main batches

There are exactly 4,875 shared skeleton slots: 4,500 transition slots and 375 serializer slots. The skeleton is deterministic round-robin stratified by kind, width, role, position, operation, and incoming carry where applicable.

• Transition batch: five real row lanes and three dummy lanes.
• Serializer batch: four real row lanes and four dummy lanes.
• Every batch shape is exactly [8,256], or 2,048 main positions.
• Every lane has its own causal mask and position reset 0..token_count-1.
• Attention and KV state are block diagonal across lanes. Cross-row attention is forbidden.
• Pair endpoints share this one main forward. Extra endpoint forwards are forbidden.

Each slot receipt losslessly emits 256 u32 token IDs, 256 u8 attention values, 256 u8 completion values, 256 u8 field IDs, 256 u8 raw units, and 256 little-endian u16 position IDs. The 2,560 raw bytes are compressed with zlib level 9, base64 encoded, and bound by compressed and uncompressed SHA-256 hashes. Dummy lanes contain the pad token and zero masks. Pack records bind all eight slot payloads and emit exact pair-to-lane activation maps.

Production tokenization remains bound to:

SHA-256 87532df5c121753de3b29194e1f9e3de47986d3f5359548fdf93606773a233d4
bytes   2309567

Every decimal digit must encode as one distinct token, and every active target digit must align to exactly one causal target token. Any lossy frame, boundary-crossing token, overlength lane, or ambiguous digit alignment is a hard rejection.

6. Paired 5,120-update schedules

Within a seed, every run cell uses the same 4,875-slot stratified skeleton before any repeat. Across seeds, the deterministic within-stratum order and balanced repeat selection differ. Each seed has its own committed cycle hash, update-RNG-stream hash, and order-invariant SHA-256 of its sorted 245-member repeat-set identity; all three values must be distinct across all three seeds. Different ordering of the same 245 members is a hard rejection. Exactly 245 prebound skeletons repeat per seed, so 4,630 packs occur once and 245 occur twice. Every repeat set contains 19 serializer, 50 initial, four inactive noninitial, 86 active carry-zero, and 86 active carry-one transition slots. Thus active noninitial local-pair dose remains balanced.

Per run and seed, every schedule row emits the exact skeleton, pack, occurrence, row presentations, nonpadding tokens, supervised positions, raw units, main positions, resident and active relation IDs, replay ID, and update RNG seed. A and B have equal resource values at every update within a seed. Serializer pack IDs and batch bytes are identical for every cell at identical positions within that seed. Seed-level batch order is intentionally different and is the replication variation; rows and updates are never treated as replications.

Unique active noninitial local pairs are exactly 3,450 at incoming carry 0 and 3,450 at incoming carry 1. Scheduled presentations are exactly 3,622 for each carry value. Initial invariance pairs are outside this balance because initial carry 1 is impossible.

7. Six cells and three paired seeds

The old combined D-C label is removed because simultaneous local and serializer activation does not identify either relation effect.

Paired seeds are exactly 2026071801, 2026071802, and 2026071803. Within a seed, M00/M10/M01/M11 use identical parent bytes, data, packs, replay, update RNG, dropout state, and main forwards. They differ only in relation activation. Across seeds, deterministic stratified batch permutations, repeat sets, and update RNG streams differ. Each seed is analyzed first as one paired replication. Pooling rows or updates as independent replication is forbidden. Within-seed factorial bookkeeping is:

local      = (M10-M00) + (M11-M01)
serializer = (M01-M00) + (M11-M10)
interaction = M11-M10-M01+M00

These are not pooled across seeds and are secondary to the paired carry-switch gate for the local package. No cell has promotion authority in this CPU preregistration.

8. Exact scheduled weights

Field raw units are default=4, op=2, w=2, p=5, c=8, a=2, b=2, r=6, z=5, and serializer answer =8. Uniform runs use the emitted completion mask as unit-one raw weights. For every seed and cell, the generator recomputes from scheduled emitted vectors:

N = scheduled supervised-position count
R = scheduled raw-unit sum
scale = reduced rational N/R
weight_i = raw_i * N/R

The emitted proof requires sum(weight_i)=N and exact mean 1/1. Tests decode the slot payloads and independently recompute N, R, the reduced fraction, and the equality.

9. Frozen future execution contract, still unauthorized

The required parent checkpoint SHA-256 is:

d79e9df26caecb9801118d1bf68bd7b85381a06b256f23478acffe40a2108459

Each run must independently load exact parent model/config bytes with fresh optimizer state. All parent parameters are trainable. One future H100, BF16 parameters/activations, FP32 gradients/loss, batch [8,256], no accumulation, dropout zero, TF32 off, deterministic algorithms on, cuDNN benchmark off, and torch.compile off are frozen.

