R12 Shared In-Model Transition Circuit Theory

Protocol schema: R12-STC-THEORY-SCHEMA-v3

Any externally reported hash for schema v2 identifies superseded bytes. This schema has no embedded self-hash. An externally computed SHA-256 may identify the exact v3 theory artifact, but it is not an implementation, generator, secret, instrumentation, or executable-protocol commitment under Section 12.

Status: THEORY AND PROTOCOL SCHEMA ONLY; NOT AN EXECUTABLE PREREGISTRATION. This file does not freeze implementation source, a data generator, support/exclusion rules, secret commitment, artifact hashes, exact training denominators, instrumentation bytes, or a report validator. It therefore authorizes no checkpoint change, CPU result, neural implementation, data generation, fit, autonomous score, accelerator job, H100 launch, capability claim, or novelty claim. Sections 12-15 specify what a later executable preregistration would have to bind before any run.

Decision in one sentence: the 578->4096->4096->12 MLP is only a local whole-pair predictor unless a fixed runtime initializes and advances an opaque state, proves that the committed carry is the carry consumed by the successor, and excludes generated output from that path; the resulting complete system is an ordinary finite-state/Mealy recurrent machine with a learned local table, not learned end-to-end reasoning.

1. Frozen empirical boundary

This dossier takes the following facts as constraints, not targets to reinterpret or improve post hoc.

The canonical r3 diagnosis in R12_DRS_CAUSAL_CYCLE_RESULT.md is the local starting point: digit response was stronger than carry response, only 9/50 integrated two-call cycles were exact, and generated-token KV was explicitly excluded from an admissible successor. The packet-on-lattice result is also binding: moving one carry bit with cursor support is exactly an ordinary finite recurrent transducer, not a new computational primitive.

The exploratory digit motor's perfect teacher-forced fit is an actuator ceiling. It is not evidence that its output is consumed, that errors do not compound, or that the model has acquired an autonomous transition law.

2. Exact question and claim boundary

The bounded question is:

Can one shared learned circuit convert the frozen post-DRS local residual into an atomic digit/carry transition, commit the carry to a minimal private state, and support width/value-OOD closed-loop execution without any generated token, parsed tape, or host arithmetic entering the successor computation?

This schema does not yet define matched training. The strongest admissible future positive claim is therefore about the entire PEDC interface and training package, not atomic commit in isolation:

Under one later executable protocol that freezes the complete training and runtime resource vectors, the PEDC package gives a reproducible causal and behavioral advantage over its primary ordinary-transducer control on the canonical digitwise transition family.

A PEDC-component attribution is allowed only if that later protocol makes PEDC and R-SEQ identical in ordered data, semantic targets, loss terms, coefficients and reductions, argmax gradient estimator, warmup, optimizer, initialization and update schedule, model calls, sequential depth, precision, FLOPs, and allocated state/source/trace/output/KV bytes, leaving agreement-or-fault commit versus R-SEQ's fixed aggregate commit as the only treatment variable. The resulting learned weight trajectories need not be equal. If exact protocol matching is impossible, any positive is package-level and cannot be attributed specifically to atomic commit, dual-view agreement, or site conditioning.

Even a complete pass would not establish:

• a new computational class;
• a new state ontology;
• learned operation selection or planning;
• learned cursor scheduling or general halting;
• arbitrary-width execution beyond the tested source representation;
• a natural-language source compiler;
• a conventional decimal answer formatter;
• learned end-to-end execution, because fixed runtime logic supplies initialization, addressing, recurrence, cursor movement, END handling, emission order, and halt;
• broad reasoning, SoTA, or a world-first primitive.

3. The bare shared trunk

Let h in R^576 be the frozen block-29 residual at one transition aperture. Let the two exact site codes be

s_D = (1,0)    digit view
s_C = (0,1)    carry view.

The candidate trunk is

f_theta(h,s) = W3 SiLU(W2 SiLU(W1 [h;s] + b1) + b2) + b3,

[h;s] in R^578,
f_theta(h,s) in R^12.

Each 12-logit output is split as

f_theta(h,s)[0:10]   digit logits for {0,...,9}
f_theta(h,s)[10:12]  next-carry/borrow logits for {0,1}.

Both site views predict the complete pair. The treatment does not use a digit view that predicts only a digit and a carry view that predicts only carry. That weaker construction permits two unrelated classifiers while making their shared parameter tensor look mechanistically meaningful.

3.1 Exact parameter ledger

Layer 1 weights       578 * 4096             2,367,488
Layer 1 bias                    4096              4,096
Layer 2 weights      4096 * 4096            16,777,216
Layer 2 bias                    4096              4,096
Layer 3 weights        4096 * 12                49,152
Layer 3 bias                      12                 12
                                                  -----------
Shared trunk trainable parameters              19,202,060
Frozen Shohin unique parameters               125,081,664
                                                  -----------
Total unique parameters                       144,283,724
Distance to 150,000,000                         5,716,276
Maximum further spend under strict `<150M`      5,716,275

The shared trunk is exactly 16,386 parameters larger than the current digit motor:

two added input features:  2 * 4096       = 8,192
two added output classes:  2 * 4096 + 2   = 8,194
                                            ------
                                            16,386

The hard latch, categorical register, cursor shift, END test, attention firewall, and fixed scatter into the existing digit/carry vocabulary rows have zero trainable parameters. They are runtime state and computation and must be reported separately. A learned register embedding, learned address head, learned halt head, extra layer norm, calibration scalar, or trainable router is not part of this count. Adding any one of them changes the protocol and is a NO-GO until separately counted and preregistered.

The remaining 5,716,275 spendable parameters are deliberately unused. Padding does not make a control stronger, and no second causal hypothesis currently justifies another learned module.

3.2 What the 12 outputs can and cannot represent

The two hard argmaxes can represent all 10 * 2 = 20 deterministic (digit,next_carry) pairs. A 20-way joint head is therefore unnecessary for a deterministic local transition.

