From 5286553db80d3733ebc1e2501b9f8efb6034bf61 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sat, 8 Aug 2026 01:06:37 -0400 Subject: [PATCH 001/107] =?UTF-8?q?docs:=20v2.0.0=20released=20=E2=80=94?= =?UTF-8?q?=20STATUS=20repo=20section=20and=20ledger=20postscript?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 12 ++++++++---- docs/ledger/2026-08.md | 9 +++++++++ 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 766eb45..b48f700 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -414,10 +414,14 @@ the whole-live-store operator census. bit-identical — including a 140,883-term survivor manifest, partition invariance across threads {1, 2, 18} × groups {1, 7, 64}, and resume after a SIGKILL mid-phase-B. -- Crate version: the `Cargo.toml` version is v2.0.0 on dev (the reshape is - breaking at both the library and CLI surface); the crates.io release is - v1.0.1 until a9 publishes. The release pipeline arms only on a main push - whose CI run succeeded, at the exact CI-validated SHA; dev never arms it. +- **v2.0.0 is released** (2026-08-08): published to crates.io via trusted + publishing, tagged, and GitHub-released from the CI-validated main SHA. + The pipeline now triggers on the main push itself and its guard waits + for CI success on the exact SHA before anything runs — crates.io + rejects `workflow_run`-minted trusted-publishing tokens (measured, + status 400), which the first armed run discovered; the invariant + (publication never outruns the verification bar) is unchanged. dev + never arms it. - CI runs formatting, clippy with warnings denied, the release test suite in three feature shapes (`--all-features`, default, `--no-default-features`) on Ubuntu and macOS, `uni.rs` parity, the classical 4..32 census diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 74a34d8..44d6508 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -1800,3 +1800,12 @@ canonical); the cert-sweep re-time is the measured 981.3 s above and AGENTS now carries the measurement instead of the estimate. v2.0.0 merges to main at the end of this run — CI validates, the release pipeline arms on the CI-validated SHA. + +Postscript, same night: the first armed release run failed in 25 s at +the crates.io token mint — trusted publishing rejects `workflow_run` +triggers by policy, which no local test could have caught. The +pipeline moved to push-on-main with an explicit CI-wait gate in the +guard (same invariant, supported trigger, same workflow identity for +the trusted-publisher config), and the second run went green through +all three jobs: **blam v2.0.0 is live on crates.io, tagged, and +GitHub-released** from the CI-validated SHA `add2350`. From 30b4b7893866dc6152f737295e84b88b59188d19 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 03:05:52 -0400 Subject: [PATCH 002/107] =?UTF-8?q?docs:=20qALC=20=E2=80=94=20quantum-alge?= =?UTF-8?q?braic=20pillar=20architecture=20design=20contract?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pre-implementation, pre-ratification. Quantum control, storeless: runtime state in l2(machine configurations), {h,t} constants via the invocation idiom, classical prefix-free syntax unchanged. Records the bare-term isometry counterexample, invariant-sector halting with ticks, the forced-synchronization argument, the coherence-block structure of the output operator, and the minimal-garbage theorem as the gating work item. Adversarial review thread: qalc-architecture. Co-Authored-By: Claude Fable 5 --- docs/quantum-algebraic/architecture.md | 399 +++++++++++++++++++++++++ 1 file changed, 399 insertions(+) create mode 100644 docs/quantum-algebraic/architecture.md diff --git a/docs/quantum-algebraic/architecture.md b/docs/quantum-algebraic/architecture.md new file mode 100644 index 0000000..1164cd3 --- /dev/null +++ b/docs/quantum-algebraic/architecture.md @@ -0,0 +1,399 @@ +# Quantum-algebraic BLC (qALC) architecture + +**Status: design contract, pre-implementation, pre-ratification.** No engine +exists and nothing in `data/` is qALC-relative. This document is the object +under adversarial review in gaslamp thread `qalc-architecture`; on +ratification it becomes the pillar's durable architecture contract, and any +moving state acquires a section in `../STATUS.md`. Claims are marked: +**[standard]** for published results, **[design]** for choices this contract +fixes, **[claim]** for arguments made here that the review must attack, and +**[open]** for named unknowns. + +## 1. Purpose and position among the pillars + +qALC is the quantum-control pillar. The existing pillars occupy two corners +of the control/data square: + +- `classical`: classical control, classical data; +- `quantum` (qBLC): classical control, quantum data — programs are classical + BLC controllers driving an exact gate-based store through five opaque + primitives (Selinger–Valiron's "quantum data, classical control" + **[standard]**). + +qALC takes the third corner: quantum control, no store. The runtime state is +a vector in ℓ² over machine configurations; superposition of *control* — +of the reduction itself — is the object of study. qBLC's architecture +(`../quantum/architecture.md` §7) chose classical control explicitly to +obtain monotone positive operator approximants and to avoid an unresolved +quantum-halting semantics. This pillar exists because both benefits are +recoverable inside quantum control (§4: invariant-sector halting), so the +dodge is a convenience, not a necessity, and the objects it excludes — +interference between reduction paths, real-valued halting mass, coherent +output operators — are exactly the ones worth measuring. + +qALC is a separate pillar, not a revision: qBLC's objects, data, and docket +are untouched, and the verification contract (§7) requires bit-identical +classical and qBLC rows after any qALC work. + +## 2. Target objects + +For a program `p` (a closed BLC term, unchanged wire code), the machine +prepares the basis configuration for `p h t` — the program applied to the +two opaque constants — with amplitude 1, and applies the global step +isometry `U` (§4) once per transition. With `P_halt` the projection onto +halted configurations: + +```text +μ_p(τ) = ‖P_halt U^τ |init(p)⟩‖² (monotone nondecreasing in τ) +μ_p = lim_τ μ_p(τ) (halting mass of p) +Ω_qALC = Σ_p 2^(−|p|) μ_p. +``` + +Halting mass is the central softening: the classical fate column +{Halt, Diverge, Unknown} becomes a real number in [0,1] with exact monotone +lower approximants and certificate-driven upper brackets. A single program is +already an Ω-like object; `μ_p ∈ {0,1}` exactly on the gate-free fragment +(§6). A divergence certificate on a sector of the superposition bounds +`μ_p` from above, so the classical certificate machinery generalizes from +verdicts to intervals **[design]**. + +The output object is an operator on ℓ² of closed normal forms over +BLC ∪ {h, t}: + +```text +ρ_p(τ) = Tr_{control, garbage, tick} [ P_halt ψ_τ ψ_τ† P_halt ] +M = Σ_p 2^(−|p|) ρ_p, Tr M = Ω_qALC. +``` + +`ρ_p(τ)` is Loewner-monotone in τ **[claim]** (§4.6), so the house +bracket discipline `M_known ⪯ M ⪯ M_known + ε I` carries over. Unlike +qBLC's number-superselected `M_Fock`, `M` can carry coherences *between +output terms*; §4.6 states exactly which branch pairs contribute +off-diagonal mass. + +The Kraft accounting is unchanged from qBLC: `|p|` is the program's own +prefix-free length, and the applied constants are invocation convention, +not program bits. + +## 3. Semantic contract + +### Language and invocation + +Programs are ordinary closed BLC terms — unchanged wire format, 1-indexed +de Bruijn, unchanged size identity. **The program syntax contains no quantum +constant**: `h` and `t` exist only as opaque values passed in by the +invocation `p h t`, so prefix-freeness and the Kraft sum are untouched by +construction, the same trick qBLC's signature uses. The two-lambda wrapper +`λh.λt. …` is an idiom, not a restriction. The application order `h` before +`t` matches the frozen qBLC signature's relative order; it must be frozen in +one place in code, with an order-pinning test, before any canonical data is +generated **[open: freeze pending, trivially two choices]**. + +### Canonical booleans and polarity + +```text +0̂ := λλ.2 (= λx.λy.x, true — the BLC encoding of bit 0) +1̂ := λλ.1 (= λx.λy.y, false) +``` + +Polarity matches the classical I/O convention and qBLC's `meas` outcome +convention: bit 0 is true. The computational basis of a qubit-like position +is {0̂, 1̂} by syntactic equality with these normal forms, nothing looser. + +### δ-rules + +The constants are rigid atoms. A δ-redex is a constant applied to an +argument that is *syntactically* one of the canonical booleans: + +```text +h 0̂ → (0̂ + 1̂)/√2 t 0̂ → 0̂ +h 1̂ → (0̂ − 1̂)/√2 t 1̂ → ω·1̂, ω = exp(iπ/4). +``` + +`h` (with Toffoli-class λ-terms, §6) and `t` restore the Clifford+T +amplitude ring. A constant applied to a closed normal form that is not a +canonical boolean is an error transition into the absorbing error sector +(§4.4), not a stuck normal form. A constant applied to a non-normal +argument is not a redex; reduction continues inside the argument. A constant +applied to a rigid open variable remains neutral. An unapplied or partially +applied constant in normal position is an ordinary normal form and may +appear in outputs. + +### No sums in syntax + +Formal superpositions never appear in program or term syntax. A runtime +"superposition" is a weighted set of ordinary basis configurations; the +calculus never rewrites a sum. `h`'s δ-rule is the only branching +transition and `t`'s the only scalar transition; everything else is the +classical machine step extended linearly **[design]**. Consequently the +Lineal call-by-base question dissolves: there is never a superposed +*subterm* to substitute (§4.2). + +### Strategy + +Reduction is leftmost-outermost strong normalization — the KN machine's +strategy — with δ-redexes and error transitions ranked among β-redexes by +position. The strategy is part of the machine's definition and therefore +part of the physics: a different strategy is a different `U` and different +canonical objects. Algebraic-λ non-confluence pathologies are dissolved by +machine-relativity: AIT objects are defined relative to a fixed universal +machine, and this contract fixes one **[design]**. One consequence to state +rather than hide: under normal order, `(λx. f x x)(h 0̂)` duplicates the +*unfired* gate application and yields two independent Hadamard instances. +Duplication always copies syntax, never amplitude, so this is generator +duplication, not cloning; branch-level fan-out of an already-fired outcome +is written explicitly (e.g. `h b̂ A B` fires the gate at head position and +selects per branch). Both idioms are expressible; the strategy decides only +their default reading. + +## 4. State space and dynamics + +### 4.1 Configurations + +The basis of the state space is **machine configurations** — term plus KN +control state (focus, spine stack) plus residual garbage registers (§4.5) +— not bare terms. Bare terms are too coarse: for a rigid context, the +sources `λf. f (h 0̂) 0̂` and `λf. f 0̂ (h 0̂)` are orthogonal, but their +images under a bare-term step overlap in the term `λf. f 0̂ 0̂`, so no +bare-term linear extension is an isometry **[claim]**. The KN control state +records the firing position for free and separates these images; unlike an +append-only history log, control state unwinds as evaluation returns, so it +is implicit history that uncomputes itself. + +### 4.2 The step isometry + +`U` is the linear extension of the deterministic machine step: each basis +configuration steps by its unique leftmost redex (β, δ, or error +transition), with `h` producing a two-branch superposition and `t` a phase. +`U` is required to be an isometry on the closed span of configurations +reachable from any `init(p)`; no extension to a unitary on all of ℓ² is +demanded, since every target object depends only on norms and sector +projections of reachable states **[design]**. + +No-cloning is structural rather than enforced: amplitudes attach to whole +configurations, never to subterms, so any duplication a β-step performs is +syntax-copying within one branch — basis fan-out, the physically permitted +copy. qBLC's entire handle/epoch apparatus has no qALC counterpart because +the store it protected does not exist. + +### 4.3 Halting: invariant sectors, not fixed points + +A configuration is *halted* when its term is in normal form and its control +is terminal. Halted configurations cannot be fixed points: if `U(x) = x` and +some arriving step also maps `c₁ → x` (every reachable halted state has +such a `c₁`, and `c₁ ≠ x` since its term or control differs), `U` is not +injective. More generally the halt sector of an injective dynamics can +contain no reachable cycle, so it is a forest of forward-infinite chains +**[claim]**. The minimal realization is a tick: `(nf, k) → (nf, k+1)` on a +counter register distinct from every rule transition. What monotonicity +actually needs is invariance, not fixedness: + +**Lemma (monotone halting mass) [claim].** If `U` is an isometry and +`U(S) ⊆ S` for the halted subspace `S`, then `‖P_S U ψ‖ ≥ ‖P_S ψ‖`. +*Sketch:* write `ψ = ψ_S + ψ_⊥`; `Uψ_S ∈ S`, and +`⟨Uψ_S, P_S Uψ_⊥⟩ = ⟨Uψ_S, Uψ_⊥⟩ = ⟨ψ_S, ψ_⊥⟩ = 0`, so +`‖P_S Uψ‖² = ‖ψ_S‖² + ‖P_S Uψ_⊥‖²`. + +This recovers exactly the monotone lower-semicomputable approximants that +qBLC's classical-control decision was made to protect: `μ_p(τ)` is exact, +monotone, and computable at every finite τ, so `μ_p` and `Ω_qALC` are lower +semicomputable. + +### 4.4 Error and stuck sectors + +Species errors (a constant applied to a non-boolean canonical form) and any +other semantic error enter their own absorbing sectors with the same +invariance-plus-tick treatment. Norm is conserved globally: halted mass, +error mass, and still-running mass sum to exactly 1 at every finite τ. +`Unknown` and `Capacity` remain resource outcomes of a finite *run* — the +driver stopping — not machine states, matching the house taxonomy. + +### 4.5 Garbage, merging, and where the quantumness lives + +Two branches interfere only when they occupy the *same basis configuration +at the same global time*. This makes the garbage discipline constitutive, +not cosmetic: if every step logged its full content, no two distinct +branches would ever re-merge, every δ-branching would decohere immediately, +and qALC would collapse into a probabilistic λ-calculus with √2-shaped +coins — quantum in name only **[claim]**. The entire quantum content of the +design lives in the merge discipline. + +The KN control state carries position information at no cost and uncomputes +itself. What it cannot carry is β's substitution content: a β-step is not +injective on (term, control) alone, and whatever residue restores +injectivity is true garbage. An environment-machine variant relocates the +problem to binding-discard steps — erasure, where the irreversibility +genuinely lives. The **minimal-garbage theorem** is this pillar's first +formal work item **[open]**: define `U` on machine configurations, +characterize the minimal residual garbage under which `U` is a global +isometry, and prove the invariant-sector lemma in that machine. Until it is +proved, every downstream object is conditional on its statement. + +**Forced synchronization [claim].** Because the halt sector is +forward-infinite chains, a branch's halting time is unerasable: two branches +reaching the same normal form at different times sit at different chain +positions forever and never interfere. Coherence between halting branches +exists only at equal halting time (with equal residual garbage). This is +Bernstein–Vazirani's synchronized-halting condition and the quantum control +machine synchronization constraint (Yuan–Villanyi–Carbin) arriving as +structure rather than as an imposed rule **[standard analogues]**. + +### 4.6 Output coherence blocks + +Group halted branches by (halting time, residual garbage, terminal +control). Within a group, branches with different normal forms contribute a +coherent block `v v†` to `ρ_p`; across groups, contributions add +incoherently. Each block is constant once formed and groups persist +(equal-time branches keep equal tick counts forever), so `ρ_p(τ)` is a sum +of a growing set of fixed PSD blocks — Loewner-monotone with limit `ρ_p` +**[claim]**. Off-diagonal mass in `M` therefore comes exactly from +equal-time, garbage-clean branch pairs: **coherence is earned by +uncomputation**, and the off-diagonal structure of `M` is a record of which +programs clean up after themselves. The output-convention question — what +beyond control, garbage, and tick is traced out, and whether any designated- +output alternative is worth defining — is explicitly parked **[open]**, +matching the same parked question in qBLC. + +## 5. Exactness and resource model + +Amplitudes live in the qBLC scalar ring `ℤ[ω]/√2^d` unchanged; the `Dw` +type, `ExactSum`, `K_CAP` capacity behavior, and checkpoint codecs are +reused as-is **[design]**. The engine never samples and never touches +floating point; f64 mirrors are display-only. + +The conservation battery *strengthens* from qBLC's inequality to an +equality: `‖ψ_τ‖² = 1` exactly at every transition, with all mass in typed +sectors. Budgets are typed as in qBLC: global transitions (the clock), +support size (branch count), and scalar magnitude (`K_CAP`); exhaustion +yields `Unknown`/`Capacity` resource outcomes distinct from semantic error +mass. Unbounded claims are stated as monotone brackets — `μ_p` by lower +approximants plus certificate upper bounds, `M` by Loewner brackets — never +as floating-point limits or finite-ring assertions about limits that need +not lie in the ring. + +## 6. Fragments + +**Gate-free fragment.** A program whose run never fires a δ-rule evolves on +a single basis path; its halting mass is 0 or 1 and equals its classical +fate. qALC is a conservative extension of the classical census by +construction, and the verification contract still tests it (§7). + +**h-only fragment.** Programs whose text never applies `t` (syntactically +identifiable; a census flag, not a separate design). Amplitudes are real, +in ℤ[1/√2]. Conjecture **[claim, needs proof]**: for *circuit-shaped* +programs — every root-to-leaf branch fires the same number of Hadamards — +path amplitudes are `n/√2^d` and all halting masses are dyadic; a +√2-irrational halting mass in the h-only fragment therefore witnesses +control-flow desynchronization, i.e. genuinely quantum control. "Circuit- +shaped" needs a precise machine-level definition before this is a theorem. +This fragment is the dyadicity campaign's natural sequel instrument: in full +qALC, ω already carries non-dyadicity, so the witness reading is +fragment-relative. + +**Universality.** Toffoli-class reversible operations are pure λ-terms on +Church-encoded data, so with `h` alone the machine reaches the +Shi–Aharonov universal gate set **[standard]** (real amplitudes; complex +via the standard rebit encoding), and `{h, t}` gives Clifford+T natively. +A formal statement of what universality means for qALC's objects — presumably +a Gács-style domination claim for `M` within an appropriate class — is +unwritten **[open]**. + +## 7. Planned engine stack and verification contract + +Planned module tree `blam::qalc`, drivers under a new `blam` subcommand +group; the reference evaluator represents `ψ_τ` as an exact sparse map from +configurations to `Dw` scalars and applies `U` transition by transition. A +fast engine, if the reference is too slow for a census, arrives only with +the same lockstep discipline qBLC uses: exhaustive fate/mass/support +equality over a configured range, engines sharing the scalar layer but not +their evaluators. + +Every qALC engine change must satisfy: + +1. `cargo test --release --all-features` and plain `cargo test --release`; +2. exact norm conservation (equality battery) on every tested program; +3. the monotonicity battery: `μ_p(τ)` nondecreasing, per transition, on the + full test range; +4. isometry spot-checks: pairwise inner-product preservation over the + reachable configuration graph at small sizes; +5. gate-free conservativity: fates and masses bit-identical to the + classical census on the covered range; +6. **the HH witness**: the program applying `h` twice to the same position + halts with mass 1 on `0̂` and mass 0 on `1̂` — destructive cancellation, + the single test that separates quantum semantics from the probabilistic + degeneration (which yields the same mass 1 but a mixed output at + (1/2, 1/2)); and +7. bit-identical classical *and* qBLC rows: qALC must remain isolated from + both existing engines. + +## 8. Design decisions + +- **Quantum control, storeless:** the pillar's reason to exist; state is + ℓ²(configurations), qubits are emergent boolean positions, and the + qBLC store discipline has nothing to protect. +- **`{h, t}` primitives:** Clifford+T ring native, scalar layer reused + wholesale; the satisfying h-only design is kept as a fragment instrument + rather than the primitive set. +- **Classical syntax only:** programs are prefix-free bits; superposition + is runtime-only. Anything else is a different (BvDL-flavored) research + program with a broken size identity. +- **β-dynamics on machine configurations:** bare terms fail isometry; + machine control is self-uncomputing implicit history. The token-machine + (quantum GoI) alternative is parked, not rejected: its natively + reversible dynamics is attractive, but it merges branches differently + and therefore defines *different objects* — if pursued, it is a separate + pillar, never a drop-in engine for this one. +- **Invariant-sector halting with ticks:** fixed points are incompatible + with injectivity; invariance suffices for monotone mass. +- **Leftmost-outermost strong reduction:** the house strategy; the machine + is the definition, which is also what dissolves algebraic-λ confluence + pathologies. +- **Exactness:** ring arithmetic only, conservation as equality, brackets + for every unbounded claim. +- **Name:** qALC, quantum algebraic lambda calculus — lineage-accurate: the + algebraic λ-calculus (Vaux; Ehrhard–Regnier) is exactly the calculus of + linear combinations of λ-terms, Lineal (Arrighi–Dowek) its + unitary-flavored cousin, and qALC is a machine-first quantum restriction + of that family. + +## 9. Open obligations + +1. **Minimal-garbage theorem** (§4.5) — the gating work item; everything + downstream is conditional on it. +2. Merge-discipline canonicity: is the minimal-garbage `U` unique in any + useful sense, and what exactly is the class of programs whose branches + re-merge (the "coherence is earned" economy made precise)? +3. The forced-synchronization argument (§4.3, §4.5) survives adversarial + review, or the halt-sector design changes. +4. Circuit-shaped dyadicity in the h-only fragment (§6): precise + definition, then proof. +5. Universality/domination statement for `M` (§6). +6. Self-interpretation: interpretation slows branches, timing is physical + (§4.5), so bisimulation with the classical self-interpreter is at best + up-to-dilation with garbage uncomputed before output; whether an + exact-ring universal simulation exists at all is open. +7. Relations among Ω objects: `Ω_qALC` versus classical `Ω` and qBLC's + `Ω_success` — inequalities, domination, or incomparability. +8. Reachability: which finitely-supported ring-valued unit vectors arise as + `ψ_τ` (small lemma, low priority). +9. Signature order freeze (§3) before any canonical data. +10. Output convention (§4.6) — parked deliberately. + +## 10. Lineage and related documents + +Standard references this design leans on: Arrighi–Dowek (Lineal; linear +extension, gates as constants), Vaux and Ehrhard–Regnier (algebraic +λ-calculus; Taylor expansion as the canonical source of term sums), van +Tonder (history-tracked unitary λ-reduction), Bernstein–Vazirani (QTM +well-formedness and synchronized halting), Shi and Aharonov +(Toffoli+Hadamard universality), Yuan–Villanyi–Carbin (synchronization +limits of quantum control flow), Selinger–Valiron (the design point qBLC +occupies), Hasuo–Hoshino and Dal Lago–Faggian–Valiron–Yoshimizu (quantum +GoI and multitoken machines, for the parked alternative), +Bădescu–Panangaden (why quantum control plus recursion has no settled +semantics — the gap this pillar's measurements would inform). + +- Classical counterpart: `../classical/architecture.md` +- Quantum-store counterpart: `../quantum/architecture.md` +- Moving state and docket: `../STATUS.md` (section pending ratification) +- Canonical evidence: none yet; `data/quantum-algebraic/` reserved. From 996f9a4b9dc0d58c392ab0f05089b5503fd79d97 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 03:32:54 -0400 Subject: [PATCH 003/107] =?UTF-8?q?docs:=20qALC=20architecture=20=E2=80=94?= =?UTF-8?q?=20incorporate=20adversarial=20review=20round=201?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Codex verdicts (thread qalc-architecture): monotone-mass lemma, bare-term counterexample, and full-logging degeneration confirmed; two claims corrected. (1) Ordinary KN control is irreversible — Var transition discards the selecting path, reachable witness (\x.x) A vs (\y.(\x.y) B) A — so the configuration basis needs a new reversible machine with orthonormal-column transition table; KN is guide, not substrate. (2) Equal-time-only coherence is a convention (common-origin tick, now normative [design]), not a consequence of injectivity. Also: normative halted dynamics id (x) id (x) shift makes 4.6 a theorem; effect-free fragment repaired against rigid-atom reduction (\h.\t. h h counterexample); clean coherent compilation named as gating universality obligation; garbage-transparent delta as contract; H-NOT-H witness added; D-circuit-shaped dyadicity with parity-sharpened witness reading; wandering-subspace formulation. Ratification gates listed in section 9. Co-Authored-By: Claude Fable 5 --- docs/quantum-algebraic/architecture.md | 279 +++++++++++++++++-------- 1 file changed, 192 insertions(+), 87 deletions(-) diff --git a/docs/quantum-algebraic/architecture.md b/docs/quantum-algebraic/architecture.md index 1164cd3..1b2211a 100644 --- a/docs/quantum-algebraic/architecture.md +++ b/docs/quantum-algebraic/architecture.md @@ -9,6 +9,15 @@ moving state acquires a section in `../STATUS.md`. Claims are marked: fixes, **[claim]** for arguments made here that the review must attack, and **[open]** for named unknowns. +Review round 1 (2026-08-09) is incorporated: the monotone-mass lemma, the +bare-term counterexample, and the degeneration claim were confirmed; two +claims were corrected (ordinary KN control does not supply reversibility — +§4.1; equal-time-only coherence is a convention, not a consequence of +isometry — §4.3/§4.5); the conservativity fragment was repaired (effect-free +against rigid-atom reduction, not gate-free against census rows — §6); and a +universality gap was recorded (clean coherent compilation — §6). The +ratification gates are listed at the end of §9. + ## 1. Purpose and position among the pillars qALC is the quantum-control pillar. The existing pillars occupy two corners @@ -52,7 +61,7 @@ halted configurations: Halting mass is the central softening: the classical fate column {Halt, Diverge, Unknown} becomes a real number in [0,1] with exact monotone lower approximants and certificate-driven upper brackets. A single program is -already an Ω-like object; `μ_p ∈ {0,1}` exactly on the gate-free fragment +already an Ω-like object; `μ_p ∈ {0,1}` exactly on the effect-free fragment (§6). A divergence certificate on a sector of the superposition bounds `μ_p` from above, so the classical certificate machinery generalizes from verdicts to intervals **[design]**. @@ -135,10 +144,14 @@ Reduction is leftmost-outermost strong normalization — the KN machine's strategy — with δ-redexes and error transitions ranked among β-redexes by position. The strategy is part of the machine's definition and therefore part of the physics: a different strategy is a different `U` and different -canonical objects. Algebraic-λ non-confluence pathologies are dissolved by -machine-relativity: AIT objects are defined relative to a fixed universal -machine, and this contract fixes one **[design]**. One consequence to state -rather than hide: under normal order, `(λx. f x x)(h 0̂)` duplicates the +canonical objects. Machine-relativity does not *dissolve* the algebraic-λ +non-confluence pathologies — it chooses one side of them: AIT objects are +defined relative to a fixed universal machine, this contract fixes one, and +the price is stated honestly: β/δ-convertibility is **not** a semantic +equality in qALC, and alternative reduction sequences are not equal — +only the machine's own sequence defines the objects **[design]**. One +consequence to state rather than hide: under normal order, +`(λx. f x x)(h 0̂)` duplicates the *unfired* gate application and yields two independent Hadamard instances. Duplication always copies syntax, never amplitude, so this is generator duplication, not cloning; branch-level fan-out of an already-fired outcome @@ -155,10 +168,22 @@ control state (focus, spine stack) plus residual garbage registers (§4.5) — not bare terms. Bare terms are too coarse: for a rigid context, the sources `λf. f (h 0̂) 0̂` and `λf. f 0̂ (h 0̂)` are orthogonal, but their images under a bare-term step overlap in the term `λf. f 0̂ 0̂`, so no -bare-term linear extension is an isometry **[claim]**. The KN control state -records the firing position for free and separates these images; unlike an -append-only history log, control state unwinds as evaluation returns, so it -is implicit history that uncomputes itself. +bare-term linear extension is an isometry **[claim, review-confirmed]**. + +Machine control separates *those* images, but the existing KN machine is not +the repair: ordinary KN control is irreversible. The variable transition +dereferences a closure and discards which variable/environment path selected +it — `focus Var(1), env [A]` and `focus Var(2), env [B, A]` step to the +identical configuration, and both are reachable, from `(λx.x) A` and +`(λy.(λx.y) B) A` **[review round 1, confirmed against the live machine]**. +And a frame that distinguishes two configurations during δ firing but later +unwinds to a common configuration has still lost orthogonality: an isometry +preserves inner products under every iterate, not just the first. So the +configuration basis belongs to a **new reversible abstract machine**, whose +transition table must have orthonormal columns as a checkable property; +the KN machine is its guide, not its substrate, and garbage is needed for +environment lookup, control unwinding, and readback collisions — not merely +for β substitution content. ### 4.2 The step isometry @@ -182,11 +207,19 @@ A configuration is *halted* when its term is in normal form and its control is terminal. Halted configurations cannot be fixed points: if `U(x) = x` and some arriving step also maps `c₁ → x` (every reachable halted state has such a `c₁`, and `c₁ ≠ x` since its term or control differs), `U` is not -injective. More generally the halt sector of an injective dynamics can -contain no reachable cycle, so it is a forest of forward-infinite chains -**[claim]**. The minimal realization is a tick: `(nf, k) → (nf, k+1)` on a -counter register distinct from every rule transition. What monotonicity -actually needs is invariance, not fixedness: +injective **[claim, review-confirmed]**. The clean general statement is via +the wandering subspace of `V = U|_S`: newly arriving halted amplitude +`a = P_S U r` lies in `S ⊖ V(S)`, hence `V^m a ⊥ V^n b` whenever `m ≠ n` +**[review round 1 formulation]**. + +**Normative halted dynamics [design].** Halted evolution is +`identity_output ⊗ identity_garbage ⊗ unilateral-shift_tick`, with every +branch entering at tick zero (common origin): `(nf, g) → (nf, g, 0)`, +`(nf, g, k) → (nf, g, k+1)`. Invariance alone is deliberately not enough — +a halt-sector unitary rotating `|0̂⟩` toward `|+⟩` preserves halted mass +while wrecking the monotone reduced output of §4.6; the normative form is +what makes §4.6 a theorem. What mass monotonicity itself needs is only +invariance, not fixedness: **Lemma (monotone halting mass) [claim].** If `U` is an isometry and `U(S) ⊆ S` for the halted subspace `S`, then `‖P_S U ψ‖ ≥ ‖P_S ψ‖`. @@ -212,41 +245,54 @@ driver stopping — not machine states, matching the house taxonomy. Two branches interfere only when they occupy the *same basis configuration at the same global time*. This makes the garbage discipline constitutive, -not cosmetic: if every step logged its full content, no two distinct -branches would ever re-merge, every δ-branching would decohere immediately, -and qALC would collapse into a probabilistic λ-calculus with √2-shaped -coins — quantum in name only **[claim]**. The entire quantum content of the -design lives in the merge discipline. - -The KN control state carries position information at no cost and uncomputes -itself. What it cannot carry is β's substitution content: a β-step is not -injective on (term, control) alone, and whatever residue restores -injectivity is true garbage. An environment-machine variant relocates the -problem to binding-discard steps — erasure, where the irreversibility +not cosmetic: under full logging — meaning an exact, ordered, collision-free +append-only history, `log′ = log · encode(step)` — two histories that ever +differ can never regain identical logs, so no two distinct branches ever +re-merge, every δ-branching decoheres immediately, `t`'s phases become +observationally irrelevant, and qALC collapses into a probabilistic +λ-calculus with √2-shaped coins — quantum in name only +**[claim, review-confirmed for exactly this definition of full logging]**. +The entire quantum content of the design lives in the merge discipline. + +Whatever residue restores injectivity is true garbage, and per §4.1 it is +needed at environment lookup, control unwinding, and readback collisions, +not merely at β substitution. An environment-machine formulation relocates +much of it to binding-discard steps — erasure, where the irreversibility genuinely lives. The **minimal-garbage theorem** is this pillar's first -formal work item **[open]**: define `U` on machine configurations, -characterize the minimal residual garbage under which `U` is a global -isometry, and prove the invariant-sector lemma in that machine. Until it is -proved, every downstream object is conditional on its statement. - -**Forced synchronization [claim].** Because the halt sector is -forward-infinite chains, a branch's halting time is unerasable: two branches +formal work item **[open, gating]**: define the reversible machine of §4.1 +as a concrete transition table, prove its columns orthonormal on the +reachable configuration graph, characterize the minimal residual garbage, +and prove the invariant-sector lemma in that machine. Until it exists, +`U`, `μ_p`, and `M` are not defined objects, and everything downstream is +conditional. + +**Synchronization as convention [design].** Under the common-origin tick, +a branch's halting time is recorded in its tick offset: two branches reaching the same normal form at different times sit at different chain -positions forever and never interfere. Coherence between halting branches -exists only at equal halting time (with equal residual garbage). This is -Bernstein–Vazirani's synchronized-halting condition and the quantum control -machine synchronization constraint (Yuan–Villanyi–Carbin) arriving as -structure rather than as an imposed rule **[standard analogues]**. +positions forever, so coherence between halting branches exists only at +equal halting time with equal residual garbage. Review round 1 corrected +this from a structural theorem to a convention: injectivity alone does not +force it — an entry map assigning per-configuration tick offsets (realizable +in earnest only if residual garbage happens to encode arrival time, so the +offset can uncompute the clock) is injective yet permits unequal-time output +coherence after the clock is traced. qALC adopts the common origin +deliberately: it is Bernstein–Vazirani's synchronized-halting construction +made a machine convention (compare also the quantum control machine +synchronization constraint of Yuan–Villanyi–Carbin **[standard]**), it is +the natural choice, and it is load-bearing for §4.6. Revisit only if +unequal-time output coherence ever becomes a wanted object. ### 4.6 Output coherence blocks Group halted branches by (halting time, residual garbage, terminal control). Within a group, branches with different normal forms contribute a coherent block `v v†` to `ρ_p`; across groups, contributions add -incoherently. Each block is constant once formed and groups persist -(equal-time branches keep equal tick counts forever), so `ρ_p(τ)` is a sum -of a growing set of fixed PSD blocks — Loewner-monotone with limit `ρ_p` -**[claim]**. Off-diagonal mass in `M` therefore comes exactly from +incoherently. *Given the normative halted dynamics of §4.3* — this is where +it earns its keep — each block is constant once formed, groups persist +(equal-time branches keep equal tick counts forever), and a branch arriving +later belongs to a later group and cannot enlarge an earlier block, so +`ρ_p(τ)` is a sum of a growing set of fixed PSD blocks — Loewner-monotone +with limit `ρ_p` **[claim, review-confirmed under the normative form]**. Off-diagonal mass in `M` therefore comes exactly from equal-time, garbage-clean branch pairs: **coherence is earned by uncomputation**, and the off-diagonal structure of `M` is a record of which programs clean up after themselves. The output-convention question — what @@ -273,29 +319,50 @@ not lie in the ring. ## 6. Fragments -**Gate-free fragment.** A program whose run never fires a δ-rule evolves on -a single basis path; its halting mass is 0 or 1 and equals its classical -fate. qALC is a conservative extension of the classical census by -construction, and the verification contract still tests it (§7). +**Effect-free fragment.** Review round 1 broke the naive version of this +fragment: `λh.λt. h h` is a classical normal form, yet its invocation +reaches the species error `h h` without ever firing a boolean δ-rule — so +"never fires a δ" does not give fate identity with the bare program's +census row. The correct statement: a run of `p h t` is *effect-free* when +no transition ever consumes a constant — no δ fires and no error transition +involving a constant fires. Effect-free evolution proceeds on a single +basis path and coincides step-for-step with classical leftmost reduction of +`p X₁ X₂` with rigid atoms — the skeleton semantics qBLC's trusted checker +already adjudicates — so conservativity is fate identity with *rigid-atom +reduction*, not with census rows, `μ_p ∈ {0,1}` on this fragment, and the +qBLC skeleton machinery is the natural tool for scoping it **[design, +repaired]**. **h-only fragment.** Programs whose text never applies `t` (syntactically identifiable; a census flag, not a separate design). Amplitudes are real, -in ℤ[1/√2]. Conjecture **[claim, needs proof]**: for *circuit-shaped* -programs — every root-to-leaf branch fires the same number of Hadamards — -path amplitudes are `n/√2^d` and all halting masses are dyadic; a -√2-irrational halting mass in the h-only fragment therefore witnesses -control-flow desynchronization, i.e. genuinely quantum control. "Circuit- -shaped" needs a precise machine-level definition before this is a theorem. -This fragment is the dyadicity campaign's natural sequel instrument: in full -qALC, ω already carries non-dyadicity, so the witness reading is -fragment-relative. - -**Universality.** Toffoli-class reversible operations are pure λ-terms on -Church-encoded data, so with `h` alone the machine reaches the -Shi–Aharonov universal gate set **[standard]** (real amplitudes; complex -via the standard rebit encoding), and `{h, t}` gives Clifford+T natively. -A formal statement of what universality means for qALC's objects — presumably -a Gács-style domination claim for `M` within an appropriate class — is +in ℤ[1/√2]. Conjecture **[claim, definition from review round 1]**: call a +program *D-circuit-shaped for halting* when, in the unfolded history tree, +every history first entering the halt sector has fired exactly `D` +Hadamards; then every halting history has amplitude `±2^(−D/2)`, terminal +amplitudes are `n_c/2^(D/2)`, and the halting mass `Σ n_c²/2^D` is dyadic. +The witness reading is correspondingly narrow: a √2-irrational halting mass +witnesses **coherent merging of histories with opposite Hadamard-count +parity** — not mere desynchronization (unequal depths ending in orthogonal +garbage stay dyadic, depths differing by an even number merge without √2 +terms, and irrational contributions can cancel in aggregate). This fragment +is the dyadicity campaign's natural sequel instrument: in full qALC, ω +already carries non-dyadicity, so the witness reading is fragment-relative. + +**Universality.** Toffoli-class reversible operations are expressible as +pure λ-terms on Church-encoded data, and Shi–Aharonov make Toffoli+Hadamard +a universal gate set **[standard]** (real amplitudes; complex via the +standard rebit encoding), with `{h, t}` giving Clifford+T natively. But the +theorem is about *abstract clean gates*, and review round 1 named the gap: +a λ-term computing a reversible Boolean function generically realizes +`|x⟩ ↦ |F(x)⟩|g_x⟩` with input-dependent garbage under this machine, and +tracing `g_x` dephases exactly the superpositions universality needs. What +qALC requires is a **clean coherent compilation theorem [open, gating]**: +λ-defined Toffoli-class terms whose residual garbage is input-independent — +Bennett compute–copy–uncompute as a λ-idiom — proved against the pillar's +reversible machine. Until it is proved, universality is a target, not a +property, and the H–NOT–H witness (§7) is its smallest instance. A formal +statement of what universality means for qALC's objects — presumably a +Gács-style domination claim for `M` within an appropriate class — is also unwritten **[open]**. ## 7. Planned engine stack and verification contract @@ -310,20 +377,31 @@ their evaluators. Every qALC engine change must satisfy: +Two clauses are normative machine contract, not just test surface: +δ-steps are **garbage-transparent** — a δ acts as `gate ⊗ I_context ⊗ +I_garbage`, writing nothing branch-dependent — and halted dynamics has the +§4.3 normative form. Every qALC engine change must then satisfy: + 1. `cargo test --release --all-features` and plain `cargo test --release`; 2. exact norm conservation (equality battery) on every tested program; 3. the monotonicity battery: `μ_p(τ)` nondecreasing, per transition, on the full test range; -4. isometry spot-checks: pairwise inner-product preservation over the - reachable configuration graph at small sizes; -5. gate-free conservativity: fates and masses bit-identical to the - classical census on the covered range; -6. **the HH witness**: the program applying `h` twice to the same position - halts with mass 1 on `0̂` and mass 0 on `1̂` — destructive cancellation, - the single test that separates quantum semantics from the probabilistic - degeneration (which yields the same mass 1 but a mixed output at - (1/2, 1/2)); and -7. bit-identical classical *and* qBLC rows: qALC must remain isolated from +4. the orthonormal-columns battery: the transition table is column- + orthonormal over the reachable configuration graph at small sizes + (subsumes pairwise inner-product spot-checks); +5. effect-free conservativity: fates and masses identical to classical + rigid-atom reduction of `p X₁ X₂` on the covered range (§6); +6. **the HH witness**: `h` twice on the same position halts with mass 1 on + `0̂` and mass 0 on `1̂` — destructive cancellation, separating quantum + semantics from the probabilistic degeneration (which yields the same + mass but a mixed output at (1/2, 1/2)); +7. **the H–NOT–H witness**: `h (NOT (h 0̂))` with `NOT` a pure λ-term halts + with mass 1 on `0̂` (HXH = Z on `|0⟩`) — HH alone certifies only local δ + coherence, and an engine could pass it while β garbage from any + interposed λ-term destroys every nontrivial coherent computation; this + witness is the smallest test that λ-computation between gates is + coherence-transparent; and +8. bit-identical classical *and* qBLC rows: qALC must remain isolated from both existing engines. ## 8. Design decisions @@ -337,14 +415,21 @@ Every qALC engine change must satisfy: - **Classical syntax only:** programs are prefix-free bits; superposition is runtime-only. Anything else is a different (BvDL-flavored) research program with a broken size identity. -- **β-dynamics on machine configurations:** bare terms fail isometry; - machine control is self-uncomputing implicit history. The token-machine - (quantum GoI) alternative is parked, not rejected: its natively - reversible dynamics is attractive, but it merges branches differently - and therefore defines *different objects* — if pursued, it is a separate - pillar, never a drop-in engine for this one. -- **Invariant-sector halting with ticks:** fixed points are incompatible - with injectivity; invariance suffices for monotone mass. +- **β-dynamics on a new reversible machine:** bare terms fail isometry, + and ordinary KN control fails reversibility (§4.1) — the configuration + algebra is a machine to be built, with the KN design as guide. The + token-machine (quantum GoI) alternative is parked, not rejected: its + natively reversible dynamics is attractive, but it merges branches + differently and therefore defines *different objects* — if pursued, it + is a separate pillar, never a drop-in engine for this one. +- **Invariant-sector halting with ticks, common origin:** fixed points are + incompatible with injectivity; invariance suffices for monotone mass; + the common-origin tick and the normative halted form (§4.3) are chosen, + not forced — they buy equal-time-only coherence and Loewner-monotone + outputs, and the injective unequal-time alternative is recorded and + declined. +- **Garbage-transparent δ:** gates act as `gate ⊗ I` on configurations; + branch-dependent δ residue would kill even the HH witness. - **Leftmost-outermost strong reduction:** the house strategy; the machine is the definition, which is also what dissolves algebraic-λ confluence pathologies. @@ -358,16 +443,27 @@ Every qALC engine change must satisfy: ## 9. Open obligations -1. **Minimal-garbage theorem** (§4.5) — the gating work item; everything - downstream is conditional on it. -2. Merge-discipline canonicity: is the minimal-garbage `U` unique in any +1. **The reversible machine + minimal-garbage theorem** (§4.1, §4.5) — the + gating work item: a concrete transition table (KN-guided, not KN), + orthonormal columns proved on the reachable graph, minimal residual + garbage characterized, invariant-sector lemma proved in that machine. + `U`, `μ_p`, and `M` are undefined until this exists. +2. **Clean coherent compilation** (§6): λ-defined Toffoli-class terms with + input-independent garbage under the machine of item 1; gating for any + universality claim. +3. Merge-discipline canonicity: is the minimal-garbage `U` unique in any useful sense, and what exactly is the class of programs whose branches re-merge (the "coherence is earned" economy made precise)? -3. The forced-synchronization argument (§4.3, §4.5) survives adversarial - review, or the halt-sector design changes. -4. Circuit-shaped dyadicity in the h-only fragment (§6): precise - definition, then proof. -5. Universality/domination statement for `M` (§6). +4. D-circuit-shaped dyadicity in the h-only fragment (§6): review round 1 + proposed the definition — every history first entering the halt sector + fires exactly `D` Hadamards — under which halting masses are `Σ n_c²/2^D`, + dyadic; and sharpened the witness reading: a √2-irrational mass + specifically witnesses coherent merging of histories with opposite + Hadamard-count *parity*, not mere desynchronization (unequal depths with + orthogonal garbage stay dyadic; even-differing depths merge without √2 + terms; irrational contributions can cancel in aggregate). Statement and + proof against the machine of item 1. +5. Universality/domination statement for `M` (§6), downstream of item 2. 6. Self-interpretation: interpretation slows branches, timing is physical (§4.5), so bisimulation with the classical self-interpreter is at best up-to-dilation with garbage uncomputed before output; whether an @@ -379,6 +475,15 @@ Every qALC engine change must satisfy: 9. Signature order freeze (§3) before any canonical data. 10. Output convention (§4.6) — parked deliberately. +**Ratification gates (review round 1):** the reversible-machine transition +table with orthonormal columns (item 1); the common-origin tick and +normative halted dynamics stated as contract (§4.3, done in this revision); +garbage-transparent δ stated as contract (§7, done); the H–NOT–H clean-gate +witness in the verification contract (§7, done); the corrected effect-free +conservativity fragment (§6, done). The open gates are items 1 and 2; the +scalar ring needs nothing — the unresolved object is the configuration +algebra, not the amplitudes. + ## 10. Lineage and related documents Standard references this design leans on: Arrighi–Dowek (Lineal; linear From a80ccf2274e809718bc3ffa63fed1ca4f1a4de60 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 03:49:12 -0400 Subject: [PATCH 004/107] =?UTF-8?q?docs:=20qALC=20=E2=80=94=20incorporate?= =?UTF-8?q?=20review=20round=202;=20add=20reference=20machine=20sketch?