Muon receives every trainable 2-D parameter whose name contains neither tok nor head: LR 1/50, momentum 19/20, Nesterov on, five Newton-Schulz steps, coefficients 3.4445,-4.7750,2.0315, no decay. AdamW receives all other trainable parameters: LR 3/1000, betas 9/10,19/20, epsilon 1e-8, no decay. Group overlap or omission is fatal. The LR schedule uses 200 linear-warmup updates, is flat through update 4095, then linearly decays for 1,024 updates to multiplier 1/10. Global gradient clipping is 1. Any skipped or nonfinite update invalidates the run.

10. Frozen losses

Main loss is weighted completion-only cross entropy divided by the sum of normalized weights.

Replay uses the frozen parent in eval mode and exact full-vocabulary KL(parent||run_cell). The mask contains positions t whose replay attention at t and t+1 is valid. KL is accumulated in FP32 over vocabulary and valid positions, then divided by valid-position count. Its coefficient is 1/10.

Local relation loss uses final-normalized hidden states before the LM head and the emitted causal prediction indices. Candidate logits are restricted to carry {0,1} or digit {0..9} and normalized within that set. A local pair is half the sum of carry JS and active-result-digit JS; eligible active pairs are averaged. Eligibility is restricted to factorial-active noninitial local_prefix_intervention pairs. Initial suffix-invariance pairs remain resident for audit but their activation is always zero, and they contribute zero to every carry numerator.

Serializer positive loss is mean JS over emitted visible reversal-aligned digit positions. Counterfactual loss is mean max(0,1/10-JS) over mismatched aligned positions. Serializer loss is positive mean plus counterfactual mean.

L_total = L_main
        + (1/10) L_KL
        + (1/4) (I_local L_local + I_serializer L_serializer)

There is no coefficient-sum renormalization. An inactive component is exactly zero. Auxiliary relations consume only the main [8,256] forward.

11. Replay and reserved evaluation

The input registry has exactly 4,096 records:

Replay occurs every fourth update, alternates families, and consumes each prebound replay prompt once per run. All cells and seeds use the same replay ID at the same update. Normalized-prompt and semantic-signature identities must be globally unique across replay, development, and secret_confirmation registry records. Training, replay, development, secret-confirmation commitments, and the later hidden opening must be pairwise disjoint by both identities.

11.1 Carry-switch canonicalization-package board

Exactly 170 active noninitial base sites use 680 of the 704 development DRS prompt commitments. Every width has 17 true-carry-zero and 17 true-carry-one sites; within each width/carry slice, roles are ten interior, five terminal add, and two terminal sub. Each base site defines a 2x2 carry/package board:

1. nominal incoming carry with old S0 present before current S1;
2. flipped incoming carry with old S0 present before current S1;
3. nominal incoming carry in a fresh prompt containing only the same S1;
4. flipped incoming carry in a fresh prompt containing only the same S1.

The history-retained package uses one-cache EOS-suppressed continuation. The fresh-current-state package starts a fresh cache; its S1 bytes are identical and no S0 bytes are present. This compound contrast simultaneously changes old-source presence, cache reset, absolute token positions, and framing. It is not a source-only effect. Source-specific attribution is deferred to a separate SCERT source-by-cache-by-position-by-framing factorial.

Each carry endpoint reconstructs its own target. An authenticated opening must store the exact site ID, endpoint and package condition, prompt bytes, endpoint token bytes and frozen-tokenizer IDs, target-token and causal-prediction positions, ordered (active_digit,outgoing_carry) target, and per-row parse and exact-score contract. Secret rows are not exposed by this CPU artifact. The following integer counts are reported separately by package condition:

1. nominal full-target exact;
2. counterfactual full-target exact, descriptive only;
3. raw output bytes changed, descriptive only;
4. paired local target-switch exact: both outputs parse and each emitted (active_digit,outgoing_carry) equals its own ordered target tuple;
5. canonicalization-package joint exact: all four outputs parse and match the local target encoded by current S1 for their carry endpoint.

For every M11 seed, history-retained-package and fresh-current-state-package target-switch must each be at least 166/170; package-joint exactness must be at least 163/170; and every width/true-carry slice must be at least 16/17. These gates are noncompensatory. Counterfactual full-target accuracy, including high accuracy under the fresh package, cannot satisfy a failed history or joint gate. These results cannot authorize a source-specific claim.