The factorized head cannot represent an arbitrary calibrated joint probability over those 20 pairs. Under residual ambiguity it supplies marginals, not correlation. Separate cross-entropy can therefore assign mass to an incoherent pair even when each marginal looks good. The autonomous claim is consequently based only on hard pair exactness and full trajectories, never marginal NLL.

The trunk also cannot create information absent from h. Width does not repair a representation collision, and site conditioning does not supply operation, operands, incoming carry, or cursor unless the frozen in-model aperture already delivers them.

4. Proposed mechanism: pre-emission dual-view commit

The treatment is named pre-emission dual-view commit (PEDC) only to make its intervention surface unambiguous. The name is not a primitive-novelty claim.

4.1 Read-only source and private state

The source is a canonical, immutable, column-addressable input:

S = (operation, a[0:w], b[0:w], END).

Digits are least-significant first for this bounded board. Converting arbitrary natural-language numerals into S is outside this protocol. The source grammar router may identify delimiters and source positions, but it may not calculate a digit, carry, cursor value, width-dependent answer, or result.

The complete cross-column mutable state is

q_t = (p_t, c_t),

p_t  one hard cursor support over source columns plus END,
c_t  one hard carry/borrow bit.

Initialization is exact and supplied by the fixed runtime:

p_0 = e_0       one-hot support on the least-significant source column
c_0 = 0         no incoming carry or borrow
q_0 = (e_0, 0).

q_0 is created inside forward_episode after the immutable source layout has been validated and before the first local residual is computed. The host does not pass p_0 or c_0, and neither value is learned or inferred from emitted text. A source with no column zero is invalid before execution.

Three different quantities must not be conflated at width w:

semantic state set                  Q_w = {0,...,w} x {0,1}
number of valid semantic states     |Q_w| = 2(w + 1)
exact information capacity          log2(2(w + 1)) bits
minimum fixed binary storage        ceil(log2(2(w + 1))) bits
one-hot physical allocation         (w + 1) cursor cells + 1 carry cell

For widths 4, 6, 8, and 10, exact information capacities are log2(10), log2(14), log2(18), and log2(22), approximately 3.3219, 3.8074, 4.1699, and 4.4594 bits. Minimum fixed binary storage is 4, 4, 5, and 5 bits; a literal one-hot-plus-carry implementation allocates 6, 8, 10, and 12 binary cells before byte/dtype packing. The valid-state information capacity, minimum coding length, allocated tensor cells, and actual bytes must all be reported separately. None is constant in width, and allocated bytes are not evidence that every raw tensor pattern is a valid semantic state.

No result digit, result prefix, continuous residual, logit vector, source copy, token id, generated KV entry, retry count, verifier value, or hidden history is allowed in q_t.

4.2 Frozen transition aperture

One private transition query is formed inside the model from immutable S and hard q_t. The cursor selects the current source column; the carry bit is injected as a hard two-valued private lane. The query may expose exactly

(operation, a[p_t], b[p_t], c_t)

to the local residual. Width, terminality, prior result digits, emitted text, future columns, and absolute cursor value are masked from the local trunk. The fixed controller may inspect whether the cursor's next support is END, but that bit may not enter f_theta.

The frozen Shohin backbone then produces one block-29 residual:

h_t = H_frozen(S, q_t) in R^576.

The private query may reuse frozen token embeddings and frozen transformer weights. It may not introduce trainable state embeddings. If the frozen backbone cannot expose the local tuple under this aperture, that is an empirical NO-GO, not permission to leak source or cursor fields around the bottleneck.

4.3 Dual-view prediction and atomic agreement

Both views are evaluated from the identical h_t, before any token is emitted:

z_D = f_theta(h_t, s_D)
z_C = f_theta(h_t, s_C)

d_D = argmax z_D[0:10]       c_D = argmax z_D[10:12]
d_C = argmax z_C[0:10]       c_C = argmax z_C[10:12].

Commit is legal only if

(d_D,c_D) = (d_C,c_C).

Disagreement enters an internal fault terminal and scores the episode wrong. There is no retry, vote, oracle, fallback, or host choice. On agreement, the pair is hard-latched:

L_t = (d_t, c_(t+1)).

The two-site agreement is an error-detection constraint, not a proof of correctness. Shared weights can make the same wrong prediction twice. Its value is that it creates an explicit protocol-schema invariant and prevents two disagreeing hard pairs from silently committing. A correct site-ignoring whole-pair predictor can satisfy the invariant legitimately; agreement does not prove that either site code is used.

4.4 Update before emission

The successor register is committed before any observable symbol:

p_(t+1) = SHIFT(p_t)
q_(t+1).carry = COPY_CARRY(L_t.carry)
q_(t+1) = (p_(t+1), q_(t+1).carry).

COPY_CARRY is the identity on one hard bit. It has exactly one authorized input, L_t.carry, and no default, stale-register, source-derived, emitted-token, or host fallback. The next aperture is defined as

h_(t+1) = H_frozen(S, p_(t+1), q_(t+1).carry).

The provenance graph therefore proves a structural path

L_t.carry -> q_(t+1).carry -> h_(t+1) -> f_theta(h_(t+1),s),

with no other authorized carry input. This proves that the committed bit is the bit presented to the successor. It does not prove that the learned successor is behaviorally sensitive to that bit. Functional consumption requires the carry-latch and stale/precomputed-carry interventions in Sections 8, 13, and 14.

Proposition: latch provenance and successor consumption. For every nonterminal step, COPY_CARRY is the identity, so direct substitution gives

q_(t+1).carry = L_t.carry
h_(t+1) = H_frozen(S, SHIFT(p_t), L_t.carry).

Because the successor aperture has no other carry argument, the carry value it consumes is exactly L_t.carry; a stale register, source-precomputed carry, or emitted carry cannot satisfy these equations. This is a proof of structural consumption for the specified machine. Behavioral use by the learned local map is a separate empirical premise: on the carry-sensitive witnesses, the next hard pair must change under a latch flip, while the stale and precomputed implementations must produce the exact failures specified in Section 8.4.