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Round 2 verdicts folded into architecture.md: arrival-time nuance refuted and replaced (fixed output-dependent entry offsets suffice for unequal-time coherence); garbage-transparent delta refactored into clean delta fibres (gate (x) J, boolean-independent injective spectator transition); halt entry typed (RunDone vs Halt, terminal control frozen, no unticked halted state); effect-free lockstep weakened to projected semantic lockstep; clean compilation now requires synchronized transition count, garbage, and terminal control; fast-engine contract hardened to exact transition-system equivalence or isometric intertwining (configuration algebra is semantic state); h-only fragment defined semantically; stale 'dissolves' ledger bullet repaired; duplicated section-7 lead-in removed; minimal garbage scoped to local predecessor-fibre minimality. New machine.md: pre-formal reference machine sketch from round 2 — environment/closure substrate, Cfg record with (p, tau) spectator labels, central residue rule with coherent push/pop, transition audit table, the two cautions (no allocation identity in basis, no destructive output sink), and the formalization checklist that gates src/qalc/. Co-Authored-By: Claude Fable 5 --- docs/quantum-algebraic/architecture.md | 198 +++++++++++++++++-------- docs/quantum-algebraic/machine.md | 126 ++++++++++++++++ 2 files changed, 263 insertions(+), 61 deletions(-) create mode 100644 docs/quantum-algebraic/machine.md diff --git a/docs/quantum-algebraic/architecture.md b/docs/quantum-algebraic/architecture.md index 1b2211a..9183896 100644 --- a/docs/quantum-algebraic/architecture.md +++ b/docs/quantum-algebraic/architecture.md @@ -18,6 +18,16 @@ against rigid-atom reduction, not gate-free against census rows — §6); and a universality gap was recorded (clean coherent compilation — §6). The ratification gates are listed at the end of §9. +Review round 2 (2026-08-09, same thread) is incorporated: the arrival-time +nuance in §4.5 was refuted and replaced (fixed output-dependent entry +offsets already permit unequal-time coherence); "garbage-transparent δ" was +refactored into the clean-δ-fibre contract (§7); halt entry was typed +(`RunDone` vs `Halt`, §4.3); effect-free lockstep was weakened to projected +semantic lockstep (§6); clean compilation acquired its synchronized-timing +requirement (§6); and the fast-engine contract was found broken as written +and replaced by exact transition-system equivalence (§7). The constructive +reference-machine sketch from that round lives in `machine.md`. + ## 1. Purpose and position among the pillars qALC is the quantum-control pillar. The existing pillars occupy two corners @@ -61,8 +71,8 @@ halted configurations: Halting mass is the central softening: the classical fate column {Halt, Diverge, Unknown} becomes a real number in [0,1] with exact monotone lower approximants and certificate-driven upper brackets. A single program is -already an Ω-like object; `μ_p ∈ {0,1}` exactly on the effect-free fragment -(§6). A divergence certificate on a sector of the superposition bounds +already an Ω-like object; every effect-free program (§6) has +`μ_p ∈ {0,1}` (the converse fails — HH is effectful with mass 1). A divergence certificate on a sector of the superposition bounds `μ_p` from above, so the classical certificate machinery generalizes from verdicts to intervals **[design]**. @@ -212,14 +222,25 @@ the wandering subspace of `V = U|_S`: newly arriving halted amplitude `a = P_S U r` lies in `S ⊖ V(S)`, hence `V^m a ⊥ V^n b` whenever `m ≠ n` **[review round 1 formulation]**. -**Normative halted dynamics [design].** Halted evolution is -`identity_output ⊗ identity_garbage ⊗ unilateral-shift_tick`, with every -branch entering at tick zero (common origin): `(nf, g) → (nf, g, 0)`, -`(nf, g, k) → (nf, g, k+1)`. Invariance alone is deliberately not enough — -a halt-sector unitary rotating `|0̂⟩` toward `|+⟩` preserves halted mass -while wrecking the monotone reduced output of §4.6; the normative form is -what makes §4.6 a theorem. What mass monotonicity itself needs is only -invariance, not fixedness: +**Normative halted dynamics [design].** Halt entry is typed with disjoint +constructors so no unticked halted basis state exists — the final readback +transition produces the halted form directly: + +```text +RunDone(nf, g, terminal-control) → Halt(nf, g, terminal-control, 0) +Halt(nf, g, c, k) → Halt(nf, g, c, k+1) +``` + +`P_halt` contains only `Halt` states; once a history enters the halt +sector it only ticks, so there is no "halts twice along one history" +ambiguity. Halted evolution is +`identity_output ⊗ identity_garbage ⊗ identity_terminal-control ⊗ +unilateral-shift_tick`, every branch entering at tick zero (common origin). +Invariance alone is deliberately not enough — a halt-sector unitary +rotating `|0̂⟩` toward `|+⟩` preserves halted mass while wrecking the +monotone reduced output of §4.6; the normative form is what makes §4.6 a +theorem. What mass monotonicity itself needs is only invariance, not +fixedness: **Lemma (monotone halting mass) [claim].** If `U` is an isometry and `U(S) ⊆ S` for the halted subspace `S`, then `‖P_S U ψ‖ ≥ ‖P_S ψ‖`. @@ -262,20 +283,32 @@ genuinely lives. The **minimal-garbage theorem** is this pillar's first formal work item **[open, gating]**: define the reversible machine of §4.1 as a concrete transition table, prove its columns orthonormal on the reachable configuration graph, characterize the minimal residual garbage, -and prove the invariant-sector lemma in that machine. Until it exists, -`U`, `μ_p`, and `M` are not defined objects, and everything downstream is -conditional. +and prove the invariant-sector lemma in that machine. "Minimal" needs a +comparison class (review round 2): a global minimum over arbitrary +reversible realizations is unlikely to be canonical and may hide +undecidable semantic equivalence; the tractable statement is *local +minimality within a fixed machine representation* — residue must +distinguish exactly each classical predecessor fibre not already +orthogonalized by a quantum transition. The candidate machine shape — +environment/closure substrate, explicit zippers, transition-local +predecessor tags — is sketched pre-formally in `machine.md`. Until the +machine exists, `U`, `μ_p`, and `M` are not defined objects, and +everything downstream is conditional. **Synchronization as convention [design].** Under the common-origin tick, a branch's halting time is recorded in its tick offset: two branches reaching the same normal form at different times sit at different chain positions forever, so coherence between halting branches exists only at equal halting time with equal residual garbage. Review round 1 corrected -this from a structural theorem to a convention: injectivity alone does not -force it — an entry map assigning per-configuration tick offsets (realizable -in earnest only if residual garbage happens to encode arrival time, so the -offset can uncompute the clock) is injective yet permits unequal-time output -coherence after the clock is traced. qALC adopts the common origin +this from a structural theorem to a convention, and round 2 corrected the +correction's nuance: injectivity alone does not force it, and a +time-homogeneous entry map may choose a fixed tick offset from the terminal +configuration alone — entering output `a` at label 0 and output `b` at +label `d` already permits unequal-time coherence whenever the offset +difference matches the arrival-time difference, with no timing information +encoded anywhere (the `b` chain simply has no reachable states below `d`). +Only *adaptively* aligning arbitrary arrivals would require the incoming +configuration to encode relative timing. qALC adopts the common origin deliberately: it is Bernstein–Vazirani's synchronized-halting construction made a machine convention (compare also the quantum control machine synchronization constraint of Yuan–Villanyi–Carbin **[standard]**), it is @@ -293,9 +326,10 @@ it earns its keep — each block is constant once formed, groups persist later belongs to a later group and cannot enlarge an earlier block, so `ρ_p(τ)` is a sum of a growing set of fixed PSD blocks — Loewner-monotone with limit `ρ_p` **[claim, review-confirmed under the normative form]**. Off-diagonal mass in `M` therefore comes exactly from -equal-time, garbage-clean branch pairs: **coherence is earned by -uncomputation**, and the off-diagonal structure of `M` is a record of which -programs clean up after themselves. The output-convention question — what +equal-time branch pairs with equal traced spectator state — equal residue +and terminal control, not necessarily *empty* residue: **coherence is +earned by uncomputation**, and the off-diagonal structure of `M` is a +record of which programs clean up after themselves. The output-convention question — what beyond control, garbage, and tick is traced out, and whether any designated- output alternative is worth defining — is explicitly parked **[open]**, matching the same parked question in qBLC. @@ -326,16 +360,23 @@ reaches the species error `h h` without ever firing a boolean δ-rule — so census row. The correct statement: a run of `p h t` is *effect-free* when no transition ever consumes a constant — no δ fires and no error transition involving a constant fires. Effect-free evolution proceeds on a single -basis path and coincides step-for-step with classical leftmost reduction of -`p X₁ X₂` with rigid atoms — the skeleton semantics qBLC's trusted checker -already adjudicates — so conservativity is fate identity with *rigid-atom -reduction*, not with census rows, `μ_p ∈ {0,1}` on this fragment, and the -qBLC skeleton machinery is the natural tool for scoping it **[design, -repaired]**. - -**h-only fragment.** Programs whose text never applies `t` (syntactically -identifiable; a census flag, not a separate design). Amplitudes are real, -in ℤ[1/√2]. Conjecture **[claim, definition from review round 1]**: call a +basis path whose *term projection* follows the same leftmost redex sequence +as classical rigid-atom reduction of `p X₁ X₂` — possibly interleaved with +reversible administrative transitions (lookup, zipper moves, residue +management) that rigid-atom reduction does not have — and reaches the same +semantic fate. That is the skeleton semantics qBLC's trusted checker +already adjudicates, so conservativity is projected fate identity with +*rigid-atom reduction*, not with census rows; every effect-free program has +`μ_p ∈ {0,1}`; and the qBLC skeleton machinery is the natural tool for +scoping the fragment **[design, repaired twice: round 1 fixed the +comparison object, round 2 weakened step-for-step to projected lockstep]**. + +**h-only fragment.** Defined semantically: no reachable transition fires +`t`. ("Never applies `t` in the text" is not plainly syntactic here — the +constants arrive at invocation and can be passed through arbitrary +higher-order plumbing; a conservative *syntactic* subset for conventional +two-lambda wrappers is worth naming separately for cheap census flagging.) +Amplitudes are real, in ℤ[1/√2]. Conjecture **[claim, definition from review round 1]**: call a program *D-circuit-shaped for halting* when, in the unfolded history tree, every history first entering the halt sector has fired exactly `D` Hadamards; then every halting history has amplitude `±2^(−D/2)`, terminal @@ -355,11 +396,17 @@ standard rebit encoding), with `{h, t}` giving Clifford+T natively. But the theorem is about *abstract clean gates*, and review round 1 named the gap: a λ-term computing a reversible Boolean function generically realizes `|x⟩ ↦ |F(x)⟩|g_x⟩` with input-dependent garbage under this machine, and -tracing `g_x` dephases exactly the superpositions universality needs. What -qALC requires is a **clean coherent compilation theorem [open, gating]**: -λ-defined Toffoli-class terms whose residual garbage is input-independent — -Bennett compute–copy–uncompute as a λ-idiom — proved against the pillar's -reversible machine. Until it is proved, universality is a target, not a +tracing `g_x` dephases exactly the superpositions universality needs. And +input-independent garbage is necessary but not sufficient under the +common-origin halt convention: input-dependent *running time* places +outputs at different tick ages and dephases them just as surely. What qALC +requires is a **clean coherent compilation theorem [open, gating]**: for a +single common transition count `T`, `U^T |x, clean⟩ = |F(x), g*, c*, 0⟩` +for every basis input `x` — same `T`, same residual garbage `g*`, same +terminal control `c*`, the intended amplitudes. Bennett +compute–copy–uncompute as a λ-idiom is the route, but its classical +discipline must be realized *and synchronized* inside the λ-machine; it is +not automatic. Until it is proved, universality is a target, not a property, and the H–NOT–H witness (§7) is its smallest instance. A formal statement of what universality means for qALC's objects — presumably a Gács-style domination claim for `M` within an appropriate class — is also @@ -369,18 +416,37 @@ unwritten **[open]**. Planned module tree `blam::qalc`, drivers under a new `blam` subcommand group; the reference evaluator represents `ψ_τ` as an exact sparse map from -configurations to `Dw` scalars and applies `U` transition by transition. A -fast engine, if the reference is too slow for a census, arrives only with -the same lockstep discipline qBLC uses: exhaustive fate/mass/support -equality over a configured range, engines sharing the scalar layer but not -their evaluators. +configurations to `Dw` scalars and applies `U` transition by transition. + +A fast engine, if the reference is too slow for a census, faces a +*stricter* bar than qBLC lockstep — final fate/mass/support equality is +insufficient, because in qALC internal configurations and residue determine +future interference: the configuration algebra is semantic state, not +implementation detail **[review round 2]**. A fast engine must either +produce the identical exact sparse amplitude map over canonical +configurations at every transition, or come with an isometric intertwining +`W U_ref = U_fast W` preserving the halt and error projections and the +output partial trace. (Hash-consing and representation tricks are fine +below that line; branch-dependent allocation identity is not — see +`machine.md`.) + +Two clauses are normative machine contract, not just test surface. First, +δ-steps are **clean δ fibres** (round 2's repair of the earlier +"garbage-transparent" wording, which presupposed `I_context` a real +machine cannot deliver): for every spectator configuration `κ`, -Every qALC engine change must satisfy: +```text +U |h, b, κ⟩ = Σ_b' H_b'b |b', J(κ)⟩ +U |t, b, κ⟩ = ω^b |b, J(κ)⟩ +``` -Two clauses are normative machine contract, not just test surface: -δ-steps are **garbage-transparent** — a δ acts as `gate ⊗ I_context ⊗ -I_garbage`, writing nothing branch-dependent — and halted dynamics has the -§4.3 normative form. Every qALC engine change must then satisfy: +with `J` one injective spectator transition, identical across input +booleans and output branches, no residue depending on either, and fibres +for distinct `κ` having orthogonal images — a common δ-rule tag is harmless +(and may be needed to separate δ ranges from β ranges); what HH needs is +equal residue across the two H columns, not literally untouched context. +Second, halted dynamics has the §4.3 normative typed form. Every qALC +engine change must then satisfy: 1. `cargo test --release --all-features` and plain `cargo test --release`; 2. exact norm conservation (equality battery) on every tested program; @@ -428,11 +494,13 @@ I_garbage`, writing nothing branch-dependent — and halted dynamics has the not forced — they buy equal-time-only coherence and Loewner-monotone outputs, and the injective unequal-time alternative is recorded and declined. -- **Garbage-transparent δ:** gates act as `gate ⊗ I` on configurations; - branch-dependent δ residue would kill even the HH witness. +- **Clean δ fibres:** gates act as `gate ⊗ J` with one injective + boolean-independent spectator transition (§7); branch-dependent δ residue + would kill even the HH witness. - **Leftmost-outermost strong reduction:** the house strategy; the machine - is the definition, which is also what dissolves algebraic-λ confluence - pathologies. + is the definition — which *chooses one machine-relative reduction + sequence* rather than resolving algebraic-λ non-confluence, and + β/δ-convertibility is not a semantic equality here (§3). - **Exactness:** ring arithmetic only, conservation as equality, brackets for every unbounded claim. - **Name:** qALC, quantum algebraic lambda calculus — lineage-accurate: the @@ -444,13 +512,14 @@ I_garbage`, writing nothing branch-dependent — and halted dynamics has the ## 9. Open obligations 1. **The reversible machine + minimal-garbage theorem** (§4.1, §4.5) — the - gating work item: a concrete transition table (KN-guided, not KN), - orthonormal columns proved on the reachable graph, minimal residual - garbage characterized, invariant-sector lemma proved in that machine. + gating work item: a concrete transition table (environment/closure + substrate per `machine.md`, KN-guided, not KN), orthonormal columns + proved on the reachable graph, residual garbage locally minimal in the + predecessor-fibre sense, invariant-sector lemma proved in that machine. `U`, `μ_p`, and `M` are undefined until this exists. 2. **Clean coherent compilation** (§6): λ-defined Toffoli-class terms with - input-independent garbage under the machine of item 1; gating for any - universality claim. + input-independent garbage, terminal control, *and transition count* + under the machine of item 1; gating for any universality claim. 3. Merge-discipline canonicity: is the minimal-garbage `U` unique in any useful sense, and what exactly is the class of programs whose branches re-merge (the "coherence is earned" economy made precise)? @@ -475,12 +544,18 @@ I_garbage`, writing nothing branch-dependent — and halted dynamics has the 9. Signature order freeze (§3) before any canonical data. 10. Output convention (§4.6) — parked deliberately. -**Ratification gates (review round 1):** the reversible-machine transition -table with orthonormal columns (item 1); the common-origin tick and -normative halted dynamics stated as contract (§4.3, done in this revision); -garbage-transparent δ stated as contract (§7, done); the H–NOT–H clean-gate -witness in the verification contract (§7, done); the corrected effect-free -conservativity fragment (§6, done). The open gates are items 1 and 2; the +**Ratification gates.** Round 1 gates: normative halted dynamics (§4.3), +clean-δ contract (§7), H–NOT–H witness (§7), corrected conservativity +fragment (§6) — all closed. Round 2 gates: fixed-offset synchronization +wording (§4.5), clean δ fibres replacing `gate ⊗ I_context` (§7), typed +`RunDone`/`Halt` entry (§4.3), projected semantic lockstep for the +effect-free fragment (§6), synchronized timing in clean compilation (§6), +exact transition-system equivalence for any fast engine (§7), and the +stale "dissolves" sentence (§8) — all closed in this revision. The open +gates are items 1 and 2 above — build the machine, prove clean +compilation; per round 2, the route ratified for exploration is the +canonical environment/closure reference machine of `machine.md` with +transition-local predecessor tags and no global-minimality claim. The scalar ring needs nothing — the unresolved object is the configuration algebra, not the amplitudes. @@ -500,5 +575,6 @@ semantics — the gap this pillar's measurements would inform). - Classical counterpart: `../classical/architecture.md` - Quantum-store counterpart: `../quantum/architecture.md` +- Reference machine sketch (pre-formal): `machine.md` - Moving state and docket: `../STATUS.md` (section pending ratification) - Canonical evidence: none yet; `data/quantum-algebraic/` reserved. diff --git a/docs/quantum-algebraic/machine.md b/docs/quantum-algebraic/machine.md new file mode 100644 index 0000000..88f130e --- /dev/null +++ b/docs/quantum-algebraic/machine.md @@ -0,0 +1,126 @@ +# qALC reference machine sketch + +**Status: pre-formal.** This document captures the constructive shape of +the reversible abstract machine that `architecture.md` §4.1 requires and +§9 item 1 gates on. Its origin is adversarial review round 2 (gaslamp +thread `qalc-architecture`, 2026-08-09), which both broke the hope that +the existing KN machine could serve and supplied this candidate route. It +is a design sketch to be formalized and then attacked — nothing here is a +contract yet, and the architecture document wins wherever they disagree. + +## 1. Substrate: environments, not substitution + +A substitution step `(λb) a → b[a]` forgets the redex boundary, the +original binder, the occurrence map, and — under weakening — the erased +argument. Inverting it can require essentially the whole redex, and +duplication can make the residue larger than the destination. An explicit +environment/closure machine turns β mostly into reversible rearrangement: + +- the body remains immutable code; +- the argument remains an explicit closure; +- binding is a persistent cons cell; +- application context remains a frame; +- lookup irreversibility is exposed at one named transition; +- erasure is exposed exactly where a cell becomes unreachable. + +That is the right surface for the local-minimality theorem: each source of +irreversibility is one named transition, not a diffuse property of a +substitution relation. (Environment machines as the standard bridge from +explicit substitutions to Krivine-style execution: Biernacka–Danvy. The +reversible interaction-machine alternative — Danos–Regnier — is a +genuinely different dynamics and stays parked per the architecture.) + +## 2. Reference configuration + +```text +Cfg { + program_sector, // fixed p; common to every branch of one run + absolute_clock, // common τ, shifted every transition + mode, // Eval | Lookup | Quote | Return | Done + focus: Closure, + env_zipper, + continuation, + output_zipper, + residue, +} +``` + +The inert `(p, τ)` spectator labels are cheap and useful: retaining `p` +separates collisions between different programs (harmless — `M` already +sums programs incoherently), and the explicit `τ` separates configurations +reached at different global stages without distinguishing branches present +at the same stage. Both are common to every branch of one `ψ_τ`, so +neither destroys intended same-time interference — and neither repairs +collisions between branches of one program at one time; the transition +table itself must do that. + +## 3. The central residue rule + +> For a deterministic target configuration `d`, every predecessor not +> already made orthogonal by a quantum transition requires an orthogonal +> residue label. Such a label may later be popped only when the live +> configuration reconstructs it uniquely. + +Reversible push/pop pair: + +```text +(c, g) → (d, g · predecessor_tag(c)) +(d', g · tag) → (e, g) // only when d' itself determines tag +``` + +Appending tags forever is the probabilistic degeneration +(`architecture.md` §4.5); coherent popping is the economy qALC exists to +measure. "Minimal garbage" is claimed only in the local sense: within this +machine representation, residue must distinguish exactly each classical +predecessor fibre not already orthogonalized by a quantum transition. No +global-minimality claim over arbitrary reversible realizations is made — +that comparison class is unlikely to be canonical and may hide undecidable +semantic equivalence. + +## 4. Transition audit (candidate table) + +| Transition | Reversible shape | Residue requirement | +|---|---|---| +| Application descent | `Eval(App(f,a), e, K) ↔ Eval(f, e, Arg(a,e)::K)` | Usually none: the argument frame reconstructs the source. | +| β / binder entry | Move the argument closure into a persistent environment cell, enter the body | Potentially none locally, but only if the landing mode/range has a unique inverse; otherwise retain a β landing tag until it can be coherently popped. | +| Environment traversal | Move cells between sides of an environment zipper one at a time | None while the zipper stays live. | +| Variable dereference | `Lookup(i, origin-env, zipper)` enters the selected closure | Must retain the selecting index/origin path (or an equivalent predecessor-fibre label). This is exactly where round 1's KN Var witness bites. | +| Lambda under readback | Push `LamEnd`, add a rigid-level environment cell, extend the output zipper | Normally reversible from frame, cell, and zipper. | +| Neutral spine / readback | Convert argument frames to normalization jobs; build output through a zipper | Preserve constructor/order in the zipper; never stream destructively into an external sink. | +| Binding erasure | Drop an unused closure/environment cell | The erased closure enters residue unless already reconstructible; quantum-dependent erased data cannot be cleanly forgotten. | +| Contraction / duplication | Reuse an immutable closure from multiple occurrence continuations | Environment sharing preferred — it preserves call-by-name re-evaluation without materializing substituted copies. Do **not** memoize: memoization changes generator-duplication semantics. | +| H / T δ | Clean δ fibre `gate ⊗ J` (architecture §7) | `J` may add a common rule tag; nothing may depend on the input or output boolean. | +| Species error | Enter the typed error chain | Retain error kind and offending closure as error garbage; output coherence is irrelevant there. | +| Terminalization | Unique `RunDone(…) → Halt(…, 0)` | Entry injective; all traced spectator state frozen thereafter. | + +## 5. Two load-bearing cautions + +1. **No allocation identity in the basis.** Fresh heap addresses would + distinguish otherwise-identical branches forever and silently decohere + everything. The reference machine needs structural/canonical immutable + closures and environments; a fast engine may hash-cons them, but + branch-dependent allocation order must never become semantic identity. +2. **No destructive output sink.** The current KN machine streams + constructors and pops frames; a reversible reference needs an explicit + output zipper whose state participates in the inverse transition. + +## 6. What formalization must produce + +In order, per the architecture's gates: + +1. the full transition table over `Cfg`, total on reachable + configurations; +2. the orthonormal-columns proof (injectivity plus the clean-δ fibre + orthogonality) on the reachable graph; +3. the local-minimality statement for `residue` in the predecessor-fibre + sense, with the pop conditions made precise; +4. the invariant-sector lemma instantiated in this machine + (`RunDone`/`Halt` typing, common-origin entry); +5. the effect-free projection lemma: term-projection of an effect-free run + follows rigid-atom leftmost reduction modulo the administrative + transitions, same fate; +6. the HH and H–NOT–H witnesses computed by hand in the formal machine — + before any code exists. + +Then the sketch goes back to the review thread as a formal object, and +only after that does `src/qalc/` get its first line. From 67af866b39ca0ae0fd887359051940e70a5d6ce9 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 04:00:36 -0400 Subject: [PATCH 005/107] docs: harmonize qALC into house current-only format MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit architecture.md rewritten as a clean durable contract — review-round narration and bracket tags removed, all post-round-2 content preserved; history moved to a ledger entry (2026-08-09) that records both review rounds, what broke, and the incorporating commits. machine.md header trimmed to current-only with a ledger pointer. AGENTS.md gains the fourth-pillar paragraph (design-contract-only, no qALC code before the section-9 gates pass) and the qalc-architecture thread. STATUS.md gains the Quantum-algebraic state section with the ordered docket: sign-off review, reversible machine, clean compilation, then src/qalc/. Co-Authored-By: Claude Fable 5 --- AGENTS.md | 15 +- docs/STATUS.md | 24 + docs/ledger/2026-08.md | 62 +++ docs/quantum-algebraic/architecture.md | 625 ++++++++++++------------- docs/quantum-algebraic/machine.md | 9 +- 5 files changed, 395 insertions(+), 340 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index e83b17f..f2938f9 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -66,7 +66,14 @@ The library is three layers — `blc` substrate, symmetric `classical` and `quantum` pillars, `lab` behind its own feature — and one binary, `blam`, whose subcommands live in `src/cli/`. Lab-gated subcommands are recognised without the feature and say how to get themselves; do not "fix" that by -deleting the arm. +deleting the arm. A fourth pillar, `quantum-algebraic` (qALC: quantum +*control*, storeless, runtime states in ℓ² over machine configurations), +exists as a design contract only — `docs/quantum-algebraic/architecture.md` +is the contract, `machine.md` beside it the pre-formal reversible-machine +sketch, and **no qALC code may land** until the contract's §9 gates pass +(formal reversible transition table with orthonormal columns, clean +coherent compilation, hand-computed HH and H–NOT–H witnesses). qALC work +must leave classical and qBLC rows bit-identical. `classical::ladder` owns the halting ladder, and every classical driver (`census`, `adjudicate`, `solomonoff`) adjudicates through it: prescan → @@ -222,6 +229,8 @@ Claude and Codex are co-equal here; handoffs run over the `gaslamp` CLI. Existing threads: `blc-conformance` (certificate exchange), `blc-interpreter` (design theory), `blc-interp-search` (slot-search spec), `blc-qblc` (qBLC design ratification), `qblc-selfint` (self-interpretation and -bisimulation), `qblc-omega-witnesses` (dyadicity hunt and phase-2 design), and -`blam-reshape` (v2 refactor design ratification and reviews). +bisimulation), `qblc-omega-witnesses` (dyadicity hunt and phase-2 design), +`blam-reshape` (v2 refactor design ratification and reviews), and +`qalc-architecture` (qALC design contract adversarial review and +ratification). Send raw evidence—encodings, diffs, measured bits—not summaries. diff --git a/docs/STATUS.md b/docs/STATUS.md index b48f700..a04342b 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -395,6 +395,30 @@ The output choice is genuinely object-defining. A designated output restores compositional discarding but must be specified and measured separately from the whole-live-store operator census. +## Quantum-algebraic state (qALC) + +A third pillar exists as a design contract only: +`quantum-algebraic/architecture.md` (quantum control, storeless — runtime +states in ℓ² over machine configurations, `h`/`t` constants at invocation, +fate softened to a real halting mass `μ_p` with `Ω_qALC = Σ 2^(−|p|) μ_p`), +with the pre-formal reversible-machine sketch in +`quantum-algebraic/machine.md`. No engine, no data; +`data/quantum-algebraic/` is reserved. The contract has passed two rounds +of adversarial review on gaslamp thread `qalc-architecture` (history in +`ledger/2026-08.md`); a third full-sign-off pass gates formalization. + +The open docket, in order: + +1. sign-off review of the harmonized contract (thread `qalc-architecture`); +2. the reversible machine: formal transition table on the + environment/closure substrate, orthonormal-columns proof, local + predecessor-fibre garbage minimality, invariant-sector lemma, and the + HH / H–NOT–H witnesses computed by hand (`machine.md` §6) — gates all + implementation; +3. the clean coherent compilation theorem (architecture §6) — gates any + universality claim; +4. then `src/qalc/`: reference evaluator first, census later. + ## Repository and release state - The v2 shape is on `dev`: one `blam` binary in place of the thirteen diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 44d6508..a746d10 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -1809,3 +1809,65 @@ guard (same invariant, supported trigger, same workflow identity for the trusted-publisher config), and the second run went green through all three jobs: **blam v2.0.0 is live on crates.io, tagged, and GitHub-released** from the CI-validated SHA `add2350`. + +## 2026-08-09 — qALC pillar conceived; architecture through two review rounds + +A design conversation about whether qBLC's classical-control architecture +is the only λ-shaped route into quantum AIT produced a third pillar +design: **qALC** (quantum algebraic lambda calculus) — quantum *control*, +storeless, Lineal-lineage. Programs stay classical prefix-free BLC bits; +the runtime state is a vector in ℓ² over machine configurations; +superposition enters only through `h`/`t` constants passed at invocation +(`p h t`), with all Toffoli-class classical structure absorbed into pure +λ-terms (Shi–Aharonov made structural — the signature shrinks from five +primitives to two, and the h-only fragment is one). Fate softens from +{Halt, Diverge, Unknown} to a real halting mass with monotone exact lower +approximants; certificates generalize to interval brackets. The contract +landed as `docs/quantum-algebraic/architecture.md` (`30b4b78`) and went +straight to adversarial review — new gaslamp thread `qalc-architecture`, +Codex at top tier. + +**Round 1** (verdict: do not ratify yet) broke two claims and confirmed +three. Broken: (1) the hope that KN control state supplies reversibility — +the live machine's Var transition discards the selecting environment path +(`focus Var(1), env [A]` and `focus Var(2), env [B,A]` step identically; +reachable from `(λx.x) A` vs `(λy.(λx.y) B) A`), so the pillar needs a +genuinely new reversible machine, KN as guide only; (2) "forced +synchronization" — equal-time-only halting coherence is a *convention* +(common-origin tick), not a consequence of injectivity. Also broken: the +gate-free conservativity fragment (`λh.λt. h h` is a classical normal +form whose invocation species-errors without firing a δ) — repaired as +the effect-free fragment against rigid-atom (skeleton) reduction. +Confirmed: the monotone-mass lemma, the bare-term isometry +counterexample, the full-logging degeneration. Round 1 also supplied the +D-circuit-shaped dyadicity definition and sharpened its witness reading +(√2-irrational h-only mass witnesses coherent merging of +opposite-Hadamard-parity histories specifically), and demanded the +clean-compilation obligation plus the H–NOT–H witness. Incorporated in +`996f9a4`. + +**Round 2** (verdict: substantially repaired, not yet ratifiable) refuted +the round-1 revision's arrival-time nuance (fixed output-dependent entry +offsets already permit unequal-time coherence — no encoded timing +needed), refactored "garbage-transparent δ" into clean δ fibres +(`gate ⊗ J`), typed the halt entry (`RunDone` → `Halt(…,0)`), weakened +effect-free lockstep to projected semantic lockstep, added the +synchronized-timing requirement to clean compilation, and found one new +break: qBLC-style final-equality lockstep is insufficient for a qALC fast +engine, because configurations and residue determine future interference +— the configuration algebra is semantic state, so a fast engine needs +exact per-transition amplitude-map equality or an isometric intertwining. +Round 2 also delivered the constructive machine sketch — environment/ +closure substrate, `(p, τ)` spectator labels, predecessor-fibre residue +rule with coherent push/pop, per-transition audit, no allocation identity +in the basis, no destructive output sink — captured as +`docs/quantum-algebraic/machine.md`. Incorporated in `a80ccf2`. + +Open gates after two rounds: build the reversible machine (formal +transition table, orthonormal columns, local predecessor-fibre +minimality) and prove clean coherent compilation. The scalar ring needs +nothing — the unresolved object is the configuration algebra, not the +amplitudes. Docs then harmonized to house current-only format (this +entry carries the history; the architecture states only the contract), +with a third full-sign-off review pass to follow before any +formalization work begins. diff --git a/docs/quantum-algebraic/architecture.md b/docs/quantum-algebraic/architecture.md index 9183896..8534f7e 100644 --- a/docs/quantum-algebraic/architecture.md +++ b/docs/quantum-algebraic/architecture.md @@ -1,32 +1,16 @@ # Quantum-algebraic BLC (qALC) architecture -**Status: design contract, pre-implementation, pre-ratification.** No engine -exists and nothing in `data/` is qALC-relative. This document is the object -under adversarial review in gaslamp thread `qalc-architecture`; on -ratification it becomes the pillar's durable architecture contract, and any -moving state acquires a section in `../STATUS.md`. Claims are marked: -**[standard]** for published results, **[design]** for choices this contract -fixes, **[claim]** for arguments made here that the review must attack, and -**[open]** for named unknowns. - -Review round 1 (2026-08-09) is incorporated: the monotone-mass lemma, the -bare-term counterexample, and the degeneration claim were confirmed; two -claims were corrected (ordinary KN control does not supply reversibility — -§4.1; equal-time-only coherence is a convention, not a consequence of -isometry — §4.3/§4.5); the conservativity fragment was repaired (effect-free -against rigid-atom reduction, not gate-free against census rows — §6); and a -universality gap was recorded (clean coherent compilation — §6). The -ratification gates are listed at the end of §9. - -Review round 2 (2026-08-09, same thread) is incorporated: the arrival-time -nuance in §4.5 was refuted and replaced (fixed output-dependent entry -offsets already permit unequal-time coherence); "garbage-transparent δ" was -refactored into the clean-δ-fibre contract (§7); halt entry was typed -(`RunDone` vs `Halt`, §4.3); effect-free lockstep was weakened to projected -semantic lockstep (§6); clean compilation acquired its synchronized-timing -requirement (§6); and the fast-engine contract was found broken as written -and replaced by exact transition-system equivalence (§7). The constructive -reference-machine sketch from that round lives in `machine.md`. +This document is the durable architecture contract for blam's +quantum-algebraic pillar. It uses the same structure as the classical and +quantum architectures so the three systems can be compared layer by layer. + +**The pillar is a design contract without an engine**: nothing in `src/` +or `data/` is qALC-relative yet, and the two gates that stand between this +document and implementation are stated in §9. The contract has been through +two rounds of adversarial review (gaslamp thread `qalc-architecture`); the +development history, including what the review broke and how the design +moved, lives in `../ledger/2026-08.md`. A final sign-off pass gates +formalization. ## 1. Purpose and position among the pillars @@ -34,25 +18,24 @@ qALC is the quantum-control pillar. The existing pillars occupy two corners of the control/data square: - `classical`: classical control, classical data; -- `quantum` (qBLC): classical control, quantum data — programs are classical - BLC controllers driving an exact gate-based store through five opaque - primitives (Selinger–Valiron's "quantum data, classical control" - **[standard]**). - -qALC takes the third corner: quantum control, no store. The runtime state is -a vector in ℓ² over machine configurations; superposition of *control* — -of the reduction itself — is the object of study. qBLC's architecture -(`../quantum/architecture.md` §7) chose classical control explicitly to -obtain monotone positive operator approximants and to avoid an unresolved -quantum-halting semantics. This pillar exists because both benefits are -recoverable inside quantum control (§4: invariant-sector halting), so the -dodge is a convenience, not a necessity, and the objects it excludes — +- `quantum` (qBLC): classical control, quantum data — programs are + classical BLC controllers driving an exact gate-based store through five + opaque primitives (Selinger–Valiron's "quantum data, classical control"). + +qALC takes the third corner: quantum control, no store. The runtime state +is a vector in ℓ² over machine configurations; superposition of *control* +— of the reduction itself — is the object of study. qBLC's architecture +(`../quantum/architecture.md` §7) chose classical control to obtain +monotone positive operator approximants and to avoid an unresolved +quantum-halting semantics. Both benefits are recoverable inside quantum +control (§4: typed invariant-sector halting), so that choice is a +convenience rather than a necessity, and the objects it excludes — interference between reduction paths, real-valued halting mass, coherent -output operators — are exactly the ones worth measuring. +output operators — are exactly the ones this pillar exists to measure. -qALC is a separate pillar, not a revision: qBLC's objects, data, and docket -are untouched, and the verification contract (§7) requires bit-identical -classical and qBLC rows after any qALC work. +qALC is a separate pillar, not a revision: qBLC's objects, data, and +docket are untouched, and the verification contract (§7) requires +bit-identical classical and qBLC rows after any qALC work. ## 2. Target objects @@ -69,12 +52,13 @@ halted configurations: ``` Halting mass is the central softening: the classical fate column -{Halt, Diverge, Unknown} becomes a real number in [0,1] with exact monotone -lower approximants and certificate-driven upper brackets. A single program is -already an Ω-like object; every effect-free program (§6) has -`μ_p ∈ {0,1}` (the converse fails — HH is effectful with mass 1). A divergence certificate on a sector of the superposition bounds -`μ_p` from above, so the classical certificate machinery generalizes from -verdicts to intervals **[design]**. +{Halt, Diverge, Unknown} becomes a real number in [0,1] with exact +monotone lower approximants and certificate-driven upper brackets. A +single program is already an Ω-like object. Every effect-free program (§6) +has `μ_p ∈ {0,1}`; the converse fails — HH is effectful with mass 1. A +divergence certificate on a sector of the superposition bounds `μ_p` from +above, so the classical certificate machinery generalizes from verdicts to +intervals. The output object is an operator on ℓ² of closed normal forms over BLC ∪ {h, t}: @@ -84,11 +68,11 @@ BLC ∪ {h, t}: M = Σ_p 2^(−|p|) ρ_p, Tr M = Ω_qALC. ``` -`ρ_p(τ)` is Loewner-monotone in τ **[claim]** (§4.6), so the house -bracket discipline `M_known ⪯ M ⪯ M_known + ε I` carries over. Unlike -qBLC's number-superselected `M_Fock`, `M` can carry coherences *between -output terms*; §4.6 states exactly which branch pairs contribute -off-diagonal mass. +`ρ_p(τ)` is Loewner-monotone in τ (§4.6), so the house bracket discipline +`M_known ⪯ M ⪯ M_known + ε I` carries over. Unlike qBLC's +number-superselected `M_Fock`, `M` can carry coherences *between output +terms*; §4.6 states exactly which branch pairs contribute off-diagonal +mass. The Kraft accounting is unchanged from qBLC: `|p|` is the program's own prefix-free length, and the applied constants are invocation convention, @@ -99,14 +83,14 @@ not program bits. ### Language and invocation Programs are ordinary closed BLC terms — unchanged wire format, 1-indexed -de Bruijn, unchanged size identity. **The program syntax contains no quantum -constant**: `h` and `t` exist only as opaque values passed in by the -invocation `p h t`, so prefix-freeness and the Kraft sum are untouched by -construction, the same trick qBLC's signature uses. The two-lambda wrapper -`λh.λt. …` is an idiom, not a restriction. The application order `h` before -`t` matches the frozen qBLC signature's relative order; it must be frozen in -one place in code, with an order-pinning test, before any canonical data is -generated **[open: freeze pending, trivially two choices]**. +de Bruijn, unchanged size identity. **The program syntax contains no +quantum constant**: `h` and `t` exist only as opaque values passed in by +the invocation `p h t`, so prefix-freeness and the Kraft sum are untouched +by construction, the same trick qBLC's signature uses. The two-lambda +wrapper `λh.λt. …` is an idiom, not a restriction. The application order +`h` before `t` matches the frozen qBLC signature's relative order; it must +be frozen in one place in code, with an order-pinning test, before any +canonical data is generated. ### Canonical booleans and polarity @@ -116,8 +100,9 @@ generated **[open: freeze pending, trivially two choices]**. ``` Polarity matches the classical I/O convention and qBLC's `meas` outcome -convention: bit 0 is true. The computational basis of a qubit-like position -is {0̂, 1̂} by syntactic equality with these normal forms, nothing looser. +convention: bit 0 is true. The computational basis of a qubit-like +position is {0̂, 1̂} by syntactic equality with these normal forms, +nothing looser. ### δ-rules @@ -133,10 +118,10 @@ h 1̂ → (0̂ − 1̂)/√2 t 1̂ → ω·1̂, ω = exp(iπ/4) amplitude ring. A constant applied to a closed normal form that is not a canonical boolean is an error transition into the absorbing error sector (§4.4), not a stuck normal form. A constant applied to a non-normal -argument is not a redex; reduction continues inside the argument. A constant -applied to a rigid open variable remains neutral. An unapplied or partially -applied constant in normal position is an ordinary normal form and may -appear in outputs. +argument is not a redex; reduction continues inside the argument. A +constant applied to a rigid open variable remains neutral. An unapplied or +partially applied constant in normal position is an ordinary normal form +and may appear in outputs. ### No sums in syntax @@ -144,66 +129,67 @@ Formal superpositions never appear in program or term syntax. A runtime "superposition" is a weighted set of ordinary basis configurations; the calculus never rewrites a sum. `h`'s δ-rule is the only branching transition and `t`'s the only scalar transition; everything else is the -classical machine step extended linearly **[design]**. Consequently the -Lineal call-by-base question dissolves: there is never a superposed -*subterm* to substitute (§4.2). +classical machine step extended linearly. The Lineal call-by-base question +dissolves: there is never a superposed *subterm* to substitute (§4.2). ### Strategy -Reduction is leftmost-outermost strong normalization — the KN machine's -strategy — with δ-redexes and error transitions ranked among β-redexes by -position. The strategy is part of the machine's definition and therefore -part of the physics: a different strategy is a different `U` and different -canonical objects. Machine-relativity does not *dissolve* the algebraic-λ -non-confluence pathologies — it chooses one side of them: AIT objects are -defined relative to a fixed universal machine, this contract fixes one, and -the price is stated honestly: β/δ-convertibility is **not** a semantic -equality in qALC, and alternative reduction sequences are not equal — -only the machine's own sequence defines the objects **[design]**. One -consequence to state rather than hide: under normal order, -`(λx. f x x)(h 0̂)` duplicates the +Reduction is leftmost-outermost strong normalization — the KN strategy — +with δ-redexes and error transitions ranked among β-redexes by position. +The strategy is part of the machine's definition and therefore part of the +physics: a different strategy is a different `U` and different canonical +objects. Machine-relativity does not resolve the algebraic-λ +non-confluence pathologies; it chooses one side of them. AIT objects are +defined relative to a fixed universal machine, this contract fixes one, +and the price is stated plainly: β/δ-convertibility is **not** a semantic +equality in qALC, and alternative reduction sequences are not equal — only +the machine's own sequence defines the objects. One consequence stated +rather than hidden: under normal order, `(λx. f x x)(h 0̂)` duplicates the *unfired* gate application and yields two independent Hadamard instances. Duplication always copies syntax, never amplitude, so this is generator duplication, not cloning; branch-level fan-out of an already-fired outcome is written explicitly (e.g. `h b̂ A B` fires the gate at head position and -selects per branch). Both idioms are expressible; the strategy decides only -their default reading. +selects per branch). Both idioms are expressible; the strategy decides +only their default reading. ## 4. State space and dynamics ### 4.1 Configurations -The basis of the state space is **machine configurations** — term plus KN -control state (focus, spine stack) plus residual garbage registers (§4.5) -— not bare terms. Bare terms are too coarse: for a rigid context, the -sources `λf. f (h 0̂) 0̂` and `λf. f 0̂ (h 0̂)` are orthogonal, but their -images under a bare-term step overlap in the term `λf. f 0̂ 0̂`, so no -bare-term linear extension is an isometry **[claim, review-confirmed]**. - -Machine control separates *those* images, but the existing KN machine is not -the repair: ordinary KN control is irreversible. The variable transition -dereferences a closure and discards which variable/environment path selected -it — `focus Var(1), env [A]` and `focus Var(2), env [B, A]` step to the -identical configuration, and both are reachable, from `(λx.x) A` and -`(λy.(λx.y) B) A` **[review round 1, confirmed against the live machine]**. -And a frame that distinguishes two configurations during δ firing but later -unwinds to a common configuration has still lost orthogonality: an isometry -preserves inner products under every iterate, not just the first. So the -configuration basis belongs to a **new reversible abstract machine**, whose -transition table must have orthonormal columns as a checkable property; -the KN machine is its guide, not its substrate, and garbage is needed for -environment lookup, control unwinding, and readback collisions — not merely -for β substitution content. +The basis of the state space is **machine configurations** — term plus +control state plus residual garbage — not bare terms. Bare terms are too +coarse: for a rigid context, the sources `λf. f (h 0̂) 0̂` and +`λf. f 0̂ (h 0̂)` are orthogonal, but their images under a bare-term step +overlap in the term `λf. f 0̂ 0̂`, so no bare-term linear extension is an +isometry. + +The machine supplying these configurations is **not** the existing KN +machine: ordinary KN control is irreversible. Its variable transition +dereferences a closure and discards which variable/environment path +selected it — `focus Var(1), env [A]` and `focus Var(2), env [B, A]` step +to the identical configuration, and both are reachable, from `(λx.x) A` +and `(λy.