12. Hidden Merkle confirmation

The hidden direct board has exactly 3,600 rows: 2,100 transitions and 1,500 serializers. Per width, transition geometry is:

Every noninitial site contains the exact Cartesian product of prefix anchor/intervention and carry endpoint c0/c1. At each carry endpoint, the prefix intervention changes exactly one earlier r[q], q<p; every other source field and byte is fixed, and the target differs only at the same already-written byte. At each prefix variant, the carry pair changes only c; both one-step targets are reconstructed and their active target digits must switch. Initial pairs instead change exactly one unprocessed suffix operand digit, remain reachable at c0, and are never carry interventions.

For every noninitial site, the verifier independently replays the operands from position zero to p and requires the one anchor carrying the solver-natural carry bit to equal that replay byte-for-byte before any prefix intervention is considered. It is not sufficient for the row merely to carry the correct reachability label. Corrupting any earlier prefix byte in both arms is fatal.

Full-state uniqueness is also insufficient. For every width, hidden transition sites mechanically enforce all of the following:

• initial and interior sites contain both addition and subtraction with at least 16/50 and 13/40 sites per operation, respectively;
• terminal-add is all addition and terminal-sub is all subtraction;
• interior sites cover every legal position 1..w-2, with position counts differing by at most one;
• active left and right digits cover 0..9 at least twice for initial/interior and at least once for terminal-add;
• feasible terminal-sub domains cover active left digits 1..9 and active right digits 0..8 at least once;
• each natural site tuple (op,p,c,a[p],b[p]) is unique; and
• every anchor endpoint tuple (op,p,c,a[p],b[p],target_digit,outgoing_carry) is unique.

These requirements are frozen inside the hidden geometry commitment. Varying irrelevant tape context while repeating one local arithmetic transition cannot satisfy the opening verifier.

Every width/slice serializer cell has 100 rows. Each width has 50 six-row sites: one operand pair, two non-palindromic reversal tapes, and all three valid slices. The opening verifier independently enforces identical pair operands, operation, width and site, natural-result exclusion, unique semantic signatures, exactly five ten-translation orbits, 100 unique tapes, exact digit marginals, zero marginals, non-affine adjacent differences, anti-shortcut diversity, and Hamming separation. Duplicate signatures are fatal.

Hidden rows are not emitted by the generator. The commitment contains only board ID, exact geometry, leaf count, Merkle algorithm/root, a domain-separated custodian-opening commitment, and no secret rows. Every opened row includes exact site/pair IDs, endpoint bytes and token IDs, prediction and target-token positions, targets, and its tokenizer-bound scoring contract.

Canonical opening rows use ASCII sorted-key compact JSON without a newline in the leaf payload. For ordinal i and canonical row bytes R:

leaf_i = SHA256("R12-OCSC-HIDDEN-LEAF-v1\0" || u64be(i)
                || u64be(len(R)) || R)
node_l = SHA256("R12-OCSC-HIDDEN-NODE-v1\0" || u64be(level)
                || left || right)
root   = SHA256("R12-OCSC-HIDDEN-ROOT-v1\0" || u64be(leaf_count)
                || tree_top)

Odd levels duplicate the last node. The verifier rejects arbitrary roots, wrong order/ordinals, duplicate IDs, malformed schemas, noncanonical JSON, noncanonical DWS state strings (including whitespace and leading-zero scalar encodings accepted by a merely syntactic parser), tampered leaves, two-position prefix mutations, wrong geometry, invalid DWS witnesses, collapsed or palindromic serializer tapes, duplicate signatures, and differing pair operands. On opening, hidden normalized prompts and semantic signatures are checked against final train, replay, development, and secret_confirmation sets.

Post-publication manifest copying is forbidden as custody evidence. Before the bundle directory exists, an external custodian must issue one canonical Ed25519-signed prepublication commitment over the exact output path and parent directory device/inode/mode/owner-UID identity, mode, artifact inventory, pad token, tokenizer/registry/hidden-commitment paths, sizes, hashes, file device/inodes, custody-root paths and device/inodes, and the complete source manifest. The production trusted public key is frozen as:

4d67229fe6b9c62f95ae9208284735fcb4c410e2efb2e4f8a6d935b762887e08

Its private key is not present in this repository. Test mode uses a distinct frozen test-only key with no production authority. This custodian signature is necessary but no longer sufficient for publication.