SHIFT is a fixed on-device one-hot permutation over source-column support. The next-support END test controls terminal emission and halt. It is hard-coded scheduling, not learned planning.

Base case. For every valid source of width at least one, fixed initialization gives q_0=(e_0,0). The first aperture therefore receives exactly (operation,a[0],b[0],0). If the corresponding one of the 200 zero-carry local cells is exact, the latch is L_0=(d_0,c_1). SHIFT(e_0)=e_1 (or END at width one), and COPY_CARRY writes exactly c_1; hence q_1=(e_1,c_1) or (END,c_1). This establishes the induction base used by Theorem 5. A CPU base-case gate must enumerate all 200/200 zero-carry cells; an autonomous report must retain the actual q_0, L_0, and q_1 bytes for every episode.

The model runtime must expose a single opaque call boundary:

forward_episode(source_tokens) -> write_only_emissions

The host may launch that call and receive the final emissions. It may not loop over columns, inspect or mutate q_t, parse a prediction, increment a cursor, compute a carry, select a retry, or decide when the arithmetic episode halts. All recurrence, SHIFT, commit, and END handling execute inside the model runtime on device.

This fixed runtime performs essential execution. It validates the source layout, creates q_0, selects the current column, applies SHIFT, copies the carry latch, detects END, orders emissions, enforces fault halt, and blocks output feedback. The learned trunk supplies only a local pair prediction over a 400-cell domain. The complete mechanism is therefore a hand-scaffolded FST/ Mealy/RNN with a learned local table, not an end-to-end learned algorithm.

4.5 Write-only emission and the causal firewall

After q_(t+1) is committed, the digit and carry views may scatter the hard latch into the existing output vocabulary. These symbols are observational:

for t in source-column order:
    emit typed digit d_t
    emit typed carry c_(t+1)
after the last pair:
    emit typed END and halt

The loop above is model-internal fixed emission control, not a host loop. The typed carry in the last pair is the terminal carry/borrow; it is not emitted a second time.

• they may be logged and compared with a target after the episode;
• they may not be appended to source KV visible to a later transition;
• they may not be parsed into a new prompt or state;
• they may not be reversed, accumulated, or converted to an integer by host code for a claim-bearing score;
• changing, deleting, or replacing every emitted symbol must leave all later private registers and transition predictions unchanged.

The primary endpoint is the exact least-significant-first transition stream and the internal halt boundary. A conventional most-significant-first answer would require a separately learned formatter with its own retained-state ledger and preregistration. This dossier does not authorize one.

Transcript intervention must occur online inside the opaque call. Before launch, the evaluator selects one of three frozen modes:

PASS       expose the emitted symbol only to the output sink
DROP       suppress the emitted symbol
REPLACE    substitute a precommitted equal-length symbol stream

The internal interceptor sits after latch-to-symbol scatter and before any token/KV/store that a later transition could read. REPLACE bytes are fixed before the call from a future protocol-bound seed and position only; they may not depend on generated symbols, logits, latch values, or failures. The host cannot change mode or replacement bytes during the call. Audit copies of q_t, L_t, and emissions may leave the call only through a write-only trace buffer that is not addressable by the transition graph. A future executable preregistration must hash the interceptor source, replacement generator, trace schema, and provenance validator.

4.6 Why this is stronger than a merged motor

A merged motor changes two token distributions. PEDC additionally imposes four causal facts:

1. digit and carry are functions of one pre-emission residual;
2. both site views must predict the whole transition pair;
3. successor carry is committed before serialization;
4. future computation is structurally independent of serialized output.

An output-dependent serializer will fail the firewall, but an output-independent Mealy/RNN can satisfy all four facts. Firewall success therefore excludes an output feedback path; it does not distinguish PEDC from ordinary recurrence. R-SEQ is the primary control for that distinction. None of these facts makes the learned local law correct; finite and autonomous gates test that separately.

5. Theorem and no-go dossier

Theorem 1: minimal state under current-column-only access

Assume the local successor may read only the operation, the current operand digits selected by the cursor, and recurrent state; it may not read lower-order operand columns, a source prefix, prior outputs, or a precomputed prefix summary. Under this premise, one incoming carry/borrow bit is sufficient to determine (digit,next_carry). It is necessary because addition with a+b=9 maps incoming carry zero and one to different digits and different outgoing carries; subtraction with a=b gives the analogous borrow witness.

The necessity statement is false without the current-column-only premise. A dense predictor with access to all lower-order source columns can recompute the incoming carry from immutable operands and need not transport a recurrent carry bit. D-ALL is the favorable control for exactly that alternative.

If cursor location is not otherwise supplied by source position or an external schedule, the state must distinguish w+1 cursor values. Combined with carry, the valid state set has 2(w+1) members, exact information capacity log2(2(w+1)), and minimum fixed binary storage ceil(log2(2(w+1))). Prior result digits are unnecessary for future local arithmetic conditional on (S,p,c).

Consequence: a result tape is unnecessary state. A treatment that improves only when prior emitted digits are visible has learned serialization or recomputation, not the declared minimal transition.

Lemma 2: shared weights do not imply a shared transition

On the two-point site domain {s_D,s_C}, a sufficiently wide nonlinear MLP can use the site bits as a gate and approximate two unrelated functions of h in disjoint hidden subspaces. The 4096-wide trunk has more than enough capacity to do so on the finite DWS support.

Consequence: parameter sharing, joint training, or perfect fit at both sites is not evidence of a common causal computation. Whole-pair cross-site agreement, same-residual evaluation, and atomic commit are mandatory.

Lemma 3: residual collision no-go

If two reachable local states x and x' require different hard transition pairs but produce the same admissible residual and site code,

(h(x),s) = (h(x'),s),

then every deterministic trunk predicts the same output for both. At least one must be wrong.

Consequence: increasing motor width cannot repair a missing carry, cursor, or operand distinction in the frozen aperture. A collision witness is an architecture NO-GO.