(λx.y) B) A`. Nor can a frame that distinguishes two +configurations during δ firing later unwind to a common configuration +without losing orthogonality: an isometry preserves inner products under +every iterate, not just the first. The configuration basis therefore +belongs to a **new reversible abstract machine**, whose transition table +must have orthonormal columns as a checkable property; the KN machine is +its guide, not its substrate, and garbage is needed for environment +lookup, control unwinding, and readback collisions — not merely for β +substitution content. The candidate machine shape is sketched in +`machine.md`. ### 4.2 The step isometry `U` is the linear extension of the deterministic machine step: each basis configuration steps by its unique leftmost redex (β, δ, or error -transition), with `h` producing a two-branch superposition and `t` a phase. -`U` is required to be an isometry on the closed span of configurations -reachable from any `init(p)`; no extension to a unitary on all of ℓ² is -demanded, since every target object depends only on norms and sector -projections of reachable states **[design]**. +transition), with `h` producing a two-branch superposition and `t` a +phase. `U` is required to be an isometry on the closed span of +configurations reachable from any `init(p)`; no extension to a unitary on +all of ℓ² is demanded, since every target object depends only on norms, +sector projections, and partial traces of reachable states. A same-space +unitary extension would be needed only for a stronger physical- +realizability claim, which this pillar does not make. No-cloning is structural rather than enforced: amplitudes attach to whole configurations, never to subterms, so any duplication a β-step performs is @@ -211,18 +197,16 @@ syntax-copying within one branch — basis fan-out, the physically permitted copy. qBLC's entire handle/epoch apparatus has no qALC counterpart because the store it protected does not exist. -### 4.3 Halting: invariant sectors, not fixed points +### 4.3 Halting: typed invariant sectors, not fixed points -A configuration is *halted* when its term is in normal form and its control -is terminal. Halted configurations cannot be fixed points: if `U(x) = x` and -some arriving step also maps `c₁ → x` (every reachable halted state has -such a `c₁`, and `c₁ ≠ x` since its term or control differs), `U` is not -injective **[claim, review-confirmed]**. The clean general statement is via -the wandering subspace of `V = U|_S`: newly arriving halted amplitude -`a = P_S U r` lies in `S ⊖ V(S)`, hence `V^m a ⊥ V^n b` whenever `m ≠ n` -**[review round 1 formulation]**. +A configuration is *halted* when it carries the `Halt` constructor. Halted +configurations cannot be fixed points: if `U(x) = x` and some arriving +step also maps `c₁ → x` (every reachable halted state has such a `c₁`, +and `c₁ ≠ x`), `U` is not injective. The general structure is the +wandering subspace of `V = U|_S`: newly arriving halted amplitude +`a = P_S U r` lies in `S ⊖ V(S)`, hence `V^m a ⊥ V^n b` whenever `m ≠ n`. -**Normative halted dynamics [design].** Halt entry is typed with disjoint +**Normative halted dynamics.** Halt entry is typed with disjoint constructors so no unticked halted basis state exists — the final readback transition produces the halted form directly: @@ -232,208 +216,200 @@ Halt(nf, g, c, k) → Halt(nf, g, c, k+1) ``` `P_halt` contains only `Halt` states; once a history enters the halt -sector it only ticks, so there is no "halts twice along one history" -ambiguity. Halted evolution is +sector it only ticks, so no history halts twice. Halted evolution is `identity_output ⊗ identity_garbage ⊗ identity_terminal-control ⊗ -unilateral-shift_tick`, every branch entering at tick zero (common origin). -Invariance alone is deliberately not enough — a halt-sector unitary -rotating `|0̂⟩` toward `|+⟩` preserves halted mass while wrecking the -monotone reduced output of §4.6; the normative form is what makes §4.6 a -theorem. What mass monotonicity itself needs is only invariance, not -fixedness: - -**Lemma (monotone halting mass) [claim].** If `U` is an isometry and +unilateral-shift_tick`, every branch entering at tick zero (common +origin). Invariance alone is deliberately not enough — a halt-sector +unitary rotating `|0̂⟩` toward `|+⟩` preserves halted mass while wrecking +the monotone reduced output of §4.6; the normative form is what makes +§4.6 a theorem. What mass monotonicity itself needs is only invariance, +not fixedness: + +**Lemma (monotone halting mass).** If `U` is an isometry and `U(S) ⊆ S` for the halted subspace `S`, then `‖P_S U ψ‖ ≥ ‖P_S ψ‖`. *Sketch:* write `ψ = ψ_S + ψ_⊥`; `Uψ_S ∈ S`, and `⟨Uψ_S, P_S Uψ_⊥⟩ = ⟨Uψ_S, Uψ_⊥⟩ = ⟨ψ_S, ψ_⊥⟩ = 0`, so -`‖P_S Uψ‖² = ‖ψ_S‖² + ‖P_S Uψ_⊥‖²`. +`‖P_S Uψ‖² = ‖Uψ_S‖² + ‖P_S Uψ_⊥‖²`. This recovers exactly the monotone lower-semicomputable approximants that qBLC's classical-control decision was made to protect: `μ_p(τ)` is exact, -monotone, and computable at every finite τ, so `μ_p` and `Ω_qALC` are lower -semicomputable. +monotone, and computable at every finite τ, so `μ_p` and `Ω_qALC` are +lower semicomputable. ### 4.4 Error and stuck sectors -Species errors (a constant applied to a non-boolean canonical form) and any -other semantic error enter their own absorbing sectors with the same -invariance-plus-tick treatment. Norm is conserved globally: halted mass, -error mass, and still-running mass sum to exactly 1 at every finite τ. -`Unknown` and `Capacity` remain resource outcomes of a finite *run* — the -driver stopping — not machine states, matching the house taxonomy. +Species errors (a constant applied to a non-boolean canonical form) and +any other semantic error enter their own absorbing sectors with the same +typed invariance-plus-tick treatment, retaining the error kind and +offending closure as error garbage. Norm is conserved globally: halted +mass, error mass, and still-running mass sum to exactly 1 at every finite +τ. `Unknown` and `Capacity` remain resource outcomes of a finite *run* — +the driver stopping — not machine states, matching the house taxonomy. ### 4.5 Garbage, merging, and where the quantumness lives Two branches interfere only when they occupy the *same basis configuration at the same global time*. This makes the garbage discipline constitutive, -not cosmetic: under full logging — meaning an exact, ordered, collision-free +not cosmetic: under full logging — an exact, ordered, collision-free append-only history, `log′ = log · encode(step)` — two histories that ever differ can never regain identical logs, so no two distinct branches ever re-merge, every δ-branching decoheres immediately, `t`'s phases become observationally irrelevant, and qALC collapses into a probabilistic -λ-calculus with √2-shaped coins — quantum in name only -**[claim, review-confirmed for exactly this definition of full logging]**. -The entire quantum content of the design lives in the merge discipline. +λ-calculus with √2-shaped coins — quantum in name only. The entire +quantum content of the design lives in the merge discipline. Whatever residue restores injectivity is true garbage, and per §4.1 it is needed at environment lookup, control unwinding, and readback collisions, not merely at β substitution. An environment-machine formulation relocates much of it to binding-discard steps — erasure, where the irreversibility genuinely lives. The **minimal-garbage theorem** is this pillar's first -formal work item **[open, gating]**: define the reversible machine of §4.1 -as a concrete transition table, prove its columns orthonormal on the -reachable configuration graph, characterize the minimal residual garbage, -and prove the invariant-sector lemma in that machine. "Minimal" needs a -comparison class (review round 2): a global minimum over arbitrary -reversible realizations is unlikely to be canonical and may hide -undecidable semantic equivalence; the tractable statement is *local -minimality within a fixed machine representation* — residue must +formal work item: define the reversible machine of §4.1 as a concrete +transition table, prove its columns orthonormal on the reachable +configuration graph, characterize the minimal residual garbage, and prove +the invariant-sector lemma in that machine. "Minimal" here is *local +minimality within the fixed machine representation* — residue must distinguish exactly each classical predecessor fibre not already -orthogonalized by a quantum transition. The candidate machine shape — -environment/closure substrate, explicit zippers, transition-local -predecessor tags — is sketched pre-formally in `machine.md`. Until the +orthogonalized by a quantum transition. A global minimum over arbitrary +reversible realizations is not claimed: that comparison class is unlikely +to be canonical and may hide undecidable semantic equivalence. Until the machine exists, `U`, `μ_p`, and `M` are not defined objects, and everything downstream is conditional. -**Synchronization as convention [design].** Under the common-origin tick, -a branch's halting time is recorded in its tick offset: two branches +**Synchronization as convention.** Under the common-origin tick, a +branch's halting time is recorded in its tick offset: two branches reaching the same normal form at different times sit at different chain positions forever, so coherence between halting branches exists only at -equal halting time with equal residual garbage. Review round 1 corrected -this from a structural theorem to a convention, and round 2 corrected the -correction's nuance: injectivity alone does not force it, and a -time-homogeneous entry map may choose a fixed tick offset from the terminal -configuration alone — entering output `a` at label 0 and output `b` at -label `d` already permits unequal-time coherence whenever the offset -difference matches the arrival-time difference, with no timing information -encoded anywhere (the `b` chain simply has no reachable states below `d`). -Only *adaptively* aligning arbitrary arrivals would require the incoming -configuration to encode relative timing. qALC adopts the common origin -deliberately: it is Bernstein–Vazirani's synchronized-halting construction -made a machine convention (compare also the quantum control machine -synchronization constraint of Yuan–Villanyi–Carbin **[standard]**), it is -the natural choice, and it is load-bearing for §4.6. Revisit only if -unequal-time output coherence ever becomes a wanted object. +equal halting time with equal residual garbage. This is a convention, not +a consequence of injectivity: a time-homogeneous entry map may choose a +fixed tick offset from the terminal configuration alone — entering output +`a` at label 0 and output `b` at label `d` already permits unequal-time +coherence whenever the offset difference matches the arrival-time +difference, with no timing information encoded anywhere (the `b` chain +simply has no reachable states below `d`); only *adaptively* aligning +arbitrary arrivals would require the incoming configuration to encode +relative timing. qALC adopts the common origin deliberately: it is +Bernstein–Vazirani's synchronized-halting construction made a machine +convention (compare the quantum control machine synchronization +constraint of Yuan–Villanyi–Carbin), it is the natural choice, and it is +load-bearing for §4.6. Revisit only if unequal-time output coherence ever +becomes a wanted object. ### 4.6 Output coherence blocks Group halted branches by (halting time, residual garbage, terminal -control). Within a group, branches with different normal forms contribute a -coherent block `v v†` to `ρ_p`; across groups, contributions add -incoherently. *Given the normative halted dynamics of §4.3* — this is where +control). Within a group, branches with different normal forms contribute +a coherent block `v v†` to `ρ_p`; across groups, contributions add +incoherently. Given the normative halted dynamics of §4.3 — this is where it earns its keep — each block is constant once formed, groups persist -(equal-time branches keep equal tick counts forever), and a branch arriving -later belongs to a later group and cannot enlarge an earlier block, so -`ρ_p(τ)` is a sum of a growing set of fixed PSD blocks — Loewner-monotone -with limit `ρ_p` **[claim, review-confirmed under the normative form]**. Off-diagonal mass in `M` therefore comes exactly from -equal-time branch pairs with equal traced spectator state — equal residue -and terminal control, not necessarily *empty* residue: **coherence is -earned by uncomputation**, and the off-diagonal structure of `M` is a -record of which programs clean up after themselves. The output-convention question — what -beyond control, garbage, and tick is traced out, and whether any designated- -output alternative is worth defining — is explicitly parked **[open]**, -matching the same parked question in qBLC. +(equal-time branches keep equal tick counts forever), and a branch +arriving later belongs to a later group and cannot enlarge an earlier +block, so `ρ_p(τ)` is a sum of a growing set of fixed PSD blocks — +Loewner-monotone with limit `ρ_p`. Off-diagonal mass in `M` therefore +comes exactly from equal-time branch pairs with equal traced spectator +state — equal residue and terminal control, not necessarily *empty* +residue: **coherence is earned by uncomputation**, and the off-diagonal +structure of `M` is a record of which programs clean up after themselves. +What beyond control, garbage, and tick is traced out — and whether a +designated-output alternative is worth defining — is an explicit open +design question, matching the same open question in qBLC. ## 5. Exactness and resource model Amplitudes live in the qBLC scalar ring `ℤ[ω]/√2^d` unchanged; the `Dw` type, `ExactSum`, `K_CAP` capacity behavior, and checkpoint codecs are -reused as-is **[design]**. The engine never samples and never touches -floating point; f64 mirrors are display-only. +reused as-is. The engine never samples and never touches floating point; +f64 mirrors are display-only. The conservation battery *strengthens* from qBLC's inequality to an -equality: `‖ψ_τ‖² = 1` exactly at every transition, with all mass in typed -sectors. Budgets are typed as in qBLC: global transitions (the clock), -support size (branch count), and scalar magnitude (`K_CAP`); exhaustion -yields `Unknown`/`Capacity` resource outcomes distinct from semantic error -mass. Unbounded claims are stated as monotone brackets — `μ_p` by lower -approximants plus certificate upper bounds, `M` by Loewner brackets — never -as floating-point limits or finite-ring assertions about limits that need -not lie in the ring. +equality: `‖ψ_τ‖² = 1` exactly at every transition, with all mass in +typed sectors. Budgets are typed as in qBLC: global transitions (the +clock), support size (branch count), and scalar magnitude (`K_CAP`); +exhaustion yields `Unknown`/`Capacity` resource outcomes distinct from +semantic error mass. Unbounded claims are stated as monotone brackets — +`μ_p` by lower approximants plus certificate upper bounds, `M` by Loewner +brackets — never as floating-point limits or finite-ring assertions about +limits that need not lie in the ring. ## 6. Fragments -**Effect-free fragment.** Review round 1 broke the naive version of this -fragment: `λh.λt. h h` is a classical normal form, yet its invocation -reaches the species error `h h` without ever firing a boolean δ-rule — so -"never fires a δ" does not give fate identity with the bare program's -census row. The correct statement: a run of `p h t` is *effect-free* when -no transition ever consumes a constant — no δ fires and no error transition -involving a constant fires. Effect-free evolution proceeds on a single -basis path whose *term projection* follows the same leftmost redex sequence -as classical rigid-atom reduction of `p X₁ X₂` — possibly interleaved with -reversible administrative transitions (lookup, zipper moves, residue -management) that rigid-atom reduction does not have — and reaches the same -semantic fate. That is the skeleton semantics qBLC's trusted checker -already adjudicates, so conservativity is projected fate identity with -*rigid-atom reduction*, not with census rows; every effect-free program has +**Effect-free fragment.** A run of `p h t` is *effect-free* when no +transition ever consumes a constant — no δ fires and no error transition +involving a constant fires. ("Never fires a δ" alone is not enough: +`λh.λt. h h` is a classical normal form whose invocation reaches the +species error `h h` without firing any boolean δ-rule.) Effect-free +evolution proceeds on a single basis path whose *term projection* follows +the same leftmost redex sequence as classical rigid-atom reduction of +`p X₁ X₂` — possibly interleaved with reversible administrative +transitions (lookup, zipper moves, residue management) that rigid-atom +reduction does not have — and reaches the same semantic fate. That is the +skeleton semantics qBLC's trusted checker already adjudicates, so +conservativity is projected fate identity with *rigid-atom reduction*, +not with bare-program census rows; every effect-free program has `μ_p ∈ {0,1}`; and the qBLC skeleton machinery is the natural tool for -scoping the fragment **[design, repaired twice: round 1 fixed the -comparison object, round 2 weakened step-for-step to projected lockstep]**. +scoping the fragment. **h-only fragment.** Defined semantically: no reachable transition fires `t`. ("Never applies `t` in the text" is not plainly syntactic here — the constants arrive at invocation and can be passed through arbitrary higher-order plumbing; a conservative *syntactic* subset for conventional -two-lambda wrappers is worth naming separately for cheap census flagging.) -Amplitudes are real, in ℤ[1/√2]. Conjecture **[claim, definition from review round 1]**: call a -program *D-circuit-shaped for halting* when, in the unfolded history tree, -every history first entering the halt sector has fired exactly `D` -Hadamards; then every halting history has amplitude `±2^(−D/2)`, terminal -amplitudes are `n_c/2^(D/2)`, and the halting mass `Σ n_c²/2^D` is dyadic. -The witness reading is correspondingly narrow: a √2-irrational halting mass +two-lambda wrappers is worth naming separately for cheap census +flagging.) Amplitudes are real, in ℤ[1/√2]. Conjecture: call a program +*D-circuit-shaped for halting* when, in the unfolded history tree, every +history first entering the halt sector has fired exactly `D` Hadamards; +then every halting history has amplitude `±2^(−D/2)`, terminal amplitudes +are `n_c/2^(D/2)`, and the halting mass `Σ n_c²/2^D` is dyadic. The +witness reading is correspondingly narrow: a √2-irrational halting mass witnesses **coherent merging of histories with opposite Hadamard-count -parity** — not mere desynchronization (unequal depths ending in orthogonal -garbage stay dyadic, depths differing by an even number merge without √2 -terms, and irrational contributions can cancel in aggregate). This fragment -is the dyadicity campaign's natural sequel instrument: in full qALC, ω -already carries non-dyadicity, so the witness reading is fragment-relative. +parity** — not mere desynchronization (unequal depths ending in +orthogonal garbage stay dyadic, depths differing by an even number merge +without √2 terms, and irrational contributions can cancel in aggregate). +This fragment is the dyadicity campaign's natural sequel instrument: in +full qALC, ω already carries non-dyadicity, so the witness reading is +fragment-relative. **Universality.** Toffoli-class reversible operations are expressible as -pure λ-terms on Church-encoded data, and Shi–Aharonov make Toffoli+Hadamard -a universal gate set **[standard]** (real amplitudes; complex via the -standard rebit encoding), with `{h, t}` giving Clifford+T natively. But the -theorem is about *abstract clean gates*, and review round 1 named the gap: -a λ-term computing a reversible Boolean function generically realizes -`|x⟩ ↦ |F(x)⟩|g_x⟩` with input-dependent garbage under this machine, and -tracing `g_x` dephases exactly the superpositions universality needs. And -input-independent garbage is necessary but not sufficient under the -common-origin halt convention: input-dependent *running time* places -outputs at different tick ages and dephases them just as surely. What qALC -requires is a **clean coherent compilation theorem [open, gating]**: for a -single common transition count `T`, `U^T |x, clean⟩ = |F(x), g*, c*, 0⟩` -for every basis input `x` — same `T`, same residual garbage `g*`, same -terminal control `c*`, the intended amplitudes. Bennett -compute–copy–uncompute as a λ-idiom is the route, but its classical -discipline must be realized *and synchronized* inside the λ-machine; it is -not automatic. Until it is proved, universality is a target, not a -property, and the H–NOT–H witness (§7) is its smallest instance. A formal -statement of what universality means for qALC's objects — presumably a -Gács-style domination claim for `M` within an appropriate class — is also -unwritten **[open]**. +pure λ-terms on Church-encoded data, and Shi–Aharonov make +Toffoli+Hadamard a universal gate set (real amplitudes; complex via the +standard rebit encoding), with `{h, t}` giving Clifford+T natively. But +the theorem is about *abstract clean gates*: a λ-term computing a +reversible Boolean function generically realizes `|x⟩ ↦ |F(x)⟩|g_x⟩` +with input-dependent garbage under this machine, and tracing `g_x` +dephases exactly the superpositions universality needs. Input-independent +garbage is necessary but not sufficient under the common-origin halt +convention: input-dependent *running time* places outputs at different +tick ages and dephases them just as surely. What qALC requires is a +**clean coherent compilation theorem**: for a single common transition +count `T`, `U^T |x, clean⟩ = |F(x), g*, c*, 0⟩` for every basis input +`x` — same `T`, same residual garbage `g*`, same terminal control `c*`, +the intended amplitudes. Bennett compute–copy–uncompute as a λ-idiom is +the route, but its classical discipline must be realized *and +synchronized* inside the λ-machine; it is not automatic. Until it is +proved, universality is a target, not a property, and the H–NOT–H witness +(§7) is its smallest instance. A formal statement of what universality +means for qALC's objects — presumably a Gács-style domination claim for +`M` within an appropriate class — is also unwritten. ## 7. Planned engine stack and verification contract Planned module tree `blam::qalc`, drivers under a new `blam` subcommand -group; the reference evaluator represents `ψ_τ` as an exact sparse map from -configurations to `Dw` scalars and applies `U` transition by transition. +group; the reference evaluator represents `ψ_τ` as an exact sparse map +from configurations to `Dw` scalars and applies `U` transition by +transition. A fast engine, if the reference is too slow for a census, faces a *stricter* bar than qBLC lockstep — final fate/mass/support equality is -insufficient, because in qALC internal configurations and residue determine -future interference: the configuration algebra is semantic state, not -implementation detail **[review round 2]**. A fast engine must either -produce the identical exact sparse amplitude map over canonical -configurations at every transition, or come with an isometric intertwining +insufficient, because in qALC internal configurations and residue +determine future interference: the configuration algebra is semantic +state, not implementation detail. A fast engine must either produce the +identical exact sparse amplitude map over canonical configurations at +every transition, or come with an isometric intertwining `W U_ref = U_fast W` preserving the halt and error projections and the -output partial trace. (Hash-consing and representation tricks are fine -below that line; branch-dependent allocation identity is not — see -`machine.md`.) +output partial trace. Hash-consing and representation tricks are fine +below that line; branch-dependent allocation identity is not (see +`machine.md`). Two clauses are normative machine contract, not just test surface. First, -δ-steps are **clean δ fibres** (round 2's repair of the earlier -"garbage-transparent" wording, which presupposed `I_context` a real -machine cannot deliver): for every spectator configuration `κ`, +δ-steps are **clean δ fibres**: for every spectator configuration `κ`, ```text U |h, b, κ⟩ = Σ_b' H_b'b |b', J(κ)⟩ @@ -442,33 +418,33 @@ U |t, b, κ⟩ = ω^b |b, J(κ)⟩ with `J` one injective spectator transition, identical across input booleans and output branches, no residue depending on either, and fibres -for distinct `κ` having orthogonal images — a common δ-rule tag is harmless -(and may be needed to separate δ ranges from β ranges); what HH needs is -equal residue across the two H columns, not literally untouched context. -Second, halted dynamics has the §4.3 normative typed form. Every qALC -engine change must then satisfy: +for distinct `κ` having orthogonal images. A common δ-rule tag is +harmless, and may be needed to separate δ ranges from β ranges; what HH +needs is equal residue across the two H columns, not literally untouched +context. Second, halted dynamics has the §4.3 normative typed form. +Every qALC engine change must then satisfy: 1. `cargo test --release --all-features` and plain `cargo test --release`; 2. exact norm conservation (equality battery) on every tested program; -3. the monotonicity battery: `μ_p(τ)` nondecreasing, per transition, on the - full test range; +3. the monotonicity battery: `μ_p(τ)` nondecreasing, per transition, on + the full test range; 4. the orthonormal-columns battery: the transition table is column- orthonormal over the reachable configuration graph at small sizes (subsumes pairwise inner-product spot-checks); 5. effect-free conservativity: fates and masses identical to classical rigid-atom reduction of `p X₁ X₂` on the covered range (§6); -6. **the HH witness**: `h` twice on the same position halts with mass 1 on - `0̂` and mass 0 on `1̂` — destructive cancellation, separating quantum - semantics from the probabilistic degeneration (which yields the same - mass but a mixed output at (1/2, 1/2)); -7. **the H–NOT–H witness**: `h (NOT (h 0̂))` with `NOT` a pure λ-term halts - with mass 1 on `0̂` (HXH = Z on `|0⟩`) — HH alone certifies only local δ - coherence, and an engine could pass it while β garbage from any - interposed λ-term destroys every nontrivial coherent computation; this - witness is the smallest test that λ-computation between gates is +6. **the HH witness**: `h` twice on the same position halts with mass 1 + on `0̂` and mass 0 on `1̂` — destructive cancellation, separating + quantum semantics from the probabilistic degeneration (which yields + the same mass but a mixed output at (1/2, 1/2)); +7. **the H–NOT–H witness**: `h (NOT (h 0̂))` with `NOT` a pure λ-term + halts with mass 1 on `0̂` (HXH = Z on `|0⟩`) — HH alone certifies only + local δ coherence, and an engine could pass it while β garbage from + any interposed λ-term destroys every nontrivial coherent computation; + this witness is the smallest test that λ-computation between gates is coherence-transparent; and -8. bit-identical classical *and* qBLC rows: qALC must remain isolated from - both existing engines. +8. bit-identical classical *and* qBLC rows: qALC must remain isolated + from both existing engines. ## 8. Design decisions @@ -476,8 +452,8 @@ engine change must then satisfy: ℓ²(configurations), qubits are emergent boolean positions, and the qBLC store discipline has nothing to protect. - **`{h, t}` primitives:** Clifford+T ring native, scalar layer reused - wholesale; the satisfying h-only design is kept as a fragment instrument - rather than the primitive set. + wholesale; the satisfying h-only design is kept as a fragment + instrument rather than the primitive set. - **Classical syntax only:** programs are prefix-free bits; superposition is runtime-only. Anything else is a different (BvDL-flavored) research program with a broken size identity. @@ -488,49 +464,42 @@ engine change must then satisfy: natively reversible dynamics is attractive, but it merges branches differently and therefore defines *different objects* — if pursued, it is a separate pillar, never a drop-in engine for this one. -- **Invariant-sector halting with ticks, common origin:** fixed points are +- **Typed invariant-sector halting, common origin:** fixed points are incompatible with injectivity; invariance suffices for monotone mass; the common-origin tick and the normative halted form (§4.3) are chosen, not forced — they buy equal-time-only coherence and Loewner-monotone - outputs, and the injective unequal-time alternative is recorded and - declined. + outputs, and the injective unequal-time alternative (fixed + output-dependent entry offsets) is recorded and declined. - **Clean δ fibres:** gates act as `gate ⊗ J` with one injective - boolean-independent spectator transition (§7); branch-dependent δ residue - would kill even the HH witness. -- **Leftmost-outermost strong reduction:** the house strategy; the machine - is the definition — which *chooses one machine-relative reduction - sequence* rather than resolving algebraic-λ non-confluence, and - β/δ-convertibility is not a semantic equality here (§3). + boolean-independent spectator transition (§7); branch-dependent δ + residue would kill even the HH witness. +- **Leftmost-outermost strong reduction:** the house strategy; the + machine is the definition — which chooses one machine-relative + reduction sequence rather than resolving algebraic-λ non-confluence, + and β/δ-convertibility is not a semantic equality here (§3). - **Exactness:** ring arithmetic only, conservation as equality, brackets for every unbounded claim. -- **Name:** qALC, quantum algebraic lambda calculus — lineage-accurate: the - algebraic λ-calculus (Vaux; Ehrhard–Regnier) is exactly the calculus of - linear combinations of λ-terms, Lineal (Arrighi–Dowek) its - unitary-flavored cousin, and qALC is a machine-first quantum restriction - of that family. +- **Name:** qALC, quantum algebraic lambda calculus — lineage-accurate: + the algebraic λ-calculus (Vaux; Ehrhard–Regnier) is exactly the + calculus of linear combinations of λ-terms, Lineal (Arrighi–Dowek) its + unitary-flavored cousin, and qALC is a machine-first quantum + restriction of that family. -## 9. Open obligations +## 9. Boundaries and open obligations -1. **The reversible machine + minimal-garbage theorem** (§4.1, §4.5) — the - gating work item: a concrete transition table (environment/closure +1. **The reversible machine + minimal-garbage theorem** (§4.1, §4.5) — + the gating work item: a concrete transition table (environment/closure substrate per `machine.md`, KN-guided, not KN), orthonormal columns proved on the reachable graph, residual garbage locally minimal in the - predecessor-fibre sense, invariant-sector lemma proved in that machine. - `U`, `μ_p`, and `M` are undefined until this exists. -2. **Clean coherent compilation** (§6): λ-defined Toffoli-class terms with - input-independent garbage, terminal control, *and transition count* - under the machine of item 1; gating for any universality claim. + predecessor-fibre sense, invariant-sector lemma proved in that + machine. `U`, `μ_p`, and `M` are undefined until this exists. +2. **Clean coherent compilation** (§6): λ-defined Toffoli-class terms + with input-independent garbage, terminal control, *and transition + count* under the machine of item 1; gating for any universality claim. 3. Merge-discipline canonicity: is the minimal-garbage `U` unique in any useful sense, and what exactly is the class of programs whose branches re-merge (the "coherence is earned" economy made precise)? -4. D-circuit-shaped dyadicity in the h-only fragment (§6): review round 1 - proposed the definition — every history first entering the halt sector - fires exactly `D` Hadamards — under which halting masses are `Σ n_c²/2^D`, - dyadic; and sharpened the witness reading: a √2-irrational mass - specifically witnesses coherent merging of histories with opposite - Hadamard-count *parity*, not mere desynchronization (unequal depths with - orthogonal garbage stay dyadic; even-differing depths merge without √2 - terms; irrational contributions can cancel in aggregate). Statement and +4. D-circuit-shaped dyadicity in the h-only fragment (§6): statement and proof against the machine of item 1. 5. Universality/domination statement for `M` (§6), downstream of item 2. 6. Self-interpretation: interpretation slows branches, timing is physical @@ -539,23 +508,13 @@ engine change must then satisfy: exact-ring universal simulation exists at all is open. 7. Relations among Ω objects: `Ω_qALC` versus classical `Ω` and qBLC's `Ω_success` — inequalities, domination, or incomparability. -8. Reachability: which finitely-supported ring-valued unit vectors arise as - `ψ_τ` (small lemma, low priority). +8. Reachability: which finitely-supported ring-valued unit vectors arise + as `ψ_τ` (small lemma, low priority). 9. Signature order freeze (§3) before any canonical data. -10. Output convention (§4.6) — parked deliberately. - -**Ratification gates.** Round 1 gates: normative halted dynamics (§4.3), -clean-δ contract (§7), H–NOT–H witness (§7), corrected conservativity -fragment (§6) — all closed. Round 2 gates: fixed-offset synchronization -wording (§4.5), clean δ fibres replacing `gate ⊗ I_context` (§7), typed -`RunDone`/`Halt` entry (§4.3), projected semantic lockstep for the -effect-free fragment (§6), synchronized timing in clean compilation (§6), -exact transition-system equivalence for any fast engine (§7), and the -stale "dissolves" sentence (§8) — all closed in this revision. The open -gates are items 1 and 2 above — build the machine, prove clean -compilation; per round 2, the route ratified for exploration is the -canonical environment/closure reference machine of `machine.md` with -transition-local predecessor tags and no global-minimality claim. The +10. Output convention (§4.6) — deliberately open, mirroring qBLC. + +Items 1 and 2 gate implementation: no `src/qalc/` code before the machine +is formal and its witnesses computed by hand (`machine.md` §6). The scalar ring needs nothing — the unresolved object is the configuration algebra, not the amplitudes. @@ -566,15 +525,17 @@ extension, gates as constants), Vaux and Ehrhard–Regnier (algebraic λ-calculus; Taylor expansion as the canonical source of term sums), van Tonder (history-tracked unitary λ-reduction), Bernstein–Vazirani (QTM well-formedness and synchronized halting), Shi and Aharonov -(Toffoli+Hadamard universality), Yuan–Villanyi–Carbin (synchronization -limits of quantum control flow), Selinger–Valiron (the design point qBLC -occupies), Hasuo–Hoshino and Dal Lago–Faggian–Valiron–Yoshimizu (quantum -GoI and multitoken machines, for the parked alternative), -Bădescu–Panangaden (why quantum control plus recursion has no settled -semantics — the gap this pillar's measurements would inform). +(Toffoli+Hadamard universality), Bennett (reversible computation and +uncomputation), Yuan–Villanyi–Carbin (synchronization limits of quantum +control flow), Selinger–Valiron (the design point qBLC occupies), +Hasuo–Hoshino and Dal Lago–Faggian–Valiron–Yoshimizu (quantum GoI and +multitoken machines, for the parked alternative), Bădescu–Panangaden +(why quantum control plus recursion has no settled semantics — the gap +this pillar's measurements would inform). - Classical counterpart: `../classical/architecture.md` - Quantum-store counterpart: `../quantum/architecture.md` - Reference machine sketch (pre-formal): `machine.md` -- Moving state and docket: `../STATUS.md` (section pending ratification) +- Development history and review record: `../ledger/2026-08.md` +- Moving state and docket: `../STATUS.md` - Canonical evidence: none yet; `data/quantum-algebraic/` reserved. diff --git a/docs/quantum-algebraic/machine.md b/docs/quantum-algebraic/machine.md index 88f130e..bd91136 100644 --- a/docs/quantum-algebraic/machine.md +++ b/docs/quantum-algebraic/machine.md @@ -2,11 +2,10 @@ **Status: pre-formal.** This document captures the constructive shape of the reversible abstract machine that `architecture.md` §4.1 requires and -§9 item 1 gates on. Its origin is adversarial review round 2 (gaslamp -thread `qalc-architecture`, 2026-08-09), which both broke the hope that -the existing KN machine could serve and supplied this candidate route. It -is a design sketch to be formalized and then attacked — nothing here is a -contract yet, and the architecture document wins wherever they disagree. +§9 item 1 gates on. It is a design sketch to be formalized and then +attacked — nothing here is a contract yet, and the architecture document +wins wherever they disagree. Provenance and review history live in +`../ledger/2026-08.md`. ## 1. Substrate: environments, not substitution From 27f2c4b0099ffc2d2e1308d660d606139313c758 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 04:12:48 -0400 Subject: [PATCH 006/107] =?UTF-8?q?docs:=20qALC=20=E2=80=94=20repair=20the?= =?UTF-8?q?=20three=20round-3=20blockers?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit (1) Clean delta fibres are now gate-indexed: U|q,b,k> = sum (Q_q) |b', J_q(k)> with J_q+ J_r = delta_qr I and orthogonality against every non-delta range — a landing shared across gate kinds overlaps H and T columns at 1/sqrt2 despite orthogonal sources. machine.md section 6 now demands the full pairwise orthogonality matrix. (2) The sqrt2-witness claim is demoted to its correct finite-approximant form: nonzero sqrt2 coefficient in mu_p(tau) at finite tau implies an opposite-parity coherent merge at tau; the limit-level reading is false (halting on dyadic masses gated by the computable bits of 1/sqrt2 gives mu = 1/sqrt2 with zero merging) and needs finite-support or uniform-D hypotheses. (3) machine.md's configuration type is now closed under its own transitions (Run/RunDone/Halt/Error union) and (p, tau) are evaluator indices outside the semantic basis — uniform over every reachable support, so in-basis they distinguish nothing while timestamping every predecessor fibre; halted factorization stays tick-only. Nonblocking: STATUS date and full doc paths; ledger and section-1 phrasing no longer outrun the open clean-compilation theorem. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 11 ++--- docs/ledger/2026-08.md | 5 ++- docs/quantum-algebraic/architecture.md | 53 ++++++++++++++-------- docs/quantum-algebraic/machine.md | 61 +++++++++++++++----------- 4 files changed, 80 insertions(+), 50 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index a04342b..ca1d1ee 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -5,7 +5,7 @@ measurements, proof boundaries, and ordered next work. The root `README.md` is the stable public map; domain documents state durable contracts; the monthly ledger preserves chronology. -Last updated: 2026-08-07. +Last updated: 2026-08-09. ## Classical state @@ -413,10 +413,11 @@ The open docket, in order: 2. the reversible machine: formal transition table on the environment/closure substrate, orthonormal-columns proof, local predecessor-fibre garbage minimality, invariant-sector lemma, and the - HH / H–NOT–H witnesses computed by hand (`machine.md` §6) — gates all - implementation; -3. the clean coherent compilation theorem (architecture §6) — gates any - universality claim; + HH / H–NOT–H witnesses computed by hand + (`quantum-algebraic/machine.md` §6) — gates all implementation; +3. the clean coherent compilation theorem + (`quantum-algebraic/architecture.md` §6) — gates any universality + claim; 4. then `src/qalc/`: reference evaluator first, census later. ## Repository and release state diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index a746d10..758e385 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -1818,8 +1818,9 @@ design: **qALC** (quantum algebraic lambda calculus) — quantum *control*, storeless, Lineal-lineage. Programs stay classical prefix-free BLC bits; the runtime state is a vector in ℓ² over machine configurations; superposition enters only through `h`/`t` constants passed at invocation -(`p h t`), with all Toffoli-class classical structure absorbed into pure -λ-terms (Shi–Aharonov made structural — the signature shrinks from five +(`p h t`), with Toffoli-class classical structure intended to be +expressed as pure λ-terms (Shi–Aharonov made structural, conditional on +the clean-compilation theorem — the signature shrinks from five primitives to two, and the h-only fragment is one). Fate softens from {Halt, Diverge, Unknown} to a real halting mass with monotone exact lower approximants; certificates generalize to interval brackets. The contract diff --git a/docs/quantum-algebraic/architecture.md b/docs/quantum-algebraic/architecture.md index 8534f7e..795e062 100644 --- a/docs/quantum-algebraic/architecture.md +++ b/docs/quantum-algebraic/architecture.md @@ -27,9 +27,10 @@ is a vector in ℓ² over machine configurations; superposition of *control* — of the reduction itself — is the object of study. qBLC's architecture (`../quantum/architecture.md` §7) chose classical control to obtain monotone positive operator approximants and to avoid an unresolved -quantum-halting semantics. Both benefits are recoverable inside quantum -control (§4: typed invariant-sector halting), so that choice is a -convenience rather than a necessity, and the objects it excludes — +quantum-halting semantics. The construction here is designed to recover +both inside quantum control (§4: typed invariant-sector halting; +conditional on the machine of §9 item 1), which would make that choice a +convenience rather than a necessity. And the objects it excludes — interference between reduction paths, real-valued halting mass, coherent output operators — are exactly the ones this pillar exists to measure. @@ -357,12 +358,23 @@ flagging.) Amplitudes are real, in ℤ[1/√2]. Conjecture: call a program *D-circuit-shaped for halting* when, in the unfolded history tree, every history first entering the halt sector has fired exactly `D` Hadamards; then every halting history has amplitude `±2^(−D/2)`, terminal amplitudes -are `n_c/2^(D/2)`, and the halting mass `Σ n_c²/2^D` is dyadic. The -witness reading is correspondingly narrow: a √2-irrational halting mass -witnesses **coherent merging of histories with opposite Hadamard-count -parity** — not mere desynchronization (unequal depths ending in +are `n_c/2^(D/2)`, and the halting mass `Σ n_c²/2^D` is dyadic. + +The witness reading is a **finite-approximant statement**: if `μ_p(τ)` +has a nonzero `√2` coefficient at finite τ, then some basis configuration +at time τ coherently merges histories with opposite Hadamard-count parity +— a configuration receiving only one parity has amplitude either dyadic +or `√2 ×` dyadic, so its squared norm is dyadic, and a finite sum of +dyadics stays dyadic. It deliberately does **not** lift to the limit: an +irrational limit mass needs no merging at all — a program can halt on +dyadic branch masses `2^(−n)` gated by the computable binary digits of +`1/√2`, giving `μ_p = 1/√2` with every history orthogonal. That is the +same countably-many-dyadic-branches phenomenon qBLC's exactness contract +already records; a limit-level witness requires an additional +finite-support or uniform-`D` hypothesis. Nor does mere +desynchronization produce √2 terms at finite τ: unequal depths ending in orthogonal garbage stay dyadic, depths differing by an even number merge -without √2 terms, and irrational contributions can cancel in aggregate). +without √2 terms, and irrational contributions can cancel in aggregate. This fragment is the dyadicity campaign's natural sequel instrument: in full qALC, ω already carries non-dyadicity, so the witness reading is fragment-relative. @@ -409,17 +421,20 @@ below that line; branch-dependent allocation identity is not (see `machine.md`). Two clauses are normative machine contract, not just test surface. First, -δ-steps are **clean δ fibres**: for every spectator configuration `κ`, +δ-steps are **clean δ fibres, gate-indexed**: for every spectator +configuration `κ` and gate `q ∈ {h, t}`, ```text -U |h, b, κ⟩ = Σ_b' H_b'b |b', J(κ)⟩ -U |t, b, κ⟩ = ω^b |b, J(κ)⟩ +U |q, b, κ⟩ = Σ_b' (Q_q)_b'b |b', J_q(κ)⟩, Q_h = H, Q_t = diag(1, ω) ``` -with `J` one injective spectator transition, identical across input -booleans and output branches, no residue depending on either, and fibres -for distinct `κ` having orthogonal images. A common δ-rule tag is -harmless, and may be needed to separate δ ranges from β ranges; what HH +with each `J_q` one injective spectator transition, identical across +input booleans and output branches *within its gate fibre*, no residue +depending on either, landings jointly orthogonal across gate kinds — +`J_q† J_r = δ_qr I`, realizable as a gate-kind landing tag — and +orthogonal to the range of every non-δ transition column. A single +landing `J` shared by both gates is not sound: `U|h,0,κ⟩` and +`U|t,0,κ⟩` would overlap at `1/√2` despite orthogonal sources. What HH needs is equal residue across the two H columns, not literally untouched context. Second, halted dynamics has the §4.3 normative typed form. Every qALC engine change must then satisfy: @@ -470,9 +485,11 @@ Every qALC engine change must then satisfy: not forced — they buy equal-time-only coherence and Loewner-monotone outputs, and the injective unequal-time alternative (fixed output-dependent entry offsets) is recorded and declined. -- **Clean δ fibres:** gates act as `gate ⊗ J` with one injective - boolean-independent spectator transition (§7); branch-dependent δ - residue would kill even the HH witness. +- **Clean δ fibres:** gates act as `gate ⊗ J_q` with gate-indexed + injective boolean-independent landings, jointly orthogonal across gate + kinds and against every non-δ range (§7); branch-dependent δ residue + would kill even the HH witness, and a landing shared across gate kinds + would break isometry outright. - **Leftmost-outermost strong reduction:** the house strategy; the machine is the definition — which chooses one machine-relative reduction sequence rather than resolving algebraic-λ non-confluence, diff --git a/docs/quantum-algebraic/machine.md b/docs/quantum-algebraic/machine.md index bd91136..d1d5f99 100644 --- a/docs/quantum-algebraic/machine.md +++ b/docs/quantum-algebraic/machine.md @@ -31,27 +31,35 @@ genuinely different dynamics and stays parked per the architecture.) ## 2. Reference configuration +The semantic basis is a typed union closed under its own transitions — +`RunDone`, `Halt`, and the error chain are basis constructors, not modes, +so the architecture's §4.3/§4.4 transitions (`RunDone → Halt(…, 0)` and +the tick chains) are rows of the same table the running modes populate: + ```text -Cfg { - program_sector, // fixed p; common to every branch of one run - absolute_clock, // common τ, shifted every transition - mode, // Eval | Lookup | Quote | Return | Done - focus: Closure, - env_zipper, - continuation, - output_zipper, - residue, -} +Config = + Run(mode, focus: Closure, env_zipper, continuation, + output_zipper, residue) // mode: Eval | Lookup | Quote | Return + | RunDone(nf, g, terminal_control) + | Halt(nf, g, terminal_control, k) + | Error(kind, residue, k) ``` -The inert `(p, τ)` spectator labels are cheap and useful: retaining `p` -separates collisions between different programs (harmless — `M` already -sums programs incoherently), and the explicit `τ` separates configurations -reached at different global stages without distinguishing branches present -at the same stage. Both are common to every branch of one `ψ_τ`, so -neither destroys intended same-time interference — and neither repairs -collisions between branches of one program at one time; the transition -table itself must do that. +The program `p` and the global step count `τ` are **evaluator indices, +not basis components**. Both are uniform over the support of every +reachable `ψ_τ` — every branch of one run carries the same program and +the same global time — so in the basis they would distinguish nothing +within a run while timestamping every predecessor fibre. Keeping them out +keeps the local-minimality statement timeless and leaves the +architecture's halted factorization exactly +`id_output ⊗ id_garbage ⊗ id_terminal-control ⊗ shift_tick`, with no +absolute-clock factor. The alternative — `(p, τ)` in-basis as +superselection coordinates, suppressed in the displayed `ρ_p` formulas — +is observationally equivalent for every target object and is declined for +basis minimality; cross-program collisions need no in-basis `p`, since +`M` already sums programs incoherently. Neither choice repairs collisions +between branches of one program at one time; the transition table itself +must do that. ## 3. The central residue rule @@ -88,9 +96,9 @@ semantic equivalence. | Neutral spine / readback | Convert argument frames to normalization jobs; build output through a zipper | Preserve constructor/order in the zipper; never stream destructively into an external sink. | | Binding erasure | Drop an unused closure/environment cell | The erased closure enters residue unless already reconstructible; quantum-dependent erased data cannot be cleanly forgotten. | | Contraction / duplication | Reuse an immutable closure from multiple occurrence continuations | Environment sharing preferred — it preserves call-by-name re-evaluation without materializing substituted copies. Do **not** memoize: memoization changes generator-duplication semantics. | -| H / T δ | Clean δ fibre `gate ⊗ J` (architecture §7) | `J` may add a common rule tag; nothing may depend on the input or output boolean. | -| Species error | Enter the typed error chain | Retain error kind and offending closure as error garbage; output coherence is irrelevant there. | -| Terminalization | Unique `RunDone(…) → Halt(…, 0)` | Entry injective; all traced spectator state frozen thereafter. | +| H / T δ | Clean δ fibre `gate ⊗ J_q`, gate-indexed landings (architecture §7) | `J_q` may add a gate-kind landing tag; `J_h† J_t = 0`; nothing may depend on the input or output boolean. | +| Species error | Enter the typed error chain `Error(kind, residue, k)` | Retain error kind and offending closure as error garbage; output coherence is irrelevant there. | +| Terminalization | Unique `RunDone(…) → Halt(…, 0)` | Entry injective; output, garbage, and terminal control frozen thereafter — only the tick advances (architecture §4.3). | ## 5. Two load-bearing cautions @@ -107,10 +115,13 @@ semantic equivalence. In order, per the architecture's gates: -1. the full transition table over `Cfg`, total on reachable - configurations; -2. the orthonormal-columns proof (injectivity plus the clean-δ fibre - orthogonality) on the reachable graph; +1. the full transition table over `Config`, total on reachable + configurations — including the `RunDone`/`Halt`/`Error` rows; +2. the orthonormal-columns proof as a *full pairwise matrix* on the + reachable graph: deterministic against deterministic, same-gate δ + columns, H against T, δ against deterministic, and the sector-entry + and tick columns — not merely injectivity plus within-fibre δ + orthogonality; 3. the local-minimality statement for `residue` in the predecessor-fibre sense, with the pop conditions made precise; 4. the invariant-sector lemma instantiated in this machine From ea4abad0c2978a29893517f3aff62b9e2faaeeb4 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 04:17:35 -0400 Subject: [PATCH 007/107] =?UTF-8?q?docs:=20qALC=20contract=20frozen=20?