A second, distinct external Ed25519 independent-review receipt is mandatory. Its signed review request binds the exact bytes and SHA-256 of each of the four owned sources separately; the frozen oracle path, bytes, and SHA-256; the full tokenizer, prompt-registry, and hidden-commitment custody contracts; the exact prepublication request object and hash; the signed physical output parent and canonical pathname; and the byte length and SHA-256 of all ten expected output files. Its decision is limited to approve-cpu-publication-contract-only and cannot authorize GPU execution, promotion, or a claim. The review receipt is a sole 0444, one-link file under its own 0555 custody root and remains outside the closed ten-file bundle. Generation, ordinary verification, and hidden- opening verification all require it.

The test review key is distinct from both prepublication keys. It can authorize test mode only. No production independent-review public key, private key, or receipt is present or invented in these bytes: the production review trust root is deliberately unset, so any production review receipt, including one signed by the test key, is rejected. Freezing a real external production review public key and supplying a matching exact-byte receipt require a later reviewed source change.

The generator verifies both signatures. The resulting manifest binds the immutable receipt path, bytes, SHA-256, request SHA-256, custodian, sequence, and signer key. Later bundle and hidden-opening verification require that same prepublication receipt, reconstruct its signed request from live source/input bytes, and separately reconstruct and verify the independent review request from the ten bundle files. Generation captures the tokenizer, registry, hidden commitment, reviewed source manifest, prepublication receipt, and independent-review receipt exactly once before publication authentication. Those same immutable byte-and-identity snapshots are threaded through build_artifacts, its final authenticated-request check, staging, and the last pre-rename check; no phase may authenticate one pathname opening and consume a later opening. Independent verification likewise captures one input set and uses those exact objects for signed-request authentication and deterministic reconstruction. A caller-supplied receipt dictionary is not trusted.

The tokenizer, registry, hidden opening, hidden commitment, custodian opening, prepublication commitment, and independent-review receipt each reside as the only 0444, one-link file under its own 0555 directory. The bundle directory is 0555 and its artifacts are 0444. A late receipt, signer substitution, test-to-production signer reuse, changed source closure, substitute registry, moved or self-rehashed bundle, unauthenticated opening, extra root file, symlink, or hard link is fatal. CPU request construction, generation, deterministic bundle verification, and hidden-opening verification all enforce this custody-root contract. Each custody read pins the root directory, inventories it through that descriptor, opens the sole child with openat/O_NOFOLLOW, reads one inode, verifies fstat before and after, verifies the directory entry still names that inode, then verifies the original and resolved root paths still name the pinned root. Loaded bytes, hashes, and sizes therefore come from one mechanically stable snapshot rather than a validate-then-reopen pathname sequence.

Bundle verification similarly opens the requested 0555 bundle directory once, inventories it through that pinned descriptor, opens all ten 0444, one-link artifacts relative to it, and retains the directory and artifact descriptors through manifest validation, artifact hashing, deterministic byte reconstruction, and the final directory-path/inode/inventory check. Hidden- opening verification reuses that same pinned bundle object, including the already authenticated manifest, train corpora, and replay bytes, through the contamination comparison and its final check. It may not verify one bundle and then reopen a replacement bundle by pathname for hidden-set comparison. It also captures the tokenizer, registry, hidden commitment, prepublication receipt, and independent-review receipt once before bundle authentication, passes those exact snapshots into bundle verification, and uses the same tokenizer/registry/ commitment bytes for hidden replay and contamination checks. An A-to-B-to-A same-path swap between those phases is therefore either irrelevant to consumed bytes or rejected by the manifest identity contract and final custody check.

13. Integer gates, not execution authority

The three immutable diagnostic evidence identities are part of the machine-readable evaluation_gate_contract() and may not be replaced by a same-schema or self-rehashed file:

artifacts/eval_history/digitwise_factorial_v4_four_arm_replay_v5_de45ace_20260718.json
d08b17a4fdaf031205ca445bb01f72a2983010e5eb929e6f13ab46409fa5c42f

artifacts/eval_history/drs_terminal_width_sweep_v2_w2_w10_20260718_mps.json
db6056e66310ed7d56509403d40f7549d016294a014c0c4527173b4005210520

artifacts/eval_history/drs_terminal_carry_residual_swap_w2_w10_20260718_mps.json
4183b8c381e559b23c41b88c8c8cc3b3d0e0b41c03b3dea4786df98a7676590f

Every seed separately requires B-A >=60 direct correct, M00-B >=-6 direct correct, M00-B >=10 serializer correct, nonnegative direct brackets M10-M00 and M11-M01, and serializer brackets M01-M00 >=10 and M11-M10 >=10. There is no pooled row-level numerator.