Theorem 4: atomic-firewall serialization exclusion

Assume q_(t+1) is a deterministic function only of (S,q_t,L_t), is committed before emission, and the future transition graph has no path from emitted symbols or generated-token KV to q_(t+1) or later residuals. Then replacing the complete emitted transcript after every step cannot change any future private state or prediction.

Proof: the first successor is equal by the update dependency restriction. Inductively, equal source and equal private state produce equal next residual, latch, and successor. Emission never enters the induction hypothesis. QED.

Consequence: transcript mutation is an exact structural test. Passing it proves only that text is not the executor, not that the private transition is arithmetically correct.

Theorem 5: initialized local closure gives bounded exact iteration

Assume:

1. q_0=(e_0,0) exactly;
2. source addressing exposes the current column only;
3. all 400 local (operation,a,b,incoming_carry) cells are exact;
4. q_(t+1).carry=COPY_CARRY(L_t.carry) with no alternate carry path;
5. the successor aperture receives q_(t+1).carry as its only carry input; and
6. SHIFT visits each source column in order and then END exactly once.

The base case is established in Section 4.4. For the induction step, suppose q_t=(e_t,c_t) contains the exact incoming carry. Premises 2 and 3 produce the exact L_t=(d_t,c_(t+1)). Premises 4 and 5 make that committed carry, rather than a stale, source-precomputed, or emitted carry, the only carry presented to the next local map. Premise 6 advances to e_(t+1) or END. Thus q_(t+1) is exact, and induction yields the exact transition stream for every finite source in the declared width bound.

The proof is conditional on functional dependence in premise 3. Wiring alone does not show consumption. The mandatory latch-flip board holds the next source tuple carry-sensitive and requires the next hard pair to follow an intervention on L_t.carry; stale and source-precomputed controls must fail that board.

Consequence: any neural failure after those premises appear to pass reveals an interface, addressing, numerical, or hidden-channel error. It may not be explained away as an arithmetic exception.

No-go 6: finite success is compatible with a motor table

There are only 400 local decimal cells. A 19.2M-parameter network can memorize them, and any fixed maximum width can be unrolled into a finite dense circuit. No finite board can prove that the learned representation is uniquely a state or exclude an unrestricted finite lookup table.

Consequence: the only reopenable claim is a resource-bounded learnability or generalization advantage over named controls. The 400-entry table is a required upper bound, not an opponent that a correct treatment is expected to beat.

6. Training-package schema, not a frozen objective

No training is authorized by this theory file. The prior version's statement that arms matched data, calls, updates, and objectives was unsupported and is retracted. This schema supplies candidate objective components but does not freeze their weights, denominators, schedule, or gradient estimator.

The package-level hypothesis is:

The already strong DRS digit residual plus the complete PEDC runtime, supervision, hard-state, and output-erasure package may improve causal carry consumption and closed-loop transfer relative to a separately specified ordinary-transducer package.

Candidate objective components are:

1. digit CE and carry CE from z_D;
2. digit CE and carry CE from z_C;
3. symmetric distribution agreement between corresponding digit and carry partitions of z_D and z_C;
4. exact hard-pair agreement penalty;
5. autonomous two-step loss after a fixed teacher-forced warmup;
6. carry-swap donor-following loss;
7. cursor-swap address-following loss;
8. transcript deletion/replacement invariance;
9. same-local-tuple invariance across width, terminality, and result history.

Before an executable comparison exists, a later preregistration must freeze all of the following for PEDC and R-SEQ:

ordered training-row identities and canonical bytes
train/development/confirmation denominators
batch composition and exact batch order for every seed
optimizer, hyperparameters, initialization, dtype, and update count
every loss term, reduction, coefficient, and denominator
teacher-forced warmup length and the exact transition to on-policy rollout
hard-argmax forward policy
hard-argmax backward policy: stop-gradient or a named exact STE
gradient clipping, accumulation, scaling, and overflow policy
checkpoint selection rule fixed before development scores
base calls, trunk calls, and recurrent microsteps per column
sequential depth and synchronization points
analytical and measured train/inference FLOPs
source, state, trace, emitted-output, and generated-KV bytes
online transcript-interceptor mode and replacement bytes

Equivalent-objective matching means each arm receives the same semantic target set and the same weighted objective under the same denominator. If an objective cannot be defined for both arms without changing its semantics, it is a package difference and must be named as such; it cannot be hidden under "matched training." In particular, an agreement penalty available only to PEDC makes the comparison package-level unless R-SEQ receives a semantically equivalent constraint.

Forbidden objectives or inputs are:

• a host-computed local result, carry, next cursor, terminal answer, or repaired state at inference;
• target carry or digit injected into the recurrent path;
• generated-token KV or parsed output used as state;
• a verifier, rejection sampler, retry loop, beam selection, or post-hoc best trace;
• a hidden result prefix or continuous 12-logit vector retained across steps;
• undisclosed differences in labels, examples, update counts, objectives, warmup, gradient policy, selection, or confirmation access.

Teacher forcing may be a warmup and diagnostic only after its exact duration is frozen. Sequence generation is known to have a teacher-forcing/inference mismatch; scheduled-sampling work addresses that mismatch but does not prove state closure (Mihaylova and Martins, 2019). Every future claim-bearing endpoint must be hard, closed-loop, and unpatched.

7. Control hierarchy and future matching contract

The only currently exact cross-arm match is the proposed learned parameter count: the frozen base plus a newly initialized 578->4096->4096->12 trunk with 19,202,060 trainable parameters. No call, data, loss, update, depth, FLOP, or byte match exists until a later executable protocol freezes and validates it.

R-SEQ: primary ordinary-transducer control

R-SEQ is the primary causal control. It is an ordinary output-independent Mealy/RNN with exact q_0, a hard (cursor,carry) register, fixed source addressing, fixed SHIFT/END runtime, and the same output firewall. It uses the same 578->4096->4096->12 trunk, hence exactly 19,202,060 learned parameters, and computes h_t, z_D, and z_C through the same per-column tensor definitions and call graph as PEDC. Numerical values may differ after training. Its fixed commit rule is

d_R = argmax (z_D[0:10]  + z_C[0:10])
c_R = argmax (z_D[10:12] + z_C[10:12])
L_t^R = (d_R,c_R).