= =?UTF-8?q?=E2=80=94=20round-4=20sign-off;=20two=20precision=20nits=20land?= =?UTF-8?q?ed?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Round 4 verdict on 27f2c4b: SIGN-OFF, all three round-3 blockers verified closed. Post-verdict nits incorporated: 'transition' pinned to one reference semantic U-step (microsteps unobservable; the displayed intertwiner is time-preserving and does not license a different semantic clock — a different cadence needs a clocked dilation W U_ref = U_fast^r W or a synchronized simulation preserving halt ages, a stronger theorem); machine.md scopes the in-basis (p, tau) equivalence claim to the passive superselection lift only. Ledger records rounds 3-4 and the freeze; STATUS drops the sign-off docket item and marks the contract frozen. Next lane: formalize the reversible machine per machine.md section 6. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 21 ++++++++++---------- docs/ledger/2026-08.md | 27 +++++++++++++++++++++++--- docs/quantum-algebraic/architecture.md | 13 ++++++++++--- docs/quantum-algebraic/machine.md | 10 +++++++--- 4 files changed, 51 insertions(+), 20 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index ca1d1ee..f652f6f 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -403,22 +403,21 @@ states in ℓ² over machine configurations, `h`/`t` constants at invocation, fate softened to a real halting mass `μ_p` with `Ω_qALC = Σ 2^(−|p|) μ_p`), with the pre-formal reversible-machine sketch in `quantum-algebraic/machine.md`. No engine, no data; -`data/quantum-algebraic/` is reserved. The contract has passed two rounds -of adversarial review on gaslamp thread `qalc-architecture` (history in -`ledger/2026-08.md`); a third full-sign-off pass gates formalization. +`data/quantum-algebraic/` is reserved. **The contract is frozen**: four +rounds of adversarial review on gaslamp thread `qalc-architecture` +concluded in a sign-off at `27f2c4b` (history in `ledger/2026-08.md`). The open docket, in order: -1. sign-off review of the harmonized contract (thread `qalc-architecture`); -2. the reversible machine: formal transition table on the - environment/closure substrate, orthonormal-columns proof, local - predecessor-fibre garbage minimality, invariant-sector lemma, and the - HH / H–NOT–H witnesses computed by hand - (`quantum-algebraic/machine.md` §6) — gates all implementation; -3. the clean coherent compilation theorem +1. the reversible machine: formal transition table on the + environment/closure substrate, orthonormal-columns proof (full + pairwise matrix), local predecessor-fibre garbage minimality, + invariant-sector lemma, and the HH / H–NOT–H witnesses computed by + hand (`quantum-algebraic/machine.md` §6) — gates all implementation; +2. the clean coherent compilation theorem (`quantum-algebraic/architecture.md` §6) — gates any universality claim; -4. then `src/qalc/`: reference evaluator first, census later. +3. then `src/qalc/`: reference evaluator first, census later. ## Repository and release state diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 758e385..1512ea5 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -1869,6 +1869,27 @@ transition table, orthonormal columns, local predecessor-fibre minimality) and prove clean coherent compilation. The scalar ring needs nothing — the unresolved object is the configuration algebra, not the amplitudes. Docs then harmonized to house current-only format (this -entry carries the history; the architecture states only the contract), -with a third full-sign-off review pass to follow before any -formalization work begins. +entry carries the history; the architecture states only the contract) in +`67af866`. + +**Round 3** (sign-off pass on the harmonized docs) verified the +harmonization faithful but BLOCKED on three formal gaps, each with a +countermodel: the clean H/T fibres shared one landing `J` and were not +jointly isometric (`⟨U(h,0,κ), U(t,0,κ)⟩ = 1/√2` on orthogonal +sources) — repaired gate-indexed with `J_q†J_r = δ_qr I`; the +√2-irrational-mass witness claim is false at the limit level (halt on +dyadic branch masses gated by the computable binary digits of `1/√2`: +`μ_p = 1/√2` with every history orthogonal, zero merging) — demoted to +the correct finite-approximant statement; and `machine.md`'s +configuration type was not closed under its own transitions, with +`(p, τ)` spectators contradicting the frozen-spectator audit — +repaired as the typed `Run | RunDone | Halt | Error` union with +`(p, τ)` as evaluator indices outside the semantic basis. Repairs in +`27f2c4b`. **Round 4: SIGN-OFF** at `27f2c4b`, plus two precision nits +landed after the verdict ("transition" = one reference semantic +`U`-step, the intertwiner does not license a different semantic clock; +only the *passive* superselection lift of the timeless machine is +claimed observationally equivalent). **The qALC architecture contract +is frozen**; the next lane is formalizing the reversible machine per +`quantum-algebraic/machine.md` §6, with the thread reconvening on the +formal transition table. diff --git a/docs/quantum-algebraic/architecture.md b/docs/quantum-algebraic/architecture.md index 795e062..1e0132f 100644 --- a/docs/quantum-algebraic/architecture.md +++ b/docs/quantum-algebraic/architecture.md @@ -416,9 +416,16 @@ state, not implementation detail. A fast engine must either produce the identical exact sparse amplitude map over canonical configurations at every transition, or come with an isometric intertwining `W U_ref = U_fast W` preserving the halt and error projections and the -output partial trace. Hash-consing and representation tricks are fine -below that line; branch-dependent allocation identity is not (see -`machine.md`). +output partial trace. "Transition" throughout means one reference +semantic `U`-step: implementation microsteps are unobservable and +unconstrained, and the displayed intertwiner is time-preserving — it +does not license a different semantic clock. An engine with a genuinely +different semantic cadence needs a clocked dilation +(`W U_ref = U_fast^r W`) or a synchronized simulation relation +preserving halt ages and output traces — a stronger theorem than this +contract grants, since timing is physical here (§4.5). Hash-consing and +representation tricks are fine below that line; branch-dependent +allocation identity is not (see `machine.md`). Two clauses are normative machine contract, not just test surface. First, δ-steps are **clean δ fibres, gate-indexed**: for every spectator diff --git a/docs/quantum-algebraic/machine.md b/docs/quantum-algebraic/machine.md index d1d5f99..b84f005 100644 --- a/docs/quantum-algebraic/machine.md +++ b/docs/quantum-algebraic/machine.md @@ -55,9 +55,13 @@ architecture's halted factorization exactly `id_output ⊗ id_garbage ⊗ id_terminal-control ⊗ shift_tick`, with no absolute-clock factor. The alternative — `(p, τ)` in-basis as superselection coordinates, suppressed in the displayed `ρ_p` formulas — -is observationally equivalent for every target object and is declined for -basis minimality; cross-program collisions need no in-basis `p`, since -`M` already sums programs incoherently. Neither choice repairs collisions +is declined for basis minimality. Only the *passive* superselection lift +(`U′ = shift_τ ⊗ U`, same table, same residue) is observationally +equivalent for every target object; a separately re-minimized in-basis +machine is not claimed equivalent, since `(p, τ)` would separate +predecessor fibres and less residue can change later interference. +Cross-program collisions need no in-basis `p`, since `M` already sums +programs incoherently. Neither choice repairs collisions between branches of one program at one time; the transition table itself must do that. From de08c12a9078a1d08bff3e57ff6d7a505fdebb70 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 04:29:06 -0400 Subject: [PATCH 008/107] =?UTF-8?q?docs:=20qALC=20machine=20=E2=80=94=20fo?= =?UTF-8?q?rmal=20draft=20v0=20with=20transition=20table=20and=20witness?= =?UTF-8?q?=20forcing?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit machine.md rewritten from sketch to formal draft: full syntax (terms, NFs, closures with canonical trimming, levels, frames, residue tags, typed Config), the complete transition table (descent/binding, charged lookup rows with Look(i, env-with-hole) tags, constants, readback, clean delta fibres with rule-indexed content-free landing tags, species errors, terminal rows), reachability invariants I1-I5, per-rule inverses, and the backward-determinism framework with the clean range-disjointness pairs proved and the lookup-family crux isolated. Two findings from hand-computing the witnesses: (1) forcing theorem — any machine with permanent lookup residue fails the contract's H-NOT-H witness (the selection tag retains the unselected alternative, which no local pop can erase), so coherent popping is a correctness requirement, not an optimization; HH passes given the A6' boolean short-circuit. (2) linearity observation — with the linear NOT (lb.lx.ly. b y x) the selection tag is bijective with the returned NF in its frame, so a pop-at-Ret discipline restores coherence exactly for non-discarding terms: erasure costs coherence, Landauer surfacing as decoherence. Open crux: a forward+backward-deterministic pop schedule. Contract implication flagged: witness 7 should specify the linear NOT, or needs amendment via the review thread. Co-Authored-By: Claude Fable 5 --- docs/quantum-algebraic/machine.md | 466 +++++++++++++++++++++--------- 1 file changed, 334 insertions(+), 132 deletions(-) diff --git a/docs/quantum-algebraic/machine.md b/docs/quantum-algebraic/machine.md index b84f005..24b10e3 100644 --- a/docs/quantum-algebraic/machine.md +++ b/docs/quantum-algebraic/machine.md @@ -1,140 +1,342 @@ -# qALC reference machine sketch - -**Status: pre-formal.** This document captures the constructive shape of -the reversible abstract machine that `architecture.md` §4.1 requires and -§9 item 1 gates on. It is a design sketch to be formalized and then -attacked — nothing here is a contract yet, and the architecture document -wins wherever they disagree. Provenance and review history live in -`../ledger/2026-08.md`. - -## 1. Substrate: environments, not substitution - -A substitution step `(λb) a → b[a]` forgets the redex boundary, the -original binder, the occurrence map, and — under weakening — the erased -argument. Inverting it can require essentially the whole redex, and -duplication can make the residue larger than the destination. An explicit -environment/closure machine turns β mostly into reversible rearrangement: - -- the body remains immutable code; -- the argument remains an explicit closure; -- binding is a persistent cons cell; -- application context remains a frame; -- lookup irreversibility is exposed at one named transition; -- erasure is exposed exactly where a cell becomes unreachable. - -That is the right surface for the local-minimality theorem: each source of -irreversibility is one named transition, not a diffuse property of a -substitution relation. (Environment machines as the standard bridge from -explicit substitutions to Krivine-style execution: Biernacka–Danvy. The -reversible interaction-machine alternative — Danos–Regnier — is a -genuinely different dynamics and stays parked per the architecture.) - -## 2. Reference configuration - -The semantic basis is a typed union closed under its own transitions — -`RunDone`, `Halt`, and the error chain are basis constructors, not modes, -so the architecture's §4.3/§4.4 transitions (`RunDone → Halt(…, 0)` and -the tick chains) are rows of the same table the running modes populate: +# qALC reference machine — formal draft v0 + +**Status: formal draft, under adversarial review.** This document +supersedes the pre-formal sketch (git history; provenance in +`../ledger/2026-08.md`) and is the working object for +`architecture.md` §9 item 1. Sections marked **[open]** are stated +obligations, not results. The architecture contract wins wherever they +disagree. + +Two findings made during this formalization stand out and are flagged +inline: the **witness-forcing analysis** (§5 — permanent lookup residue +makes the contract's H–NOT–H witness fail, so coherent popping is +load-bearing, not optional) and the **linearity observation** (§5.3 — the +coherent NOT is the linear λ-term; discarding selectors decohere by +exactly their erased content). + +## 1. Syntax + +### Terms and normal forms + +```text +T ::= Var(i) | Lam(T) | App(T, T) | h | t (i ≥ 1, 1-indexed) +NF ::= Lam(NF) | Neu +Neu ::= Var(i) | h | t | App(Neu, NF) +``` + +Source programs contain no `h`/`t`; the constants enter only through +`init(p) = App(App(p, h), t)`. Canonical booleans: `0̂ = Lam(Lam(Var 2))`, +`1̂ = Lam(Lam(Var 1))`. + +### Closures, environments, levels + +```text +Bind ::= Clo(T, Env) | Level(l) (l ≥ 1, binder depth) +Env ::= [Bind, …] (index 1 = innermost) +``` + +**Canonical-closure discipline**: closures are structural values — +no allocation identity — and every constructed closure is trimmed to the +free-variable support of its term (a closed term's closure is +`Clo(T, ∅)`; in particular constants and canonical booleans always carry +the empty environment). Trimming at construction is not an erasure step: +the discarded entries were never part of the closure's identity. + +### Frames, residue, configurations + +```text +Frame ::= Arg(Clo) — pending call-by-name argument + | LamK — readback re-entry for one binder + | AppK(Neu) — spine head held while an argument normalizes + | Try_h | Try_t — δ-argument normalization in flight + +Res ::= Look(i, Env∖i) — lookup tag: index and origin env with hole + | Jh | Jt | Jn_h | Jn_t — δ landing tags (rule-indexed, content-free) + | … — further tags only as §4 forces them + +Config ::= + Run(mode, S: [Frame], m: depth, R: [Res]) + where mode ::= Eval(Clo) | Ret(NF) + | RunDone(nf: NF, R, c: TermCtl) + | Halt(nf, R, c, k) + | Error(kind, R, k) +``` + +`(p, τ)` are evaluator indices, not basis components (architecture §4.2, +machine choice ratified in review). `TermCtl` is the terminal control +value — for this table the constant `⊥` (the empty stack at depth 0), +retained explicitly per the architecture's halted factorization. + +## 2. The transition table + +Deterministic rows are basis-to-basis; the two δ rows carry the clean +gate fibres. `top(S) ∉ Arg` abbreviates "S is empty or its head is not an +`Arg` frame". + +### Descent and binding + +```text +A1 Eval⟨(App f a, e)⟩ | S → Eval⟨(f, e)⟩ | Arg(Clo(a,e))::S +A2 Eval⟨(Lam b, e)⟩ | Arg(c)::S → Eval⟨(b, c::e)⟩ | S +A3 Eval⟨(Lam b, e)⟩ | S, top∉Arg → Eval⟨(b, Level(m+1)::e)⟩ | LamK::S [m → m+1] +``` + +### Lookup (the charged rows) + +```text +A4 Eval⟨(Var i, e)⟩ | S, e[i]=Clo c → Eval⟨c⟩ | S [R → R·Look(i, e∖i)] +A5 Eval⟨(Var i, e)⟩ | S, e[i]=Level l → Ret⟨Var(m−l+1)⟩ | S + [R → R·Look(i, e∖i)] +``` + +### Constants + +```text +A6 Eval⟨(g, ∅)⟩ | Arg(c)::S, g∈{h,t} → Eval⟨c⟩ | Try_g::S +A7 Eval⟨(g, ∅)⟩ | S, top∉Arg → Ret⟨g⟩ | S +``` + +### Readback ```text -Config = - Run(mode, focus: Closure, env_zipper, continuation, - output_zipper, residue) // mode: Eval | Lookup | Quote | Return - | RunDone(nf, g, terminal_control) - | Halt(nf, g, terminal_control, k) - | Error(kind, residue, k) +R1 Ret⟨n⟩ | LamK::S → Ret⟨Lam n⟩ | S [m → m−1] +R2 Ret⟨n⟩ | Arg(c)::S, n neutral → Eval⟨c⟩ | AppK(n)::S +R3 Ret⟨n'⟩ | AppK(n)::S → Ret⟨App n n'⟩ | S ``` -The program `p` and the global step count `τ` are **evaluator indices, -not basis components**. Both are uniform over the support of every -reachable `ψ_τ` — every branch of one run carries the same program and -the same global time — so in the basis they would distinguish nothing -within a run while timestamping every predecessor fibre. Keeping them out -keeps the local-minimality statement timeless and leaves the -architecture's halted factorization exactly -`id_output ⊗ id_garbage ⊗ id_terminal-control ⊗ shift_tick`, with no -absolute-clock factor. The alternative — `(p, τ)` in-basis as -superselection coordinates, suppressed in the displayed `ρ_p` formulas — -is declined for basis minimality. Only the *passive* superselection lift -(`U′ = shift_τ ⊗ U`, same table, same residue) is observationally -equivalent for every target object; a separately re-minimized in-basis -machine is not claimed equivalent, since `(p, τ)` would separate -predecessor fibres and less residue can change later interference. -Cross-program collisions need no in-basis `p`, since `M` already sums -programs incoherently. Neither choice repairs collisions -between branches of one program at one time; the transition table itself -must do that. - -## 3. The central residue rule - -> For a deterministic target configuration `d`, every predecessor not -> already made orthogonal by a quantum transition requires an orthogonal -> residue label. Such a label may later be popped only when the live -> configuration reconstructs it uniquely. - -Reversible push/pop pair: +### δ fibres and species errors + +```text +D1 Ret⟨0̂⟩ | Try_h::S → (1/√2)·( Eval⟨(0̂,∅)⟩|S + Eval⟨(1̂,∅)⟩|S ) [R·Jh] + Ret⟨1̂⟩ | Try_h::S → (1/√2)·( Eval⟨(0̂,∅)⟩|S − Eval⟨(1̂,∅)⟩|S ) [R·Jh] +D2 Ret⟨0̂⟩ | Try_t::S → Eval⟨(0̂,∅)⟩ | S [R·Jt] + Ret⟨1̂⟩ | Try_t::S → ω · Eval⟨(1̂,∅)⟩ | S [R·Jt] +D3 Ret⟨n⟩ | Try_g::S, n neutral → Ret⟨App g n⟩ | S [R·Jn_g] +E1 Ret⟨n⟩ | Try_g::S, n closed NF, n∉{0̂,1̂} + → Error(Species(g), R·⟨g,n⟩, 0) +``` + +`Jh`, `Jt`, `Jn_h`, `Jn_t` are rule-indexed and content-free: the two +outcomes of one `D1` firing receive the *same* tag, which is the clean +δ-fibre requirement — the landing `J_q` is one injective spectator +transition per gate, independent of input and output boolean, and the +distinct tags realize `J_q† J_r = δ_qr I` and orthogonality against the +neutral row. + +### Terminal sectors ```text -(c, g) → (d, g · predecessor_tag(c)) -(d', g · tag) → (e, g) // only when d' itself determines tag +F1 Ret⟨n⟩ | ∅, m = 0 → RunDone(n, R, ⊥) +F2 RunDone(n, R, c) → Halt(n, R, c, 0) +F3 Halt(n, R, c, k) → Halt(n, R, c, k+1) +F4 Error(kind, R, k) → Error(kind, R, k+1) ``` -Appending tags forever is the probabilistic degeneration -(`architecture.md` §4.5); coherent popping is the economy qALC exists to -measure. "Minimal garbage" is claimed only in the local sense: within this -machine representation, residue must distinguish exactly each classical -predecessor fibre not already orthogonalized by a quantum transition. No -global-minimality claim over arbitrary reversible realizations is made — -that comparison class is unlikely to be canonical and may hide undecidable -semantic equivalence. - -## 4. Transition audit (candidate table) - -| Transition | Reversible shape | Residue requirement | -|---|---|---| -| Application descent | `Eval(App(f,a), e, K) ↔ Eval(f, e, Arg(a,e)::K)` | Usually none: the argument frame reconstructs the source. | -| β / binder entry | Move the argument closure into a persistent environment cell, enter the body | Potentially none locally, but only if the landing mode/range has a unique inverse; otherwise retain a β landing tag until it can be coherently popped. | -| Environment traversal | Move cells between sides of an environment zipper one at a time | None while the zipper stays live. | -| Variable dereference | `Lookup(i, origin-env, zipper)` enters the selected closure | Must retain the selecting index/origin path (or an equivalent predecessor-fibre label). This is exactly where round 1's KN Var witness bites. | -| Lambda under readback | Push `LamEnd`, add a rigid-level environment cell, extend the output zipper | Normally reversible from frame, cell, and zipper. | -| Neutral spine / readback | Convert argument frames to normalization jobs; build output through a zipper | Preserve constructor/order in the zipper; never stream destructively into an external sink. | -| Binding erasure | Drop an unused closure/environment cell | The erased closure enters residue unless already reconstructible; quantum-dependent erased data cannot be cleanly forgotten. | -| Contraction / duplication | Reuse an immutable closure from multiple occurrence continuations | Environment sharing preferred — it preserves call-by-name re-evaluation without materializing substituted copies. Do **not** memoize: memoization changes generator-duplication semantics. | -| H / T δ | Clean δ fibre `gate ⊗ J_q`, gate-indexed landings (architecture §7) | `J_q` may add a gate-kind landing tag; `J_h† J_t = 0`; nothing may depend on the input or output boolean. | -| Species error | Enter the typed error chain `Error(kind, residue, k)` | Retain error kind and offending closure as error garbage; output coherence is irrelevant there. | -| Terminalization | Unique `RunDone(…) → Halt(…, 0)` | Entry injective; output, garbage, and terminal control frozen thereafter — only the tick advances (architecture §4.3). | - -## 5. Two load-bearing cautions - -1. **No allocation identity in the basis.** Fresh heap addresses would - distinguish otherwise-identical branches forever and silently decohere - everything. The reference machine needs structural/canonical immutable - closures and environments; a fast engine may hash-cons them, but - branch-dependent allocation order must never become semantic identity. -2. **No destructive output sink.** The current KN machine streams - constructors and pops frames; a reversible reference needs an explicit - output zipper whose state participates in the inverse transition. - -## 6. What formalization must produce - -In order, per the architecture's gates: - -1. the full transition table over `Config`, total on reachable - configurations — including the `RunDone`/`Halt`/`Error` rows; -2. the orthonormal-columns proof as a *full pairwise matrix* on the - reachable graph: deterministic against deterministic, same-gate δ - columns, H against T, δ against deterministic, and the sector-entry - and tick columns — not merely injectivity plus within-fibre δ - orthogonality; -3. the local-minimality statement for `residue` in the predecessor-fibre - sense, with the pop conditions made precise; -4. the invariant-sector lemma instantiated in this machine - (`RunDone`/`Halt` typing, common-origin entry); -5. the effect-free projection lemma: term-projection of an effect-free run - follows rigid-atom leftmost reduction modulo the administrative - transitions, same fate; -6. the HH and H–NOT–H witnesses computed by hand in the formal machine — - before any code exists. - -Then the sketch goes back to the review thread as a formal object, and -only after that does `src/qalc/` get its first line. +## 3. Reachability invariants + +The range-disjointness proofs of §4 are relative to the reachable set, +and these invariants carry them: + +- **I1**: `Ret⟨Lam n⟩` never meets an `Arg` frame (a Lam over a pending + argument would have fired A2 earlier under this strategy). +- **I2**: `Level(l)` occurs in a reachable environment only with + `l ≤ m`, and the entries of any environment's Level-set are exactly + the currently open binders above the closure's capture point. +- **I3**: constants and canonical booleans always appear as `Clo(·, ∅)` + (canonical-closure discipline). +- **I4**: `Try_g` frames appear only above the evaluation of a δ + argument; at most one `Ret` is in flight. +- **I5**: depth `m` equals the number of `LamK` frames in `S`. + +**[open]** I1–I5 need induction proofs over the table once the residue +discipline of §4 is fixed; none is expected to be delicate. + +## 4. The reversibility framework + +**Definition (backward determinism).** A function +`φ : Reach → Rule ∪ {init}` assigning to every reachable configuration +the unique rule that produced it. `U` is an isometry on the reachable +span iff (a) each rule is injective on its domain, (b) rule ranges are +pairwise disjoint on `Reach` (`φ` well-defined), and (c) the δ fibres are +internally orthonormal and orthogonal to every other range. The +orthonormal-columns battery is the finite-range check of exactly this. + +Per-rule inverses (giving (a)) are immediate from the table: + +- A1⁻¹ re-forms `App` from focus and the `Arg` frame (their shared + environment is part of A1's range condition); +- A2⁻¹ pops the environment head back into an `Arg` frame; +- A3⁻¹ / R1⁻¹ are inverse to each other's shape by I5; +- A4⁻¹/A5⁻¹ plug the focus (resp. the emitted variable) back into the + hole of the `Look` tag — this is why the tag carries `(i, e∖i)`; +- R2⁻¹/R3⁻¹ re-form the spine state; D-rows and E1 are injective by the + tags; F-rows by the typed constructors. + +**(b) is the substantive obligation.** The clean pairs are separated by +mode, top frame, and the invariants (examples: A2-range has `Clo` at the +environment head where A3-range has `Level(m)` — disjoint by I2; R1/R3 +ranges are separated by the returned NF's outer constructor plus I1). +The hard family is everything whose range lands in an unconstrained +`Eval` configuration: **A4 against A1/A2/A6/D1/D2** — a dereferenced +closure can look like anything. The `Look` tag does not by itself +separate these ranges (an A1 source whose stale residue happens to end +in a `Look` collides with a fresh A4 target), so the discipline is: + +> **Residue-freshness invariant [open]**: the table is arranged so that +> for reachable configurations, whether the residue head was written by +> the producing step is determined by the configuration shape. The +> candidate mechanism is a one-bit `fresh` flag on `Run` set by charged +> rows (A4, A5, D·, E1) and cleared by the first uncharged row after — +> with the flag's own overwrite made lawful by the *pop schedule* below. + +**[open]** This is the crux of item 1 and the first thing the review +should attack; §5 shows the pop schedule is forced independently, so the +freshness mechanism and the pop schedule must be designed together. + +**Local minimality** is then the statement: `Look(i, e∖i)` is exactly +the predecessor-fibre content for A4/A5 (the round-1 KN witness shows +`i` and the origin environment are genuinely lost without it), the +δ tags are exactly the fibre separators, and no uncharged row retains +anything — each of its predecessor fibres is a singleton by (b). + +## 5. The witness-forcing analysis + +### 5.1 HH passes on this table + +Hand computation of `h (h 0̂)` (= `App(h, App(h, 0̂))` after invocation +plumbing; the outer `t`-abstraction is administrative and shared): + +all steps through the inner δ are common to both branches — A1, A6 +(outer `h`), A1, A6 (inner `h`), A3·A3·A5·R1·R1 normalizing the literal +`0̂` (one `Look` tag, *common*), then `D1` branches with the shared `Jh` +tag. Each branch's boolean lands as `Ret`-adjacent `Eval⟨(b̂,∅)⟩` under +the outer `Try_h`; it is already a normal form, and its renormalization +(A3·A3·A5·R1·R1) writes `Look` tags whose content is +*branch-independent* — `0̂` and `1̂` share the index-to-hole shape only +when… **it is not branch-independent**: `0̂` looks up `Var 2`, `1̂` looks +up `Var 1`, so the second `Look` tags differ, and naively HH decoheres +too. The repair is already in the table: `D1`'s outcomes re-enter as +`Eval⟨(b̂,∅)⟩` — and a returned δ *value is already an NF*, so the table +must (and here does) route it back to the waiting `Try` frame without +renormalization when the outer frame is `Try_g`: + +```text +A6′ Eval⟨(b̂,∅)⟩ | Try_g::S → Ret⟨b̂⟩ | Try_g::S [no tags] +``` + +**[open]** A6′ as stated is a recognition rule (boolean-valued focus +short-circuits to `Ret`); its range/injectivity interplay with A3 needs +the §4 treatment, and its generalization (any NF-valued closure +short-circuits) is a design choice with real consequences — as stated +it is deliberately minimal: booleans under `Try` only. With A6′, both +HH branches write no post-branch `Look` tags, residues stay equal, the +outer `D1` fires per branch with the common `Jh`, and the `1̂` +amplitudes cancel: final state `|0̂⟩` at mass 1. **HH passes, and the +δ tags' content-freeness plus A6′ are exactly what it needed.** + +### 5.2 Permanent lookup residue fails H–NOT–H — the forcing theorem + +Take `NOT := λb. b 1̂ 0̂` (the selector) and run +`h (NOT (h 0̂))`. After the inner δ, the branches carry `b̂ = 0̂` / `1̂` +and equal residue `R₀`. Evaluating `NOT b̂`: A1·A1·A2 bind `b`, then A4 +looks up `b` — tag `Look(1, [_])`, *equal* across branches (the hole +excludes the differing entry). The boolean then consumes the two +argument closures — A2·A2 with environment `[Clo(0̂,∅), Clo(1̂,∅)]` +equal across branches by I3 — and then the selection fires: + +```text +branch 0̂: A4 on Var 2 → tag Look(2, [Clo(0̂,∅), _]) +branch 1̂: A4 on Var 1 → tag Look(1, [_, Clo(1̂,∅)]) +``` + +The tags differ in both hole position and retained content, and the +retained content is the **unselected alternative**. No local pop can +erase them: the pop-legality condition (the post-pop configuration +determines the tag) fails, because after selection the configuration +holds only the selected value — the unselected closure is information +the branch no longer carries anywhere else. The branches therefore +reach the outer `D1` with unequal residue, the `1̂` amplitudes fail to +cancel, and the halting state is the (1/2, 1/2) mixture: **witness 7 of +the architecture's verification contract fails on any machine whose +lookup residue is permanent.** Coherent popping is not an optimization — +the frozen contract makes it a correctness requirement. + +### 5.3 The linearity observation and the pop-at-Ret candidate + +Run the same computation with the **linear** NOT, +`NOT′ := λb.λx.λy. b y x` — no duplication, no discard. The δ-argument +`NOT′ b̂` normalizes under two binders (A3·A3, branch-independent), the +lookup of `b` writes an equal tag as before, and the selection consumes +*level variables*, not literals: + +```text +branch 0̂: Look(2, [Clo(x̄), _]) result NF: 1̂ +branch 1̂: Look(1, [_, Clo(ȳ)]) result NF: 0̂ +``` + +The tags still differ — the one selection bit must live somewhere — but +now the correspondence `result NF ↔ tag` is a *bijection in the +enclosing frame*: `1̂` says "the second binder was selected", which is +exactly `i = 2` and exactly which level closure the hole retains. A +**pop-at-Ret** rule that, when a `Try`/readback boundary returns an NF, +pops every residue tag whose content is determined by the returned NF +and the frame it returns into, is (i) locally legal (the tag is +re-derivable, so the pop is injective) and (ii) exactly what H–NOT–H +needs: both branches pop their selection tags at `Ret`, residues +equalize, and the outer `D1` cancels the `1̂` amplitudes. With the +*selector* NOT of §5.2 the bijection fails — the unselected literal is +not recoverable from the result — and the branches stay decohered. + +Conjecture (the **linearity conjecture**): λ-terms that are linear in +the consumed boolean (every binder used exactly once — no discard, no +duplication) admit tag-balanced execution under pop-at-Ret and are +coherence-transparent; terms that *discard* decohere by exactly the +erased content. Erasure costs coherence — Landauer's principle +surfacing as decoherence structure, and precisely the Lineal intuition +that the linear fragment is the unitary one. + +**[open — the crux]** Pop-at-Ret needs a deterministic schedule +(which tags, in which order, fused into which `Ret` rows) and must +preserve backward determinism (§4): a popped configuration's producing +rule must remain recognizable. This is the same mechanism as the +residue-freshness invariant and they must be solved together. Failure +mode to check: whether pop-at-Ret can be made forward-deterministic +without a phase counter that is itself unerasable garbage. + +### 5.4 Contract implication + +If pop-at-Ret (or an equivalent) works, witness 7 stands as frozen and +the machine earns H–NOT–H for the linear NOT — and the witness should +then *specify* `NOT′` (the linear term), since §5.2 shows the selector +NOT fails for reasons that are physically honest (it reads and +discards). If no sound pop schedule exists, witness 7 is unsatisfiable +as frozen and the contract needs an amendment tying it to the +clean-compilation theorem (architecture §6). Either way the resolution +must go back through the review thread before implementation. + +## 6. Invariant sectors + +`RunDone`, `Halt`, `Error` are basis constructors; F1–F4 are rows of the +same table. F2/F3 realize the architecture's normative halted dynamics +(`id_output ⊗ id_garbage ⊗ id_terminal-control ⊗ shift_tick`, entry at +tick 0); F4 is its error-sector twin. The monotone-halting-mass lemma +(architecture §4.3) instantiates directly: the halt sector is spanned by +`Halt(·)` configurations, F2 maps into it, F3 maps it into itself +injectively, no row maps out of it, and newly arriving amplitude lies in +the wandering subspace `S ⊖ V(S)` by the typed entry. The same argument +covers `Error` verbatim. + +## 7. Formalization checklist (live status) + +| Item (architecture §9 / machine §6) | Status | +|---|---| +| Transition table, total on reachable `Config` | drafted (§2), A6′ and pop rows pending | +| Per-rule injectivity | proved rowwise (§4) | +| Range disjointness — clean pairs | proved via I1–I5 (§4) | +| Range disjointness — lookup family, freshness, pops | **open crux** (§4, §5.3) | +| Local predecessor-fibre minimality | stated; follows the crux | +| Invariant-sector lemma in-machine | done (§6) | +| HH witness by hand | done — passes given A6′ (§5.1) | +| H–NOT–H witness by hand | done both ways — forcing theorem (§5.2–5.3) | +| Effect-free projection lemma | **[open]**, expected routine | +| Clean compilation (architecture item 2) | untouched; §5.3 suggests the linear fragment as its substrate | From 98812036910a6d85c6ec153ea0e913ca476ba1e3 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 04:44:11 -0400 Subject: [PATCH 009/107] =?UTF-8?q?docs:=20qALC=20machine=20v0=20review=20?= =?UTF-8?q?incorporated=20=E2=80=94=20retractions,=20defect=20register,=20?= =?UTF-8?q?v1=20fork?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review verdict: DO NOT BUILD ON v0. machine.md updated honestly: universal forcing theorem retracted (LookFull(e, r) counterdesign gives injective, permanent, branch-independent lookup tags; the selector tag is also locally recoverable given a code decoder — the gap is provenance, not information loss); linearity conjecture retracted both directions (lb. b I I is linear but non-injective so the consumed bit must persist; generic pop-at-Ret merges N@1 with I@0 — the NF-tag bijection is code-relative and p is not a basis coordinate). Correct notion: operational injectivity of the computed map + synchronized code-aware cleanup — Landauer attached to semantics, not syntax. The narrow theorem stands review-confirmed: permanent Look(i, e-hole) residue in this table decoheres selector H-NOT-H absent code-aware cleanup. Bennett compute-copy-uncompute with a protected result zipper and true reverse mode recorded as the sound scheduling shape; witness 7 stands, to be pinned to an exact NOT wire term. Defect register: A2 vs canonical trimming (vacuous binders erase), A1/A2 range collision, A6' domain/range collisions, E1 drops (S, m), D3/R3 stale-tag collision, one-bit freshness non-reversible. v1 = coloured landing modes + explicit reverse control. Machine-defining fork 7.3 left open for ratification: minimal tags/earned coherence (A) vs symmetric redundant tags (B) — different canonical Omega_qALC. Ledger updated. Co-Authored-By: Claude Fable 5 --- docs/ledger/2026-08.md | 31 ++++ docs/quantum-algebraic/machine.md | 272 +++++++++++++++++++----------- 2 files changed, 205 insertions(+), 98 deletions(-) diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 1512ea5..3b73f77 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -1893,3 +1893,34 @@ claimed observationally equivalent). **The qALC architecture contract is frozen**; the next lane is formalizing the reversible machine per `quantum-algebraic/machine.md` §6, with the thread reconvening on the formal transition table. + +**Machine formal draft v0** (`de08c12`, same day): full syntax, a +~16-row transition table with charged `Look(i, e∖i)` lookup rows and +rule-indexed content-free δ landing tags, reachability invariants, +per-rule inverses, invariant sectors, and both witnesses computed by +hand. The hand computation produced two claims: a universal forcing +theorem (permanent lookup residue fails witness 7) and a linearity +conjecture (linear terms are coherence-transparent under generic +pop-at-Ret). **Review verdict: DO NOT BUILD ON v0.** Confirmed: the +invariant-sector construction, the H–NOT–H decoherence trace, and the +narrowed theorem (permanent `Look(i, e∖i)` in *this* table decoheres +selector H–NOT–H absent code-aware cleanup). Refuted: the universal +forcing claim (the `LookFull(e, r)` counterdesign gives injective, +permanent, branch-independent lookup tags) and the linearity conjecture +both ways (`λb. b I I` is linear but non-injective, so the consumed bit +must persist; generic pop-at-Ret is unsound because the NF↔tag +bijection is code-relative and `p` is not a basis coordinate — the +N-applied-to-1̂ vs I-applied-to-0̂ collision). The correct notion is +**operational injectivity of the computed map plus synchronized +code-aware cleanup** — Landauer attached to semantics, not syntax. +Five table defects registered (A2 vs trimming on vacuous binders, +A1/A2 range collision, A6′ unsound as displayed, E1 drops control, +D3/R3 stale-tag collision; one-bit freshness is non-reversible). v1 +direction ratified by the review: rule-coloured landing modes with +explicit forward/reverse (Bennett) control; witness 7 stands, to be +pinned to an exact NOT wire term, with its proof the smallest +clean-compilation lemma. One machine-defining fork left deliberately +open for ratification before v1: minimal tags + earned coherence (A) +versus symmetric redundant tags (B) — different canonical `Ω_qALC`, +recorded in `machine.md` §7.3. All incorporated in the same-day +machine.md revision. diff --git a/docs/quantum-algebraic/machine.md b/docs/quantum-algebraic/machine.md index 24b10e3..875fc60 100644 --- a/docs/quantum-algebraic/machine.md +++ b/docs/quantum-algebraic/machine.md @@ -1,18 +1,15 @@ # qALC reference machine — formal draft v0 -**Status: formal draft, under adversarial review.** This document -supersedes the pre-formal sketch (git history; provenance in -`../ledger/2026-08.md`) and is the working object for -`architecture.md` §9 item 1. Sections marked **[open]** are stated -obligations, not results. The architecture contract wins wherever they -disagree. - -Two findings made during this formalization stand out and are flagged -inline: the **witness-forcing analysis** (§5 — permanent lookup residue -makes the contract's H–NOT–H witness fail, so coherent popping is -load-bearing, not optional) and the **linearity observation** (§5.3 — the -coherent NOT is the linear λ-term; discarding selectors decohere by -exactly their erased content). +**Status: formal draft v0 — reviewed, verdict DO NOT BUILD ON v0.** +This document supersedes the pre-formal sketch (git history; provenance +in `../ledger/2026-08.md`) and is the working object for +`architecture.md` §9 item 1. The v0 review (thread `qalc-architecture`) +confirmed the invariant-sector construction and the H–NOT–H decoherence +trace, **refuted the universal forcing theorem and the linearity +conjecture** (corrected statements in §5), and found five table defects +(register in §7). v1 must rebuild the table around an explicit +rule-coloured forward/reverse control discipline; the v1 design fork is +stated in §7.3. The architecture contract wins wherever they disagree. ## 1. Syntax @@ -231,88 +228,106 @@ short-circuits) is a design choice with real consequences — as stated it is deliberately minimal: booleans under `Try` only. With A6′, both HH branches write no post-branch `Look` tags, residues stay equal, the outer `D1` fires per branch with the common `Jh`, and the `1̂` -amplitudes cancel: final state `|0̂⟩` at mass 1. **HH passes, and the -δ tags' content-freeness plus A6′ are exactly what it needed.** +amplitudes cancel: final state `|0̂⟩` at mass 1. The amplitude +computation is review-confirmed; "HH passes" is conditional on the A6′ +repair of §7.1 (distinct `ReadyBool` landing with branch-independent +provenance), since A6′ as displayed overlaps A3 and collides with +genuine readback. -### 5.2 Permanent lookup residue fails H–NOT–H — the forcing theorem +### 5.2 Selector H–NOT–H decoheres under this table's permanent tags -Take `NOT := λb. b 1̂ 0̂` (the selector) and run -`h (NOT (h 0̂))`. After the inner δ, the branches carry `b̂ = 0̂` / `1̂` -and equal residue `R₀`. Evaluating `NOT b̂`: A1·A1·A2 bind `b`, then A4 -looks up `b` — tag `Look(1, [_])`, *equal* across branches (the hole -excludes the differing entry). The boolean then consumes the two -argument closures — A2·A2 with environment `[Clo(0̂,∅), Clo(1̂,∅)]` -equal across branches by I3 — and then the selection fires: +Take `NOT := λb. b 1̂ 0̂` (the selector) and run `h (NOT (h 0̂))`. After +the inner δ, the branches carry `b̂ = 0̂` / `1̂` and equal residue `R₀`. +The `b`-lookup tag is equal across branches (the hole excludes the +differing entry); the selection then fires: ```text branch 0̂: A4 on Var 2 → tag Look(2, [Clo(0̂,∅), _]) branch 1̂: A4 on Var 1 → tag Look(1, [_, Clo(1̂,∅)]) ``` -The tags differ in both hole position and retained content, and the -retained content is the **unselected alternative**. No local pop can -erase them: the pop-legality condition (the post-pop configuration -determines the tag) fails, because after selection the configuration -holds only the selected value — the unselected closure is information -the branch no longer carries anywhere else. The branches therefore -reach the outer `D1` with unequal residue, the `1̂` amplitudes fail to -cancel, and the halting state is the (1/2, 1/2) mixture: **witness 7 of -the architecture's verification contract fails on any machine whose -lookup residue is permanent.** Coherent popping is not an optimization — -the frozen contract makes it a correctness requirement. - -### 5.3 The linearity observation and the pop-at-Ret candidate - -Run the same computation with the **linear** NOT, -`NOT′ := λb.λx.λy. b y x` — no duplication, no discard. The δ-argument -`NOT′ b̂` normalizes under two binders (A3·A3, branch-independent), the -lookup of `b` writes an equal tag as before, and the selection consumes -*level variables*, not literals: - -```text -branch 0̂: Look(2, [Clo(x̄), _]) result NF: 1̂ -branch 1̂: Look(1, [_, Clo(ȳ)]) result NF: 0̂ -``` - -The tags still differ — the one selection bit must live somewhere — but -now the correspondence `result NF ↔ tag` is a *bijection in the -enclosing frame*: `1̂` says "the second binder was selected", which is -exactly `i = 2` and exactly which level closure the hole retains. A -**pop-at-Ret** rule that, when a `Try`/readback boundary returns an NF, -pops every residue tag whose content is determined by the returned NF -and the frame it returns into, is (i) locally legal (the tag is -re-derivable, so the pop is injective) and (ii) exactly what H–NOT–H -needs: both branches pop their selection tags at `Ret`, residues -equalize, and the outer `D1` cancels the `1̂` amplitudes. With the -*selector* NOT of §5.2 the bijection fails — the unselected literal is -not recoverable from the result — and the branches stay decohered. - -Conjecture (the **linearity conjecture**): λ-terms that are linear in -the consumed boolean (every binder used exactly once — no discard, no -duplication) admit tag-balanced execution under pop-at-Ret and are -coherence-transparent; terms that *discard* decohere by exactly the -erased content. Erasure costs coherence — Landauer's principle -surfacing as decoherence structure, and precisely the Lineal intuition -that the linear fragment is the unitary one. - -**[open — the crux]** Pop-at-Ret needs a deterministic schedule -(which tags, in which order, fused into which `Ret` rows) and must -preserve backward determinism (§4): a popped configuration's producing -rule must remain recognizable. This is the same mechanism as the -residue-freshness invariant and they must be solved together. Failure -mode to check: whether pop-at-Ret can be made forward-deterministic -without a phase counter that is itself unerasable garbage. - -### 5.4 Contract implication - -If pop-at-Ret (or an equivalent) works, witness 7 stands as frozen and -the machine earns H–NOT–H for the linear NOT — and the witness should -then *specify* `NOT′` (the linear term), since §5.2 shows the selector -NOT fails for reasons that are physically honest (it reads and -discards). If no sound pop schedule exists, witness 7 is unsatisfiable -as frozen and the contract needs an amendment tying it to the -clean-compilation theorem (architecture §6). Either way the resolution -must go back through the review thread before implementation. +The tags differ, the branches reach the outer `D1` with unequal +residue, the `1̂` amplitudes fail to cancel, and the halting state is +the (1/2, 1/2) mixture. **Correct theorem (review-verified): permanent +`Look(i, e∖i)` residue in this table makes selector H–NOT–H decohere +unless a code-aware cleanup transition removes it.** + +Two stronger claims made by v0 are **retracted**: + +- *"No local pop is legal"* — false. The selector's tag *is* determined + by its result once the decoder is known (`1̂ ↦ Look(2, [0̂,_])`, + `0̂ ↦ Look(1, [_,1̂])`): the unselected literal is the complement of + the selected one, fixed by the code. What is missing is live + *provenance* — a marker that this decoder applies — which makes it a + scheduling problem, not an information-theoretic impossibility. +- *"Any machine with permanent lookup residue fails"* — false. + Counterdesign `LookFull(e, r)` with `r` the occurrence ordinal of the + selected entry among equal entries of `e`: injective (recover `i` as + the `r`-th occurrence of the returned closure in `e`), permanent, and + *branch-independent* whenever the whole environment is — for the + selector both branches write the identical `LookFull([0̂,1̂], 1)`. It + violates the local-minimality economy by design, but it refutes the + universal claim and marks a genuine machine-design axis (§7.3). + +### 5.3 Coherence is operational injectivity, not syntactic linearity + +v0 conjectured that terms linear in the consumed boolean are +coherence-transparent under a generic pop-at-Ret rule. **Both halves +are false** (review countermodels, verified): + +- *Generic pop-at-Ret is unsound.* `N = λb.λx.λy. b y x` applied to + `1̂` and `I' = λb.λx.λy. b x y` applied to `0̂` both return `0̂` at + the same frame shape and depth, with *different* selection tags + (`Look(1, [_,Clo(ȳ)])` vs `Look(2, [Clo(ȳ),_])`). A pop keyed only + on the returned NF and frame would merge distinct configurations — + non-injective — and since `p` is not a basis coordinate, the inverse + cannot consult program identity. The NF ↔ tag bijection exists only + relative to a retained code/call-site decoder. +- *Linearity is not sufficient.* `λb. b I I` uses `b` exactly once and + maps both booleans to `I`: the computed function is non-injective, so + by injectivity of `U` the consumed bit *must* persist somewhere, and + no cleanup can produce equal residue. Conversely, syntactic + duplication can be coherent — basis-copying `b ↦ (b, b)` is + injective. + +The correct notion: **coherence-transparency requires operational +injectivity of the computed map on the branch support, plus a +synchronized, code-aware cleanup schedule.** Erasure = non-injectivity +of the computed function, and *that* is what costs coherence — the +Landauer reading survives, attached to semantics rather than syntax. + +### 5.4 The sound scheduling shape: explicit reversible uncomputation + +The plausible construction (review round, unproved here) is Bennett +compute–copy–uncompute specialized to the machine: + +1. push a branch-independent `CleanK(code, call-site)` frame; +2. evaluate forward, accumulating reversible tags; +3. copy the returned basis NF into a protected result zipper; +4. enter a distinct **reverse mode** and invert the forward transitions + in LIFO order; +5. use the protected result to reconstruct and clear the input when the + compiled map is injective; +6. return with a fixed direction state and branch-independent residual + control. + +The direction flag is safe only because reverse execution restores it — +it is never "cleared" by a forward row. Proving this schedule sound for +one pinned NOT term is **the smallest clean-compilation lemma**, and it +is the actual content behind witness 7. + +### 5.5 Contract implication (review-ratified direction) + +Witness 7 stands as a machine gate, in the satisfiable world: pin an +exact NOT wire term (`NOT′ = λb.λx.