The primary local effect is hidden noninitial paired carry target-switch exact at M11. Every seed requires M11 >=392/400, M11-M01 >=8, M11-M00 >=8, and M10-M00 >=0. All three seed gates must pass. Initial suffix-invariance rows contribute exactly zero. The M11 hidden target-switch gate is also 79/80 per width, 198/200 interior, 124/125 terminal add, and 75/75 terminal sub; these are noncompensatory.

Replay top-1 parent-match gates, per seed and cell, are 1268/1280 overall and 634/640 in each family.

The immutable replay-v5 dissociation is also a required noncompensatory readout. Relative to the frozen parent, every candidate must report exact-state gains and losses for terminal classes 00, 01, 10, and 11, split by operation and width. Class 10 must have strictly more gains than losses overall. Class 00 must have gains at least equal to losses both overall and within subtraction. Directional carry decisions are scored on matched parent/candidate rows. For expected-carry-one rows, repairs of parent 1->0 errors must strictly outnumber new candidate 1->0 errors. Independently, for expected-carry-zero rows, repairs of parent 0->1 errors must strictly outnumber new candidate 0->1 errors. Same-carry other-field gains and losses are reported separately and cannot compensate for either directional carry gate. Effective main and auxiliary supervision counts and normalized weights must be reported for matched feasible carry-positive and carry-negative contexts; a positive-only carry supplement is forbidden. Among the matched class-00 regressions, the count whose first mismatch involves the c field must be strictly below the frozen v5 references of 196/200 overall and 155/158 within subtraction. The report must split c-only, c+r, and r-only first mismatches by operation and width and state whether the first mismatch occurs before the terminal digit. These c-field reduction gates cannot be offset by any class-10 gain or aggregate exactness increase. A future source-bound GPU preregistration may tighten these floors before execution but may not pool or remove these slices after seeing a candidate result.

The frozen width-two-through-ten sweep is a separate development nonregression board. Before strict parsing, a tolerant frozen extractor must report the exact raw mismatch field set over p,c,r,z separately for each polarity and width; parse failure may not null or synthesize those field counters. Strict terminal state exactness is then scored independently: all nine positive-final-carry rows and all nine negative/no-final-carry rows must be exact, including final r, c, p, and z. Positive-arm serializers must include the terminal carry and be exact at every width (9/9). Negative-arm serializers at widths two through six must preserve the parent floor (5/5), while widths seven through ten form a separate reverse-readout generalization gate (4/4). No width, polarity, or raw field may borrow credit from another slice, and no raw field, transition, residual-swap, or serializer gate may compensate for another. This board does not replace the larger hidden confirmation board and has no independent promotion authority.

The layer-29 residual-swap board is a third independent calibration gate. At every width two through ten, signed positive-minus-negative separation must be strictly positive and positive-arm absolute c1-c0 logit separation must be strictly positive; the frozen width-six inversion must be repaired. Those teacher-forced directions have no independent authority and cannot compensate for either the autonomous strict-state gate or autonomous serializer gate. Width pooling is forbidden.

Hidden gates are 3564/3600 overall, 99/100 in every serializer width/slice, and ceil(0.99*n)/n in every nonempty transition width/role/carry/prefix-variant slice. Initial suffix-invariance is 248/250. Impossible slices remain N/A.

14. Bundle, source, and permanent-evidence policy

The closed test bundle has exactly ten files: both corpora, relations, replay, tokenization receipts, packs, schedule, commitments, audit, and manifest. The manifest lists exactly the nine non-manifest artifacts. Duplicate JSON keys, nonfinite values, unknown keys, unsafe paths, symlinks, nonregular files, hard links, unsafe modes, and uncommitted bytes are rejected. Tokenizer, registry, hidden commitment, prepublication receipt, and independent-review receipt are bound by exact bytes, SHA-256, descriptor identity, and custody-root identity.

The source manifest is shohin-ocsc-source-manifest-v4. It binds the four owned files and train/digitwise_protocol.py, the shohin-ocsc-bootstrap-source-identity-v2 record, and shohin-ocsc-runtime-closure-v3. The bootstrap identity contains the actual external executable and runtime-manifest descriptors and hashes, the C attestation hash, checkout-root identity, source descriptors, pinned Python identity, and external runtime inventory. A caller-built Python dictionary, internal launcher constant, direct import, or direct runner/generator invocation cannot produce an authoritative source-bound CLI result.

The runtime closure binds the pinned interpreter; Python implementation, version, ABI, and isolation flags; loaded stdlib and distribution modules; full installed-file inventories for cryptography and tokenizers; imported native images; and the external pre-attestation inventory. On Linux, executable native mappings and /proc/self/exe must match the already pinned device/inode identities. Every consumed loaded-module path must have appeared in the external manifest before the generator compiled. Shadow modules, lazy imports outside the inventory, path replacement, and in-place byte drift fail closed.