It writes c_R through the same COPY_CARRY path before emission. Its emitted symbols do not feed its state, so it can legitimately pass every transcript-firewall test. Logit summation is fixed, adds no parameters or retained cross-step state, and makes R-SEQ favorable on view disagreements: R-SEQ may continue with a correct aggregate where PEDC must fault.

For an exact comparison, one audited per-column code path computes both per-view argmaxes, the agreement bit, both logit sums, and both aggregate argmaxes in both arms. A frozen selector chooses agreement-or-fault for PEDC and L_t^R for R-SEQ; the unselected candidate cannot enter q_(t+1). Both arms use one base residual, two ordered trunk invocations, the same scratch and trace tensors, and the same private-state allocation. This construction makes exact call, sequential-depth, analytical-FLOP, and byte matching possible; it does not freeze those quantities in this theory file. Both site outputs must retain identical whole-pair targets, loss terms, coefficients, and reductions; R-SEQ may not gain a lighter objective by dropping the cross-site outputs.

A future implementation must realize PEDC and R-SEQ through one audited code path and freeze the equality vector in Section 6. The executable protocol must make base calls, trunk calls, sequential depth, objective semantics, analytical FLOPs, and allocated state/source/trace/output bytes exactly equal, not merely within an observed tolerance. Measured wall time and hardware counters are reported but are not substitutes for that analytical equality.

R-SEQ is the decisive control. PEDC-specific advantage is admissible only if R-SEQ is validly matched and PEDC beats it under the later byte-bound comparative gates. If R-SEQ ties or wins, retain the simpler ordinary transducer and reject the PEDC-specific claim.

G-SER: favorable unmatched generic output control

G-SER fires the same-size trunk at actual digit and carry grammar positions and may see ordinary generated prefix/KV. It can use different base calls, sequential depth, retained KV, and training objectives. It is therefore parameter-matched but resource- and interface-unmatched unless a future protocol proves otherwise.

An output-dependent G-SER instance should fail online transcript interception. A G-SER instance that ignores generated output can pass; behaviorally it has become an output-independent transducer rather than evidence that the firewall distinguishes architecture names. G-SER is contextual evidence, not the primary PEDC attribution control.

D-ALL: favorable unmatched dense recomputation control

D-ALL receives the cursor and dense access to immutable operation and all operand columns on every step. It can recompute carry from the complete lower-order source prefix rather than transport it. Its source access and state resource differ essentially from PEDC, so it is parameter-matched but resource-unmatched.

D-ALL tests the premise of Theorem 1. If it ties or wins, recurrent carry is not needed on this board. That is a useful systems result but not a PEDC-specific causal comparison.

Required nonmatched incumbents and ceilings

These additional arms are reported honestly and never called equivalent:

• frozen base;
• current 19,185,674-parameter digit motor, after its autonomous report is sealed;
• separately reviewed carry motor, only after its own custody gate clears;
• admissible digit-plus-carry motor bundle at its actual parameter count;
• learned 400-cell table with the same source address and emission wrapper;
• hard decimal oracle used only as an external upper-bound auditor, charged as external execution and never called a treatment.

The carry lane's data, reports, or unpublished artifacts may not be imported to train or select this lane.

7.1 Resource receipt

Before any fit, each arm must bind numeric values for:

base_unique_parameters
added_trainable_parameters
total_unique_parameters
runtime_state_semantic_variables_and_cardinality_by_width
runtime_state_exact_information_capacity_by_width
runtime_state_minimum_binary_storage_by_width
runtime_state_allocated_cells_by_width
runtime_state_allocated_bytes_by_width_and_dtype
source_cache_bytes
trace_buffer_bytes
emitted_output_bytes
generated_token_kv_bytes_visible_to_transition
retained_result_tape_bits
training_examples
supervised_digit_labels
supervised_carry_labels
counterfactual_pairs
optimizer_updates
loss_terms_weights_reductions_hash
warmup_and_on_policy_schedule_hash
hard_argmax_forward_backward_policy
training_flops
base_calls_per_column
trunk_calls_per_column
inference_flops_per_column
sequential_depth
oracle_calls_at_inference
external_execution_calls
host_arithmetic_calls
parser_repair_calls
retry_calls

For a PEDC-specific claim, PEDC and R-SEQ must match every applicable field exactly under independently recomputed canonical receipts. If one field cannot be equalized without changing the control's semantics, the comparison is package-level and M-gates for PEDC-specific advantage are ineligible. G-SER and D-ALL are favorable unmatched controls and publish their actual resource vectors without padding. Equal parameter count alone is never described as a matched experiment.

8. Causal interventions and negative controls

The following tests are mandatory in any future executable protocol. Aggregate accuracy cannot substitute for them.

8.1 Carry interchange

Pair recipient and donor cases with identical operation, current operand digits, cursor support, and END status but opposite incoming carry. Swap only the hard carry bit. The complete local pair must follow the donor carry. No donor source, residual, token, or result history may transfer.

The CPU board contains exactly 400 different-carry donor swaps and 400 same-carry donor shams: 2 operations times 2 recipient carry classes times 100 current operand pairs. A future learned-board generator must preserve these four strata in each confirmation regime.

8.2 Cursor interchange

Hold source and carry fixed and move only hard cursor support. The selected operand column and subsequent support must follow the donor cursor. The carry must remain the recipient carry.

8.3 Digit-latch sham

After atomic commit, replace only the write-only digit latch with a different digit before emission. The visible digit must change, while q_(t+1) and every future private transition remain bit-identical. This distinguishes ephemeral output from recurrent state.

8.4 Carry-latch intervention

Replace only committed c_(t+1) before register write. The current visible digit remains unchanged; the next transition must follow the intervention when the next local tuple distinguishes carry. Double intervention restores the baseline.