λy. b y x` is a reasonable choice — +easier for this machine, though the selector NOT is *not* intrinsically +incoherent: Boolean NOT is bijective and its alternatives are fixed +code, so a sufficiently code-aware reversible compilation can clean it +too); state that passing the witness requires a proved code-aware +reversible cleanup schedule; and treat the whole thing as the first +concrete lemma of clean coherent compilation rather than a theorem +about binder counts. The witness-pinning amendment goes back through +the review thread with v1. ## 6. Invariant sectors @@ -326,17 +341,78 @@ injectively, no row maps out of it, and newly arriving amplitude lies in the wandering subspace `S ⊖ V(S)` by the typed entry. The same argument covers `Error` verbatim. -## 7. Formalization checklist (live status) +## 7. v0 defect register and the v1 direction + +### 7.1 Confirmed table defects (review countermodels) + +1. **A2 is not injective under canonical trimming.** For a vacuous + binder, `Eval⟨(Lam I, ∅)⟩ | Arg(X)` and `| Arg(Y)` both land at + `Eval⟨(I, ∅)⟩` once the constructed closure trims the unused entry. + The discarded argument is genuine erased content: v1 must either + route it to residue (the sketch's binding-erasure row, lost in v0) + or abandon trimming-at-construction for bound entries. Separately, + trimming must be suffix-only or `Env` must become a sparse indexed + map — deleting interior entries shifts de Bruijn indices. +2. **A1 and A2 ranges collide** on unconstrained `Eval` targets: + `((λx.x) X) Y` and `(λx. x Y) X` both reach + `Eval⟨(Var 1, [X])⟩ | Arg(Y)::S`. The v0 "clean pairs" claim checked + only marked-target rules; deterministic rows need producer marking + too. +3. **A6′** overlaps A3's domain (needs explicit exclusion) and its + target collides with genuine R1 readback of a non-literal + normalizing to a boolean; it needs a distinct landing mode + (`ReadyBool` with branch-independent provenance), which HH tolerates. +4. **E1 is not injective**: it drops `S` and `m` (`h I` vs `(h I) A` + reach the same error with different discarded continuations). Error + garbage must retain the complete discarded control: `(S, m, n, g)`. + Error-sector coherence is irrelevant; norm preservation is not. +5. **D3/R3 collide** through stale `Jn_g` residue, and the one-bit + freshness proposal is itself non-reversible — clearing a flag merges + its prior values. Producer marking must be **rule-coloured landing + modes removed only through explicit inverse/uncompute paths**, not + flags cleared by forward rows. + +### 7.2 What stands after review + +The invariant-sector construction and wandering-subspace argument (§6); +the H–NOT–H decoherence trace and its corrected narrow theorem (§5.2); +the operational-injectivity reformulation (§5.3); the Bennett scheduling +shape (§5.4); I1/I5 provisionally, with induction proofs deferred until +the coloured-mode table exists. + +### 7.3 The v1 design fork (machine-defining, to be settled before v1) + +The canonical machine — and therefore the canonical `Ω_qALC` — depends +on a genuine choice surfaced by the `LookFull` counterdesign: + +- **(A) Minimal tags + code-aware reversible cleanup**: residue is + locally minimal (`Look(i, e∖i)` style), coherence is *earned* through + explicit compute–copy–uncompute (§5.4), and the coherence economy is + a rich measured object — programs that clean up interfere, programs + that don't decohere. +- **(B) Symmetric redundant tags (`LookFull`-style)**: residue retains + branch-independent context wherever possible, more coherence comes + for free, the witness passes with less machinery — and the measured + economy flattens, since redundancy substitutes for uncomputation. + +These define *different canonical objects*, in the same way the frozen +signature order defines qBLC's: the choice must be made deliberately, +recorded, and then pinned. v0's working recommendation is (A), for +alignment with the architecture's local-minimality theorem and because +(B) hides exactly the erasure structure the pillar exists to measure — +but the fork is open until ratified. + +### 7.4 Formalization checklist (live status) | Item (architecture §9 / machine §6) | Status | |---|---| -| Transition table, total on reachable `Config` | drafted (§2), A6′ and pop rows pending | -| Per-rule injectivity | proved rowwise (§4) | -| Range disjointness — clean pairs | proved via I1–I5 (§4) | -| Range disjointness — lookup family, freshness, pops | **open crux** (§4, §5.3) | -| Local predecessor-fibre minimality | stated; follows the crux | -| Invariant-sector lemma in-machine | done (§6) | -| HH witness by hand | done — passes given A6′ (§5.1) | -| H–NOT–H witness by hand | done both ways — forcing theorem (§5.2–5.3) | -| Effect-free projection lemma | **[open]**, expected routine | -| Clean compilation (architecture item 2) | untouched; §5.3 suggests the linear fragment as its substrate | +| Transition table, total on reachable `Config` | v0 drafted; **rebuild for v1** with coloured landing modes (§7.1) | +| Per-rule injectivity | v0 claims partially refuted (A2, E1); redo in v1 | +| Range disjointness | v0 claim false (A1/A2); needs producer marking throughout | +| Local predecessor-fibre minimality | blocked on the §7.3 fork | +| Invariant-sector lemma in-machine | **done** (§6, review-confirmed) | +| HH witness by hand | amplitude computation confirmed; conditional on A6′ repair | +| H–NOT–H witness by hand | decoherence trace confirmed; coherent path = smallest clean-compilation lemma (§5.4) | +| Witness-7 pinning amendment (NOT′) | drafted direction (§5.5); thread ratification with v1 | +| Effect-free projection lemma | open | +| Clean compilation (architecture item 2) | §5.4 is its smallest instance; substrate = operationally injective maps | From 632cb50b5277003b6aa4d3035e763ba03671f5e8 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 04:54:28 -0400 Subject: [PATCH 010/107] =?UTF-8?q?docs:=20qALC=20machine=20formal=20draft?= =?UTF-8?q?=20v1=20=E2=80=94=20no-erasure=20forward=20machine,=20colour=20?= =?UTF-8?q?discipline,=20Try-boundary=20protocol?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Full rewrite around three commitments answering the v0 review. (1) No-erasure forward machine: trimming abolished, envs never dropped — A2 injective by env-head pop, vacuous binders carry dead entries as coherence cost removed only by reverse execution; the only forward discard is the branch-independent Drop(c) at delta-fire. (2) Rule-coloured configurations: via on every Run, Join(predecessor colour) charged every step — ranges pairwise disjoint by colour, backward determinism structural, clean delta fibres realized by colour disjointness (J_h+J_t=0 is D1 != D2). Conservative charging means raw interference iff identical control path + equal content tags (HH survives raw); the minimality theorem becomes a monotone program of via-transparency lemmas, each enlarging measured coherence, ratified like the machine itself. (3) Try-boundary protocol: forward-copy-reverse across delta boundaries, with reverse running THROUGH interior deltas as adjoint columns — no code-supplied inverse needed, input retained by the frame so injectivity of the computed function is never required. Post-protocol branches differ only in result register and global timing: interference iff branch paths are transition-count-equal, deriving the architecture's common-T clean compilation from machine structure. Witness 7 passes for the path-symmetric NOT' (hand trace); v1 predicts the selector NOT also passes under the protocol (measurable, not a gate). Fork (A) ratified and built in; v0 defect resolution map and updated checklist included. Co-Authored-By: Claude Fable 5 --- docs/quantum-algebraic/machine.md | 673 +++++++++++++----------------- 1 file changed, 301 insertions(+), 372 deletions(-) diff --git a/docs/quantum-algebraic/machine.md b/docs/quantum-algebraic/machine.md index 875fc60..a388042 100644 --- a/docs/quantum-algebraic/machine.md +++ b/docs/quantum-algebraic/machine.md @@ -1,418 +1,347 @@ -# qALC reference machine — formal draft v0 - -**Status: formal draft v0 — reviewed, verdict DO NOT BUILD ON v0.** -This document supersedes the pre-formal sketch (git history; provenance -in `../ledger/2026-08.md`) and is the working object for -`architecture.md` §9 item 1. The v0 review (thread `qalc-architecture`) -confirmed the invariant-sector construction and the H–NOT–H decoherence -trace, **refuted the universal forcing theorem and the linearity -conjecture** (corrected statements in §5), and found five table defects -(register in §7). v1 must rebuild the table around an explicit -rule-coloured forward/reverse control discipline; the v1 design fork is -stated in §7.3. The architecture contract wins wherever they disagree. - -## 1. Syntax - -### Terms and normal forms +# qALC reference machine — formal draft v1 + +**Status: formal draft v1, submitted for adversarial review.** Working +object for `architecture.md` §9 item 1. v0's review verdict, refuted +claims, and defect register are in `../ledger/2026-08.md`; every v0 +defect has a v1 resolution (§8.1). Fork (A) of the v0 register — +minimal-information residue with *earned* coherence — is ratified and +built in. The architecture contract wins wherever they disagree. + +v1 is organized around three design commitments that answer the v0 +review: + +1. **A no-erasure forward machine** (§1): nothing is discarded in + forward mode — no closure trimming, no environment drops. Erasure + exists only as explicit, reversible discard-to-residue, and most of + v0's injectivity defects dissolve because the information they lost + is simply never lost. +2. **Rule-coloured configurations with join charging** (§2): every + running configuration carries the colour (rule id) of its producer; + every step charges a `Join` tag recording its predecessor's colour. + Ranges are pairwise disjoint by colour, backward determinism is + structural, and the local-minimality theorem becomes a monotone + research program (§2.3) rather than a single fragile claim. +3. **The Try-boundary protocol** (§5): coherent gate application is + implemented by forward–copy–reverse execution across δ-argument + boundaries, with the reverse pass running *through* earlier δs as + their adjoint columns. Coherence is earned exactly by uncomputation, + interference requires path-length synchronization — reproducing the + architecture's common-`T` clean-compilation requirement from machine + structure — and witness 7 passes for the path-symmetric `NOT′`. + +## 1. Syntax and state ```text -T ::= Var(i) | Lam(T) | App(T, T) | h | t (i ≥ 1, 1-indexed) +T ::= Var(i) | Lam(T) | App(T, T) | h | t (i ≥ 1, 1-indexed) NF ::= Lam(NF) | Neu Neu ::= Var(i) | h | t | App(Neu, NF) -``` - -Source programs contain no `h`/`t`; the constants enter only through -`init(p) = App(App(p, h), t)`. Canonical booleans: `0̂ = Lam(Lam(Var 2))`, -`1̂ = Lam(Lam(Var 1))`. -### Closures, environments, levels - -```text -Bind ::= Clo(T, Env) | Level(l) (l ≥ 1, binder depth) -Env ::= [Bind, …] (index 1 = innermost) +Bind ::= Clo(T, Env) | Level(l) +Env ::= [Bind, …] — full lists; NEVER trimmed; index-stable +Clo ::= (T, Env) — structural identity, no allocation identity ``` -**Canonical-closure discipline**: closures are structural values — -no allocation identity — and every constructed closure is trimmed to the -free-variable support of its term (a closed term's closure is -`Clo(T, ∅)`; in particular constants and canonical booleans always carry -the empty environment). Trimming at construction is not an erasure step: -the discarded entries were never part of the closure's identity. - -### Frames, residue, configurations +Canonical booleans `0̂ = Lam(Lam(Var 2))`, `1̂ = Lam(Lam(Var 1))`. +Closures are untrimmed: a closure's environment is whatever was in +scope at capture, verbatim. Dead environment entries are a *coherence +cost*, not a correctness cost — they are removed only by reverse +execution (§5), never by a forward rule. (v0's trimming-at-construction +broke A2 injectivity on vacuous binders and is abandoned.) ```text -Frame ::= Arg(Clo) — pending call-by-name argument - | LamK — readback re-entry for one binder - | AppK(Neu) — spine head held while an argument normalizes - | Try_h | Try_t — δ-argument normalization in flight +Frame ::= Arg(Clo) + | LamK + | AppK(Neu) + | Try_g(Clo) — δ boundary; RETAINS the argument closure + | Try_g(Clo, b̂) — after result copy (protocol, §5) -Res ::= Look(i, Env∖i) — lookup tag: index and origin env with hole - | Jh | Jt | Jn_h | Jn_t — δ landing tags (rule-indexed, content-free) - | … — further tags only as §4 forces them +Res ::= Join(colour) — predecessor colour, charged every step + | Look(i, Env∖i) — lookup content (A4/A5 only) + | Drop(Clo) — explicit discard (δ-fire only, §5) + +Colour ::= Init | A1 | A2 | A3 | A4 | A5 | A6 | A6b | A7 + | R1 | R2 | R3 | D1 | D2 | D3 | CP | RV(c) Config ::= - Run(mode, S: [Frame], m: depth, R: [Res]) - where mode ::= Eval(Clo) | Ret(NF) - | RunDone(nf: NF, R, c: TermCtl) - | Halt(nf, R, c, k) - | Error(kind, R, k) + Run(dir: Fwd | Rev, via: Colour, mode: Eval(Clo) | Ret(NF), + S: [Frame], m: depth, R: [Res]) + | RunDone(nf, R, c⊥) + | Halt(nf, R, c⊥, k) + | Error(kind, ctl: (S, m, NF, gate), R, k) ``` -`(p, τ)` are evaluator indices, not basis components (architecture §4.2, -machine choice ratified in review). `TermCtl` is the terminal control -value — for this table the constant `⊥` (the empty stack at depth 0), -retained explicitly per the architecture's halted factorization. - -## 2. The transition table - -Deterministic rows are basis-to-basis; the two δ rows carry the clean -gate fibres. `top(S) ∉ Arg` abbreviates "S is empty or its head is not an -`Arg` frame". +`(p, τ)` remain evaluator indices (frozen contract). `Error` retains +the complete discarded control `(S, m, offending NF, gate)` — v0's E1 +defect. + +## 2. The colour discipline + +### 2.1 Structure + +Every forward row `r` fires from a source pattern (which does not +constrain `via` — any producer is acceptable), sets the target's +`via := r`, and pushes `Join(source.via)`. Reverse rows (§5) are the +formal inverses: they read their own colour, pop the `Join`, and +restore the predecessor. + +**Theorem shape (injectivity).** For forward rows: given a target +`(Fwd, via = r, core′, R·Join(v))`, rule `r` is identified by `via`, +its core inverse (§3, rowwise) reconstructs the source core from +`core′` plus `r`'s content tags, and the source colour is `v`. Two +distinct sources cannot share a target: same `via` forces the same +rule, same `Join` forces the same predecessor colour, and rowwise core +injectivity forces the same core. Range disjointness across rules is +immediate from `via`. δ fibres: the two outcomes of one `D1` firing +share `via`, `Join`, and spectators, differing only in the outcome +boolean — the fibre is `Q_q ⊗ J_q` with `J_q` realized by +(`via := Dq`, push `Join`), identical across input and output booleans, +and fibres from distinct sources are orthogonal because spectators or +`Join` content differ. Cross-gate orthogonality `J_h†J_t = 0` is the +colour disjointness `D1 ≠ D2`. This realizes the architecture's clean +δ fibre clause exactly. + +### 2.2 What conservative charging costs, honestly + +`Join` tags record the control path. Two branches of one program +re-merge in raw forward execution **iff they executed the identical +rule sequence with equal content tags** — control-path-identical +branches (HH's two δ outcomes) interfere freely; control-divergent +branches decohere until cleaned. Under fork (A) this is the honest +physics: raw forward execution never erases, so control divergence is +recorded, and interference across divergent control is *earned* through +the reverse machinery of §5. This is not the probabilistic +degeneration of the architecture's §4.5: content is not logged, and +same-control interference (HH) survives raw. + +### 2.3 The minimality program + +A row is *via-transparent* if its source colour is derivable from the +rule plus target core on reachable configurations — then its `Join` +push can be soundly omitted. v1 charges every row (conservative, +sound). Each via-transparency lemma proved later removes a tag class +and **monotonically enlarges the class of raw-interfering programs**; +the true minimal-garbage machine is the maximal safe transparency set. +This replaces v0's single minimality claim with a program whose every +step is independently checkable — and every step *changes the measured +coherence economy*, so transparency lemmas must be ratified and pinned +like the machine itself before canonical data exists. + +## 3. The forward table + +Every row implicitly: `via := `, push `Join(source.via)`; all +rows are `dir = Fwd` except where stated. Content residue beyond +`Join` is noted per row. ### Descent and binding ```text -A1 Eval⟨(App f a, e)⟩ | S → Eval⟨(f, e)⟩ | Arg(Clo(a,e))::S -A2 Eval⟨(Lam b, e)⟩ | Arg(c)::S → Eval⟨(b, c::e)⟩ | S -A3 Eval⟨(Lam b, e)⟩ | S, top∉Arg → Eval⟨(b, Level(m+1)::e)⟩ | LamK::S [m → m+1] +A1 Eval⟨(App f a, e)⟩ | S → Eval⟨(f, e)⟩ | Arg(Clo(a,e))::S +A2 Eval⟨(Lam b, e)⟩ | Arg(c)::S → Eval⟨(b, c::e)⟩ | S +A3 Eval⟨(Lam b, e)⟩ | S, top∉Arg∪Try → Eval⟨(b, Level(m+1)::e)⟩ | LamK::S [m+1] ``` -### Lookup (the charged rows) +A2 is injective with no residue: the environment head is never trimmed +away, so A2⁻¹ pops it back into an `Arg` frame. Vacuous binders carry +their dead entry as live state (coherence cost, §5 removes it). + +### Lookup (content-charged) ```text -A4 Eval⟨(Var i, e)⟩ | S, e[i]=Clo c → Eval⟨c⟩ | S [R → R·Look(i, e∖i)] -A5 Eval⟨(Var i, e)⟩ | S, e[i]=Level l → Ret⟨Var(m−l+1)⟩ | S - [R → R·Look(i, e∖i)] +A4 Eval⟨(Var i, e)⟩ | S, e[i] = Clo c → Eval⟨c⟩ | S [+ Look(i, e∖i)] +A5 Eval⟨(Var i, e)⟩ | S, e[i] = Level l → Ret⟨Var(m−l+1)⟩ | S [+ Look(i, e∖i)] ``` -### Constants +### Constants and the δ boundary ```text -A6 Eval⟨(g, ∅)⟩ | Arg(c)::S, g∈{h,t} → Eval⟨c⟩ | Try_g::S -A7 Eval⟨(g, ∅)⟩ | S, top∉Arg → Ret⟨g⟩ | S +A6 Eval⟨(g, e)⟩ | Arg(c)::S, g∈{h,t} → Eval⟨c⟩ | Try_g(c)::S +A6b Eval⟨(b̂, e)⟩ | Try_g(c)::S → Ret⟨b̂⟩ | Try_g(c)::S +A7 Eval⟨(g, e)⟩ | S, top∉Arg → Ret⟨g⟩ | S ``` +`Try_g(c)` retains the argument closure — the δ boundary is also the +protocol boundary of §5. A6b is the boolean short-circuit; its v0 +collisions with A3 and R1 are resolved by colour (`via = A6b`) and by +A3's explicit `Try` exclusion. A6's source keeps `e` in the closure +`c`'s captured environment; nothing is dropped. + ### Readback ```text -R1 Ret⟨n⟩ | LamK::S → Ret⟨Lam n⟩ | S [m → m−1] -R2 Ret⟨n⟩ | Arg(c)::S, n neutral → Eval⟨c⟩ | AppK(n)::S -R3 Ret⟨n'⟩ | AppK(n)::S → Ret⟨App n n'⟩ | S +R1 Ret⟨n⟩ | LamK::S → Ret⟨Lam n⟩ | S [m−1] +R2 Ret⟨n⟩ | Arg(c)::S, n neutral → Eval⟨c⟩ | AppK(n)::S +R3 Ret⟨n′⟩ | AppK(n)::S → Ret⟨App n n′⟩ | S ``` -### δ fibres and species errors +### δ rows (protocol-mediated; see §5 for the full firing sequence) ```text -D1 Ret⟨0̂⟩ | Try_h::S → (1/√2)·( Eval⟨(0̂,∅)⟩|S + Eval⟨(1̂,∅)⟩|S ) [R·Jh] - Ret⟨1̂⟩ | Try_h::S → (1/√2)·( Eval⟨(0̂,∅)⟩|S − Eval⟨(1̂,∅)⟩|S ) [R·Jh] -D2 Ret⟨0̂⟩ | Try_t::S → Eval⟨(0̂,∅)⟩ | S [R·Jt] - Ret⟨1̂⟩ | Try_t::S → ω · Eval⟨(1̂,∅)⟩ | S [R·Jt] -D3 Ret⟨n⟩ | Try_g::S, n neutral → Ret⟨App g n⟩ | S [R·Jn_g] -E1 Ret⟨n⟩ | Try_g::S, n closed NF, n∉{0̂,1̂} - → Error(Species(g), R·⟨g,n⟩, 0) +CP Ret⟨b̂⟩ | Try_g(c)::S → Run(Rev, …) | Try_g(c, b̂)::S +D1 fire on result register b̂ in Try_h(c, b̂), post-protocol: + b̂=0̂ → (1/√2)(⟨0̂-continue⟩ + ⟨1̂-continue⟩) [+ Drop(c)] + b̂=1̂ → (1/√2)(⟨0̂-continue⟩ − ⟨1̂-continue⟩) [+ Drop(c)] +D2 likewise with Q_t = diag(1, ω) [+ Drop(c)] +D3 Ret⟨n⟩ | Try_g(c)::S, n neutral → Ret⟨App g n⟩ | S [+ Drop(c)] +E1 Ret⟨n⟩ | Try_g(c)::S, n closed NF ∉ {0̂,1̂} + → Error(Species(g), (S, m, n, g), R, 0) ``` -`Jh`, `Jt`, `Jn_h`, `Jn_t` are rule-indexed and content-free: the two -outcomes of one `D1` firing receive the *same* tag, which is the clean -δ-fibre requirement — the landing `J_q` is one injective spectator -transition per gate, independent of input and output boolean, and the -distinct tags realize `J_q† J_r = δ_qr I` and orthogonality against the -neutral row. +`⟨b̂′-continue⟩` abbreviates `Eval⟨(b̂′, ∅)⟩ | S` — the boolean +literal is closed, so the empty environment is its verbatim capture, +not a trim. `Drop(c)` is the machine's only discard: the retained +`Try` closure is branch-independent by construction (captured before +the δ fired), so this tag never decoheres branches of one firing. ### Terminal sectors ```text -F1 Ret⟨n⟩ | ∅, m = 0 → RunDone(n, R, ⊥) -F2 RunDone(n, R, c) → Halt(n, R, c, 0) -F3 Halt(n, R, c, k) → Halt(n, R, c, k+1) -F4 Error(kind, R, k) → Error(kind, R, k+1) -``` - -## 3. Reachability invariants - -The range-disjointness proofs of §4 are relative to the reachable set, -and these invariants carry them: - -- **I1**: `Ret⟨Lam n⟩` never meets an `Arg` frame (a Lam over a pending - argument would have fired A2 earlier under this strategy). -- **I2**: `Level(l)` occurs in a reachable environment only with - `l ≤ m`, and the entries of any environment's Level-set are exactly - the currently open binders above the closure's capture point. -- **I3**: constants and canonical booleans always appear as `Clo(·, ∅)` - (canonical-closure discipline). -- **I4**: `Try_g` frames appear only above the evaluation of a δ - argument; at most one `Ret` is in flight. -- **I5**: depth `m` equals the number of `LamK` frames in `S`. - -**[open]** I1–I5 need induction proofs over the table once the residue -discipline of §4 is fixed; none is expected to be delicate. - -## 4. The reversibility framework - -**Definition (backward determinism).** A function -`φ : Reach → Rule ∪ {init}` assigning to every reachable configuration -the unique rule that produced it. `U` is an isometry on the reachable -span iff (a) each rule is injective on its domain, (b) rule ranges are -pairwise disjoint on `Reach` (`φ` well-defined), and (c) the δ fibres are -internally orthonormal and orthogonal to every other range. The -orthonormal-columns battery is the finite-range check of exactly this. - -Per-rule inverses (giving (a)) are immediate from the table: - -- A1⁻¹ re-forms `App` from focus and the `Arg` frame (their shared - environment is part of A1's range condition); -- A2⁻¹ pops the environment head back into an `Arg` frame; -- A3⁻¹ / R1⁻¹ are inverse to each other's shape by I5; -- A4⁻¹/A5⁻¹ plug the focus (resp. the emitted variable) back into the - hole of the `Look` tag — this is why the tag carries `(i, e∖i)`; -- R2⁻¹/R3⁻¹ re-form the spine state; D-rows and E1 are injective by the - tags; F-rows by the typed constructors. - -**(b) is the substantive obligation.** The clean pairs are separated by -mode, top frame, and the invariants (examples: A2-range has `Clo` at the -environment head where A3-range has `Level(m)` — disjoint by I2; R1/R3 -ranges are separated by the returned NF's outer constructor plus I1). -The hard family is everything whose range lands in an unconstrained -`Eval` configuration: **A4 against A1/A2/A6/D1/D2** — a dereferenced -closure can look like anything. The `Look` tag does not by itself -separate these ranges (an A1 source whose stale residue happens to end -in a `Look` collides with a fresh A4 target), so the discipline is: - -> **Residue-freshness invariant [open]**: the table is arranged so that -> for reachable configurations, whether the residue head was written by -> the producing step is determined by the configuration shape. The -> candidate mechanism is a one-bit `fresh` flag on `Run` set by charged -> rows (A4, A5, D·, E1) and cleared by the first uncharged row after — -> with the flag's own overwrite made lawful by the *pop schedule* below. - -**[open]** This is the crux of item 1 and the first thing the review -should attack; §5 shows the pop schedule is forced independently, so the -freshness mechanism and the pop schedule must be designed together. - -**Local minimality** is then the statement: `Look(i, e∖i)` is exactly -the predecessor-fibre content for A4/A5 (the round-1 KN witness shows -`i` and the origin environment are genuinely lost without it), the -δ tags are exactly the fibre separators, and no uncharged row retains -anything — each of its predecessor fibres is a singleton by (b). - -## 5. The witness-forcing analysis - -### 5.1 HH passes on this table - -Hand computation of `h (h 0̂)` (= `App(h, App(h, 0̂))` after invocation -plumbing; the outer `t`-abstraction is administrative and shared): - -all steps through the inner δ are common to both branches — A1, A6 -(outer `h`), A1, A6 (inner `h`), A3·A3·A5·R1·R1 normalizing the literal -`0̂` (one `Look` tag, *common*), then `D1` branches with the shared `Jh` -tag. Each branch's boolean lands as `Ret`-adjacent `Eval⟨(b̂,∅)⟩` under -the outer `Try_h`; it is already a normal form, and its renormalization -(A3·A3·A5·R1·R1) writes `Look` tags whose content is -*branch-independent* — `0̂` and `1̂` share the index-to-hole shape only -when… **it is not branch-independent**: `0̂` looks up `Var 2`, `1̂` looks -up `Var 1`, so the second `Look` tags differ, and naively HH decoheres -too. The repair is already in the table: `D1`'s outcomes re-enter as -`Eval⟨(b̂,∅)⟩` — and a returned δ *value is already an NF*, so the table -must (and here does) route it back to the waiting `Try` frame without -renormalization when the outer frame is `Try_g`: - -```text -A6′ Eval⟨(b̂,∅)⟩ | Try_g::S → Ret⟨b̂⟩ | Try_g::S [no tags] +F1 Ret⟨n⟩ | ∅, m = 0 → RunDone(n, R, ⊥) +F2 RunDone(n, R, c) → Halt(n, R, c, 0) +F3 Halt(n, R, c, k) → Halt(n, R, c, k+1) +F4 Error(kind, ctl, R, k) → Error(kind, ctl, R, k+1) ``` -**[open]** A6′ as stated is a recognition rule (boolean-valued focus -short-circuits to `Ret`); its range/injectivity interplay with A3 needs -the §4 treatment, and its generalization (any NF-valued closure -short-circuits) is a design choice with real consequences — as stated -it is deliberately minimal: booleans under `Try` only. With A6′, both -HH branches write no post-branch `Look` tags, residues stay equal, the -outer `D1` fires per branch with the common `Jh`, and the `1̂` -amplitudes cancel: final state `|0̂⟩` at mass 1. The amplitude -computation is review-confirmed; "HH passes" is conditional on the A6′ -repair of §7.1 (distinct `ReadyBool` landing with branch-independent -provenance), since A6′ as displayed overlaps A3 and collides with -genuine readback. - -### 5.2 Selector H–NOT–H decoheres under this table's permanent tags - -Take `NOT := λb. b 1̂ 0̂` (the selector) and run `h (NOT (h 0̂))`. After -the inner δ, the branches carry `b̂ = 0̂` / `1̂` and equal residue `R₀`. -The `b`-lookup tag is equal across branches (the hole excludes the -differing entry); the selection then fires: +## 4. Reachability invariants + +- **I1**: `Ret⟨Lam n⟩` never meets an `Arg` frame. +- **I2**: `Level(l)` occurs in reachable environments only with + `l ≤ m`, ordered by capture. +- **I3**: `Try_g(c)` frames appear only above a δ-argument evaluation; + at most one `Ret` in flight per branch. +- **I4**: depth `m` equals the number of `LamK` frames in `S`. +- **I5** (new): in `Fwd` mode the residue is a faithful LIFO record — + the top tag was pushed by the producing step. + +**[open]** Induction proofs over the v1 table, after review. + +## 5. The Try-boundary protocol + +The δ boundary is where coherence is earned. The full sequence for a +δ-argument (entered at A6, `Try_g(c)` retaining the argument closure): + +1. **Forward**: the argument evaluates under the `Try` frame, + accumulating `Join`/`Look` tags; earlier δs inside the argument fire + normally (branching the configuration). +2. **Copy (CP)**: on `Ret⟨b̂⟩ | Try_g(c)`, the machine basis-copies the + result boolean into the frame — `Try_g(c, b̂)` — and flips to + `dir = Rev`. Per basis configuration this is a CNOT into a fresh + register: injective, branch-local, legal. +3. **Reverse**: `Rev` rows are the formal inverses of the forward rows, + popping tags in LIFO order and restoring predecessor configurations. + Crucially, reverse runs *through* interior δ firings as their + adjoint columns (`Q_q†` acting on the configuration superposition) — + reverse is always available because the machine is an isometry, and + no code-supplied inverse function is needed. The reverse pass ends, + by construction, at the unique `Try`-entry configuration whose + colour is `A6` — the frame itself is the entry marker. +4. **Fire**: the state is now the branch-independent entry + configuration tensored with the result register carrying the + argument's value superposition. The δ row (D1/D2) fires on the + result register, `Drop(c)` charges the retained closure, and + evaluation continues with the outcome literal. + +**What this buys.** Across the whole protocol the argument evaluation +acts as one coherent linear map from the entry configuration to the +result register — Bennett compute–copy–uncompute with the input +retained by the frame, so injectivity of the *computed function* is +never needed (retaining the input makes `c ↦ (c, f(c))` injective for +every `f`). The tags written by divergent branch control are unwound +symmetrically, so post-protocol branches differ **only in the result +register and in global timing**. + +**What it honestly does not buy.** Branches whose forward evaluation +took different numbers of transitions finish the protocol at different +global times and never interfere — the synchronization convention, +resurfacing as the machine-level residue of control divergence. A +δ-argument interferes coherently iff its branch paths are +transition-count-equal. This *derives* the architecture §6 +clean-compilation requirement (single common `T`) from machine +structure instead of stipulating it, and defines the clean fragment +operationally: **code whose branch paths are length-balanced**. + +**Witness 7.** `NOT′ = λb.λx.λy. b y x` is path-symmetric: both +booleans drive rule-for-rule identical control (`A3·A3`, the `b` +lookup, two `A2`s, one selection lookup, readback) with equal +transition counts, differing only in `Look` content that the reverse +pass pops. Hand trace (§6.2): the protocol returns the entry +configuration with result register `(1/√2)(|1̂⟩ ± |0̂⟩)` per branch +sign, the outer D1 fires, and the `1̂` amplitudes cancel — mass 1 on +`0̂`. The witness-pinning amendment (architecture witness 7 names +`NOT′` and the protocol) travels with this draft's review. + +**[open — protocol determinism obligations]** (i) CP fires whenever a +basis boolean returns under `Try` — forward-deterministic; A6b's +short-circuit must be ordered before CP for already-literal booleans +(else HH's outcomes would pay a full protocol pass; ordering is a +determinism choice to pin, and either choice is sound — the +short-circuit is an optimization with identical amplitudes since a +literal's protocol is empty). (ii) `Rev` rows need their own +backward-determinism check: `dir`+colour makes their ranges disjoint +from forward rows, and each `Rev` row's injectivity is its forward +row's. (iii) The direction flip at CP and the flip back at fire are +paired; neither "clears" anything — the v0 freshness defect does not +recur. + +## 6. Witnesses by hand + +### 6.1 HH — raw, no protocol + +`h (h 0̂)`: shared prefix A1·A6(outer)·A1·A6(inner)·A3·A3·A5·R1·R1 +(one `Look`, common), inner CP/trivial-protocol, D1 branches with +shared colour and `Join`; each outcome short-circuits via A6b to the +outer `Try`, outer protocol is empty (literal), outer D1 fires per +branch, residues equal throughout, `1̂` cancels: mass 1 on `0̂`. +Control paths are rule-identical across branches — HH interferes raw, +as §2.2 promises. + +### 6.2 H–NOT–H — protocol-mediated + +`h (NOT′ (h 0̂))`: shared prefix through the inner D1; branches carry +`b̂ = 0̂/1̂` with equal residue; forward evaluation of `NOT′ b̂` runs +length-equal, rule-identical control with branch-divergent `Look` +content (`Look(2, [Clo(x̄), _])` vs `Look(1, [_, Clo(ȳ)])`); CP copies +`1̂`/`0̂`; reverse pops the `Look`s and `Join`s symmetrically and runs +back through the inner D1 adjoint; the entry configuration +re-materializes branch-independently with result register +`H·X`-transformed; outer D1 fires; `1̂` amplitudes cancel: **mass 1 on +`0̂`**. With the selector `NOT = λb. b 1̂ 0̂` the forward paths are +also length-equal in this table — the selector's decoherence in v0 came +from permanent tags, which the protocol now pops — so v1 predicts the +selector *also* passes; the pinned witness stays `NOT′` because its +symmetry is robust to table refinements, and the selector's fate is a +measurable, not a gate. **[open: both traces to be verified +step-indexed in review]** + +## 7. Invariant sectors + +Unchanged from v0 (review-confirmed): `RunDone`/`Halt`/`Error` are +typed constructors, F2/F3/F4 realize the normative halted dynamics and +its error twin, newly halting amplitude lies in the wandering subspace, +and the monotone-mass lemma instantiates verbatim. + +## 8. Bookkeeping + +### 8.1 v0 defect resolution map + +| v0 defect | v1 resolution | +|---|---| +| A2 non-injective under trimming | no-erasure forward machine: trimming abolished (§1) | +| A1/A2 range collision | colour discipline: ranges disjoint by `via` (§2.1) | +| A6′ domain/range collisions | A6b colour + A3 `Try` exclusion (§3) | +| E1 drops `(S, m)` | `Error` retains full control (§1, §3) | +| D3/R3 stale-tag collision | colour discipline (§2.1) | +| freshness flag non-reversible | no flags; paired CP/fire direction flips (§5) | -```text -branch 0̂: A4 on Var 2 → tag Look(2, [Clo(0̂,∅), _]) -branch 1̂: A4 on Var 1 → tag Look(1, [_, Clo(1̂,∅)]) -``` +### 8.2 Formalization checklist (live) -The tags differ, the branches reach the outer `D1` with unequal -residue, the `1̂` amplitudes fail to cancel, and the halting state is -the (1/2, 1/2) mixture. **Correct theorem (review-verified): permanent -`Look(i, e∖i)` residue in this table makes selector H–NOT–H decohere -unless a code-aware cleanup transition removes it.** - -Two stronger claims made by v0 are **retracted**: - -- *"No local pop is legal"* — false. The selector's tag *is* determined - by its result once the decoder is known (`1̂ ↦ Look(2, [0̂,_])`, - `0̂ ↦ Look(1, [_,1̂])`): the unselected literal is the complement of - the selected one, fixed by the code. What is missing is live - *provenance* — a marker that this decoder applies — which makes it a - scheduling problem, not an information-theoretic impossibility. -- *"Any machine with permanent lookup residue fails"* — false. - Counterdesign `LookFull(e, r)` with `r` the occurrence ordinal of the - selected entry among equal entries of `e`: injective (recover `i` as - the `r`-th occurrence of the returned closure in `e`), permanent, and - *branch-independent* whenever the whole environment is — for the - selector both branches write the identical `LookFull([0̂,1̂], 1)`. It - violates the local-minimality economy by design, but it refutes the - universal claim and marks a genuine machine-design axis (§7.3). - -### 5.3 Coherence is operational injectivity, not syntactic linearity - -v0 conjectured that terms linear in the consumed boolean are -coherence-transparent under a generic pop-at-Ret rule. **Both halves -are false** (review countermodels, verified): - -- *Generic pop-at-Ret is unsound.* `N = λb.λx.λy. b y x` applied to - `1̂` and `I' = λb.λx.λy. b x y` applied to `0̂` both return `0̂` at - the same frame shape and depth, with *different* selection tags - (`Look(1, [_,Clo(ȳ)])` vs `Look(2, [Clo(ȳ),_])`). A pop keyed only - on the returned NF and frame would merge distinct configurations — - non-injective — and since `p` is not a basis coordinate, the inverse - cannot consult program identity. The NF ↔ tag bijection exists only - relative to a retained code/call-site decoder. -- *Linearity is not sufficient.* `λb. b I I` uses `b` exactly once and - maps both booleans to `I`: the computed function is non-injective, so - by injectivity of `U` the consumed bit *must* persist somewhere, and - no cleanup can produce equal residue. Conversely, syntactic - duplication can be coherent — basis-copying `b ↦ (b, b)` is - injective. - -The correct notion: **coherence-transparency requires operational -injectivity of the computed map on the branch support, plus a -synchronized, code-aware cleanup schedule.** Erasure = non-injectivity -of the computed function, and *that* is what costs coherence — the -Landauer reading survives, attached to semantics rather than syntax. - -### 5.4 The sound scheduling shape: explicit reversible uncomputation - -The plausible construction (review round, unproved here) is Bennett -compute–copy–uncompute specialized to the machine: - -1. push a branch-independent `CleanK(code, call-site)` frame; -2. evaluate forward, accumulating reversible tags; -3. copy the returned basis NF into a protected result zipper; -4. enter a distinct **reverse mode** and invert the forward transitions - in LIFO order; -5. use the protected result to reconstruct and clear the input when the - compiled map is injective; -6. return with a fixed direction state and branch-independent residual - control. - -The direction flag is safe only because reverse execution restores it — -it is never "cleared" by a forward row. Proving this schedule sound for -one pinned NOT term is **the smallest clean-compilation lemma**, and it -is the actual content behind witness 7. - -### 5.5 Contract implication (review-ratified direction) - -Witness 7 stands as a machine gate, in the satisfiable world: pin an -exact NOT wire term (`NOT′ = λb.λx.λy. b y x` is a reasonable choice — -easier for this machine, though the selector NOT is *not* intrinsically -incoherent: Boolean NOT is bijective and its alternatives are fixed -code, so a sufficiently code-aware reversible compilation can clean it -too); state that passing the witness requires a proved code-aware -reversible cleanup schedule; and treat the whole thing as the first -concrete lemma of clean coherent compilation rather than a theorem -about binder counts. The witness-pinning amendment goes back through -the review thread with v1. - -## 6. Invariant sectors - -`RunDone`, `Halt`, `Error` are basis constructors; F1–F4 are rows of the -same table. F2/F3 realize the architecture's normative halted dynamics -(`id_output ⊗ id_garbage ⊗ id_terminal-control ⊗ shift_tick`, entry at -tick 0); F4 is its error-sector twin. The monotone-halting-mass lemma -(architecture §4.3) instantiates directly: the halt sector is spanned by -`Halt(·)` configurations, F2 maps into it, F3 maps it into itself -injectively, no row maps out of it, and newly arriving amplitude lies in -the wandering subspace `S ⊖ V(S)` by the typed entry. The same argument -covers `Error` verbatim. - -## 7. v0 defect register and the v1 direction - -### 7.1 Confirmed table defects (review countermodels) - -1. **A2 is not injective under canonical trimming.** For a vacuous - binder, `Eval⟨(Lam I, ∅)⟩ | Arg(X)` and `| Arg(Y)` both land at - `Eval⟨(I, ∅)⟩` once the constructed closure trims the unused entry. - The discarded argument is genuine erased content: v1 must either - route it to residue (the sketch's binding-erasure row, lost in v0) - or abandon trimming-at-construction for bound entries. Separately, - trimming must be suffix-only or `Env` must become a sparse indexed - map — deleting interior entries shifts de Bruijn indices. -2. **A1 and A2 ranges collide** on unconstrained `Eval` targets: - `((λx.x) X) Y` and `(λx. x Y) X` both reach - `Eval⟨(Var 1, [X])⟩ | Arg(Y)::S`. The v0 "clean pairs" claim checked - only marked-target rules; deterministic rows need producer marking - too. -3. **A6′** overlaps A3's domain (needs explicit exclusion) and its - target collides with genuine R1 readback of a non-literal - normalizing to a boolean; it needs a distinct landing mode - (`ReadyBool` with branch-independent provenance), which HH tolerates. -4. **E1 is not injective**: it drops `S` and `m` (`h I` vs `(h I) A` - reach the same error with different discarded continuations). Error - garbage must retain the complete discarded control: `(S, m, n, g)`. - Error-sector coherence is irrelevant; norm preservation is not. -5. **D3/R3 collide** through stale `Jn_g` residue, and the one-bit - freshness proposal is itself non-reversible — clearing a flag merges - its prior values. Producer marking must be **rule-coloured landing - modes removed only through explicit inverse/uncompute paths**, not - flags cleared by forward rows. - -### 7.2 What stands after review - -The invariant-sector construction and wandering-subspace argument (§6); -the H–NOT–H decoherence trace and its corrected narrow theorem (§5.2); -the operational-injectivity reformulation (§5.3); the Bennett scheduling -shape (§5.4); I1/I5 provisionally, with induction proofs deferred until -the coloured-mode table exists. - -### 7.3 The v1 design fork (machine-defining, to be settled before v1) - -The canonical machine — and therefore the canonical `Ω_qALC` — depends -on a genuine choice surfaced by the `LookFull` counterdesign: - -- **(A) Minimal tags + code-aware reversible cleanup**: residue is - locally minimal (`Look(i, e∖i)` style), coherence is *earned* through - explicit compute–copy–uncompute (§5.4), and the coherence economy is - a rich measured object — programs that clean up interfere, programs - that don't decohere. -- **(B) Symmetric redundant tags (`LookFull`-style)**: residue retains - branch-independent context wherever possible, more coherence comes - for free, the witness passes with less machinery — and the measured - economy flattens, since redundancy substitutes for uncomputation. - -These define *different canonical objects*, in the same way the frozen -signature order defines qBLC's: the choice must be made deliberately, -recorded, and then pinned. v0's working recommendation is (A), for -alignment with the architecture's local-minimality theorem and because -(B) hides exactly the erasure structure the pillar exists to measure — -but the fork is open until ratified. - -### 7.4 Formalization checklist (live status) - -| Item (architecture §9 / machine §6) | Status | +| Item | Status | |---|---| -| Transition table, total on reachable `Config` | v0 drafted; **rebuild for v1** with coloured landing modes (§7.1) | -| Per-rule injectivity | v0 claims partially refuted (A2, E1); redo in v1 | -| Range disjointness | v0 claim false (A1/A2); needs producer marking throughout | -| Local predecessor-fibre minimality | blocked on the §7.3 fork | -| Invariant-sector lemma in-machine | **done** (§6, review-confirmed) | -| HH witness by hand | amplitude computation confirmed; conditional on A6′ repair | -| H–NOT–H witness by hand | decoherence trace confirmed; coherent path = smallest clean-compilation lemma (§5.4) | -| Witness-7 pinning amendment (NOT′) | drafted direction (§5.5); thread ratification with v1 | -| Effect-free projection lemma | open | -| Clean compilation (architecture item 2) | §5.4 is its smallest instance; substrate = operationally injective maps | +| Transition table, total on reachable `Config` | v1 drafted (§3, §5); Rev rows schematic | +| Injectivity / range disjointness | theorem shape §2.1; rowwise inverses stated; full proof after review | +| Local minimality | reframed as the transparency program (§2.3) | +| Invariant-sector lemma | done (review-confirmed) | +| HH by hand | done raw (§6.1) | +| H–NOT–H by hand | done via protocol (§6.2); step-indexed verification open | +| Witness-7 pinning (NOT′ + protocol) | drafted; travels with this review | +| Effect-free projection lemma | open; expect: term projection = rigid-atom sequence, administrative rows are A6b/CP-free on effect-free runs | +| Clean compilation | operationally derived: length-balanced code + protocol (§5); formal statement open | From e819d80b83f7d161c489fb533c78ea98a419b1b8 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 05:01:24 -0400 Subject: [PATCH 011/107] docs: normalize colour -> color (American spelling, matches future Rust identifiers) Co-Authored-By: Claude Fable 5 --- docs/ledger/2026-08.md | 2 +- docs/quantum-algebraic/machine.md | 40 +++++++++++++++---------------- 2 files changed, 21 insertions(+), 21 deletions(-) diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 3b73f77..6d1d3ad 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -1916,7 +1916,7 @@ code-aware cleanup** — Landauer attached to semantics, not syntax. Five table defects registered (A2 vs trimming on vacuous binders, A1/A2 range collision, A6′ unsound as displayed, E1 drops control, D3/R3 stale-tag collision; one-bit freshness is non-reversible). v1 -direction ratified by the review: rule-coloured landing modes with +direction ratified by the review: rule-colored landing modes with explicit forward/reverse (Bennett) control; witness 7 stands, to be pinned to an exact NOT wire term, with its proof the smallest clean-compilation lemma. One machine-defining fork left deliberately diff --git a/docs/quantum-algebraic/machine.md b/docs/quantum-algebraic/machine.md index a388042..297a574 100644 --- a/docs/quantum-algebraic/machine.md +++ b/docs/quantum-algebraic/machine.md @@ -15,10 +15,10 @@ review: exists only as explicit, reversible discard-to-residue, and most of v0's injectivity defects dissolve because the information they lost is simply never lost. -2. **Rule-coloured configurations with join charging** (§2): every - running configuration carries the colour (rule id) of its producer; - every step charges a `Join` tag recording its predecessor's colour. - Ranges are pairwise disjoint by colour, backward determinism is +2. **Rule-colored configurations with join charging** (§2): every + running configuration carries the color (rule id) of its producer; + every step charges a `Join` tag recording its predecessor's color. + Ranges are pairwise disjoint by color, backward determinism is structural, and the local-minimality theorem becomes a monotone research program (§2.3) rather than a single fragile claim. 3. **The Try-boundary protocol** (§5): coherent gate application is @@ -55,15 +55,15 @@ Frame ::= Arg(Clo) | Try_g(Clo) — δ boundary; RETAINS the argument closure | Try_g(Clo, b̂) — after result copy (protocol, §5) -Res ::= Join(colour) — predecessor colour, charged every step +Res ::= Join(color) — predecessor color, charged every step | Look(i, Env∖i) — lookup content (A4/A5 only) | Drop(Clo) — explicit discard (δ-fire only, §5) -Colour ::= Init | A1 | A2 | A3 | A4 | A5 | A6 | A6b | A7 +Color ::= Init | A1 | A2 | A3 | A4 | A5 | A6 | A6b | A7 | R1 | R2 | R3 | D1 | D2 | D3 | CP | RV(c) Config ::= - Run(dir: Fwd | Rev, via: Colour, mode: Eval(Clo) | Ret(NF), + Run(dir: Fwd | Rev, via: Color, mode: Eval(Clo) | Ret(NF), S: [Frame], m: depth, R: [Res]) | RunDone(nf, R, c⊥) | Halt(nf, R, c⊥, k) @@ -74,22 +74,22 @@ Config ::= the complete discarded control `(S, m, offending NF, gate)` — v0's E1 defect. -## 2. The colour discipline +## 2. The color discipline ### 2.1 Structure Every forward row `r` fires from a source pattern (which does not constrain `via` — any producer is acceptable), sets the target's `via := r`, and pushes `Join(source.via)`. Reverse rows (§5) are the -formal inverses: they read their own colour, pop the `Join`, and +formal inverses: they read their own color, pop the `Join`, and restore the predecessor. **Theorem shape (injectivity).** For forward rows: given a target `(Fwd, via = r, core′, R·Join(v))`, rule `r` is identified by `via`, its core inverse (§3, rowwise) reconstructs the source core from -`core′` plus `r`'s content tags, and the source colour is `v`. Two +`core′` plus `r`'s content tags, and the source color is `v`. Two distinct sources cannot share a target: same `via` forces the same -rule, same `Join` forces the same predecessor colour, and rowwise core +rule, same `Join` forces the same predecessor color, and rowwise core injectivity forces the same core. Range disjointness across rules is immediate from `via`. δ fibres: the two outcomes of one `D1` firing share `via`, `Join`, and spectators, differing only in the outcome @@ -97,7 +97,7 @@ boolean — the fibre is `Q_q ⊗ J_q` with `J_q` realized by (`via := Dq`, push `Join`), identical across input and output booleans, and fibres from distinct sources are orthogonal because spectators or `Join` content differ. Cross-gate orthogonality `J_h†J_t = 0` is the -colour disjointness `D1 ≠ D2`. This realizes the architecture's clean +color disjointness `D1 ≠ D2`. This realizes the architecture's clean δ fibre clause exactly. ### 2.2 What conservative charging costs, honestly @@ -115,7 +115,7 @@ same-control interference (HH) survives raw. ### 2.3 The minimality program -A row is *via-transparent* if its source colour is derivable from the +A row is *via-transparent* if its source color is derivable from the rule plus target core on reachable configurations — then its `Join` push can be soundly omitted. v1 charges every row (conservative, sound). Each via-transparency lemma proved later removes a tag class @@ -161,7 +161,7 @@ A7 Eval⟨(g, e)⟩ | S, top∉Arg → Ret⟨g⟩ | S `Try_g(c)` retains the argument closure — the δ boundary is also the protocol boundary of §5. A6b is the boolean short-circuit; its v0 -collisions with A3 and R1 are resolved by colour (`via = A6b`) and by +collisions with A3 and R1 are resolved by color (`via = A6b`) and by A3's explicit `Try` exclusion. A6's source keeps `e` in the closure `c`'s captured environment; nothing is dropped. @@ -233,7 +233,7 @@ The δ boundary is where coherence is earned. The full sequence for a reverse is always available because the machine is an isometry, and no code-supplied inverse function is needed. The reverse pass ends, by construction, at the unique `Try`-entry configuration whose - colour is `A6` — the frame itself is the entry marker. + color is `A6` — the frame itself is the entry marker. 