All path opens in the external bootstrap, runner, and generator use lexical absolute paths only to choose descriptor-relative components. Each component is opened with O_NOFOLLOW and checked against its directory entry before the next component is consumed. Checkout sources are opened relative to the pinned root descriptor. No pre-open resolve() or realpath() is authority. Existing symlink aliases, source symlinks, root aliases, .. escapes, and post-pin component or final-file replacement are rejected.

publish_bundle() remains the one publication mechanics path. Production mode unconditionally rejects until the separately reviewed downstream implementations listed in section 15 exist. Test-mode qualification mechanics still require the signed output-parent identity, deterministic stage/journal/lease names, a kernel flock lease, descriptor-relative O_EXCL|O_NOFOLLOW writes, file fsync after chmod, stage fsync, atomic no-replace rename, parent fsync, strict descriptor/inode readback, deterministic reconstruction, and two complete verification passes. The no-replace primitive is renameatx_np(RENAME_EXCL) on macOS and renameat2(RENAME_NOREPLACE) on Linux; unsupported filesystems fail closed.

Evidence retention is permanent. Failed or partial stages, journals, leases, broker requests, copied broker events, broker receipts, derived reports, markers, and final receipts are never removed or rewritten by an ordinary publication, restart, error, or qualification path. A successful canonical test tree also retains its journal and lease. A partial staged restart verifies the journal/tree binding, stops, and requires a new externally committed output identity. A canonical restart may verify the completed tree idempotently but retains its journal and lease. Torn or absent journals, orphan metadata, ambiguous stage-plus-canonical state, foreign children, coherent same-UID forgeries, replacement inodes, collisions, and injected I/O failures remain in place and fail closed.

capture_retained_publication_evidence() performs descriptor-only inventory and readback without mutation. The five exact crash points are:

stage-created-before-journal
journal-durable-before-first-artifact
partial-artifact-write
stage-fsync-before-rename
canonical-before-parent-fsync

The first point records an absent journal; all later points require the journal. Every point requires the retained lease. The final point requires the retained canonical tree; the other four require the retained stage. Tree, child, journal, lease, and parent identities are rechecked after full reads.

The current test inventory is exactly 56 collected tests. It includes hostile regressions for actual bootstrap-byte drift, runner/source drift, direct execution, pre-attestation environment shadowing, caller-built contexts, root and source symlink aliases, final-file and path-component replacement, runtime shadowing, Linux executable/native-image substitution, no-replace collisions, both-host lease contention, externally launched broker/report source actions, all five exact hard-crash points, partial writes, post-rename fsync failure, foreign and coherent-forgery children, broker omission, publication-path omission, re-signed malformed crash evidence, boolean and count forgery, report/marker forgery, and permanent evidence retention. Author tests remain local evidence only.

15. Honest downstream boundary

No real bundle consumer, trainer, evaluator, report validator, parameter ledger, or train/eval exclusion implementation exists in this repair. Their reviewed source paths and SHA-256 values are null in consumer_interface_contract(). nonexecuting_consumer_contract() can only validate and canonically copy a reference request. It cannot open a bundle, construct tensors, fit weights, evaluate a checkpoint, validate a scientific report, allocate parameters to optimizer groups, prove train/eval exclusion, or authorize publication.

Bundle publication, consumer compatibility, fitting, evaluation, checkpoint or metric production, H100 or other GPU use, promotion, and scientific claims stay NO-GO until all six implementations are real, source-bound, independently reviewed, hash-frozen, and tested against a real reviewed bundle. A separate execution preregistration and parameter ledger are also mandatory. A local or Linux/Lustre filesystem qualification receipt cannot satisfy any of these missing gates.

16. Unexecuted two-host Linux/Lustre qualification source

No remote or two-host qualification has been run for these bytes. Fresh independent exact-byte review is mandatory before even a local qualification attempt. That review may authorize only source inspection and local or Linux/Lustre filesystem qualification. It may not authorize scientific bundle publication, model consumption, fitting, evaluation, GPU work, or claims.

qualification_contract() is shohin-ocsc-linux-lustre-two-host-qualification-source-v2 with status unexecuted-source-contract-only. Its authority fields for qualification, bundle publication, consumer integration, fit/evaluation, GPU use, and scientific claims are all false. The executable qualification-only actions are:

--print-source-manifest
--qualification-output-dir
--qualification-broker-transfer-event
--qualification-write-evidence-package

--qualification-output-dir additionally accepts exactly one reviewed --qualification-crash-point value from the five-point inventory below. It is rejected for every other action.