The CPU successor-consumption board is exact:

q_0 carry                                      0
first-column pairs per operation             100
carry-sensitive second pairs per operation    10
operations                                     2
total two-column latch-flip cases           2,000

The second pair is carry-sensitive by construction: addition uses every a_1+b_1=9 pair and subtraction uses every a_1=b_1 pair. For each case:

1. run the first transition from exact q_0 and retain audit copy L_0;
2. run the baseline successor;
3. flip only L_0.carry before COPY_CARRY and run the successor;
4. verify q_1.carry equals the intervened bit byte-for-byte;
5. require the second hard pair to equal the oracle under the intervened carry and to differ from baseline; and
6. flip the latch twice and require exact baseline restoration.

All six checks must pass 2,000/2,000. This is the concrete proof obligation that the successor functionally consumes L_0.carry, not merely that a bit is stored.

Two planted negatives are mandatory on the same board:

• stale carry: write q_1.carry=q_0.carry=0; it must follow the flipped latch in exactly 900/2,000 cases and fail in 1,100/2,000;
• source-precomputed carry: recompute the unintervened first-column carry from (operation,a_0,b_0,0) and ignore L_0; it must follow the flipped latch in exactly 0/2,000 cases.

The stale denominator is algebraic, not empirical. Under incoming carry zero, exactly 45 of the 100 addition pairs produce carry one and exactly 45 of the 100 subtraction pairs produce borrow one. Crossing each first pair with ten carry-sensitive second pairs gives 2 * 45 * 10 = 900 baseline-one cases and 1,100 baseline-zero cases. After the latch flip, stale zero therefore matches exactly the former 900 cases. The unintervened precomputed bit is the complement of the flipped latch in all 2,000 cases, giving exact zero following.

The source-precomputed oracle exists only inside the CPU negative control and auditor and is charged as external execution. It is forbidden in every learned treatment. A future neural protocol must generate a separate, balanced, precommitted latch-flip board and run both stale and precomputed/baseline-clamp controls; Section 14 gives the required candidate denominator schema.

8.5 Transcript deletion and adversarial replacement

Run each episode through the internal PASS, DROP, and REPLACE modes from Section 4.5. All private register bytes, later transition pairs, and halt location must be identical. Only the write-only output sink may differ. Running three separate host-side prompts after parsing an earlier response is not this test and is invalid.

8.6 Site-code controls

• swap s_D and s_C after training;
• replace both with one code;
• shuffle site codes within identical local tuples;
• zero one view after the other has committed;
• train without whole-pair cross-view supervision.

A site-ignoring whole-pair predictor is legitimate: it can set the two site-input columns effectively to zero and return the same correct pair from both views. Therefore invariance under swapping codes, replacing both with one code, or zeroing site features does not falsify local transition, carry consumption, or the PEDC package. It shows only that site conditioning was unused and forbids a site-conditioning contribution claim.

Likewise, cross-view agreement can be vacuous when both views are identical. If removing whole-pair agreement loses no advantage, withhold the agreement-specific claim; do not convert that silence into an autonomous NO-GO. PEDC-specific advantage is decided against R-SEQ, not by demanding that site codes matter.

8.7 Structural cheating controls

The CPU validator must reject implementations that are behaviorally correct but retain any of:

• prior result digits;
• a continuous residual or logits across columns;
• source identity beyond immutable read-only source;
• generated token ids or KV;
• a hidden step counter separate from cursor support;
• width or terminality in the local trunk input;
• a host-updated cursor/carry object;
• a parser callback, decimal helper, verifier, retry flag, or answer accumulator.

8.8 Representation and shortcut negatives

• same local tuple, different width/terminality/result prefix: transition pair invariant;
• different local target, identical or collision-forced residual: at least one failure, as required by Lemma 3;
• shuffled carry labels within nuisance strata: autonomous carry following collapses;
• shuffled digit labels: digit exactness collapses;
• carry-zero policy: fails every frozen carry-one witness;
• cursor-zero policy: fails source-column interchange;
• planted output-dependent serializer: must fail DROP/REPLACE when its generated history is its causal state;
• output-independent Mealy/RNN: may pass the firewall and must be admitted as an ordinary-transducer positive control rather than mislabeled a serializer failure;
• stale carry and source-precomputed carry: must produce the exact latch-flip failures in Section 8.4.

9. Distinguishing local transition from serialization

The dossier uses the following operational definitions.

Serialization: a module changes the probability of a target symbol at a grammar location. Its prediction may depend on teacher tokens, generated history, or a state prepared elsewhere. It need not update anything that a future computation consumes.

Local transition: a module maps the admissible current local state to a hard output and a hard successor state; the successor is later consumed, and the complete cycle remains correct after all emitted text is deleted.

The shared trunk counts as a local transition only if all are true:

1. local tuple interventions change the hard pair selectively;
2. the PEDC treatment's two whole-pair views satisfy its declared agreement rule, whether or not site codes are used;
3. the committed carry, not a stale/source-precomputed carry or emitted carry token, controls the next step on the exact latch-flip board;
4. cursor swaps control source selection without a host update;
5. transcript deletion leaves the private trajectory unchanged;
6. autonomous two-step and full-trace gates pass;
7. the full package is interpreted against R-SEQ as the primary ordinary transducer, with G-SER and D-ALL reported as favorable unmatched controls.

Perfect teacher-forced fit satisfies none of conditions 2 through 7 by itself.