4. **Fire**: the state is now the branch-independent entry configuration tensored with the result register carrying the argument's value superposition. The δ row (D1/D2) fires on the @@ -276,7 +276,7 @@ short-circuit must be ordered before CP for already-literal booleans determinism choice to pin, and either choice is sound — the short-circuit is an optimization with identical amplitudes since a literal's protocol is empty). (ii) `Rev` rows need their own -backward-determinism check: `dir`+colour makes their ranges disjoint +backward-determinism check: `dir`+color makes their ranges disjoint from forward rows, and each `Rev` row's injectivity is its forward row's. (iii) The direction flip at CP and the flip back at fire are paired; neither "clears" anything — the v0 freshness defect does not @@ -288,7 +288,7 @@ recur. `h (h 0̂)`: shared prefix A1·A6(outer)·A1·A6(inner)·A3·A3·A5·R1·R1 (one `Look`, common), inner CP/trivial-protocol, D1 branches with -shared colour and `Join`; each outcome short-circuits via A6b to the +shared color and `Join`; each outcome short-circuits via A6b to the outer `Try`, outer protocol is empty (literal), outer D1 fires per branch, residues equal throughout, `1̂` cancels: mass 1 on `0̂`. Control paths are rule-identical across branches — HH interferes raw, @@ -326,10 +326,10 @@ and the monotone-mass lemma instantiates verbatim. | v0 defect | v1 resolution | |---|---| | A2 non-injective under trimming | no-erasure forward machine: trimming abolished (§1) | -| A1/A2 range collision | colour discipline: ranges disjoint by `via` (§2.1) | -| A6′ domain/range collisions | A6b colour + A3 `Try` exclusion (§3) | +| A1/A2 range collision | color discipline: ranges disjoint by `via` (§2.1) | +| A6′ domain/range collisions | A6b color + A3 `Try` exclusion (§3) | | E1 drops `(S, m)` | `Error` retains full control (§1, §3) | -| D3/R3 stale-tag collision | colour discipline (§2.1) | +| D3/R3 stale-tag collision | color discipline (§2.1) | | freshness flag non-reversible | no flags; paired CP/fire direction flips (§5) | ### 8.2 Formalization checklist (live) From 7f28eec906ebd9f15859e1f433b4e9024a2c7db6 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 05:03:23 -0400 Subject: [PATCH 012/107] =?UTF-8?q?docs:=20qALC=20machine=20v1=20verdict?= =?UTF-8?q?=20registered=20=E2=80=94=20protocol=20broken=20by=20no-cloning?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review verdict: scaffold holds (no-erasure A2 repair, Drop branch-independence, color+Join killing the v0 cross-rule collisions, clean fibres compatible with colors), Try-boundary protocol CONFIRMED-BROKEN: CP basis-copies a superposed result, CNOT(|+>|0>) = Bell, (H x I)Bell != |0>|+>, (H x H)Bell = Bell — the copy entangles with history, uncomputation cannot restore the entry configuration, and HH itself breaks (outer argument h 0-hat is not a literal). The input-retained Bennett argument fails as applied: Try retains syntax, not the branch input as a register. Sections 5-6 retained as the record of a productive failed construction. Registered: six residual v1-local defects, the conservative-Join contract drift (transparency set vs architecture amendment), and three unadjudicated v2 routes (classical-restricted Bennett + compiled-gadget witness; token-style no-copy transport; raw machine + code-side coherence). Do not build src/qalc on v1. Co-Authored-By: Claude Fable 5 --- docs/quantum-algebraic/machine.md | 94 +++++++++++++++++++++++++++++-- 1 file changed, 88 insertions(+), 6 deletions(-) diff --git a/docs/quantum-algebraic/machine.md b/docs/quantum-algebraic/machine.md index 297a574..59f66f9 100644 --- a/docs/quantum-algebraic/machine.md +++ b/docs/quantum-algebraic/machine.md @@ -1,11 +1,17 @@ # qALC reference machine — formal draft v1 -**Status: formal draft v1, submitted for adversarial review.** Working -object for `architecture.md` §9 item 1. v0's review verdict, refuted -claims, and defect register are in `../ledger/2026-08.md`; every v0 -defect has a v1 resolution (§8.1). Fork (A) of the v0 register — -minimal-information residue with *earned* coherence — is ratified and -built in. The architecture contract wins wherever they disagree. +**Status: formal draft v1 — reviewed; Try-boundary protocol +CONFIRMED-BROKEN, scaffold survives.** Working object for +`architecture.md` §9 item 1. The v1 review verdict is registered in §9: +the no-erasure forward machine and the color discipline hold (with +three residual within-row defects), but the §5 protocol fails on a +no-cloning countermodel — basis-copying a superposed result entangles +the copy with the computation history, so the reverse pass cannot +restore the entry configuration — taking §6's witness traces down with +it. Sections 5 and 6 are retained as the record of a productive failed +construction; do not build on them. v2 routes are in §9.4. Review +history: `../ledger/2026-08.md`. Fork (A) remains ratified. The +architecture contract wins wherever they disagree. v1 is organized around three design commitments that answer the v0 review: @@ -345,3 +351,79 @@ and the monotone-mass lemma instantiates verbatim. | Witness-7 pinning (NOT′ + protocol) | drafted; travels with this review | | Effect-free projection lemma | open; expect: term projection = rigid-atom sequence, administrative rows are A6b/CP-free on effect-free runs | | Clean compilation | operationally derived: length-balanced code + protocol (§5); formal statement open | + +## 9. v1 review verdict (registered) + +### 9.1 The fatal countermodel (no-cloning) + +Model an inner δ-argument as work register `V = H` on `|0⟩` with a +fresh result register. Forward: `H|0⟩ = |+⟩`. CP basis-copies: +`CNOT(|+⟩|0⟩) = (|00⟩+|11⟩)/√2 = |Φ⁺⟩`. Reversing the work register: + +```text +(H ⊗ I)|Φ⁺⟩ = ½[ |0⟩(|0⟩+|1⟩) + |1⟩(|0⟩−|1⟩) ] ≠ |0⟩|+⟩ +(H ⊗ H)|Φ⁺⟩ = |Φ⁺⟩ +``` + +The copy is entangled with the source; uncomputation cannot restore a +branch-independent entry configuration, and tracing the work register +leaves the maximally mixed result. Basis-copying an unknown +superposition is the standard obstruction, and the v1 CP step commits +it. Consequently broken: §6.1 (HH — the outer argument `h 0̂` is not a +literal, so its protocol is nontrivial), §6.2, the H–NOT–H claim, and +the selector prediction. The input-retained Bennett argument fails as +applied: `Try_g(c)` retains *syntax*, not the quantum branch input as +an independent register, and `f(c)` as a superposition makes CP produce +entanglement, not a `(c, f(c))` tensor product. Equal transition count +is necessary for interference but not sufficient. + +### 9.2 What holds + +No-erasure repairs A2 (env-head pop is a true inverse; dead entries +change configuration identity, not the projected reduction sequence). +`Drop(c)` is branch-independent within one δ fibre. Color + `Join` +eliminates the v0 cross-rule collisions (A1/A2, D3/R3), conditional on +rowwise core injectivity. Clean δ fibres are compatible with colors +(D1's outcomes share color, `Join`, spectators; `J_h†J_t = 0` is +`D1 ≠ D2`). Reverse-through-δ is locally definable as an isometric +tagged-fibre adjoint — but "reverse is always available because the +machine is an isometry" is too strong globally: each reverse row's +domain and range must be explicit, and a lone outcome maps under `H†` +into counterfactual predecessor components. + +### 9.3 Residual table defects (v1-local, repairable) + +1. A3's blanket `Try` exclusion strands non-boolean lambdas under + `Try_g` (`h (λx.x)` never reaches E1): A3 must fire under `Try` for + non-canonical lambdas, A6b taking priority only on `0̂`/`1̂`. +2. A6b erases the selected closure's captured environment (its source + has `Eval⟨(b̂, e)⟩`, its target only `b̂` and `c`): retain or charge + `e`. +3. E1 still drops `c` from the retained control. +4. I2 must be scoped to live environments — residue-held environments + can retain `Level(l)` past readback. +5. Residue push order (content tag vs `Join`) must be normative. +6. CP/Rev boundary rows were never actual table rows with a + deterministic stopping schedule. + +### 9.4 Contract drift and v2 routes + +**Drift**: conservative `Join` charging is a sound proof scaffold but +is not the architecture's predecessor-fibre-minimal machine; either the +maximal transparency set is finished and ratified before canonical +objects, or the architecture is amended to accept the conservative +colored machine as the semantic definition. + +**v2 routes** (review-suggested, unadjudicated): (a) restrict Bennett +cleanup to genuinely classical reversible subcomputations with retained +data registers, making coherent gate composition a *code-orchestrated* +discipline (compute; uncompute the input from the output where the +computed map is injective — the smallest clean-compilation lemma, +correctly posed at last) with witness 7 amended to a compiled gadget; +(b) a reversible interaction/token construction in which the output is +*transported* to the δ without basis-copying an unknown superposition — +the parked qGoI dynamics resurfacing as an internal mechanism rather +than a separate pillar; (c) accept the raw colored machine as the +canonical semantics and move all coherence engineering into compiled +code. The witness-7 amendment does not name any machine mechanism in +any route. From 8b978fbe94bdb8e868e375c3604dacd5fd7a5c93 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 05:12:13 -0400 Subject: [PATCH 013/107] =?UTF-8?q?docs:=20qALC=20route=20(b)=20pinned=20?= =?UTF-8?q?=E2=80=94=20token-transport=20v2=20brief;=20STATUS=20docket=20u?= =?UTF-8?q?pdated?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit token.md: exploration brief for the v2 token-transport machine — why tokens (IAM bideterminism may dissolve the injectivity war at the root; term read-only, no copies anywhere), the eight inherited guardrails from four review rounds (no basis-copying superpositions, global injectivity, typed sectors, timing physics, clean fibres, conservativity, witness battery, fork A), the six design questions (token state space, h-fibre on superposed positions, readback/NF story, exponential-context vs Look tags, synchronization, where Omega_qALC lives), and the required architecture section-8 amendment (token machine promoted from parked alternative to THE machine — thread ratification before drafting). machine.md 9.4 records the route choice; STATUS carries the v1 outcome and reordered docket. Written for a fresh-context continuation. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 20 ++++-- docs/quantum-algebraic/machine.md | 4 +- docs/quantum-algebraic/token.md | 111 ++++++++++++++++++++++++++++++ 3 files changed, 127 insertions(+), 8 deletions(-) create mode 100644 docs/quantum-algebraic/token.md diff --git a/docs/STATUS.md b/docs/STATUS.md index f652f6f..d82a296 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -407,17 +407,23 @@ with the pre-formal reversible-machine sketch in rounds of adversarial review on gaslamp thread `qalc-architecture` concluded in a sign-off at `27f2c4b` (history in `ledger/2026-08.md`). +Machine formalization is two failed-productively drafts deep +(`quantum-algebraic/machine.md`; v0 broke on producer marking, v1's +Try-boundary protocol broke on no-cloning — verdicts registered in §9 +and the ledger). The surviving scaffold: no-erasure forward table, +color discipline, typed terminal sectors, witness battery. Route (b) — +token-transport dynamics — is the chosen v2 direction. + The open docket, in order: -1. the reversible machine: formal transition table on the - environment/closure substrate, orthonormal-columns proof (full - pairwise matrix), local predecessor-fibre garbage minimality, - invariant-sector lemma, and the HH / H–NOT–H witnesses computed by - hand (`quantum-algebraic/machine.md` §6) — gates all implementation; -2. the clean coherent compilation theorem +1. ratify the architecture §8 amendment route (b) requires + (`quantum-algebraic/token.md` §4, thread `qalc-architecture`); +2. v2 token-transport machine design against the inherited constraints + (`quantum-algebraic/token.md` §§2–3), through the review loop; +3. the clean coherent compilation theorem (`quantum-algebraic/architecture.md` §6) — gates any universality claim; -3. then `src/qalc/`: reference evaluator first, census later. +4. then `src/qalc/`: reference evaluator first, census later. ## Repository and release state diff --git a/docs/quantum-algebraic/machine.md b/docs/quantum-algebraic/machine.md index 59f66f9..da20f6a 100644 --- a/docs/quantum-algebraic/machine.md +++ b/docs/quantum-algebraic/machine.md @@ -426,4 +426,6 @@ the parked qGoI dynamics resurfacing as an internal mechanism rather than a separate pillar; (c) accept the raw colored machine as the canonical semantics and move all coherence engineering into compiled code. The witness-7 amendment does not name any machine mechanism in -any route. +any route. **Route (b) chosen by a9, 2026-08-09** — exploration brief +and inherited constraints in `token.md`; the architecture amendment it +requires is `token.md` §4. diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md new file mode 100644 index 0000000..e60e2f0 --- /dev/null +++ b/docs/quantum-algebraic/token.md @@ -0,0 +1,111 @@ +# qALC machine v2 — token-transport exploration brief + +**Status: exploration brief, pre-design.** Route (b) of `machine.md` +§9.4 — a reversible interaction/token construction in which values are +*transported* to δs rather than copied — was chosen by a9 (2026-08-09) +as the v2 direction after the v1 Try-boundary protocol fell to the +no-cloning countermodel. This brief pins what any v2 design must +inherit from the four completed review rounds, the questions it must +answer, and the one contract amendment it requires. Written for a +fresh-context continuation; read `architecture.md`, `machine.md` §9, +and the ledger entry first. + +## 1. Why tokens + +The Interaction Abstract Machine (Danos–Regnier) runs on untyped pure +terms, never rewrites the term, and is **bideterministic — natively +reversible**. The entire v0/v1 injectivity war (producer marking, +color disciplines, join charging) may dissolve at the root: orthonormal +columns could come from the dynamics instead of being engineered onto +it. The term is read-only, so there is no substitution, no closure +construction, no environment erasure — the state is a token position +plus context stacks, and the exponential-context stack plays the role +our `Look` tags played, reversibly by construction. Quantum prior art: +Hasuo–Hoshino (quantum GoI), Dal Lago–Faggian–Valiron–Yoshimizu +(multitoken machines) — typed/linear-logic settings; the untyped port +is the open engineering. + +## 2. Inherited constraints (the four rounds' guardrails) + +Any v2 design is dead on arrival unless it respects: + +1. **No basis-copying of unknown superpositions** — the v1 killshot: + `CNOT(|+⟩|0⟩) = |Φ⁺⟩`, `(H⊗I)|Φ⁺⟩ ≠ |0⟩|+⟩` (`machine.md` §9.1). + Values reach δs by *transport* or not at all. +2. **Global single-map injectivity on the reachable basis** — bare + syntactic states are too coarse (the `λf. f (h 0̂) 0̂` overlap); + whatever the token state is, distinct sources need orthogonal + images under every iterate, checked as a full pairwise matrix. +3. **Typed invariant halting sectors with ticks** (frozen architecture + §4.3): no reachable fixed points; `RunDone → Halt(…,0)`; common + origin; error sectors identically, retaining complete discarded + control (v1 defect: dropping the continuation breaks injectivity + even where coherence is irrelevant). +4. **Interference = same configuration, same global time.** Timing is + physical; length-unbalanced branches decohere honestly. Any claimed + coherence must survive a step-indexed trace. +5. **Clean δ fibres, gate-indexed** (frozen architecture §7): + `U|q,b,κ⟩ = Σ (Q_q)|b′, J_q(κ)⟩`, `J_q†J_r = δ_qr I`, landings + boolean-independent, orthogonal to all non-δ ranges. In token + terms: how a δ node acts on a passing token must have exactly this + fibre structure, including when the token *position* superposes + (quantum control is the point — a classically-positioned token with + a quantum payload is design A again). +6. **Effect-free conservativity** against rigid-atom leftmost + reduction (projected fate identity — for a token machine this + becomes: the path semantics restricted to constant-free runs must + compute the same normal forms; the strong-normalization/readback + story is where IAM-style machines are weakest, and the census needs + NFs). +7. **Witness battery**: HH must cancel; H–NOT–H is the coherence bar; + witness statements name wire terms only, never machine mechanisms + (review-ratified). `λb. b I I` (non-injective map) must *not* come + out coherent — unitarity forbids it. +8. **Fork (A) stands**: minimal-information residue, earned coherence, + and any residual charging must land in the predecessor-fibre + minimality frame (or amend the architecture explicitly). + +## 3. Questions the design must answer + +1. What is the token state space (position, direction, multiplicative + and exponential stacks — and payload?), and is the *linear + extension of the token step* on ℓ²(token states) an isometry for + free from bideterminism, once δ-branching is added as a unitary + block? +2. How does `h` act: the token position superposing over the two + boolean answers to a query is the natural guess — spell out the + fibre and check constraint 5. +3. Readback: IAM natively answers head/path queries; the census needs + full normal forms and halting masses. Exhaustive path enumeration, + jumping variants (Danos–Regnier's optimal/jumping machines), or a + readback driver looping the token — and what "halting" is + (constraint 3) when the machine is a wanderer rather than a + rewriter. +4. Duplication: non-linear code revisits subterms with different + exponential contexts — verify this genuinely replaces the v0/v1 + `Look` content tags and what, if anything, is charged. +5. Timing: token path lengths differ across branches — same + synchronization physics (constraint 4); check H–NOT–H path lengths + concretely for `NOT′` and the selector. +6. Where does `Ω_qALC` live: per-program halting mass as the norm of + what, and does the Loewner-monotone output-block structure + (architecture §4.6) survive the change of machine? + +## 4. Contract amendment required + +Architecture §8 ("β-dynamics on a new reversible machine") currently +*parks* the token alternative as "different objects … a separate +pillar, never a drop-in engine." Route (b) makes the token machine +*the* qALC machine, which is an amendment to that frozen design +decision — it must be ratified through the `qalc-architecture` thread +(where Codex proposed route (b)) before v2 is drafted against the +contract, and the β-dynamics text rewritten to record why the pivot +happened (the §9.1 countermodel) rather than silently swapped. + +## 5. What carries over from v1 regardless + +The typed terminal sectors and their lemma (review-confirmed twice); +the witness battery and hand-trace discipline; the defect-register +habit; the color-discipline *idea* as a fallback producer-marking tool +if bideterminism has gaps at the δ or readback boundaries; and the +review loop itself — draft, thread, countermodel, register, iterate. From c36577b46320f9c7a96bbd107c6cd607054c6ca4 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 05:12:35 -0400 Subject: [PATCH 014/107] =?UTF-8?q?docs:=20ledger=20=E2=80=94=20v1=20kills?= =?UTF-8?q?hot=20and=20route=20(b)=20decision;=20session=20pinned=20for=20?= =?UTF-8?q?compaction?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Fable 5 --- docs/ledger/2026-08.md | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 6d1d3ad..5fd1393 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -1924,3 +1924,30 @@ open for ratification before v1: minimal tags + earned coherence (A) versus symmetric redundant tags (B) — different canonical `Ω_qALC`, recorded in `machine.md` §7.3. All incorporated in the same-day machine.md revision. + +**v1 and its killshot** (same day). a9 ratified fork (A); machine.md +v1 (`632cb50`) rebuilt the table on three commitments: a no-erasure +forward machine (trimming abolished — A2 injective by env-head pop), +rule-colored configurations with per-step `Join` charging (ranges +disjoint by color; minimality recast as a monotone program of +via-transparency lemmas), and a Try-boundary protocol +(forward–copy–reverse through interior δs) claimed to earn coherence +and derive the common-`T` clean-compilation requirement from machine +structure. **Review verdict: scaffold HOLDS (no-erasure, color +discipline, clean fibres, terminal sectors), protocol +CONFIRMED-BROKEN by no-cloning**: the CP step basis-copies a +superposed result — `CNOT(|+⟩|0⟩) = |Φ⁺⟩`, `(H⊗I)|Φ⁺⟩ ≠ |0⟩|+⟩` — so +the copy entangles with the history, the reverse pass cannot restore +the entry configuration, and even HH fails (its outer argument is not +a literal). Six residual v1-local defects and one contract-drift flag +(conservative `Join` vs the frozen minimality gate) registered in +`machine.md` §9. The corrected structural lesson: coherent gate +composition through λ-computation is irreducibly code-orchestrated — +v0's forcing intuition returns for the right reason (no-cloning, not +tag permanence). **a9 chose route (b) — token-transport dynamics — +for v2**: IAM-style bideterminism may dissolve the injectivity war at +the root, values reach δs by transport rather than copy. Exploration +brief with the eight inherited guardrails, six design questions, and +the required architecture §8 amendment: `quantum-algebraic/token.md` +(`8b978fb`). Session pinned for compaction at this point; the v2 +design starts fresh against the brief. From bb0e917ec154a7c6f584a93c59bae6feab2c298a Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 05:40:33 -0400 Subject: [PATCH 015/107] qalc: token-machine amendment ratified and applied; v2 design sketch MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Architecture §8 pivot to IAM-lineage token transport, ratified through thread qalc-architecture (AMEND-then-RATIFY) with consequential edits: init as root query token over invocation sectors, isometric halted factorization NF x garbage x control x tick, observational strategy clause, generator-duplication constraint, delta-rules as fibre amplitude specs, negative witness as battery item 8, Danos-Regnier in the lineage. token.md grows from brief to working design: exact lambda-IAM table (bideterminism verified independently by the fresh feasibility thread qalc-token-machine, verdict promising-with-hard-open-problems), the delta-gadget sketch (probe protocol, unitary blocks on arrival states, balanced virtual answers, no-store consistency), eight-point isometry checklist, lambda-JAM exclusion, and the three-program formal kernel as the v2 gate. STATUS docket reordered; ledger carries both consults. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 37 +- docs/ledger/2026-08.md | 54 +++ docs/quantum-algebraic/architecture.md | 313 ++++++++++------- docs/quantum-algebraic/token.md | 460 +++++++++++++++++++++---- 4 files changed, 656 insertions(+), 208 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index d82a296..b2d3a39 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -401,25 +401,32 @@ A third pillar exists as a design contract only: `quantum-algebraic/architecture.md` (quantum control, storeless — runtime states in ℓ² over machine configurations, `h`/`t` constants at invocation, fate softened to a real halting mass `μ_p` with `Ω_qALC = Σ 2^(−|p|) μ_p`), -with the pre-formal reversible-machine sketch in +with the active machine design in `quantum-algebraic/token.md` and the +failed rewriting drafts (v0/v1) preserved in `quantum-algebraic/machine.md`. No engine, no data; -`data/quantum-algebraic/` is reserved. **The contract is frozen**: four -rounds of adversarial review on gaslamp thread `qalc-architecture` -concluded in a sign-off at `27f2c4b` (history in `ledger/2026-08.md`). - -Machine formalization is two failed-productively drafts deep -(`quantum-algebraic/machine.md`; v0 broke on producer marking, v1's -Try-boundary protocol broke on no-cloning — verdicts registered in §9 -and the ledger). The surviving scaffold: no-erasure forward table, -color discipline, typed terminal sectors, witness battery. Route (b) — -token-transport dynamics — is the chosen v2 direction. +`data/quantum-algebraic/` is reserved. **The contract is frozen and +amended**: four review rounds concluded in a sign-off at `27f2c4b`, and +the token-machine amendment — route (b) after v1's no-cloning killshot +— was ratified through thread `qalc-architecture` and applied +(2026-08-09; history in `ledger/2026-08.md`). The machine is now +IAM-lineage token transport: term read-only, bideterministic substrate +(exact λIAM table pinned in `token.md` §6), values transported to δs +by routing, never copied. + +The v2 design sketch is drafted (`token.md` §7: probe protocol, +δ blocks on arrival states, balanced virtual answers, no-store +consistency) and a fresh-context feasibility review (thread +`qalc-token-machine`) independently graded the route +promising-with-hard-open-problems, converging with the sketch on every +load-bearing point; its checklist and exclusions are folded in. The open docket, in order: -1. ratify the architecture §8 amendment route (b) requires - (`quantum-algebraic/token.md` §4, thread `qalc-architecture`); -2. v2 token-transport machine design against the inherited constraints - (`quantum-algebraic/token.md` §§2–3), through the review loop; +1. **the three-program formal kernel** (`token.md` §8 — the v2 gate): + full table, range-disjointness, step-indexed traces of HH / + H–NOT–H / the negative witness, column-Gram enumeration; L1/L2 and + the readback controller are the hard parts; +2. kernel through the review loop (both threads); 3. the clean coherent compilation theorem (`quantum-algebraic/architecture.md` §6) — gates any universality claim; diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 5fd1393..7af4b76 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -1951,3 +1951,57 @@ brief with the eight inherited guardrails, six design questions, and the required architecture §8 amendment: `quantum-algebraic/token.md` (`8b978fb`). Session pinned for compaction at this point; the v2 design starts fresh against the brief. + +**Amendment ratified; v2 sketch drafted; feasibility confirmed** +(2026-08-09, post-compaction continuation). Two consults ran in +parallel. The §8 amendment went to `qalc-architecture`: verdict +**AMEND, then RATIFY** — the reviewer's tightened replacement text +(bideterminism as guide-not-proof; immutable-invocation basis; +internal readback) was adopted along with consequential edits across +the whole contract: `init(p)` as a root query token with invocation +sectors, the isometric halted factorization +`ℓ²(NF) ⊗ garbage ⊗ control ⊗ tick` with many-to-one decoders +forbidden, the strategy clause re-scoped to observational +conservativity (a per-step leftmost projection demand would have +ruled out the adopted dynamics), duplication as the +generator-semantics constraint, error completeness, δ-rules recast as +fibre amplitude specifications, the `λb. b I I` negative witness +stated correctly as inner-product preservation (battery item 8; +bit-identical rows becomes 9), and Danos–Regnier entering the lineage +as the principal machine ancestor. "Different objects" resolved by +adoption, not refutation — no equivalence with the rewriting proposal +is claimed. + +Simultaneously a deliberately fresh-context thread +(`qalc-token-machine`) delivered an independent feasibility read: +**promising-with-hard-open-problems**. Plain λIAM + δ rules is BROKEN +(the machine stops at a rigid head and never enters its argument); +what is plausible is a λIAM-derived delimited query/return machine +with canonical readback — a new machine, not a small extension. The +review's λIAM table and bideterminism verification (partial bijection, +`flip` reversal, four inverse rule pairs, vs arXiv:2002.05649) matched +the table Claude had extracted from the literature the same hour, and +its raw canonical-boolean asymmetry derivation (`1̂` one `λ↑` step +behind `0̂`, binder positions in the exit tape) independently +reproduced the sketch's `l_a·μ` vs `•·l_b·μ` exit shapes — the two +analyses converged on every load-bearing point: balanced +boolean-independent answer transport is mandatory, readback must be an +internal reversible controller inside `U`, the λJAM jump rule is +noninjective and excluded, and the single hardest problem is clean +transport through nonlinear λ-code (H–NOT–H), clean for `NOT`, +residue-retaining for `λb. b I I`. + +`token.md` grew from brief to working design: exact λIAM substrate +(§6), the δ-gadget sketch (§7 — probe protocol with gate-tagged frame, +value-as-routing with exit-slot classification, the 2×2 block firing +on arrival states with the review's eight-point isometry checklist, +balanced virtual answers as the design freedom the classical IAM never +needed, no-store outcome consistency via return addresses, the +`h ((h 0̂) 0̂ 0̂)` decoherence sanity check giving mass 1/2 where a +merging machine would violate norm), and the obligations register (§8) +headed by the review's **three-program formal kernel** as the v2 gate: +full table + range disjointness + step-indexed HH / H–NOT–H / +negative-witness traces + column-Gram enumeration. Load-bearing open +items: L1 (arrival-residue determinacy), L2 (pop timing), C1 (no +fresh re-query), and the readback controller — the hardest undesigned +component. STATUS docket reordered accordingly. diff --git a/docs/quantum-algebraic/architecture.md b/docs/quantum-algebraic/architecture.md index 1e0132f..72fd204 100644 --- a/docs/quantum-algebraic/architecture.md +++ b/docs/quantum-algebraic/architecture.md @@ -6,11 +6,11 @@ quantum architectures so the three systems can be compared layer by layer. **The pillar is a design contract without an engine**: nothing in `src/` or `data/` is qALC-relative yet, and the two gates that stand between this -document and implementation are stated in §9. The contract has been through -two rounds of adversarial review (gaslamp thread `qalc-architecture`); the -development history, including what the review broke and how the design -moved, lives in `../ledger/2026-08.md`. A final sign-off pass gates -formalization. +document and implementation are stated in §9. The contract has undergone +adversarial review and ratification in gaslamp thread `qalc-architecture`, +including the ratified token-machine amendment (§8); the development +history, subsequent amendments, and the failed rewriting-machine +formalizations are recorded in `../ledger/2026-08.md`. ## 1. Purpose and position among the pillars @@ -41,9 +41,12 @@ bit-identical classical and qBLC rows after any qALC work. ## 2. Target objects For a program `p` (a closed BLC term, unchanged wire code), the machine -prepares the basis configuration for `p h t` — the program applied to the -two opaque constants — with amplitude 1, and applies the global step -isometry `U` (§4) once per transition. With `P_halt` the projection onto +prepares `|init(p)⟩` — the root query token over the immutable invocation +term `p h t`, with initial direction, empty context stacks, and initial +readback control — with amplitude 1, and applies the global step isometry +`U` (§4) once per transition. Positions are structural and +program-relative (no allocation identity), so the global state space is +an explicit orthogonal direct sum over invocation sectors. With `P_halt` the projection onto halted configurations: ```text @@ -107,8 +110,10 @@ nothing looser. ### δ-rules -The constants are rigid atoms. A δ-redex is a constant applied to an -argument that is *syntactically* one of the canonical booleans: +The constants are rigid atoms. The δ-rules specify *amplitudes*, not +rewrites — in the machine they are realized as unitary scattering on +gate fibres (§7) after the machine's internal delimited interrogation +of the applied constant's argument establishes its value: ```text h 0̂ → (0̂ + 1̂)/√2 t 0̂ → 0̂ @@ -116,87 +121,103 @@ h 1̂ → (0̂ − 1̂)/√2 t 1̂ → ω·1̂, ω = exp(iπ/4) ``` `h` (with Toffoli-class λ-terms, §6) and `t` restore the Clifford+T -amplitude ring. A constant applied to a closed normal form that is not a -canonical boolean is an error transition into the absorbing error sector -(§4.4), not a stuck normal form. A constant applied to a non-normal -argument is not a redex; reduction continues inside the argument. A -constant applied to a rigid open variable remains neutral. An unapplied or -partially applied constant in normal position is an ordinary normal form -and may appear in outputs. +amplitude ring. Recognition of the canonical booleans is owned by the +interrogation/readback layer, not by pattern-matching a rewritten term. +An argument whose interrogation returns a closed normal form that is +not a canonical boolean drives an error transition into the absorbing +error sector (§4.4), not a stuck normal form. An argument still under +interrogation is an ordinary running configuration, and a divergent +interrogation stays in the running sector. A constant applied to a +rigid open variable remains neutral. An unapplied or partially applied +constant in normal position is an ordinary normal form and may appear +in outputs. ### No sums in syntax Formal superpositions never appear in program or term syntax. A runtime "superposition" is a weighted set of ordinary basis configurations; the -calculus never rewrites a sum. `h`'s δ-rule is the only branching -transition and `t`'s the only scalar transition; everything else is the -classical machine step extended linearly. The Lineal call-by-base question +calculus never rewrites a sum. `h`'s δ-fibre is the only +amplitude-branching column of `U` and `t`'s the only scalar column; +every non-δ column is basis-to-basis. The Lineal call-by-base question dissolves: there is never a superposed *subterm* to substitute (§4.2). ### Strategy -Reduction is leftmost-outermost strong normalization — the KN strategy — -with δ-redexes and error transitions ranked among β-redexes by position. -The strategy is part of the machine's definition and therefore part of the -physics: a different strategy is a different `U` and different canonical -objects. Machine-relativity does not resolve the algebraic-λ -non-confluence pathologies; it chooses one side of them. AIT objects are -defined relative to a fixed universal machine, this contract fixes one, -and the price is stated plainly: β/δ-convertibility is **not** a semantic -equality in qALC, and alternative reduction sequences are not equal — only -the machine's own sequence defines the objects. One consequence stated -rather than hidden: under normal order, `(λx. f x x)(h 0̂)` duplicates the -*unfired* gate application and yields two independent Hadamard instances. -Duplication always copies syntax, never amplitude, so this is generator -duplication, not cloning; branch-level fan-out of an already-fired outcome -is written explicitly (e.g. `h b̂ A B` fires the gate at head position and -selects per branch). Both idioms are expressible; the strategy decides -only their default reading. +The machine does not rewrite: the invocation term is immutable and +evaluation is token transport. The classical strategy commitment survives +as two clauses. First, **observational conservativity**: if rigid-atom +leftmost-outermost normalization of `p X₁ X₂` reaches normal form `n`, +the machine's internal full-readback process halts with output `n`; if it +has no normal form, the machine never enters `Halt` (§6). No per-step +simulation of leftmost reduction is required — token transitions do not +project step-for-step onto redex steps, and demanding that they do would +rule out the adopted dynamics. Second, **machine-relativity transfers to +the token clock**: the token/query/readback schedule and its step count +are part of the machine's definition and therefore part of the physics — +a different schedule is a different `U` and different canonical objects, +δ event order is whatever the schedule makes it, and β/δ-convertibility +is **not** a semantic equality in qALC. Machine-relativity does not +resolve the algebraic-λ non-confluence pathologies; it chooses one side +of them. Duplication is generator semantics stated as a constraint rather +than as syntax-copying: contraction revisits the same immutable subterm +under distinct exponential contexts, each visit to an unfired δ +occurrence is a distinct gate event (`(λx. f x x)(h 0̂)` yields two +independent Hadamard events), and no machine rule copies an +already-superposed runtime value. Branch-level fan-out of a fired outcome +is still written explicitly in code (`h b̂ A B` fires the gate, then +selects per branch). ## 4. State space and dynamics ### 4.1 Configurations -The basis of the state space is **machine configurations** — term plus -control state plus residual garbage — not bare terms. Bare terms are too -coarse: for a rigid context, the sources `λf. f (h 0̂) 0̂` and -`λf. f 0̂ (h 0̂)` are orthogonal, but their images under a bare-term step -overlap in the term `λf. f 0̂ 0̂`, so no bare-term linear extension is an -isometry. - -The machine supplying these configurations is **not** the existing KN -machine: ordinary KN control is irreversible. Its variable transition -dereferences a closure and discards which variable/environment path -selected it — `focus Var(1), env [A]` and `focus Var(2), env [B, A]` step -to the identical configuration, and both are reachable, from `(λx.x) A` -and `(λy.(λx.y) B) A`. Nor can a frame that distinguishes two -configurations during δ firing later unwind to a common configuration -without losing orthogonality: an isometry preserves inner products under -every iterate, not just the first. The configuration basis therefore -belongs to a **new reversible abstract machine**, whose transition table -must have orthonormal columns as a checkable property; the KN machine is -its guide, not its substrate, and garbage is needed for environment -lookup, control unwinding, and readback collisions — not merely for β -substitution content. The candidate machine shape is sketched in -`machine.md`. +The basis of the state space is **canonical token configurations over +the immutable invocation term**: the invocation identity together with +token position, direction, context stacks (multiplicative and +exponential), and internal query/readback control. Positions are +structural — a rooted zipper into the invocation term — with no +allocation identity. + +Two abandoned substrates motivate this choice and are recorded with the +v0/v1 drafts in `machine.md`. Bare terms are too coarse: for a rigid +context, the sources `λf. f (h 0̂) 0̂` and `λf. f 0̂ (h 0̂)` are +orthogonal, but their images under a bare-term step overlap in +`λf. f 0̂ 0̂`, so no bare-term linear extension is an isometry. And +ordinary KN control is irreversible: its variable transition discards +which variable/environment path selected the closure, and no frame +discipline that distinguishes configurations during δ firing can later +unwind to a common configuration without losing orthogonality — an +isometry preserves inner products under every iterate. The adopted +substrate is IAM-lineage token transport (Danos–Regnier), whose +classical transition table is bideterministic — injective per row, with +pairwise-disjoint ranges classified by position kind and tape top — as +prior structure. That is the design guide, not the proof: the complete +qALC table, including δ scattering, full-normal-form readback, error +entry, and halted entry, still owes the orthonormal-columns proof on the +reachable graph. The active machine design is `token.md`; `machine.md` +is the historical record of the failed rewriting formalizations. ### 4.2 The step isometry `U` is the linear extension of the deterministic machine step: each basis -configuration steps by its unique leftmost redex (β, δ, or error -transition), with `h` producing a two-branch superposition and `t` a -phase. `U` is required to be an isometry on the closed span of -configurations reachable from any `init(p)`; no extension to a unitary on -all of ℓ² is demanded, since every target object depends only on norms, -sector projections, and partial traces of reachable states. A same-space -unitary extension would be needed only for a stronger physical- -realizability claim, which this pillar does not make. +configuration steps by its unique token transition — except at a δ fibre, +where the unitary block produces `h`'s two-branch superposition or `t`'s +phase, and at error entry. `U` is required to be an isometry on the +closed span of configurations reachable from any `init(p)`; no extension +to a unitary on all of ℓ² is demanded, since every target object depends +only on norms, sector projections, and partial traces of reachable +states. A same-space unitary extension would be needed only for a +stronger physical-realizability claim, which this pillar does not make. +Every basis column has finite support with exact ring coefficients, and +one step applied to a finitely-supported state is effectively computable +— the sparse reference evaluator (§7) depends on this. No-cloning is structural rather than enforced: amplitudes attach to whole -configurations, never to subterms, so any duplication a β-step performs is -syntax-copying within one branch — basis fan-out, the physically permitted -copy. qBLC's entire handle/epoch apparatus has no qALC counterpart because -the store it protected does not exist. +configurations, never to subterms or token payloads, and the machine +contains no copy operation anywhere — contraction is revisitation of an +immutable subterm under distinct exponential contexts (§3). qBLC's +entire handle/epoch apparatus has no qALC counterpart because the store +it protected does not exist. ### 4.3 Halting: typed invariant sectors, not fixed points @@ -220,7 +241,19 @@ Halt(nf, g, c, k) → Halt(nf, g, c, k+1) sector it only ticks, so no history halts twice. Halted evolution is `identity_output ⊗ identity_garbage ⊗ identity_terminal-control ⊗ unilateral-shift_tick`, every branch entering at tick zero (common -origin). Invariance alone is deliberately not enough — a halt-sector +origin). For the token machine this factorization is itself normative: +halted states must factor **isometrically** as +`ℓ²(NF) ⊗ garbage ⊗ terminal-control ⊗ tick` — either an internal +reversible readback controller constructs a canonical normal-form +register, or the halted token transcript decomposes bijectively into +`(nf, garbage)`. A many-to-one classical decoder from terminal traces to +normal forms is not acceptable: it would silently choose which traces +merge coherently. Query scheduling and readback are internal to the +single time-homogeneous `U` — an external driver relaunching token +queries would make `τ`, halting age, monotonicity, and interference +driver-relative rather than machine-relative. Full normal forms are +essential: a term with a weak-head normal form but no normal form must +remain non-halting under the strong-normalization target. Invariance alone is deliberately not enough — a halt-sector unitary rotating `|0̂⟩` toward `|+⟩` preserves halted mass while wrecking the monotone reduced output of §4.6; the normative form is what makes §4.6 a theorem. What mass monotonicity itself needs is only invariance, @@ -242,7 +275,10 @@ lower semicomputable. Species errors (a constant applied to a non-boolean canonical form) and any other semantic error enter their own absorbing sectors with the same typed invariance-plus-tick treatment, retaining the error kind and -offending closure as error garbage. Norm is conserved globally: halted +enough argument-interrogation transcript and control to make error entry +injective — coherence being irrelevant in the error sector does not +permit information loss (the v1 lesson), and error columns participate +in the full pairwise range matrix. Norm is conserved globally: halted mass, error mass, and still-running mass sum to exactly 1 at every finite τ. `Unknown` and `Capacity` remain resource outcomes of a finite *run* — the driver stopping — not machine states, matching the house taxonomy. @@ -259,15 +295,19 @@ observationally irrelevant, and qALC collapses into a probabilistic λ-calculus with √2-shaped coins — quantum in name only. The entire quantum content of the design lives in the merge discipline. -Whatever residue restores injectivity is true garbage, and per §4.1 it is -needed at environment lookup, control unwinding, and readback collisions, -not merely at β substitution. An environment-machine formulation relocates -much of it to binding-discard steps — erasure, where the irreversibility -genuinely lives. The **minimal-garbage theorem** is this pillar's first -formal work item: define the reversible machine of §4.1 as a concrete -transition table, prove its columns orthonormal on the reachable -configuration graph, characterize the minimal residual garbage, and prove -the invariant-sector lemma in that machine. "Minimal" here is *local +The vocabulary needs care in a token machine: live multiplicative and +exponential stacks are *control*, not automatically garbage; +predecessor-fibre residue means any information a configuration must +carry beyond the canonical live token state; terminal garbage is +whatever non-output token/readback state survives at `RunDone`. +Classical bideterminism makes ordinary token steps singleton-predecessor +by construction, but it neither proves the chosen stack representation +minimal nor covers the δ, readback, and terminal boundaries. The +**minimal-garbage theorem** is this pillar's first formal work item: +define the machine of §4.1 as a concrete transition table, prove its +columns orthonormal on the reachable configuration graph, characterize +the minimal residual garbage, and prove the invariant-sector lemma in +that machine. "Minimal" here is *local minimality within the fixed machine representation* — residue must distinguish exactly each classical predecessor fibre not already orthogonalized by a quantum transition. A global minimum over arbitrary @@ -338,14 +378,13 @@ transition ever consumes a constant — no δ fires and no error transition involving a constant fires. ("Never fires a δ" alone is not enough: `λh.λt. h h` is a classical normal form whose invocation reaches the species error `h h` without firing any boolean δ-rule.) Effect-free -evolution proceeds on a single basis path whose *term projection* follows -the same leftmost redex sequence as classical rigid-atom reduction of -`p X₁ X₂` — possibly interleaved with reversible administrative -transitions (lookup, zipper moves, residue management) that rigid-atom -reduction does not have — and reaches the same semantic fate. That is the -skeleton semantics qBLC's trusted checker already adjudicates, so -conservativity is projected fate identity with *rigid-atom reduction*, -not with bare-program census rows; every effect-free program has +evolution proceeds on a single basis path — no δ fires, so no branching +— and its observable outcome matches classical rigid-atom reduction of +`p X₁ X₂`: the same normal form through the machine's internal readback +and the same fate, with no evolving term projection and no step-for-step +correspondence claimed (§3). That is the skeleton semantics qBLC's +trusted checker already adjudicates, so conservativity is outcome +identity with *rigid-atom reduction*, not with bare-program census rows; every effect-free program has `μ_p ∈ {0,1}`; and the qBLC skeleton machinery is the natural tool for scoping the fragment. @@ -393,9 +432,13 @@ tick ages and dephases them just as surely. What qALC requires is a **clean coherent compilation theorem**: for a single common transition count `T`, `U^T |x, clean⟩ = |F(x), g*, c*, 0⟩` for every basis input `x` — same `T`, same residual garbage `g*`, same terminal control `c*`, -the intended amplitudes. Bennett compute–copy–uncompute as a λ-idiom is -the route, but its classical discipline must be realized *and -synchronized* inside the λ-machine; it is not automatic. Until it is +the intended amplitudes, with `|x, clean⟩` and the result read through +canonical token initialization and halted-output states. Clean +compilation must be realized by synchronized reversible token transport +and uncomputation; no construction may basis-copy an unknown quantum +result (the v1 countermodel), and the classical Bennett discipline +applies only where the copied register is genuinely classical. +Synchronization is not automatic. Until it is proved, universality is a target, not a property, and the H–NOT–H witness (§7) is its smallest instance. A formal statement of what universality means for qALC's objects — presumably a Gács-style domination claim for @@ -443,7 +486,14 @@ orthogonal to the range of every non-δ transition column. A single landing `J` shared by both gates is not sound: `U|h,0,κ⟩` and `U|t,0,κ⟩` would overlap at `1/√2` despite orthogonal sources. What HH needs is equal residue across the two H columns, not literally untouched -context. Second, halted dynamics has the §4.3 normative typed form. +context. The fibre must be exhibited, not metaphorical: the design must +identify the canonical pairing of the two boolean input states and the +two output states sharing one spectator fibre with exactly equal +spectators. Boolean values encoded by token *position* are acceptable +precisely when that pairing is exhibited; quantum control must reside in +superposed token configurations — a classically-positioned token driving +a hidden quantum payload register is the classical-control corner, not +this pillar. Second, halted dynamics has the §4.3 normative typed form. Every qALC engine change must then satisfy: 1. `cargo test --release --all-features` and plain `cargo test --release`; @@ -464,8 +514,16 @@ Every qALC engine change must then satisfy: local δ coherence, and an engine could pass it while β garbage from any interposed λ-term destroys every nontrivial coherent computation; this witness is the smallest test that λ-computation between gates is - coherence-transparent; and -8. bit-identical classical *and* qBLC rows: qALC must remain isolated + coherence-transparent; +8. **the negative witness**: for `λb. b I I` (a non-injective boolean + map) applied to a fired `h` outcome, the synchronized images of basis + inputs `0̂` and `1̂` remain orthogonal full configurations and never + merge into the same halted basis state. The assertion is + inner-product preservation, not a reduced-output statement — both + branches may output `I`, and tracing orthogonal garbage yields + `|I⟩⟨I|` either way; unitarity forbids the merge, and an engine that + merges them has a non-injective column; and +9. bit-identical classical *and* qBLC rows: qALC must remain isolated from both existing engines. ## 8. Design decisions @@ -479,13 +537,29 @@ Every qALC engine change must then satisfy: - **Classical syntax only:** programs are prefix-free bits; superposition is runtime-only. Anything else is a different (BvDL-flavored) research program with a broken size identity. -- **β-dynamics on a new reversible machine:** bare terms fail isometry, - and ordinary KN control fails reversibility (§4.1) — the configuration - algebra is a machine to be built, with the KN design as guide. The - token-machine (quantum GoI) alternative is parked, not rejected: its - natively reversible dynamics is attractive, but it merges branches - differently and therefore defines *different objects* — if pursued, it - is a separate pillar, never a drop-in engine for this one. +- **Token-transport dynamics on a reversible interaction machine:** + qALC's defining machine is IAM-lineage. The invocation term is + immutable and read-only; a basis configuration canonically identifies + that invocation together with token position, direction, context + stacks, and internal query/readback control. Gate arguments reach δ + nodes by reversible transport, never by basis-copying an unknown + superposition. Classical IAM bideterminism is the design guide, not + the proof: the complete qALC transition table — including δ + scattering, full-normal-form readback, error entry, and halted entry — + must still satisfy the orthonormal-columns contract. This supersedes + the previous decision (ratified, then amended through the same thread) + to build β-dynamics on a reversible rewriting machine and to park + token dynamics as defining "different objects." The pivot is forced by + the v1 no-cloning countermodel (`machine.md` §9.1): copying a + superposed δ-argument result before uncomputation produces + `CNOT(|+⟩|0⟩) = |Φ⁺⟩`, preventing the adjoint pass from restoring a + clean entry state. The "different objects" observation remains true + and is resolved by adoption rather than refutation: because `U`, + `μ_p`, and `M` were never defined and no qALC data exists, the token + machine's clock and merge discipline now become their definition. A + rewriting machine is the parked alternative and would define different + objects; no equivalence, refinement, or preservation of the rewriting + proposal is claimed. - **Typed invariant-sector halting, common origin:** fixed points are incompatible with injectivity; invariance suffices for monotone mass; the common-origin tick and the normative halted form (§4.3) are chosen, @@ -512,9 +586,10 @@ Every qALC engine change must then satisfy: ## 9. Boundaries and open obligations 1. **The reversible machine + minimal-garbage theorem** (§4.1, §4.5) — - the gating work item: a concrete transition table (environment/closure - substrate per `machine.md`, KN-guided, not KN), orthonormal columns - proved on the reachable graph, residual garbage locally minimal in the + the gating work item: a canonical token transition table (IAM-lineage + per `token.md`) including δ scattering, full-normal-form readback, + and the error/halting adapters, orthonormal columns proved on the + reachable graph, residual garbage locally minimal in the predecessor-fibre sense, invariant-sector lemma proved in that machine. `U`, `μ_p`, and `M` are undefined until this exists. 