16.1 External bootstrap prerequisite

An independent reviewer must compile the exact reviewed polyglot runner as C to an external absolute path and freeze the resulting executable bytes:

cc -std=c11 -O2 -Wall -Wextra -Werror -pedantic -x c \
  /absolute/reviewed/shohin/pipeline/run_orthogonal_carry_serializer_curriculum.py \
  -o /absolute/reviewer-controlled/ocsc-external-bootstrap

The reviewer must separately create and approve one canonical ASCII runtime manifest. Its first line and sorted record format are:

shohin-ocsc-external-runtime-closure-v1
bootstrap<TAB><sha256><TAB><absolute bootstrap path>
python<TAB><sha256><TAB><absolute Python path>
runtime-held<TAB><sha256><TAB><absolute imported code/native path>
runtime-inventory<TAB><sha256><TAB><absolute non-code inventory path>

The manifest must include the complete transitive runtime and native-image closure needed by the runner and generator. It is reviewed input, not generated inside the project Python process. The bootstrap executable, Python, manifest, and every record must be one non-world-writable regular file with one hard link. The checkout root and every component must be a real directory, not a symlink.

All qualification-source commands have this external prefix:

readonly OCSC_BOOTSTRAP=/absolute/reviewer-controlled/ocsc-external-bootstrap
readonly OCSC_RUNTIME=/absolute/reviewer-controlled/runtime.manifest
readonly OCSC_PYTHON=/absolute/reviewer-controlled/python
readonly OCSC_ROOT=/absolute/reviewed/shohin
readonly OCSC_RUNNER="$OCSC_ROOT/pipeline/run_orthogonal_carry_serializer_curriculum.py"

/usr/bin/env -i LC_ALL=C PYTHONDONTWRITEBYTECODE=1 \
  "$OCSC_BOOTSTRAP" \
  --bootstrap-sha256 '<approved actual bootstrap SHA-256>' \
  --runtime-manifest "$OCSC_RUNTIME" \
  --runtime-manifest-sha256 '<approved runtime-manifest SHA-256>' \
  --python "$OCSC_PYTHON" --python-sha256 '<approved Python SHA-256>' \
  --runner "$OCSC_RUNNER" --checkout-root "$OCSC_ROOT" \
  --runner-sha256 '<approved runner SHA-256>' \
  --prereg-sha256 '<approved preregistration SHA-256>' \
  --generator-sha256 '<approved generator SHA-256>' \
  --tests-sha256 '<approved tests SHA-256>' \
  --oracle-sha256 37cd76751eb4146f85268d6c0e44d946eb353ee03605ceb25f4bda97e4c00813 \
  --profile qualification -- <one reviewed qualification-only action>

Replacing the final action with --print-qualification-contract before the -- prints the runner contract after C attestation and accepts no generator arguments. -- --print-source-manifest forces the complete generator runtime and source closure, but both inspection results have zero authority.

16.2 Required execution paths

After a separate review authorizes qualification, node A and distinct node B must run the exact prefix against the same Lustre mount source and output-parent device/inode. Node A uses --qualification-output-dir and the real frozen tokenizer, registry, commitment, external test-mode prepublication commitment, and independent-review receipt. Node B must contend while node A holds the real kernel lease and must record live exclusion. Both nodes must use distinct host, FQDN, kernel, publisher, sequence, and nonce identities. A same-host process or fork is local mechanics evidence only.

Deliberate process deaths must cover all five crash points. Each attempt uses a new externally committed output identity. No failed attempt is reused or altered. Restart observation uses the same publish_bundle() and capture_retained_publication_evidence() paths. Linux must exercise the real renameat2(RENAME_NOREPLACE) branch on Lustre, file fsync after chmod, stage and parent fsync, descriptor/inode readback, collision rejection, live flock exclusion, and canonical restart verification.

The crash selector is inside publish_bundle(), not a parallel simulator. It sends SIGKILL after the stage is opened but before its journal, after the journal and parent are durable, after a durable strict prefix of the first artifact, after the complete stage is chmoded and fsynced, or after the no-replace rename but before parent fsync. Canonical restart fsyncs the parent before strict descriptor readback. The other four restart states fail closed and retain the exact stage, journal when present, lease, and children.