10. Expressive and systems limits

1. Finite local table. Decimal add/sub has 400 local cells. The trunk is massively overparameterized relative to that table.
2. Frozen representation ceiling. The trunk cannot separate residual collisions.
3. No learned address claim. The source grammar and cursor shift are fixed architecture supplied equally to controls.
4. No learned halt claim. END handling is fixed. Fault halt only detects internal disagreement.
5. No probabilistic joint model. The 10-way and 2-way heads are factorized.
6. Bounded source format. Natural-language parsing and decimal reformatting are outside the experiment.
7. No answer tape. Write-only least-significant-first emissions are scored directly. A host-produced conventional integer is not a model endpoint.
8. Fixed precision. Hard argmax and register bytes must be identical in the declared inference precision. Soft state during claim-bearing evaluation is forbidden.
9. No primitive separation. RNNs, finite transducers, and fixed-depth dense unrolling can realize the same bounded function.
10. No inference from spare budget. Unused parameter headroom is not latent evidence for a larger architecture.
11. Essential fixed executor. The runtime, not the learned trunk, performs initialization, source addressing, cursor movement, carry copying, END handling, emission scheduling, fault halt, and output isolation. Calling the package "in-model" locates those operations inside one opaque model runtime; it does not make them learned.
12. Learned local table. On this board the trainable trunk's semantic job is extensionally a 400-entry local transition table represented by a large MLP. Closed-loop success would validate the interface and fitted table, not end-to-end discovery of arithmetic execution.

11. Honest novelty and prior-art boundary

The architecture's known components include tied MLPs, finite-state recurrence, hard categorical state, redundant consistency checks, fixed cursor movement, masked attention, and write-only observation. Recurrent neural execution and algorithm learning are established, including Neural GPUs, Neural Programmer-Interpreters, and Universal Transformers. Persistent transformer state is also established through architectures such as Recurrent Memory Transformer and Block-Recurrent Transformers. External differentiable memory predates all of these in Neural Turing Machines.

Therefore PEDC is not claimed as a new computational primitive, new recurrence class, or new memory ontology. A bounded prior-art search does not justify such a claim.

The untested Shohin-facing package hypothesis is the exact conjunction below:

one post-DRS pre-emission residual
  -> two site-conditioned whole-pair views
  -> hard agreement or fail-stop
  -> atomic carry write before output
  -> minimal private cursor/carry recurrence
  -> complete output-token causal erasure.

This conjunction predicts exact behavior under latch swaps, output deletion, and state interchange that the current motors do not enforce. Site-code ablation is diagnostic only because a site-ignoring whole-pair predictor is valid. The possible contribution is a bounded package-level optimization and interface result. A PEDC-specific attribution requires an exactly matched R-SEQ comparison; if R-SEQ ties or matching fails, that narrower claim is closed.

12. Requirements for a future executable preregistration

No board, denominator, seed, generator, secret, source hash, or instrumentation is frozen by this theory schema. Consequently Sections 13 and 14 are recommended gate schemas, not executable decisions.

Before any CPU or learned run, a separate immutable executable preregistration must bind at least:

1. exact implementation paths and SHA-256 hashes for treatment, every control, generator, interceptor, provenance checker, report writer, and validator;
2. canonical source serialization, tokenizer identity, source-position map, local-cell ordering, and byte normalization;
3. exact train/development/confirmation support intervals, exclusion rules, decontamination algorithm, retry policy, and denominators;
4. one secret commitment domain and formula, one entropy source, one reveal, and a rule that any second secret, reseed, or regenerated board invalidates the experiment;
5. exact row-generation algorithm, row ordering, stratum counts, board hashes, and independently replayed generator receipts;
6. exact training package from Section 6 and exact PEDC/R-SEQ equality receipts from Section 7;
7. instrumentation that records audit copies of q_0, every L_t, every q_(t+1), source-address support, interceptor mode/bytes, hard predictions, logits, fault state, and halt without exposing that trace to execution;
8. exact denominator and expected result for every CPU negative, including stale and source-precomputed carry;
9. a finite preservation-prompt board with exact bytes and hash, with the preservation claim limited to those bytes; and
10. canonical report serialization, content hash, mode/custody rules, and an independent validator that recomputes every aggregate from row evidence.

One acceptable candidate confirmation shape, which is not frozen here, is:

fit_w4                 400 episodes
fit_w6                 400 episodes
value_ood_w4           400 episodes
value_ood_w6           400 episodes
width_ood_w8           400 episodes
width_ood_w10          400 episodes
                       ------------
total                2,400 episodes

Under that candidate, each regime would contain 200 additions and 200 nonnegative subtractions. Additions would split 100/100 by terminal carry zero/one. Subtractions would split 100/100 by absence/presence of at least one intermediate borrow. Fit/value-OOD scalar supports, complete operand pairs, and episode traces would be disjoint, and widths 8 and 10 would be absent from all training rows. None of those facts is binding until generator bytes and board hashes are frozen.

The candidate seed set is:

1337
7331
20260717

An executable protocol should apply every threshold separately to every seed unless it explicitly says mean, prohibit best-seed selection, and reveal its confirmation board once only after every arm checkpoint and resource receipt is immutable. These become enforceable only when bound to exact bytes.

Reports must retain row-level inputs, hard predictions, both site-view logits, agreement state, register states, cursor supports, intervention identities, emitted symbols, and exact failure location. Aggregates without independently recomputable rows are invalid. This is a report-schema requirement, not evidence that the missing instrumentation currently exists.

13. Recommended executable CPU gate schema

The proposed CPU falsifier is an integration and collapse audit with a planted oracle local transition. It does not fit Shohin and cannot establish learnability. It may not run under this theory file: a separate executable preregistration must first bind every item in Section 12.

Under that future binding, CPU GO requires every condition C0-C17:

The 16 C5 contexts are the exact Cartesian product

width             in {4,6,8,10}
terminality       in {nonterminal,terminal}
prior-result view in {all-zero,adversarial-nonzero}

The adversarial prefix is generated deterministically from the local-cell index and is guaranteed to differ from the all-zero prefix. Neither prefix may enter the local trunk provenance.

Any single failure is CPU NO-GO. A complete executable binding plus CPU pass would authorize only independent review of a possible neural preregistration. It would not authorize training or an accelerator.

14. Recommended autonomous gate schema

No learned experiment is executable under this file. A later experiment is admissible only after an executable protocol binds Section 12, the CPU gates pass, an independent review clears the bytes, data/resource receipts are immutable, and the digit-motor autonomous result is sealed. The carry motor may enter only after its separate reviewer authorizes it; this lane may not bypass that gate.