2. **Clean coherent compilation** (§6): λ-defined Toffoli-class terms @@ -538,28 +613,32 @@ Every qALC engine change must then satisfy: 10. Output convention (§4.6) — deliberately open, mirroring qBLC. Items 1 and 2 gate implementation: no `src/qalc/` code before the machine -is formal and its witnesses computed by hand (`machine.md` §6). The -scalar ring needs nothing — the unresolved object is the configuration -algebra, not the amplitudes. +is formal and its witnesses computed by hand in the formal token-machine +document. The scalar ring needs nothing — the unresolved object is the +configuration algebra, not the amplitudes. ## 10. Lineage and related documents -Standard references this design leans on: Arrighi–Dowek (Lineal; linear -extension, gates as constants), Vaux and Ehrhard–Regnier (algebraic -λ-calculus; Taylor expansion as the canonical source of term sums), van -Tonder (history-tracked unitary λ-reduction), Bernstein–Vazirani (QTM +Standard references this design leans on: Danos–Regnier (the Interaction +Abstract Machine — the principal machine lineage) and +Accattoli–Dal Lago–Vanoni (the λIAM, its λ-calculus presentation, and +the bideterminism analysis), Arrighi–Dowek (Lineal; linear extension, +gates as constants), Vaux and Ehrhard–Regnier (algebraic λ-calculus; +Taylor expansion as the canonical source of term sums), van Tonder +(history-tracked unitary λ-reduction), Bernstein–Vazirani (QTM well-formedness and synchronized halting), Shi and Aharonov (Toffoli+Hadamard universality), Bennett (reversible computation and uncomputation), Yuan–Villanyi–Carbin (synchronization limits of quantum control flow), Selinger–Valiron (the design point qBLC occupies), Hasuo–Hoshino and Dal Lago–Faggian–Valiron–Yoshimizu (quantum GoI and -multitoken machines, for the parked alternative), Bădescu–Panangaden -(why quantum control plus recursion has no settled semantics — the gap -this pillar's measurements would inform). +multitoken machines), Bădescu–Panangaden (why quantum control plus +recursion has no settled semantics — the gap this pillar's measurements +would inform). - Classical counterpart: `../classical/architecture.md` - Quantum-store counterpart: `../quantum/architecture.md` -- Reference machine sketch (pre-formal): `machine.md` +- Active machine design: `token.md` +- Historical failed rewriting drafts (v0/v1): `machine.md` - Development history and review record: `../ledger/2026-08.md` - Moving state and docket: `../STATUS.md` - Canonical evidence: none yet; `data/quantum-algebraic/` reserved. diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index e60e2f0..7e6b7df 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -1,14 +1,26 @@ -# qALC machine v2 — token-transport exploration brief - -**Status: exploration brief, pre-design.** Route (b) of `machine.md` -§9.4 — a reversible interaction/token construction in which values are -*transported* to δs rather than copied — was chosen by a9 (2026-08-09) -as the v2 direction after the v1 Try-boundary protocol fell to the -no-cloning countermodel. This brief pins what any v2 design must -inherit from the four completed review rounds, the questions it must -answer, and the one contract amendment it requires. Written for a -fresh-context continuation; read `architecture.md`, `machine.md` §9, -and the ledger entry first. +# qALC machine v2 — token-transport design + +**Status: ratified direction, working design sketch, pre-review.** +Route (b) of `machine.md` §9.4 — a reversible interaction/token +construction in which values are *transported* to δs rather than copied +— was chosen by a9 (2026-08-09) after the v1 Try-boundary protocol fell +to the no-cloning countermodel. The architecture §8 amendment this +required was ratified through thread `qalc-architecture` (AMEND, then +RATIFY — with the reviewer's tightened text and consequential edits) +and applied to `architecture.md` the same day. §§1–5 are the +exploration brief; §6 pins the exact classical substrate; §§7–8 are the +working design sketch and its obligations — **hand-derived, not yet +reviewed as a whole**. A parallel fresh-context feasibility review +(thread `qalc-token-machine`, same day) independently graded the route +**promising-with-hard-open-problems** and converged with the sketch on +every load-bearing point it covers: delimited gate interrogation is +new machinery (plain λIAM stops at a rigid head), raw canonical-boolean +traversal is spectator-distinguishing and one step desynchronized (two +independent derivations agree), balanced answer transport is mandatory, +readback must be an internal reversible controller, and the single +hardest problem is transport through nonlinear λ-code — H–NOT–H. Its +additions are folded in below (§6 verified bideterminism and the +jumping exclusion, §7.2 checklist, §8 kernel gate). ## 1. Why tokens @@ -25,82 +37,106 @@ Hasuo–Hoshino (quantum GoI), Dal Lago–Faggian–Valiron–Yoshimizu (multitoken machines) — typed/linear-logic settings; the untyped port is the open engineering. -## 2. Inherited constraints (the four rounds' guardrails) +## 2. Inherited constraints (guardrails) -Any v2 design is dead on arrival unless it respects: +Items 1–8 are the four completed review rounds' guardrails; 9–13 were +added at amendment ratification. Any v2 design is dead on arrival +unless it respects: 1. **No basis-copying of unknown superpositions** — the v1 killshot: `CNOT(|+⟩|0⟩) = |Φ⁺⟩`, `(H⊗I)|Φ⁺⟩ ≠ |0⟩|+⟩` (`machine.md` §9.1). - Values reach δs by *transport* or not at all. -2. **Global single-map injectivity on the reachable basis** — bare - syntactic states are too coarse (the `λf. f (h 0̂) 0̂` overlap); - whatever the token state is, distinct sources need orthogonal - images under every iterate, checked as a full pairwise matrix. -3. **Typed invariant halting sectors with ticks** (frozen architecture - §4.3): no reachable fixed points; `RunDone → Halt(…,0)`; common - origin; error sectors identically, retaining complete discarded - control (v1 defect: dropping the continuation breaks injectivity - even where coherence is irrelevant). + Values reach δs by *transport* or not at all; no machine rule copies + an already-superposed runtime value. +2. **Global single-map injectivity on the reachable basis** — whatever + the token state is, distinct sources need orthogonal images under + every iterate, checked as a full pairwise matrix over all columns, + δ, readback, error, and halt included. +3. **Typed invariant halting sectors with ticks** (architecture §4.3): + no reachable fixed points; common origin; halted states factor + **isometrically** as `ℓ²(NF) ⊗ garbage ⊗ terminal-control ⊗ tick` — + a many-to-one classical decoder from terminal traces to normal + forms is forbidden; error sectors identically, retaining complete + discarded control. 4. **Interference = same configuration, same global time.** Timing is physical; length-unbalanced branches decohere honestly. Any claimed coherence must survive a step-indexed trace. -5. **Clean δ fibres, gate-indexed** (frozen architecture §7): - `U|q,b,κ⟩ = Σ (Q_q)|b′, J_q(κ)⟩`, `J_q†J_r = δ_qr I`, landings - boolean-independent, orthogonal to all non-δ ranges. In token - terms: how a δ node acts on a passing token must have exactly this - fibre structure, including when the token *position* superposes - (quantum control is the point — a classically-positioned token with - a quantum payload is design A again). -6. **Effect-free conservativity** against rigid-atom leftmost - reduction (projected fate identity — for a token machine this - becomes: the path semantics restricted to constant-free runs must - compute the same normal forms; the strong-normalization/readback - story is where IAM-style machines are weakest, and the census needs - NFs). -7. **Witness battery**: HH must cancel; H–NOT–H is the coherence bar; - witness statements name wire terms only, never machine mechanisms - (review-ratified). `λb. b I I` (non-injective map) must *not* come - out coherent — unitarity forbids it. +5. **Clean δ fibres, gate-indexed** (architecture §7): + `U|q,b,κ⟩ = Σ (Q_q)_{b'b}|b′, J_q(κ)⟩`, `J_q†J_r = δ_qr I`, + landings boolean-independent. The fibre must be *exhibited*: the + canonical pairing of the two boolean input states and two output + states sharing one spectator, with exactly equal spectators. + Boolean-as-position is acceptable precisely when that pairing is + exhibited; a classically-positioned token driving a hidden quantum + payload register is the classical-control corner, not this pillar. +6. **Full-NF effect-free conservativity** (observational): if + rigid-atom leftmost-outermost normalization of `p X₁ X₂` reaches + normal form `n`, the machine's internal readback halts with output + `n`; if no NF exists, the machine never enters `Halt` — including + WHNF-without-NF cases. No token-step/redex-step simulation is + required or expected. +7. **Witness battery**: HH must cancel (mass 1 on `0̂`); H–NOT–H is + the coherence bar; the negative witness — `λb. b I I` on a fired + `h` outcome — is an inner-product assertion: the synchronized + images of `0̂` and `1̂` remain orthogonal *full configurations* + (both branches may output `I`; the reduced output can't see it). + Witness statements name wire terms only, never machine mechanisms. 8. **Fork (A) stands**: minimal-information residue, earned coherence, - and any residual charging must land in the predecessor-fibre - minimality frame (or amend the architecture explicitly). + predecessor-fibre-local minimality — with token vocabulary: live + stacks are control, not garbage; residue is what a configuration + carries beyond the canonical live token state; terminal garbage is + the non-output state surviving at `RunDone`. +9. **Closed semantic readback**: all query scheduling and NF + construction happen inside one computable, time-homogeneous `U`. + No external driver relaunching token queries — that would make τ, + halting age, monotonicity, and interference driver-relative. +10. **Canonical position identity**: positions are structural (rooted + zipper into the immutable invocation term), no allocation + identity; the global space is an orthogonal direct sum over + invocation sectors. +11. **Locally finite computability**: every basis column has finite + support with exact ring coefficients, and one step on finite + support is effectively computable (the sparse evaluator depends on + it). +12. **Generator duplication as constraint**: contraction revisits the + same immutable subterm under distinct exponential contexts; each + visit to an unfired δ occurrence is a distinct gate event. +13. **Error completeness**: species-error entry retains enough + interrogation transcript and control to be injective and + participates in the full pairwise range matrix. ## 3. Questions the design must answer -1. What is the token state space (position, direction, multiplicative - and exponential stacks — and payload?), and is the *linear - extension of the token step* on ℓ²(token states) an isometry for - free from bideterminism, once δ-branching is added as a unitary - block? -2. How does `h` act: the token position superposing over the two - boolean answers to a query is the natural guess — spell out the - fibre and check constraint 5. -3. Readback: IAM natively answers head/path queries; the census needs - full normal forms and halting masses. Exhaustive path enumeration, - jumping variants (Danos–Regnier's optimal/jumping machines), or a - readback driver looping the token — and what "halting" is - (constraint 3) when the machine is a wanderer rather than a - rewriter. -4. Duplication: non-linear code revisits subterms with different - exponential contexts — verify this genuinely replaces the v0/v1 - `Look` content tags and what, if anything, is charged. -5. Timing: token path lengths differ across branches — same - synchronization physics (constraint 4); check H–NOT–H path lengths - concretely for `NOT′` and the selector. -6. Where does `Ω_qALC` live: per-program halting mass as the norm of - what, and does the Loewner-monotone output-block structure - (architecture §4.6) survive the change of machine? - -## 4. Contract amendment required - -Architecture §8 ("β-dynamics on a new reversible machine") currently -*parks* the token alternative as "different objects … a separate -pillar, never a drop-in engine." Route (b) makes the token machine -*the* qALC machine, which is an amendment to that frozen design -decision — it must be ratified through the `qalc-architecture` thread -(where Codex proposed route (b)) before v2 is drafted against the -contract, and the β-dynamics text rewritten to record why the pivot -happened (the §9.1 countermodel) rather than silently swapped. +1. What is the token state space, and is the linear extension of the + token step an isometry once δ-branching is added as a unitary + block? *(§7 sketches the answer; Lemma L1 is the crux.)* +2. How does `h` act — spell out the fibre and check guardrail 5. + *(§7.2–7.3.)* +3. Readback: full normal forms and halting mass from a head-query + machine, internal to `U`. *(Open — the largest undesigned + component; §7.8.)* +4. Duplication: exponential contexts replacing the v0/v1 `Look` + content tags. *(Native to the substrate; §6.)* +5. Timing: same synchronization physics; check H–NOT–H path lengths + concretely. *(§7.7; trace obligation.)* +6. Where does `Ω_qALC` live. *(Designated halt states on the token + clock; same wandering-subspace lemma; §7.8.)* + +## 4. Contract amendment — ratified and applied + +Architecture §8's β-dynamics decision parked the token machine as +"different objects … a separate pillar, never a drop-in engine." +Route (b) promotes it to *the* qALC machine. The amendment was +ratified in thread `qalc-architecture` (2026-08-09) with the +reviewer's tightened text — IAM bideterminism as guide-not-proof, the +immutable-invocation basis, internal readback — plus consequential +edits across §§2–10 (init as root query token, isometric halted +factorization, observational strategy clause, generator-duplication +constraint, error completeness, the negative witness as battery item +8, Danos–Regnier in the lineage) and applied to `architecture.md` in +the same commit series. The "different objects" observation was +resolved by **adoption, not refutation**: `U`, `μ_p`, `M` had never +been defined, so the token machine's clock and merge discipline become +their definition; a rewriting machine is now the parked alternative. ## 5. What carries over from v1 regardless @@ -109,3 +145,275 @@ the witness battery and hand-trace discipline; the defect-register habit; the color-discipline *idea* as a fallback producer-marking tool if bideterminism has gaps at the δ or readback boundaries; and the review loop itself — draft, thread, countermodel, register, iterate. + +## 6. The classical substrate, exact: λIAM + +Source: Accattoli–Dal Lago–Vanoni, *The (Abstract) Machinery of +Interaction* (PPDP 2020, arXiv:2002.05649); table as reproduced in +*The Space of Interaction* (LICS 2021, arXiv:2104.13795, Fig. 1), +Closed CbN setting — which matches ours (invocation terms are closed). + +```text +States s ::= (t, C, L, T, d) — code subterm, context, + log, tape, direction +Logged positions l ::= (t, Cn, Ln) — |Ln| = n = level of Cn +Tapes T ::= ε | •·T | l·T +Logs L ::= ε | l·L +Directions d ::= ↓ | ↑ +``` + +The level of a context = the number of arguments the hole lies under. +Initial state: `s_t = (t, ⟨·⟩, ε, ε, ↓)`. Final states: +`(λx.u, C, L, ε, ↓)` — the head abstraction of the weak-head normal +form. The λIAM implements Closed CbN: the run from `s_t` terminates +iff weak-head reduction terminates on `t`. + +```text +•1 (t u, C, L, T, ↓) → (t, C⟨⟨·⟩u⟩, L, •·T, ↓) +•2 (λx.t, C, L, •·T, ↓) → (t, C⟨λx.⟨·⟩⟩, L, T, ↓) +var (x, C⟨λx.Dn⟩, Ln·L, T, ↓) → (λx.Dn⟨x⟩, C, L, (x,λx.Dn,Ln)·T, ↑) +bt2 (λx.Dn⟨x⟩, C, L, (x,λx.Dn,Ln)·T, ↓) → (x, C⟨λx.Dn⟩, Ln·L, T, ↑) +•3 (t, C⟨⟨·⟩u⟩, L, •·T, ↑) → (t u, C, L, T, ↑) +•4 (t, C⟨λx.⟨·⟩⟩, L, T, ↑) → (λx.t, C, L, •·T, ↑) +arg (t, C⟨⟨·⟩u⟩, L, l·T, ↑) → (u, C⟨t⟨·⟩⟩, l·L, T, ↓) +bt1 (t, C⟨u⟨·⟩⟩, l·L, T, ↑) → (u, C⟨⟨·⟩t⟩, L, l·T, ↓) +``` + +Reading: `↓` states query the head variable of the code; `↑` states +search for an abstraction's argument; `↓` with a logged position on +the tape top is backtracking (`bt1` starts it, `bt2` ends it). `•` +records the crossing of an application whose identity is forgotten — +search up to β-redexes. `var` jumps from an occurrence to its binder, +saving the occurrence (with the log slice covering its level) as a +logged position; `arg` completes an argument query, moving the logged +position from tape to log as the return address for later +backtracking. + +**Bideterminism is structural.** Forward: the applicable rule is +determined by direction, code shape, and tape top. Backward: target +patterns are pairwise disjoint by the dual classification — +`↓`-targets split by position kind and tape top (function-position/• += `•1`, function-position/l = `bt1`, λ-body = `•2`, argument-position += `arg`), `↑`-targets likewise (application = `•3`, λ/• = `•4`, λ/l = +`var`, variable = `bt2`) — and each row is individually injective +(pure stack transport; nothing is erased, `•` has constant content). +The feasibility review verified the published statement independently +against arXiv:2002.05649: the step relation is a partial bijection, +`flip(s′) → flip(s)` gives the reverse machine, and the rules occur in +inverse pairs (`•1`/`•3`, `•2`/`•4`, `var`/`bt2`, `arg`/`bt1`). +Initial states generalize to observation depth `k`: +`(t, ⟨·⟩, ε, •^k, ↓)` — the hook the readback controller iterates on. +This is exactly the property v0/v1 fought to engineer and lost: +**zero-garbage reversibility as a structural fact about the table.** +Two boundary caveats, review-supplied: a partial bijection's linear +extension is an isometry only once *totalized on reachables* — every +final or stuck shape needs a norm-one successor (tick sectors, error +adapters), or norm leaks; and the **jumping variant (λJAM) is +excluded** — its jump rule drops the skipped source state, is plainly +noninjective on the raw state grammar, and retaining the skipped +source as residue would give back the history the jump avoids. + +For qALC the walked term is the immutable invocation `p h t`; the +constants are two extra leaf kinds with no classical rules of their +own — every transition at a constant leaf belongs to the δ gadget +(§7) or to neutral readback. + +## 7. The δ-gadget design sketch — working notes, unverified + +Everything in this section is hand-derived against §6 and **has not +been reviewed or step-indexed**; it records the design position for +the review loop, not established results. + +### 7.1 Value as routing: the probe + +A boolean's value, in interaction terms, is *which argument it +selects*. The gadget learns its argument's value the way the calculus +uses it: when the first query in `↓` reaches the `h` leaf (tape top +`•` — `h` is applied), the gadget consumes that `•` and launches a +**probe**: enter the argument `M` in `↓` with two probe bullets and a +gate-tagged probe frame on the tape — tape `•·•·μ_h·T`. The probe run +is an ordinary λIAM sub-run: it needs no new machinery, may hit inner +δs (branching mid-probe — this is how HH composes), may escape into +the outer term (open-head `M`), or may never return (divergent `M`; +that amplitude honestly never halts). + +Exit shapes at the gadget's virtual application context, hand-derived: + +```text +M = 0̂ = λa.λb.a : •2 •2 var — exits ↑, tape l_a·μ_h·T +M = 1̂ = λa.λb.b : •2 •2 var •4 — exits ↑, tape •·l_b·μ_h·T +``` + +The standard `↑` routing against the two virtual applications then +seeks virtual slot 1 (tape top `l`) or virtual slot 2 (tape top `•` +then `l`) — i.e. **the boolean arrives as the token's exit slot: pure +position, no payload, nothing copied**. Non-boolean normal arguments +classify by other exit shapes (`λa.a` exits `l_a·•·μ_h·T`; a +three-lambda prefix strands `↓` on `μ_h`; …) and enter the species +error sector, retaining the transcript (guardrail 13). Totality of +this classification over all exit shapes is a proof obligation. + +### 7.2 The δ block fires on arrival states + +Let `arr_b` be the arrival state at virtual slot `b+1` for a given +spectator `κ` (tape rest `T`, log, gadget instance position). The δ +column is the unitary block **directly on arrivals** — no copy, no +uncompute step, so the v1 killshot shape cannot arise: + +```text +U |arr_b, κ⟩ = Σ_b′ (Q_q)_{b′b} |ans_b′, J_q(κ)⟩ Q_h = H, Q_t = diag(1, ω) +``` + +with `ans_b′` gate-tagged answer-routing states (the `J_q` landing +tags give cross-gate orthogonality). "Partial injection + unitary +blocks" is *not* automatically an isometry; the feasibility review's +checklist is adopted as the proof shape — `U†U = I` exactly when: +(1) the ordinary step is injective on ordinary sources; (2) each +reachable source matches exactly one rule; (3) each `Q_q` is unitary; +(4) `κ ↦ landing(q, b′, κ)` is injective; (5) landing subspaces for +distinct gate kinds are orthogonal; (6) every δ landing is orthogonal +to every ordinary successor; (7) reachable finals have norm-one +successors (ticks/errors — totalization); (8) landings are valid +reachable-basis states and the reachable span is forward-invariant. +One-step column orthonormality then propagates to every iterate. + +The global-injectivity risk is concentrated in one place: the block +absorbs the arrival's `b`-dependent tape prefix (`l_a·μ` vs +`•·l_b·μ`), so two *different* reachable arrivals at the same slot +with the same spectator would collide. Hence: + +**Lemma obligation L1 (arrival-residue determinacy).** For every +reachable (gate instance, slot, spectator) triple, exactly one arrival +residue is reachable. Per classical branch this holds because the +probe run from a fixed entry is deterministic; across δ-branches it is +*arranged* by §7.3. This is the design's load-bearing lemma. + +### 7.3 Balanced virtual answers + +After firing, the gadget must behave as `b̂′` toward the outstanding +outer question. Real booleans route *asymmetrically* (the exit shapes +above differ in depth and leave different logged positions) — routing +a fired outcome through real-boolean shapes would attach `b′`-dependent +residue and rebuild decoherence-by-history. The virtual answers are +machine primitives, and we define them **balanced**: `ans_b′` consumes +the outer question's bullets and routes to the selected continuation +in a number of transitions independent of `b′`, leaving no +`b′`-dependent tape or log content. The answer bit lives only in the +token's exit position — which is precisely what the *next* δ block +reads. This is design freedom the classical IAM never needed and the +quantum machine cannot live without. + +### 7.4 HH, informally + +`h (h 0̂)` (through the wrapper plumbing, which is branch-independent +since it precedes the inner fire): the outer gadget probes `h 0̂`; the +probe reaches the inner gadget, which probes `0̂` — deterministic, +single branch — and fires `H` on its arrivals; the two branches route +through balanced virtual answers to the outer gadget's virtual slots, +arriving with **equal spectators at equal time**; the outer block +gives `(|a₀⟩+|a₁⟩)/√2` from slot 1 and `(|a₀⟩−|a₁⟩)/√2` from slot 2 — +sum `|a₀⟩`, mass 1 on `0̂`. The cancellation happens exactly because +post-fire paths run through machine-primitive balanced routing rather +than real-term routing. **Unverified**: needs the step-indexed trace +against the full table. + +A soundness spot-check that falls out: `h ((h 0̂) 0̂ 0̂)` — the inner +coin selects *different `0̂` occurrences*, whose selection paths carry +distinct live return addresses; the branches reach the outer gadget +with distinct spectators, do not merge, and the output mass on `0̂` +is 1/2 — the correct physics (H on a dephased bit), where a naive +merging machine would violate norm conservation. The machine's +refusal to merge distinct-history branches is not a bug; it is the +mechanism that makes the coherent cases meaningful. + +### 7.5 Consistency without a store + +A fired instance is re-interrogated only through backtracking, and a +backtracking re-entry carries the return-address logged position that +encodes the original slot — routing reads the outcome off the token +itself. No global store of fired outcomes exists; the outcome lives +exactly as long as the token's routing history needs it. + +**Conjecture C1 (no fresh re-query).** No reachable run interrogates +the same gate instance (same exponential context) through a second +independent first-query. Distinct occurrences are distinct instances +(guardrail 12); within one instance, the classical λIAM never +re-launches a completed query. If C1 fails, a consistency mechanism +is needed and the design weakens materially. + +### 7.6 The negative witness, mechanically + +`λb. b I I` on a fired outcome: the branches select different `I` +occurrences; their live return addresses differ while the identity +behaviors run and survive into the halted transcript as distinct +garbage — the synchronized images stay orthogonal full +configurations, as guardrail 7 requires, *automatically*. The +decoherence direction (distinct residue ⇒ orthogonal forever) is +structural. The coherence direction — balanced injective code ends +with *equal* residue at the next fire — is exactly the H–NOT–H +obligation: + +**Lemma obligation L2 (pop timing).** Characterize when selection +residue leaves the token before the next gate event. NOT′ = +`λb.λx.λy. b y x` should pop symmetrically; the selector +`λb. b 1̂ 0̂` routes through real boolean literals whose shapes are +unbalanced — the v1 prediction that the selector's coherence is a +measurable, not a given, returns with a concrete mechanism. + +### 7.7 Timing + +Interference requires equal token time (guardrail 4). Virtual answers +are step-balanced by definition (§7.3); interposed real code must be +step-balanced on its own — the clean-compilation common-`T` +requirement reappears as **path-length balance measured in token +steps**, derived from machine structure rather than stipulated. Same +shape as v1's derivation, honest mechanism this time. + +### 7.8 Not yet designed + +- **The readback controller** — the largest open component: full-NF + readback internal to `U` (guardrail 9), iterating head queries + reversibly under machine control, entering `RunDone` with the + isometric `NF ⊗ garbage ⊗ control ⊗ tick` factorization (guardrail + 3), common-origin ticks. The λIAM answers weak-head queries; the + strong-normalization loop is the untyped port's known weak point + and the feasibility thread's central question. +- The `t` gadget (expected trivial: phase on arrivals, identity + routing, own landing tag `J_t`). +- Error-sector adapters and their injectivity. +- The formal table itself, with the full pairwise range matrix. + +## 8. The kernel gate, and the obligations register + +The v2 formalization target — adopted from the feasibility review — is +a **three-program formal kernel**, deliberately smaller than a full +machine document: the eight λIAM rules; tagged gate-interrogation, +answer, return, error, readback, and tick rules; a proof that every +rule range is disjoint from every unrelated rule range; step-indexed +traces, with `(position, direction, log, tape, answer label)` reported +at every step, of + +```text +h (h 0̂) — HH: mass 1 on 0̂ by cancellation +h (NOT′ (h 0̂)) — the coherence bar +(λb. b I I) (h 0̂) — the negative witness: no merge +``` + +and a column-Gram enumeration over the small reachable graph, showing +`NOT′` returns a boolean-independent spectator while the non-injective +map does not. If the kernel works, the route is genuinely promising; +if HH needs special-case stack erasure or H–NOT–H leaves distinct +log/tape states, the route has only relocated the v1 obstruction. + +| Item | Status | +|---|---| +| L1 arrival-residue determinacy | stated; unproved — load-bearing | +| L2 pop timing / coherence return | stated; unproved | +| C1 no fresh re-query | conjectured | +| Probe-exit classification totality | obligation | +| Totalization (norm-one successors everywhere) | obligation (review) | +| Three-program kernel (table + traces + Gram) | the v2 gate; unstarted | +| Readback controller | undesigned — hardest open | +| `μ_p`/`Ω_qALC` on the token clock | pending readback design | +| Nonlinear reuse of a fired result (`λb.…b…b…`) | undesigned (review) | +| Bideterminism of §6 | verified (review, vs arXiv:2002.05649) | From 86b9750f5cbb571e47af384d217699aba193245b Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 05:49:39 -0400 Subject: [PATCH 016/107] docs: harmonize qALC docs to current-only format AGENTS.md fourth-pillar paragraph carries the token design and the qalc-token-machine thread. token.md drops its brief-era sections (design questions, applied amendment, v1 carry-over) and stands as guardrails / substrate / sketch / kernel-gate (renumbered 1-4). machine.md re-headed as historical record. Review-event narration trimmed from the architecture in favor of ledger pointers; cross-references updated throughout. Ledger carries the history. Co-Authored-By: Claude Fable 5 --- AGENTS.md | 27 ++- docs/STATUS.md | 6 +- docs/ledger/2026-08.md | 10 +- docs/quantum-algebraic/architecture.md | 48 ++-- docs/quantum-algebraic/machine.md | 16 +- docs/quantum-algebraic/token.md | 323 +++++++++++-------------- 6 files changed, 199 insertions(+), 231 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index f2938f9..bb981e9 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -67,13 +67,19 @@ The library is three layers — `blc` substrate, symmetric `classical` and whose subcommands live in `src/cli/`. Lab-gated subcommands are recognised without the feature and say how to get themselves; do not "fix" that by deleting the arm. A fourth pillar, `quantum-algebraic` (qALC: quantum -*control*, storeless, runtime states in ℓ² over machine configurations), -exists as a design contract only — `docs/quantum-algebraic/architecture.md` -is the contract, `machine.md` beside it the pre-formal reversible-machine -sketch, and **no qALC code may land** until the contract's §9 gates pass -(formal reversible transition table with orthonormal columns, clean -coherent compilation, hand-computed HH and H–NOT–H witnesses). qALC work -must leave classical and qBLC rows bit-identical. +*control*, storeless, runtime states in ℓ² over token configurations), +exists as a ratified contract plus an active machine design, no code — +`docs/quantum-algebraic/architecture.md` is the contract (IAM-lineage +token transport: the invocation term is read-only and values reach the +`h`/`t` gates by token routing, never by copying), `token.md` beside it +the active design (exact λIAM substrate, δ-gadget sketch, obligations +register), and `machine.md` the record of the two failed +rewriting-machine drafts — read-only history, do not build on it. +**No qALC code may land** until the contract's §9 gates pass; the +concrete first gate is `token.md` §4's three-program kernel (full +transition table, range disjointness, step-indexed HH / H–NOT–H / +negative-witness traces, column-Gram enumeration). qALC work must +leave classical and qBLC rows bit-identical. `classical::ladder` owns the halting ladder, and every classical driver (`census`, `adjudicate`, `solomonoff`) adjudicates through it: prescan → @@ -230,7 +236,8 @@ Existing threads: `blc-conformance` (certificate exchange), `blc-interpreter` (design theory), `blc-interp-search` (slot-search spec), `blc-qblc` (qBLC design ratification), `qblc-selfint` (self-interpretation and bisimulation), `qblc-omega-witnesses` (dyadicity hunt and phase-2 design), -`blam-reshape` (v2 refactor design ratification and reviews), and -`qalc-architecture` (qALC design contract adversarial review and -ratification). +`blam-reshape` (v2 refactor design ratification and reviews), +`qalc-architecture` (qALC design contract adversarial review, +ratification, and amendments), and `qalc-token-machine` (qALC token +machine feasibility and kernel review). Send raw evidence—encodings, diffs, measured bits—not summaries. diff --git a/docs/STATUS.md b/docs/STATUS.md index b2d3a39..6bd963a 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -410,10 +410,10 @@ the token-machine amendment — route (b) after v1's no-cloning killshot — was ratified through thread `qalc-architecture` and applied (2026-08-09; history in `ledger/2026-08.md`). The machine is now IAM-lineage token transport: term read-only, bideterministic substrate -(exact λIAM table pinned in `token.md` §6), values transported to δs +(exact λIAM table pinned in `token.md` §2), values transported to δs by routing, never copied. -The v2 design sketch is drafted (`token.md` §7: probe protocol, +The v2 design sketch is drafted (`token.md` §3: probe protocol, δ blocks on arrival states, balanced virtual answers, no-store consistency) and a fresh-context feasibility review (thread `qalc-token-machine`) independently graded the route @@ -422,7 +422,7 @@ load-bearing point; its checklist and exclusions are folded in. The open docket, in order: -1. **the three-program formal kernel** (`token.md` §8 — the v2 gate): +1. **the three-program formal kernel** (`token.md` §4 — the v2 gate): full table, range-disjointness, step-indexed traces of HH / H–NOT–H / the negative witness, column-Gram enumeration; L1/L2 and the readback controller are the hard parts; diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 7af4b76..edf19da 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2004,4 +2004,12 @@ full table + range disjointness + step-indexed HH / H–NOT–H / negative-witness traces + column-Gram enumeration. Load-bearing open items: L1 (arrival-residue determinacy), L2 (pop timing), C1 (no fresh re-query), and the readback controller — the hardest undesigned -component. STATUS docket reordered accordingly. +component. STATUS docket reordered accordingly. The docs were then +harmonized to the house current-only format: AGENTS.md's +fourth-pillar paragraph updated to the token design and the +`qalc-token-machine` thread listed; token.md's brief-era sections +(design questions, the applied amendment, the v1 carry-over list) +retired with their surviving content absorbed into the guardrails, +sketch, and obligations register (renumbered §§1–4); machine.md +re-headed as a historical record; review-event narration trimmed from +the architecture in favor of ledger pointers. diff --git a/docs/quantum-algebraic/architecture.md b/docs/quantum-algebraic/architecture.md index 72fd204..37ca2a9 100644 --- a/docs/quantum-algebraic/architecture.md +++ b/docs/quantum-algebraic/architecture.md @@ -5,12 +5,11 @@ quantum-algebraic pillar. It uses the same structure as the classical and quantum architectures so the three systems can be compared layer by layer. **The pillar is a design contract without an engine**: nothing in `src/` -or `data/` is qALC-relative yet, and the two gates that stand between this -document and implementation are stated in §9. The contract has undergone -adversarial review and ratification in gaslamp thread `qalc-architecture`, -including the ratified token-machine amendment (§8); the development -history, subsequent amendments, and the failed rewriting-machine -formalizations are recorded in `../ledger/2026-08.md`. +or `data/` is qALC-relative yet, and the two gates that stand between +this document and implementation are stated in §9. The contract is +ratified through gaslamp thread `qalc-architecture`; the development +history and the superseded rewriting-machine formalizations live in +`../ledger/2026-08.md` and `machine.md`. ## 1. Purpose and position among the pillars @@ -178,8 +177,8 @@ exponential), and internal query/readback control. Positions are structural — a rooted zipper into the invocation term — with no allocation identity. -Two abandoned substrates motivate this choice and are recorded with the -v0/v1 drafts in `machine.md`. Bare terms are too coarse: for a rigid +Two rejected substrates motivate this choice (record: `machine.md` and +the ledger). Bare terms are too coarse: for a rigid context, the sources `λf. f (h 0̂) 0̂` and `λf. f 0̂ (h 0̂)` are orthogonal, but their images under a bare-term step overlap in `λf. f 0̂ 0̂`, so no bare-term linear extension is an isometry. And @@ -277,8 +276,8 @@ any other semantic error enter their own absorbing sectors with the same typed invariance-plus-tick treatment, retaining the error kind and enough argument-interrogation transcript and control to make error entry injective — coherence being irrelevant in the error sector does not -permit information loss (the v1 lesson), and error columns participate -in the full pairwise range matrix. Norm is conserved globally: halted +permit information loss — and error columns participate in the full +pairwise range matrix. Norm is conserved globally: halted mass, error mass, and still-running mass sum to exactly 1 at every finite τ. `Unknown` and `Capacity` remain resource outcomes of a finite *run* — the driver stopping — not machine states, matching the house taxonomy. @@ -436,7 +435,7 @@ the intended amplitudes, with `|x, clean⟩` and the result read through canonical token initialization and halted-output states. Clean compilation must be realized by synchronized reversible token transport and uncomputation; no construction may basis-copy an unknown quantum -result (the v1 countermodel), and the classical Bennett discipline +result (`machine.md` §9.1), and the classical Bennett discipline applies only where the copied register is genuinely classical. Synchronization is not automatic. Until it is proved, universality is a target, not a property, and the H–NOT–H witness @@ -468,7 +467,8 @@ different semantic cadence needs a clocked dilation preserving halt ages and output traces — a stronger theorem than this contract grants, since timing is physical here (§4.5). Hash-consing and representation tricks are fine below that line; branch-dependent -allocation identity is not (see `machine.md`). +allocation identity is not (`token.md` §1, canonical position +identity). Two clauses are normative machine contract, not just test surface. First, δ-steps are **clean δ fibres, gate-indexed**: for every spectator @@ -546,20 +546,16 @@ Every qALC engine change must then satisfy: superposition. Classical IAM bideterminism is the design guide, not the proof: the complete qALC transition table — including δ scattering, full-normal-form readback, error entry, and halted entry — - must still satisfy the orthonormal-columns contract. This supersedes - the previous decision (ratified, then amended through the same thread) - to build β-dynamics on a reversible rewriting machine and to park - token dynamics as defining "different objects." The pivot is forced by - the v1 no-cloning countermodel (`machine.md` §9.1): copying a - superposed δ-argument result before uncomputation produces - `CNOT(|+⟩|0⟩) = |Φ⁺⟩`, preventing the adjoint pass from restoring a - clean entry state. The "different objects" observation remains true - and is resolved by adoption rather than refutation: because `U`, - `μ_p`, and `M` were never defined and no qALC data exists, the token - machine's clock and merge discipline now become their definition. A - rewriting machine is the parked alternative and would define different - objects; no equivalence, refinement, or preservation of the rewriting - proposal is claimed. + must still satisfy the orthonormal-columns contract. The route was + chosen over β-dynamics on a reversible rewriting machine after the + latter's coherence protocol fell to a no-cloning countermodel + (`machine.md` §9.1: copying a superposed δ-argument result before + uncomputation produces `CNOT(|+⟩|0⟩) = |Φ⁺⟩`, and the adjoint pass + cannot restore a clean entry state). The token machine's clock and + merge discipline define `U`, `μ_p`, and `M`; a rewriting machine is + the parked alternative and would define *different objects* — no + equivalence, refinement, or preservation of the rewriting proposal is + claimed. - **Typed invariant-sector halting, common origin:** fixed points are incompatible with injectivity; invariance suffices for monotone mass; the common-origin tick and the normative halted form (§4.3) are chosen, diff --git a/docs/quantum-algebraic/machine.md b/docs/quantum-algebraic/machine.md index da20f6a..1796c0c 100644 --- a/docs/quantum-algebraic/machine.md +++ b/docs/quantum-algebraic/machine.md @@ -1,8 +1,10 @@ -# qALC reference machine — formal draft v1 +# qALC rewriting machine — historical record (v0/v1, superseded) -**Status: formal draft v1 — reviewed; Try-boundary protocol -CONFIRMED-BROKEN, scaffold survives.** Working object for -`architecture.md` §9 item 1. The v1 review verdict is registered in §9: +**Status: historical record — do not build on this document.** The +rewriting-machine route was superseded by token transport +(`token.md`, the active design; architecture §8). This file preserves +formal draft v1 and its verdicts. The v1 review verdict is registered +in §9: the no-erasure forward machine and the color discipline hold (with three residual within-row defects), but the §5 protocol fails on a no-cloning countermodel — basis-copying a superposed result entangles @@ -426,6 +428,6 @@ the parked qGoI dynamics resurfacing as an internal mechanism rather than a separate pillar; (c) accept the raw colored machine as the canonical semantics and move all coherence engineering into compiled code. The witness-7 amendment does not name any machine mechanism in -any route. **Route (b) chosen by a9, 2026-08-09** — exploration brief -and inherited constraints in `token.md`; the architecture amendment it -requires is `token.md` §4. +any route. **Route (b) chosen by a9, 2026-08-09**; the +architecture amendment it required was ratified and applied the same +day, and `token.md` is now the active machine design. diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index 7e6b7df..9675ac5 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -1,56 +1,37 @@ -# qALC machine v2 — token-transport design - -**Status: ratified direction, working design sketch, pre-review.** -Route (b) of `machine.md` §9.4 — a reversible interaction/token -construction in which values are *transported* to δs rather than copied -— was chosen by a9 (2026-08-09) after the v1 Try-boundary protocol fell -to the no-cloning countermodel. The architecture §8 amendment this -required was ratified through thread `qalc-architecture` (AMEND, then -RATIFY — with the reviewer's tightened text and consequential edits) -and applied to `architecture.md` the same day. §§1–5 are the -exploration brief; §6 pins the exact classical substrate; §§7–8 are the -working design sketch and its obligations — **hand-derived, not yet -reviewed as a whole**. A parallel fresh-context feasibility review -(thread `qalc-token-machine`, same day) independently graded the route -**promising-with-hard-open-problems** and converged with the sketch on -every load-bearing point it covers: delimited gate interrogation is -new machinery (plain λIAM stops at a rigid head), raw canonical-boolean -traversal is spectator-distinguishing and one step desynchronized (two -independent derivations agree), balanced answer transport is mandatory, -readback must be an internal reversible controller, and the single -hardest problem is transport through nonlinear λ-code — H–NOT–H. Its -additions are folded in below (§6 verified bideterminism and the -jumping exclusion, §7.2 checklist, §8 kernel gate). - -## 1. Why tokens - -The Interaction Abstract Machine (Danos–Regnier) runs on untyped pure -terms, never rewrites the term, and is **bideterministic — natively -reversible**. The entire v0/v1 injectivity war (producer marking, -color disciplines, join charging) may dissolve at the root: orthonormal -columns could come from the dynamics instead of being engineered onto -it. The term is read-only, so there is no substitution, no closure -construction, no environment erasure — the state is a token position -plus context stacks, and the exponential-context stack plays the role -our `Look` tags played, reversibly by construction. Quantum prior art: -Hasuo–Hoshino (quantum GoI), Dal Lago–Faggian–Valiron–Yoshimizu -(multitoken machines) — typed/linear-logic settings; the untyped port -is the open engineering. - -## 2. Inherited constraints (guardrails) - -Items 1–8 are the four completed review rounds' guardrails; 9–13 were -added at amendment ratification. Any v2 design is dead on arrival -unless it respects: - -1. **No basis-copying of unknown superpositions** — the v1 killshot: +# qALC machine — token-transport design + +**Status: active design, pre-kernel; the sketch (§3) is hand-derived +and unverified.** The qALC machine is IAM-lineage token transport +(architecture §8): the invocation term is immutable and read-only, the +runtime basis is token configurations, and gate arguments reach δs by +routing, never by copying. The rationale: the Interaction Abstract +Machine (Danos–Regnier) is **bideterministic — natively reversible** — +so orthonormal columns can come from the dynamics instead of being +engineered onto them; there is no substitution, no closure +construction, no environment erasure; and the exponential context does +reversibly what content tags did irreversibly in the rejected +rewriting substrate. Quantum prior art: Hasuo–Hoshino (quantum GoI), +Dal Lago–Faggian–Valiron–Yoshimizu (multitoken machines) — +typed/linear settings; the untyped port is the open engineering, with +a standing feasibility grade of promising-with-hard-open-problems. +This document is current-only: guardrails (§1), the exact classical +substrate (§2), the design sketch (§3), and the kernel gate with the +obligations register (§4). History — the route choice, the ratified +amendment, the review record, the failed rewriting drafts — lives in +`../ledger/2026-08.md` and `machine.md`. + +## 1. Guardrails + +Any design is dead on arrival unless it respects: + +1. **No basis-copying of unknown superpositions** — `CNOT(|+⟩|0⟩) = |Φ⁺⟩`, `(H⊗I)|Φ⁺⟩ ≠ |0⟩|+⟩` (`machine.md` §9.1). - Values reach δs by *transport* or not at all; no machine rule copies - an already-superposed runtime value. -2. **Global single-map injectivity on the reachable basis** — whatever - the token state is, distinct sources need orthogonal images under - every iterate, checked as a full pairwise matrix over all columns, - δ, readback, error, and halt included. + Values reach δs by *transport* or not at all; no machine rule + copies an already-superposed runtime value. +2. **Global single-map injectivity on the reachable basis** — distinct + sources need orthogonal images under every iterate, checked as a + full pairwise matrix over all columns, δ, readback, error, and halt + included. 3. **Typed invariant halting sectors with ticks** (architecture §4.3): no reachable fixed points; common origin; halted states factor **isometrically** as `ℓ²(NF) ⊗ garbage ⊗ terminal-control ⊗ tick` — @@ -80,11 +61,11 @@ unless it respects: images of `0̂` and `1̂` remain orthogonal *full configurations* (both branches may output `I`; the reduced output can't see it). Witness statements name wire terms only, never machine mechanisms. -8. **Fork (A) stands**: minimal-information residue, earned coherence, - predecessor-fibre-local minimality — with token vocabulary: live - stacks are control, not garbage; residue is what a configuration - carries beyond the canonical live token state; terminal garbage is - the non-output state surviving at `RunDone`. +8. **Minimal-information residue, earned coherence** (fork A), in + token vocabulary: live stacks are control, not garbage; residue is + what a configuration carries beyond the canonical live token state; + terminal garbage is the non-output state surviving at `RunDone`; + minimality is predecessor-fibre-local. 