The production broker path is execute_qualification_broker_transfer(), exposed by --qualification-broker-transfer-event. It validates one signed raw event, writes an immutable signed broker request with no replacement, copies the exact event with descriptor-relative no-replace I/O, fsyncs the file after chmod, fsyncs the parent, performs descriptor/inode and exact-byte readback, then writes an immutable signed broker receipt. Request, copied event, and receipt remain at their original paths and inodes.

--qualification-write-evidence-package accepts only shohin-ocsc-qualification-raw-evidence-request-v1: reviewer identity, sequence, nonce, command, raw signed events, signed broker requests, signed broker receipts, and its payload hash. It has no fields for checks, booleans, summaries, numerators, or denominators. The source derives and no-replace writes the report, marker, and final receipt. The signing key is a separately pinned 0400 custody file supplied with --qualification-signing-key. No production qualification key is configured in these bytes, so production mode remains fail-closed.

The derived report, marker, and final receipt are each written no-replace into a distinct deterministic one-file custody root. Each file is descriptor-read back against its directory entry, each root is fsynced and frozen at mode 0555, and the package parent is fsynced. The externally attested action then revalidates the final signature, all events, both broker records, report, and marker before returning its zero-authority verification record. Any partial custody root remains permanently retained.

16.3 Event-derived machine contract

Each raw event is shohin-ocsc-qualification-event-v1, signed in domain R12-OCSC-QUALIFICATION-EVENT-v1\0. It binds qualification, host, FQDN, kernel, per-host sequence and previous-event hash, event type, nonce, source manifest, Lustre mount source/path, output-parent device/inode, and structured details. Booleans are forbidden. evidence_sha256 is recomputed from the other detail fields. Per-host sequences start at one with no gaps and hash-chain every signed event.

Exactly one event is required for each check below:

external_bootstrap_source_bound
all_consumed_source_bytes_pinned
runtime_closure_complete_before_action
real_tokenizer_registry_consumed
cross_node_distinct_hosts
same_lustre_mount_and_output_inode
production_broker_transfer_complete
publication_path_complete
renameat2_noreplace_real
descriptor_relative_io
file_fsync_after_chmod
stage_and_parent_fsync
kernel_flock_live_exclusion
stale_lease_observed_without_mutation
all_crash_evidence_permanently_retained
canonical_death_recovery
collision_rejected
path_substitution_rejected
coherent_forgery_foreign_child_preserved
partial_child_preserved
foreign_replacement_preserved
runtime_shadow_import_rejected
injected_io_fail_closed
strict_full_readback
report_marker_receipt_event_derived
permanent_evidence_inventory_recorded

The broker-transfer check additionally requires exactly one shohin-ocsc-qualification-broker-request-v1 and one shohin-ocsc-qualification-broker-receipt-v1, both signed and hash-bound to that event and to the same source manifest. The publication-path event must contain this exact ordered path:

production-broker-transfer
publish_bundle-stage-no-replace
file-fsync-after-chmod
stage-fsync
rename-noreplace
parent-fsync
descriptor-inode-readback

derive_qualification_report() produces shohin-ocsc-qualification-derived-report-v1. Its check_evidence values are event/request/receipt ID lists, never booleans. Its summary is mechanically fixed to 26 raw events, one broker request, one broker receipt, 26 derived checks, five retained crash records, and two distinct hosts. qualification_marker() revalidates these counts and IDs. Neither accepts a caller denominator or success map.

The final canonical receipt is shohin-ocsc-linux-lustre-qualification-receipt-v3 with exactly:

schema
qualification_id, reviewer_id, sequence, nonce_hex
command, command_sha256
source_manifest, source_manifest_sha256
raw_events
broker_requests
broker_receipts
derived_report
marker
claim_boundary
signature_algorithm, signer_public_key_hex, signature_hex

Its signature domain is R12-OCSC-LINUX-LUSTRE-QUALIFICATION-v3\0. Verification checks the signature, revalidates every raw event and broker chain, re-derives the report and marker, and requires exact recursive equality. A re-signed forged count, check, publication path, crash inventory, event, report, or marker is rejected.

16.4 Decision boundary

Author tests establish source behavior only. They do not establish a Lustre mount, distinct physical hosts, external reviewer identity, or qualification receipt. The honest result after author verification can be at most GO for fresh independent exact-byte source rereview and qualification-source review. Actual local or Linux/Lustre qualification remains NO-GO until that review explicitly authorizes it. Remote qualification is never authorized by author tests.

Even a valid future qualification receipt has qualification_authority=false in this repair and cannot authorize production bundle publication or any downstream scientific action. Consumer integration, fit/eval, H100, model reports, promotion, and claims remain NO-GO until the separate implementations and reviews in section 15 exist.