If the candidate 2,400-episode board in Section 12 is adopted, the future generator must also create a dedicated 1,200-case successor-consumption board:

6 regimes * 200 cases
per regime:
  100 additions with second-column a_1+b_1=9
  100 subtractions with second-column a_1=b_1
  within each operation, baseline L_0.carry balanced 50/50

Every case begins from exact q_0, flips only L_0.carry, and runs through the online opaque interface. The board, balancing algorithm, and denominator are only candidate requirements until bound to generator and board hashes.

The future generator must also seal one negative-control-only sidecar bit per case: the unintervened baseline L_0.carry. That sidecar is absent from source_tokens, treatment, PEDC, and R-SEQ. The planted stale control writes constant zero; the planted precomputed control writes the sealed sidecar and ignores the runtime latch. The latter is intentionally forbidden external state, must be charged as one sidecar bit per case plus its generator/auditor execution, and exists only to prove that the gate rejects precomputed carry. Because baseline carry is balanced 50/50 within each operation and the latch is flipped, stale zero follows in exactly 600/1,200 register writes and the sealed baseline bit follows in exactly 0/1,200.

14.1 Absolute learned-package gates

Under the candidate denominators, every seed must satisfy all of A0-A16:

The 90% width-10 trace gate cannot be replaced by local accuracy. If r_1,...,r_10 are the step-conditioned success probabilities along successful prefixes, chain factorization gives trace success prod_i r_i; 90% trace success therefore requires their geometric mean to be at least 0.90^(1/10) = 98.9519%. It does not imply that every individual step has at least 98.9519% accuracy, and it does not assume independent errors.

14.2 Comparative mechanism gates

Passing A0-A16 is an engineering GO for the entire bounded PEDC package, not a PEDC-component result or learned-reasoning result.

R-SEQ validity must not import PEDC's absolute treatment floors. In particular, R-SEQ is not required to pass A3-A12, A7's 95% two-step floor, or A8's 90% trace floor. A future executable protocol must instead freeze a development-only R-SEQ validity board, row-disjoint from both training and confirmation, and bind all of the following criteria before fitting:

1. strict checkpoint load, the scheduled update count, finite losses/logits, a post-fit parameter hash different from initialization, deterministic replay, and every M1 equality receipt must pass;
2. byte-exact q_0, SHIFT, COPY_CARRY, END, online interceptor, and no-host/no-result-path audits must pass independently of arithmetic score;
3. a frozen rational-logit selector board must exercise agreement and disagreement cases, reproduce the exact R-SEQ sum-logit rule, and trace its selected carry byte through COPY_CARRY into q_(t+1); the stale and sealed-sidecar implementations must produce their preregistered failures;
4. on a uniformly weighted 400-cell development local board, R-SEQ must predict all ten digits and both carry values and exceed, by at least 5.0 percentage points on every seed, each of its same-seed untrained initialization, the best fixed-pair predictor, and the planted carry-zero policy in one-step hard pair exactness; and
5. on the 20 carry-sensitive event pairs (10 addition pairs with a+b=9 and 10 subtraction pairs with a=b), changing only incoming carry must change R-SEQ's hard pair in at least 15/20, while deterministic duplicate queries must be byte-identical in 40/40 cells.

These criteria are independent of PEDC scores and confirmation outcomes. They reject an unloaded, untrained, nonfinite, constant, carry-blind, dead-selector, or forbidden-path control without imposing any confirmation two-step or trace accuracy floor. They therefore place no algebraic lower bound on the R-SEQ scores used by M3-M4. If R-SEQ fails one criterion, the outcome is NO-GO for PEDC-specific attribution; the failed arm may not be replaced or retrained after confirmation is visible.

A PEDC-specific interface claim additionally requires all of M1-M4. The separate shared-package efficiency claim additionally requires M5:

There is no post-fit selector-swap promotion gate. Under A3, each PEDC view has the same hard winner on every scored transition. With the same frozen tie rule, that winner also wins the componentwise logit sum, so replacing the selector on the fitted PEDC checkpoint is behaviorally identical. It is a diagnostic only. The R-SEQ scored in M3-M4 is the single separately trained, fully bound primary arm from M1-M2; no additional retrained selector arm is introduced.

If PEDC passes A0-A16 but R-SEQ ties, retain the simpler ordinary transducer and record NO-GO for PEDC-specific advantage. If exact PEDC/R-SEQ matching fails, only a full-package comparison is admissible. If D-ALL ties, dense recomputation remains sufficient. If G-SER ties, inspect its firewall path: an output-dependent instance is serialization; an output-independent instance is another recurrent/transducer realization. If only teacher-forced or one-step gates pass, no closed-loop claim is allowed. If M1-M4 pass but M5 fails, the PEDC-specific interface result may stand, but the shared-package efficiency claim is withheld.

15. Final recommendation

CPU NOW:
  NO-GO to execute. GO only to author and independently review a separate
  executable preregistration that binds Section 12 and C0-C17 to exact bytes.

NEURAL OR AUTONOMOUS RUN NOW:
  NO-GO. This theory schema freezes neither an experiment nor matched training;
  the CPU protocol is absent, the digit-motor autonomous result is pending under
  the stated premise, and the carry lane remains separately review-gated.

H100 NOW:
  NO-GO. This file authorizes no accelerator launch now or by implication.

EVENTUAL ENGINEERING GO:
  only under a later executable protocol if every A0-A16 gate passes on every
  frozen seed. The claim is a bounded FST/RNN package with a learned local table,
  not learned end-to-end reasoning.

EVENTUAL PEDC-SPECIFIC INTERFACE GO:
  only if every A0-A16 and M1-M4 gate passes, PEDC/R-SEQ matching is exact, and
  no hidden result tape, generated-token recurrence, host arithmetic, repair,
  retry, or missing primary control exists.

EVENTUAL SHARED-PACKAGE EFFICIENCY GO:
  only if the PEDC-specific interface gate passes and M5 also passes.

ANY OTHER OUTCOME:
  NO-GO for PEDC-specific attribution; preserve the result as package-level
  localization or retain the simplest ordinary control that actually passes.