9. **Closed semantic readback**: all query scheduling and NF construction happen inside one computable, time-homogeneous `U`. No external driver relaunching token queries — that would make τ, @@ -104,49 +85,7 @@ unless it respects: interrogation transcript and control to be injective and participates in the full pairwise range matrix. -## 3. Questions the design must answer - -1. What is the token state space, and is the linear extension of the - token step an isometry once δ-branching is added as a unitary - block? *(§7 sketches the answer; Lemma L1 is the crux.)* -2. How does `h` act — spell out the fibre and check guardrail 5. - *(§7.2–7.3.)* -3. Readback: full normal forms and halting mass from a head-query - machine, internal to `U`. *(Open — the largest undesigned - component; §7.8.)* -4. Duplication: exponential contexts replacing the v0/v1 `Look` - content tags. *(Native to the substrate; §6.)* -5. Timing: same synchronization physics; check H–NOT–H path lengths - concretely. *(§7.7; trace obligation.)* -6. Where does `Ω_qALC` live. *(Designated halt states on the token - clock; same wandering-subspace lemma; §7.8.)* - -## 4. Contract amendment — ratified and applied - -Architecture §8's β-dynamics decision parked the token machine as -"different objects … a separate pillar, never a drop-in engine." -Route (b) promotes it to *the* qALC machine. The amendment was -ratified in thread `qalc-architecture` (2026-08-09) with the -reviewer's tightened text — IAM bideterminism as guide-not-proof, the -immutable-invocation basis, internal readback — plus consequential -edits across §§2–10 (init as root query token, isometric halted -factorization, observational strategy clause, generator-duplication -constraint, error completeness, the negative witness as battery item -8, Danos–Regnier in the lineage) and applied to `architecture.md` in -the same commit series. The "different objects" observation was -resolved by **adoption, not refutation**: `U`, `μ_p`, `M` had never -been defined, so the token machine's clock and merge discipline become -their definition; a rewriting machine is now the parked alternative. - -## 5. What carries over from v1 regardless - -The typed terminal sectors and their lemma (review-confirmed twice); -the witness battery and hand-trace discipline; the defect-register -habit; the color-discipline *idea* as a fallback producer-marking tool -if bideterminism has gaps at the δ or readback boundaries; and the -review loop itself — draft, thread, countermodel, register, iterate. - -## 6. The classical substrate, exact: λIAM +## 2. The classical substrate, exact: λIAM Source: Accattoli–Dal Lago–Vanoni, *The (Abstract) Machinery of Interaction* (PPDP 2020, arXiv:2002.05649); table as reproduced in @@ -163,10 +102,12 @@ Directions d ::= ↓ | ↑ ``` The level of a context = the number of arguments the hole lies under. -Initial state: `s_t = (t, ⟨·⟩, ε, ε, ↓)`. Final states: -`(λx.u, C, L, ε, ↓)` — the head abstraction of the weak-head normal -form. The λIAM implements Closed CbN: the run from `s_t` terminates -iff weak-head reduction terminates on `t`. +Initial states, parameterized by observation depth `k`: +`(t, ⟨·⟩, ε, •^k, ↓)` — the hook the readback controller iterates on. +Final states: `(λx.u, C, L, ε, ↓)` — the head abstraction of the +weak-head normal form. The λIAM implements Closed CbN: the run from +the depth-0 initial state terminates iff weak-head reduction +terminates on `t`. ```text •1 (t u, C, L, T, ↓) → (t, C⟨⟨·⟩u⟩, L, •·T, ↓) @@ -189,42 +130,41 @@ logged position; `arg` completes an argument query, moving the logged position from tape to log as the return address for later backtracking. -**Bideterminism is structural.** Forward: the applicable rule is -determined by direction, code shape, and tape top. Backward: target +**Bideterminism is structural** (verified against arXiv:2002.05649). +The step relation is a partial bijection: `flip(s′) → flip(s)` gives +the reverse machine, and the rules occur in inverse pairs (`•1`/`•3`, +`•2`/`•4`, `var`/`bt2`, `arg`/`bt1`). Forward, the applicable rule is +determined by direction, code shape, and tape top; backward, target patterns are pairwise disjoint by the dual classification — `↓`-targets split by position kind and tape top (function-position/• = `•1`, function-position/l = `bt1`, λ-body = `•2`, argument-position = `arg`), `↑`-targets likewise (application = `•3`, λ/• = `•4`, λ/l = `var`, variable = `bt2`) — and each row is individually injective (pure stack transport; nothing is erased, `•` has constant content). -The feasibility review verified the published statement independently -against arXiv:2002.05649: the step relation is a partial bijection, -`flip(s′) → flip(s)` gives the reverse machine, and the rules occur in -inverse pairs (`•1`/`•3`, `•2`/`•4`, `var`/`bt2`, `arg`/`bt1`). -Initial states generalize to observation depth `k`: -`(t, ⟨·⟩, ε, •^k, ↓)` — the hook the readback controller iterates on. -This is exactly the property v0/v1 fought to engineer and lost: -**zero-garbage reversibility as a structural fact about the table.** -Two boundary caveats, review-supplied: a partial bijection's linear -extension is an isometry only once *totalized on reachables* — every -final or stuck shape needs a norm-one successor (tick sectors, error -adapters), or norm leaks; and the **jumping variant (λJAM) is -excluded** — its jump rule drops the skipped source state, is plainly -noninjective on the raw state grammar, and retaining the skipped -source as residue would give back the history the jump avoids. +Zero-garbage reversibility is a structural fact about the table. + +Two boundary caveats. A partial bijection's linear extension is an +isometry only once *totalized on reachables* — every final or stuck +shape needs a norm-one successor (tick sectors, error adapters), or +norm leaks. And the **jumping variant (λJAM) is excluded**: its jump +rule drops the skipped source state, is plainly noninjective on the +raw state grammar, and retaining the skipped source as residue would +give back the history the jump avoids. For qALC the walked term is the immutable invocation `p h t`; the constants are two extra leaf kinds with no classical rules of their own — every transition at a constant leaf belongs to the δ gadget -(§7) or to neutral readback. +(§3) or to neutral readback. A rigid head's argument is *not* entered +by any classical rule (the standard machine stops at the head), so +gate interrogation is necessarily new machinery. -## 7. The δ-gadget design sketch — working notes, unverified +## 3. The δ-gadget design sketch — unverified -Everything in this section is hand-derived against §6 and **has not -been reviewed or step-indexed**; it records the design position for -the review loop, not established results. +Everything in this section is hand-derived against §2 and **has not +been step-indexed against a full table**; it records the design +position for the kernel (§4), not established results. -### 7.1 Value as routing: the probe +### 3.1 Value as routing: the probe A boolean's value, in interaction terms, is *which argument it selects*. The gadget learns its argument's value the way the calculus @@ -247,18 +187,21 @@ M = 1̂ = λa.λb.b : •2 •2 var •4 — exits ↑, tape •·l_b·μ_h The standard `↑` routing against the two virtual applications then seeks virtual slot 1 (tape top `l`) or virtual slot 2 (tape top `•` then `l`) — i.e. **the boolean arrives as the token's exit slot: pure -position, no payload, nothing copied**. Non-boolean normal arguments -classify by other exit shapes (`λa.a` exits `l_a·•·μ_h·T`; a -three-lambda prefix strands `↓` on `μ_h`; …) and enter the species -error sector, retaining the transcript (guardrail 13). Totality of -this classification over all exit shapes is a proof obligation. +position, no payload, nothing copied**. The two literal-boolean paths +are one step apart and leave different binder positions in the tape — +which is exactly why fired outcomes must never be routed through +literal-boolean shapes (§3.3). Non-boolean normal arguments classify +by other exit shapes (`λa.a` exits `l_a·•·μ_h·T`; a three-lambda +prefix strands `↓` on `μ_h`; …) and enter the species error sector, +retaining the transcript (guardrail 13). Totality of this +classification over all exit shapes is a proof obligation. -### 7.2 The δ block fires on arrival states +### 3.2 The δ block fires on arrival states Let `arr_b` be the arrival state at virtual slot `b+1` for a given spectator `κ` (tape rest `T`, log, gadget instance position). The δ column is the unitary block **directly on arrivals** — no copy, no -uncompute step, so the v1 killshot shape cannot arise: +uncompute step, so the no-cloning shape cannot arise: ```text U |arr_b, κ⟩ = Σ_b′ (Q_q)_{b′b} |ans_b′, J_q(κ)⟩ Q_h = H, Q_t = diag(1, ω) @@ -266,16 +209,16 @@ U |arr_b, κ⟩ = Σ_b′ (Q_q)_{b′b} |ans_b′, J_q(κ)⟩ Q_h = H, Q_t with `ans_b′` gate-tagged answer-routing states (the `J_q` landing tags give cross-gate orthogonality). "Partial injection + unitary -blocks" is *not* automatically an isometry; the feasibility review's -checklist is adopted as the proof shape — `U†U = I` exactly when: -(1) the ordinary step is injective on ordinary sources; (2) each -reachable source matches exactly one rule; (3) each `Q_q` is unitary; -(4) `κ ↦ landing(q, b′, κ)` is injective; (5) landing subspaces for -distinct gate kinds are orthogonal; (6) every δ landing is orthogonal -to every ordinary successor; (7) reachable finals have norm-one -successors (ticks/errors — totalization); (8) landings are valid -reachable-basis states and the reachable span is forward-invariant. -One-step column orthonormality then propagates to every iterate. +blocks" is *not* automatically an isometry; the proof shape is: +`U†U = I` exactly when (1) the ordinary step is injective on ordinary +sources; (2) each reachable source matches exactly one rule; (3) each +`Q_q` is unitary; (4) `κ ↦ landing(q, b′, κ)` is injective; +(5) landing subspaces for distinct gate kinds are orthogonal; +(6) every δ landing is orthogonal to every ordinary successor; +(7) reachable finals have norm-one successors (ticks/errors — +totalization); (8) landings are valid reachable-basis states and the +reachable span is forward-invariant. One-step column orthonormality +then propagates to every iterate. The global-injectivity risk is concentrated in one place: the block absorbs the arrival's `b`-dependent tape prefix (`l_a·μ` vs @@ -286,24 +229,24 @@ with the same spectator would collide. Hence: reachable (gate instance, slot, spectator) triple, exactly one arrival residue is reachable. Per classical branch this holds because the probe run from a fixed entry is deterministic; across δ-branches it is -*arranged* by §7.3. This is the design's load-bearing lemma. +*arranged* by §3.3. This is the design's load-bearing lemma. -### 7.3 Balanced virtual answers +### 3.3 Balanced virtual answers After firing, the gadget must behave as `b̂′` toward the outstanding outer question. Real booleans route *asymmetrically* (the exit shapes -above differ in depth and leave different logged positions) — routing -a fired outcome through real-boolean shapes would attach `b′`-dependent -residue and rebuild decoherence-by-history. The virtual answers are -machine primitives, and we define them **balanced**: `ans_b′` consumes -the outer question's bullets and routes to the selected continuation -in a number of transitions independent of `b′`, leaving no -`b′`-dependent tape or log content. The answer bit lives only in the -token's exit position — which is precisely what the *next* δ block -reads. This is design freedom the classical IAM never needed and the -quantum machine cannot live without. - -### 7.4 HH, informally +of §3.1 differ in depth and leave different logged positions) — +routing a fired outcome through real-boolean shapes would attach +`b′`-dependent residue and rebuild decoherence-by-history. The virtual +answers are machine primitives, and we define them **balanced**: +`ans_b′` consumes the outer question's bullets and routes to the +selected continuation in a number of transitions independent of `b′`, +leaving no `b′`-dependent tape or log content. The answer bit lives +only in the token's exit position — which is precisely what the *next* +δ block reads. This is design freedom the classical IAM never needed +and the quantum machine cannot live without. + +### 3.4 HH, informally `h (h 0̂)` (through the wrapper plumbing, which is branch-independent since it precedes the inner fire): the outer gadget probes `h 0̂`; the @@ -315,7 +258,9 @@ gives `(|a₀⟩+|a₁⟩)/√2` from slot 1 and `(|a₀⟩−|a₁⟩)/√2` fr sum `|a₀⟩`, mass 1 on `0̂`. The cancellation happens exactly because post-fire paths run through machine-primitive balanced routing rather than real-term routing. **Unverified**: needs the step-indexed trace -against the full table. +against the full table. If the return produces `κ₀ ≠ κ₁`, the `|1̂⟩` +amplitudes do not cancel and the `1̂` mass is 1/2 — the probabilistic +degeneration, exactly. A soundness spot-check that falls out: `h ((h 0̂) 0̂ 0̂)` — the inner coin selects *different `0̂` occurrences*, whose selection paths carry @@ -326,7 +271,7 @@ merging machine would violate norm conservation. The machine's refusal to merge distinct-history branches is not a bug; it is the mechanism that makes the coherent cases meaningful. -### 7.5 Consistency without a store +### 3.5 Consistency without a store A fired instance is re-interrogated only through backtracking, and a backtracking re-entry carries the return-address logged position that @@ -341,7 +286,7 @@ independent first-query. Distinct occurrences are distinct instances re-launches a completed query. If C1 fails, a consistency mechanism is needed and the design weakens materially. -### 7.6 The negative witness, mechanically +### 3.6 The negative witness, mechanically `λb. b I I` on a fired outcome: the branches select different `I` occurrences; their live return addresses differ while the identity @@ -357,41 +302,50 @@ obligation: residue leaves the token before the next gate event. NOT′ = `λb.λx.λy. b y x` should pop symmetrically; the selector `λb. b 1̂ 0̂` routes through real boolean literals whose shapes are -unbalanced — the v1 prediction that the selector's coherence is a -measurable, not a given, returns with a concrete mechanism. +unbalanced — the selector's coherence is a measurable, not a given. -### 7.7 Timing +### 3.7 Timing Interference requires equal token time (guardrail 4). Virtual answers -are step-balanced by definition (§7.3); interposed real code must be +are step-balanced by definition (§3.3); interposed real code must be step-balanced on its own — the clean-compilation common-`T` requirement reappears as **path-length balance measured in token -steps**, derived from machine structure rather than stipulated. Same -shape as v1's derivation, honest mechanism this time. +steps**, derived from machine structure rather than stipulated. There +is no computable uniform padding for arbitrary untyped code, so the +coherent fragment is a discipline, not a default — which is the +"coherence is earned" economy, now with a concrete currency. -### 7.8 Not yet designed +### 3.8 Not yet designed - **The readback controller** — the largest open component: full-NF readback internal to `U` (guardrail 9), iterating head queries - reversibly under machine control, entering `RunDone` with the + reversibly under machine control (a depth-first output zipper over + the depth-`k` initial states of §2), entering `RunDone` with the isometric `NF ⊗ garbage ⊗ control ⊗ tick` factorization (guardrail 3), common-origin ticks. The λIAM answers weak-head queries; the - strong-normalization loop is the untyped port's known weak point - and the feasibility thread's central question. + strong-normalization loop is the untyped port's known weak point. +- Nonlinear reuse of a *fired* result (`λb. … b … b …`): sequential + controlled reuse must be distinguished from forbidden coherent + copying. - The `t` gadget (expected trivial: phase on arrivals, identity routing, own landing tag `J_t`). - Error-sector adapters and their injectivity. - The formal table itself, with the full pairwise range matrix. -## 8. The kernel gate, and the obligations register +If bideterminism turns out to have gaps at the δ or readback +boundaries, the rewriting drafts' color discipline (rule-id producer +marking with join charging) remains available as a local fallback +tool. + +## 4. The kernel gate, and the obligations register -The v2 formalization target — adopted from the feasibility review — is -a **three-program formal kernel**, deliberately smaller than a full -machine document: the eight λIAM rules; tagged gate-interrogation, -answer, return, error, readback, and tick rules; a proof that every -rule range is disjoint from every unrelated rule range; step-indexed -traces, with `(position, direction, log, tape, answer label)` reported -at every step, of +The formalization target is a **three-program formal kernel**, +deliberately smaller than a full machine document: the eight λIAM +rules; tagged gate-interrogation, answer, return, error, readback, +and tick rules; a proof that every rule range is disjoint from every +unrelated rule range; step-indexed traces, with +`(position, direction, log, tape, answer label)` reported at every +step, of ```text h (h 0̂) — HH: mass 1 on 0̂ by cancellation @@ -403,7 +357,8 @@ and a column-Gram enumeration over the small reachable graph, showing `NOT′` returns a boolean-independent spectator while the non-injective map does not. If the kernel works, the route is genuinely promising; if HH needs special-case stack erasure or H–NOT–H leaves distinct -log/tape states, the route has only relocated the v1 obstruction. +log/tape states, the route has only relocated the rewriting +substrate's obstruction and the fork reopens. | Item | Status | |---|---| @@ -411,9 +366,9 @@ log/tape states, the route has only relocated the v1 obstruction. | L2 pop timing / coherence return | stated; unproved | | C1 no fresh re-query | conjectured | | Probe-exit classification totality | obligation | -| Totalization (norm-one successors everywhere) | obligation (review) | -| Three-program kernel (table + traces + Gram) | the v2 gate; unstarted | +| Totalization (norm-one successors everywhere) | obligation | +| Three-program kernel (table + traces + Gram) | the gate; unstarted | | Readback controller | undesigned — hardest open | | `μ_p`/`Ω_qALC` on the token clock | pending readback design | -| Nonlinear reuse of a fired result (`λb.…b…b…`) | undesigned (review) | -| Bideterminism of §6 | verified (review, vs arXiv:2002.05649) | +| Nonlinear reuse of a fired result | undesigned | +| Bideterminism of §2 | verified vs arXiv:2002.05649 | From 7a6914d7ae0980b678490d53cae13f0db292397b Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 06:36:02 -0400 Subject: [PATCH 017/107] =?UTF-8?q?qalc:=20three-program=20kernel=20v1=20?= =?UTF-8?q?=E2=80=94=20machine-verified,=20in=20review?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit kernel.md: full transition table over the lambda-IAM substrate (call, recall, arrive/fire, retrace, anshead/vb2/vvar, root, errors, ticks), step-indexed HH trace, results and findings registers. HH cancels to mass 1 on 0-hat at the outer fire; H-NOT-H passes the coherence bar through NOT'; the negative witness stays orthogonal in residue and time; column-Gram orthonormal on all five reachable bases. Findings: C1 refuted (re-interrogation is real; recall = ticket-replay, no store); selector NOT measured decoherent by one-step desync; error residues must freeze complete control (third recurrence). token.md and STATUS synced; ledger carries the method and iterations. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 22 ++- docs/ledger/2026-08.md | 33 ++++ docs/quantum-algebraic/kernel.md | 297 +++++++++++++++++++++++++++++++ docs/quantum-algebraic/token.md | 34 ++-- 4 files changed, 367 insertions(+), 19 deletions(-) create mode 100644 docs/quantum-algebraic/kernel.md diff --git a/docs/STATUS.md b/docs/STATUS.md index 6bd963a..c6ef226 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -420,13 +420,25 @@ consistency) and a fresh-context feasibility review (thread promising-with-hard-open-problems, converging with the sketch on every load-bearing point; its checklist and exclusions are folded in. +**Kernel v1 is drafted and machine-verified** +(`quantum-algebraic/kernel.md`): full transition table over the λIAM +substrate, step-indexed traces, column-Gram orthonormal on every +tested reachable basis. HH halts with mass 1 on `0̂` by exact +cancellation at the outer fire; H–NOT–H passes the coherence bar +through NOT′; the negative witness's branches stay orthogonal in +residue and time. Measured findings: the selector NOT decoheres by +one-step desynchronization (the coherence economy in token steps); +re-interrogation is real (C1 refuted) and handled by ticket-replay +(`recall`) with no store. + The open docket, in order: -1. **the three-program formal kernel** (`token.md` §4 — the v2 gate): - full table, range-disjointness, step-indexed traces of HH / - H–NOT–H / the negative witness, column-Gram enumeration; L1/L2 and - the readback controller are the hard parts; -2. kernel through the review loop (both threads); +1. kernel v1 through the review loop (adversarial verification in + `qalc-token-machine`, contract conformance in `qalc-architecture` + — both dispatched 2026-08-09); the sharpest open lemma is + re-entry determinacy (`recall` erases `b′`); +2. the readback controller (full-NF halt sectors; the kernel's root + classifier is its 1-bit case) and the `t` gate's `ℤ[ω]` scalars; 3. the clean coherent compilation theorem (`quantum-algebraic/architecture.md` §6) — gates any universality claim; diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index edf19da..28c6e4c 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2013,3 +2013,36 @@ retired with their surviving content absorbed into the guardrails, sketch, and obligations register (renumbered §§1–4); machine.md re-headed as a historical record; review-event narration trimmed from the architecture in favor of ledger pointers. + +**Kernel v1 — the phase-1 gate passes mechanically** (2026-08-09, +same session). Method: a scratch λIAM stepper validated +state-for-state against the 17-state worked example in +arXiv:2104.13795 §III, extended to a superposition evolver (exact +`ℤ[1/√2]`, norm asserted 1 at every global step), used to force the +gate rules into shape against running countermodels — four design +corrections in as many iterations, each caught mechanically. The +rules that survived: `call` flips ↑ at the leaf with `γ_g·••·μ_g` +and the *classical* rules transport the probe through arbitrary +dereference plumbing (and retrace it after the fire — bideterminism +doing what v1's hand-built reverse machine could not); the δ block +fires directly on boundary-arrival states; balanced virtual answers +(`vvar` emits `•^(b′+1)·α_g(b′)`) need no padding because the +slot-2 bullet is spent by the classifier, not a step; every virtual +exit pays one extra bullet for the gate's own application crossing +(derived twice from literal-boolean ground-truth traces). Two +discoveries: the error-residue-completeness lesson recurred a third +time (a `Done` residue dropping the VB control register collided +two branches — caught as norm 3/2 by the negative witness, exactly +its job), and **C1 is false** — outputs re-interrogate fired gates +by backtracking through the selection — resolved by `recall` +(ticket-replay mirroring the literal's `bt2`-replay, no store, b′ +erased under a kernel-verified determinacy lemma). Results: HH mass +1 on `0̂` (cancellation at the outer fire, support collapses to 1 +at t=33); H–NOT–H mass 1 on `0̂` (L2 confirmed for NOT′); negative +witness 1/2+1/2 orthogonal in residue and time; **selector NOT +measured decoherent** (1/2, 1/2 mixed, Δt=1 — the coherence economy +in token steps); lone `h 0̂` correct; column-Gram orthonormal on +all five reachable bases (49–131 states). `kernel.md` committed as +the document of record; both reviews dispatched (adversarial +verification with an independent-reimplementation request to +`qalc-token-machine`, contract conformance to `qalc-architecture`). diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md new file mode 100644 index 0000000..23f0df9 --- /dev/null +++ b/docs/quantum-algebraic/kernel.md @@ -0,0 +1,297 @@ +# qALC three-program kernel — v1 + +**Status: kernel v1, machine-verified, pre-review.** This is the +formalization gate demanded by `token.md` §4: the complete transition +table for a boolean-output qALC machine, step-indexed traces of the +three witness programs, and a column-Gram enumeration over the +reachable bases. All obligations pass. Verification was mechanized in +a scratch superposition evolver (exact `ℤ[1/√2]` arithmetic, norm +asserted equal to 1 at every global step; the evolver stays out of the +tree per the no-code gate — reviewers should reproduce independently, +which is stronger verification than sharing it). Scope limits are in +§7; nothing here claims more than the kernel. + +```text +h (h 0̂) mass 1 on 0̂, single terminal configuration +h (NOT′ (h 0̂)) mass 1 on 0̂, single terminal configuration +(λb. b I I) (h 0̂) two error configurations, 1/2 + 1/2, orthogonal + in residue AND in entry time — never merge +column-Gram orthonormal on every reachable basis tested +``` + +Two probes beyond the gate, both physics-correct: the selector +`λb. b 1̂ 0̂` interposed in H–NOT–H **decoheres** (1/2, 1/2 mixed, +branches one step desynchronized) — the first mechanical measurement +of the coherence-is-earned economy; and lone `h 0̂` gives 1/2, 1/2 at +equal ticks. + +## 1. Scope + +The kernel machine answers a single **root boolean question** about +the invocation `p h t`: initial state +`(root, ↓, log ε, tape •·•·ρ)`, halting sectors `Halt(0̂)`/`Halt(1̂)` +for boolean outputs and an absorbing error sector for everything +else (non-boolean normal forms land there — legitimate for the +kernel, whose three programs need only this; full normal-form +readback is the next design stage, not smuggled in here). The ring +is `ℤ[1/√2]` — `h` only; `t` is the same table with +`Q_t = diag(1, ω)` over `ℤ[ω]/√2^d` and its own tags, deliberately +left unexercised. Classical substrate: the eight λIAM rules exactly +as pinned in `token.md` §2. + +## 2. State space + +```text +Run ::= (pos, d, log, tape) — λIAM shape, plus VB phase + | (leaf, VB(g, b′, k), log, tape) k ∈ {0,1,2} +Done ::= RunDone/Halt(b, residue, tick) | Error(residue, tick) +residue = the COMPLETE pre-entry state (pos, d, log, tape, VB phase) + +tape/log entries: • | logged position l | γ_g | μ_g | A_g(b′) + | α_g(b′) | ρ +``` + +`γ_g` (gate boundary marker), `μ_g` (probe frame), `A_g(b′)` (fired +answer token), `α_g(b′)` (answer ticket — a logged-position-like +entry with empty slice), `ρ` (root frame). The classical transport +rules (`arg`, `bt1`) treat `γ` and `α` exactly like logged positions; +`bt2` never matches them (no binder). `lp-like := l | γ | α`; +arrival classifiers accept `l | α` as the answer position, never `γ`. + +## 3. The transition table + +Classical rules `•1 •2 •3 •4 var arg bt2` are unchanged from +`token.md` §2. `bt1` is restricted to non-`γ` log heads; the `γ`-head +case belongs to the gate boundary (arrive/retrace below). New rules — +every `Done` entry freezes the complete source state as residue: + +```text +call (g, ↓, L, •·T) → (g, ↑, L, γ_g·•·•·μ_g·T) + g's leaf position; the top • is the query's application + crossing. Classical transport then delivers the probe to + g's true argument through arbitrary dereference plumbing. + +recall (g, ↓, L, •^(b′+1)·α_g(b′)·T) → (g, ↑, L, •·•·•·T) + consistent replay of a fired instance off its ticket — no + fire. Mirrors the literal boolean's bt2-replay: consume the + slot-dependent re-descent bullets and the ticket, emit the + two virtual lambda crossings plus the gate-application + compensation. Bullet/ticket arity mismatch → Error. + +arrive/ (m ends 'a', ↑, γ_g·L, P_b·μ_g·T) → +fire Σ_b′ (Q_g)_{b′b} · (m, ↑, γ_g·L, A_g(b′)·T) + P_0 = l· P_1 = •·l· (l ∈ {logged position, α}) + the δ block, directly on arrival states; Q_h = H. + Other tape shapes at a γ boundary → Error (species). + +retrace (m ends 'a', ↑, γ_g·L, A_g(b′)·T) → (parent+'f', ↓, + L, γ_g·A_g(b′)·T) [bt1's action on the γ head] + Classical rules then retrace the inward transit to the leaf. + +anshead (g, ↓, L, γ_g·A_g(b′)·T) → (g, VB(g, b′, 0), L, T) +vb2 (g, VB(g,b′,k<2), L, •·T) → (g, VB(g,b′,k+1), L, T) +vvar (g, VB(g,b′,2), L, T) → (g, ↑, L, •^(b′+1)·α_g(b′)·T) + the balanced virtual answer: consume the outer question's + two bullets as the two virtual lambdas, then emit the seek. + One bullet pays the gate-application crossing; the rest + encode the slot; α carries the return ticket. + +root (root, ↑, ε, P_b·ρ) → RunDone(b̂) → Halt(b̂, res, 0) → tick + other ρ arrivals → Error (non-boolean output) +errors VB with a non-• non-classifier tape top; ↓-stuck on μ/ρ + (too many head lambdas); neutral constants under μ/ρ; + recall arity mismatch — all → Error, complete residue. +ticks Halt/Error(…, k) → (…, k+1) +``` + +## 4. Where the design came from (load-bearing derivations) + +**Classical transport is the whole protocol.** `call` does not move +the token to the argument; it flips ↑ at the leaf with `γ_g` on top, +and the untouched classical rules carry the probe through any +var/arg dereference plumbing to the gate's true argument — verified +through double indirection (`((λg.g) h) 0̂` style). Dually, after +`fire`, `retrace` is one rule and the classical rules run the inward +transit backward to the leaf — bideterminism doing what v1's entire +hand-built reverse machine failed to do. + +**The gate-application compensation (+1 bullet).** A literal +boolean's lambdas are real tree nodes: its answer exits by real `•4` +crossings that later pay real `•3` crossings. The virtual boolean +sits one application *deeper* (at the gate leaf, function of its own +application node), so every virtual exit emits one extra bullet to +pay that crossing: `vvar` emits `•^(b′+1)·α` (one for the gate app, +`b′` for the slot skip), `recall` emits `•••` (two virtual lambdas +plus the gate app). Both derived by replaying the literal-boolean +ground-truth traces, not stipulated. + +**Balance needs no padding.** The classical `0̂`/`1̂` exits are one +step apart (the `•4` for the deeper binder). In the virtual answer +the slot-2 bullet is consumed by the arrival *classifier*, not by a +step, so both branches take identical step counts from fire to the +next boundary. The earlier design guess (a pad rule) was wrong and +is gone. + +**Re-interrogation is real; the no-store mechanism works.** +Conjecture C1 of `token.md` §3.5 is **false**: an output's variable +can seek its argument by backtracking *through* the boolean +selection, re-dereferencing to the gate leaf (the negative witness +does this). The literal boolean answers re-entry by `bt2` on the +selection ticket — replaying its structure, net tape-neutral. +`recall` is the virtual mirror: it reads `b′` off the `α` ticket and +replays without firing. The outcome of a fired gate lives only in +the tokens the machine already carries — no store, as designed. + +## 5. Verification results + +Mechanized runs, exact arithmetic, norm ≡ 1 asserted at every global +step (a norm increase is a non-injectivity detector — see §6): + +| program | sectors | support | terminal at | tick-aligned | +|---|---|---|---|---| +| `h (h 0̂)` | `0̂`: 1 | 1 | t=48 | yes | +| `h (NOT′ (h 0̂))` | `0̂`: 1 | 1 | t=63 | yes | +| `(λb. b I I)(h 0̂)` | err: 1 | 2 | t=59 | no (Δ=2) | +| `h (selNOT (h 0̂))` | `0̂`: 1/2, `1̂`: 1/2 | 4 | t=78 | no (Δ=1) | +| `h 0̂` | `0̂`: 1/2, `1̂`: 1/2 | 2 | t=30 | yes | + +HH's `1̂` amplitudes cancel *at the outer fire step* (t=33): the two +branches arrive at the boundary as a clean fibre — equal position, +log, tape-below-slot, and time — so everything after t=33 is a +single classical path. H–NOT–H does the same through NOT′'s real +selection legs (residue popped, lengths equal — the L2 obligation +confirmed for NOT′). The negative witness's branches keep distinct +residues and enter the error sector two steps apart — orthogonal two +ways over, as unitarity demands, and its four-state predecessor was +the run that caught a real table bug (§6). + +**Column-Gram enumeration**: for each program, the union of all +basis states reachable during evolution (ticks truncated at depth 2; +the tick shift is manifestly isometric beyond it), every column +checked unit-norm and every distinct pair orthogonal: + +| program | reachable basis | non-unit | non-orthogonal | +|---|---|---|---| +| HH | 61 | 0 | 0 | +| H–NOT–H | 83 | 0 | 0 | +| negative | 99 | 0 | 0 | +| selector | 131 | 0 | 0 | +| lone H | 49 | 0 | 0 | + +## 6. Findings register + +1. **The selector decoheres — the economy is measurable.** `NOT′` + (path-balanced) preserves coherence; `λb. b 1̂ 0̂` routes through + literal booleans whose step counts differ by one, and the machine + returns the mixed 1/2, 1/2 — mechanically deriving what the + rewriting drafts could only predict. "Coherence is earned" now + has a unit: token steps. +2. **Error residue must be the complete state — including control + phase.** The first negative-witness run produced norm 3/2: two + branches differing only in the VB `b′` register collided in an + error entry whose residue dropped the register. Third recurrence + of this bug class (v0 E1, v1 E1, here); the lesson is now a rule + shape: `Done` residues freeze the whole state, no exceptions. +3. **The norm assertion is a live non-injectivity detector.** Both + table bugs found during construction announced themselves as + norm violations in the negative witness — the witness battery + works as designed, and `λb. b I I` specifically earns its place. + +## 7. Honest scope and obligations discharged/remaining + +Discharged by the kernel: HH and H–NOT–H step-indexed traces; L2 +for `NOT′`; the negative witness; orthonormal columns on the tested +reachable bases; totality on every reachable state (the evolver +faults on stuck states; none occurred). + +Remaining, inherited or newly exposed: + +1. **Re-entry determinacy (new, replaces C1).** `recall` absorbs + `α_g(b′)`; injectivity needs `b′` recoverable from the retained + state. It holds on the kernel programs (the pending question + carries branch-distinct positions) and needs a general proof — + the sharpest open lemma, alongside general L1. +2. **Source-pattern disjointness is by rule priority in the scratch + model**; the formal table must make it structural (the Gram check + covers targets, not source overlap). +3. **The `•^(b′+1)·α` adjacency patterns** (recall trigger, arrival + shapes) are verified on the kernel programs; their totality over + all reachable shapes needs the general species-classification + proof. +4. **Boolean-output halt only** — the readback controller + (`token.md` §3.8) remains the largest undesigned component; the + root classifier here is its 1-bit special case. +5. **`t` unexercised** (needs `ℤ[ω]` scalars; table shape ready). +6. Gram enumeration is per-program reachable bases, not an + all-programs theorem — that is exactly the orthonormal-columns + proof obligation of architecture §9 item 1. + +## 8. Appendix — HH step-indexed trace + +Notation: `b` = bullet, `L(path|n)` = logged position (slice length +n), `gh/mh` = `γ_h`/`μ_h`, `Ahb′` = `A_h(b′)`, `ahb′` = `α_h(b′)`, +`R` = ρ. Amplitude `m/r2^k` = `m·2^(−k/2)`. Term paths: wrapper +`(λh.λt. h (h 0̂)) h t`; `fa` = the h leaf, `ffbbf`/`ffbbaf` = outer/ +inner `h` occurrences, `ffbba` = `h 0̂`, `ffbbaa` = `0̂`. + +```text +t= 1 b1 1 f D log[] tape[b b b R] +t= 2 b1 1 ff D log[] tape[b b b b R] +t= 3 b2 1 ffb D log[] tape[b b b R] +t= 4 b2 1 ffbb D log[] tape[b b R] +t= 5 b1 1 ffbbf D log[] tape[b b b R] +t= 6 var 1 ff U log[] tape[L(ffbbf|0) b b b R] +t= 7 arg 1 fa D log[L(ffbbf|0)] tape[b b b R] +t= 8 call 1 fa U log[L(ffbbf|0)] tape[gh b b mh b b R] +t= 9 bt1 1 ff D log[] tape[L(ffbbf|0) gh b b mh b b R] +t= 10 bt2 1 ffbbf U log[] tape[gh b b mh b b R] +t= 11 arg 1 ffbba D log[gh] tape[b b mh b b R] +t= 12 b1 1 ffbbaf D log[gh] tape[b b b mh b b R] +t= 13 var 1 ff U log[] tape[L(ffbbaf|1) b b b mh b b R] +t= 14 arg 1 fa D log[L(ffbbaf|1)] tape[b b b mh b b R] +t= 15 call 1 fa U log[L(ffbbaf|1)] tape[gh b b mh b b mh b b R] +t= 16 bt1 1 ff D log[] tape[L(ffbbaf|1) gh …] +t= 17 bt2 1 ffbbaf U log[gh] tape[gh b b mh b b mh b b R] +t= 18 arg 1 ffbbaa D log[gh gh] tape[b b mh b b mh b b R] +t= 19 b2 1 ffbbaab D log[gh gh] tape[b mh b b mh b b R] +t= 20 b2 1 ffbbaabb D log[gh gh] tape[mh b b mh b b R] +t= 21 var 1 ffbbaa U log[gh gh] tape[L(ffbbaabb|0) mh b b mh b b R] +t= 22 fire-h ————— inner δ: slot-1 arrival at the inner γ boundary ————— + 1/r2 ffbbaa U log[gh gh] tape[Ah0 b b mh b b R] + 1/r2 ffbbaa U log[gh gh] tape[Ah1 b b mh b b R] +t= 23 retrace (both branches, lockstep) ffbbaf D tape[gh Ahb′ …] +t= 24 var both ff U … +t= 25 arg both fa D log[L(ffbbaf|1)] tape[gh Ahb′ b b mh b b R] +t= 26 anshead both fa VB(h,b′,0) tape[b b mh b b R] +t= 27 vb2 both fa VB(h,b′,1) tape[b mh b b R] +t= 28 vb2 both fa VB(h,b′,2) tape[mh b b R] +t= 29 vvar ————— balanced emission: b′=0: [b ah0 mh …]; b′=1: [b b ah1 mh …] +t= 30 bt1 both ff D … +t= 31 bt2 both ffbbf U … +t= 32 b3 both ffbba U b′=0: tape[ah0 mh b b R]; b′=1: tape[b ah1 mh b b R] +t= 33 fire-h ————— outer δ: branches arrive as a clean fibre (equal + log, position, T, time; slots differ) — H fires, the + A_h(1) amplitudes cancel exactly, support returns to 1: + 1 ffbba U log[gh] tape[Ah0 b b R] +t= 34 retrace 1 ffbbf D … +t= 35 var 1 ff U … +t= 36 arg 1 fa D tape[gh Ah0 b b R] +t= 37 anshead 1 fa VB(h,0,0) tape[b b R] +t= 38 vb2 1 fa VB(h,0,1) tape[b R] +t= 39 vb2 1 fa VB(h,0,2) tape[R] +t= 40 vvar 1 fa U log[L(ffbbf|0)] tape[b ah0 R] +t= 41 bt1 1 ff D log[] tape[L(ffbbf|0) b ah0 R] +t= 42 bt2 1 ffbbf U log[] tape[b ah0 R] +t= 43 b3 1 ffbb U log[] tape[ah0 R] +t= 44 b4 1 ffb U log[] tape[b ah0 R] +t= 45 b4 1 ff U log[] tape[b b ah0 R] +t= 46 b3 1 f U log[] tape[b ah0 R] +t= 47 b3 1 root U log[] tape[ah0 R] +t= 48 rootdone → RunDone(0̂) → Halt(0̂, residue (ah0·R), 0) → ticks. + Mass 1 on 0̂, amplitude 2/√2² = 1 exactly. +``` + +The H–NOT–H and negative-witness traces (63 and 59 steps) follow the +same notation and are mechanically reproducible from the table; their +checkpoints (fires, anshead/vvar windows, recall events in the +negative witness, terminal entries) are as reported in §5. diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index 9675ac5..b65227d 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -279,12 +279,18 @@ encodes the original slot — routing reads the outcome off the token itself. No global store of fired outcomes exists; the outcome lives exactly as long as the token's routing history needs it. -**Conjecture C1 (no fresh re-query).** No reachable run interrogates -the same gate instance (same exponential context) through a second -independent first-query. Distinct occurrences are distinct instances -(guardrail 12); within one instance, the classical λIAM never -re-launches a completed query. If C1 fails, a consistency mechanism -is needed and the design weakens materially. +**C1 (no fresh re-query) is REFUTED — and the design survived it.** +The kernel (`kernel.md`) found that an output's variable can seek its +argument by backtracking *through* the boolean selection, +re-dereferencing to the gate leaf as a fresh-looking query (the +negative witness does it). The literal boolean answers re-entry by +`bt2`-replay on its selection ticket; the machine mirrors this with +a `recall` rule that reads `b′` off the `α` ticket and replays +without firing — consistency with no store, as this section hoped, +but through a rule, not a reachability argument. The residual +obligation is **re-entry determinacy**: `recall` erases `b′`, so +injectivity needs `b′` recoverable from the retained state +(kernel-verified; general proof open). ### 3.6 The negative witness, mechanically @@ -362,13 +368,13 @@ substrate's obstruction and the fork reopens. | Item | Status | |---|---| -| L1 arrival-residue determinacy | stated; unproved — load-bearing | -| L2 pop timing / coherence return | stated; unproved | -| C1 no fresh re-query | conjectured | -| Probe-exit classification totality | obligation | -| Totalization (norm-one successors everywhere) | obligation | -| Three-program kernel (table + traces + Gram) | the gate; unstarted | -| Readback controller | undesigned — hardest open | +| Three-program kernel (table + traces + Gram) | **v1 drafted and machine-verified — `kernel.md`; in review** | +| L1 arrival-residue determinacy | kernel-verified; general proof open | +| L2 pop timing / coherence return | confirmed for NOT′ (kernel); selector measured decoherent | +| Re-entry determinacy (replaces refuted C1) | kernel-verified; general proof open — sharpest lemma | +| Probe-exit classification totality | open (kernel error rules are catch-alls) | +| Totalization (norm-one successors everywhere) | verified on kernel bases; general proof open | +| Readback controller | undesigned — hardest open; kernel's root classifier is its 1-bit case | | `μ_p`/`Ω_qALC` on the token clock | pending readback design | -| Nonlinear reuse of a fired result | undesigned | +| Nonlinear reuse of a fired result | partially exercised (negative witness); general story open | | Bideterminism of §2 | verified vs arXiv:2002.05649 | From fa85d9e66a810f29a8b5c504cb1e66a3cbd3ed2c Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 06:43:14 -0400 Subject: [PATCH 018/107] =?UTF-8?q?qalc:=20kernel=20v1.1=20=E2=80=94=20con?= =?UTF-8?q?formance=20blocker=20fixed,=20amendments=20applied?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Output alphabet {0-hat, 1-hat, I}: the negative witness's I output is a valid NF, both branches Halt(I) with orthogonal residues and times (the real witness-8 assertion; v1.0 misclassified it as error). RunDone/Halt split into separate U steps, timing convention pinned. Gram strengthened to structural amplitude-blind BFS (cancelled targets included; bases 53-135, zero stuck, zero defects). Output-density report added. Architecture: witness 7 pinned to the exact NOT' wire term with the selector as a measured distinct coherence class; stale leftmost-outermost bullet replaced. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 23 ++-- docs/ledger/2026-08.md | 27 +++++ docs/quantum-algebraic/architecture.md | 30 +++-- docs/quantum-algebraic/kernel.md | 156 +++++++++++++++++-------- 4 files changed, 170 insertions(+), 66 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index c6ef226..d053d4d 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -425,18 +425,23 @@ load-bearing point; its checklist and exclusions are folded in. substrate, step-indexed traces, column-Gram orthonormal on every tested reachable basis. HH halts with mass 1 on `0̂` by exact cancellation at the outer fire; H–NOT–H passes the coherence bar -through NOT′; the negative witness's branches stay orthogonal in -residue and time. Measured findings: the selector NOT decoheres by -one-step desynchronization (the coherence economy in token steps); -re-interrogation is real (C1 refuted) and handled by ticket-replay -(`recall`) with no store. +through NOT′; the negative witness's branches halt with the *same* +output `I` and stay orthogonal in residue and time. Measured +findings: the selector NOT decoheres by one-step desynchronization +(the coherence economy in token steps); re-interrogation is real +(C1 refuted) and handled by ticket-replay (`recall`) with no store. +The conformance review (thread `qalc-architecture`) returned +partial-conformance with one blocker — v1.0 misclassified the valid +output `I` as an error — fixed in v1.1 along with separate +`RunDone`/`Halt` steps, a structural (cancelled-targets-included) +Gram, and two mandated architecture amendments (witness 7 pinned to +the exact `NOT′` wire term; the stale strategy bullet). The open docket, in order: -1. kernel v1 through the review loop (adversarial verification in - `qalc-token-machine`, contract conformance in `qalc-architecture` - — both dispatched 2026-08-09); the sharpest open lemma is - re-entry determinacy (`recall` erases `b′`); +1. the adversarial machine review (`qalc-token-machine`, independent + reimplementation requested — in flight); the sharpest open lemma + is re-entry determinacy (`recall` erases `b′`); 2. the readback controller (full-NF halt sectors; the kernel's root classifier is its 1-bit case) and the `t` gate's `ℤ[ω]` scalars; 3. the clean coherent compilation theorem diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 28c6e4c..511ddb6 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2046,3 +2046,30 @@ all five reachable bases (49–131 states). `kernel.md` committed as the document of record; both reviews dispatched (adversarial verification with an independent-reimplementation request to `qalc-token-machine`, contract conformance to `qalc-architecture`). + +**Kernel conformance round** (2026-08-09, same session). Verdict: +partial conformance, one blocker — v1.0's root classifier sent the +negative witness's output `I` to the error sector, but `I` is a +valid closed normal form (only a gate *applied to* a non-boolean is +a species error), so witness 8 was testing error-entry injectivity +rather than same-output-never-merges. v1.1 fixes: output alphabet +{`0̂`, `1̂`, `I`} with the `l·•·ρ` root signature for `I` (both +branches now `Halt(I, …)` — 1/2 + 1/2, orthogonal residues, Δt = 2: +the noninjective-output dilation exactly); `RunDone → Halt` split +into separate `U` steps with the timing convention pinned; the Gram +strengthened to the structural amplitude-blind BFS (cancelled +targets' columns included — HH's basis grows 61→82, still clean, and +totality falls out as zero stuck states); output-density reporting +added (lone `h 0̂` halts exactly diagonal — the ticket survives, the +bare coin's coherence unearned, as the economy demands); battery +accounting corrected (items 1/9 not-applicable rather than vacuous; +5 not exercised). Two mandated architecture amendments applied: +witness 7 pinned to the exact wire term `NOT′ = λb.λx.λy. b y x` +with the selector recorded as a measured member of a different +coherence class, and the stale leftmost-outermost §8 bullet replaced +by token-schedule-with-observational-conservativity. The review also +ratified the erasure-scope framing: the kernel Gram itself proves +the `fire`/`recall` erasures injective on the enumerated domains, +the general schemas stay conditional on the determinacy lemmas, and +the input boolean must never be conservatively charged as residue +(it is the consumed quantum coordinate). diff --git a/docs/quantum-algebraic/architecture.md b/docs/quantum-algebraic/architecture.md index 37ca2a9..7ccb194 100644 --- a/docs/quantum-algebraic/architecture.md +++ b/docs/quantum-algebraic/architecture.md @@ -509,12 +509,18 @@ Every qALC engine change must then satisfy: on `0̂` and mass 0 on `1̂` — destructive cancellation, separating quantum semantics from the probabilistic degeneration (which yields the same mass but a mixed output at (1/2, 1/2)); -7. **the H–NOT–H witness**: `h (NOT (h 0̂))` with `NOT` a pure λ-term - halts with mass 1 on `0̂` (HXH = Z on `|0⟩`) — HH alone certifies only - local δ coherence, and an engine could pass it while β garbage from - any interposed λ-term destroys every nontrivial coherent computation; - this witness is the smallest test that λ-computation between gates is - coherence-transparent; +7. **the H–NOT′–H witness**: `h (NOT′ (h 0̂))` with the exact wire + term `NOT′ := λb.λx.λy. b y x` halts with mass 1 on `0̂` + (HXH = Z on `|0⟩`) — HH alone certifies only local δ coherence, + and an engine could pass it while garbage from any interposed + λ-term destroys every nontrivial coherent computation; this + witness is the smallest test that λ-computation between gates is + coherence-transparent. The term is pinned because extensionally + equivalent implementations of negation need not share a + coherence class — the selector `λb. b 1̂ 0̂` is a measured + member of a different one (it decoheres by one-step + desynchronization; `kernel.md`), which is the economy working, + not a failed witness; 8. **the negative witness**: for `λb. b I I` (a non-injective boolean map) applied to a fired `h` outcome, the synchronized images of basis inputs `0̂` and `1̂` remain orthogonal full configurations and never @@ -567,10 +573,14 @@ Every qALC engine change must then satisfy: kinds and against every non-δ range (§7); branch-dependent δ residue would kill even the HH witness, and a landing shared across gate kinds would break isometry outright. -- **Leftmost-outermost strong reduction:** the house strategy; the - machine is the definition — which chooses one machine-relative - reduction sequence rather than resolving algebraic-λ non-confluence, - and β/δ-convertibility is not a semantic equality here (§3). +- **Token schedule with observational leftmost-outermost + conservativity:** the token/query/readback cadence defines the + semantic clock; effect-free outcomes equal rigid-atom + leftmost-outermost normalization without stepwise redex simulation + (§3, §6). The machine is the definition — which chooses one + machine-relative semantics rather than resolving algebraic-λ + non-confluence, and β/δ-convertibility is not a semantic equality + here (§3). - **Exactness:** ring arithmetic only, conservation as equality, brackets for every unbounded claim. - **Name:** qALC, quantum algebraic lambda calculus — lineage-accurate: diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 23f0df9..c8b569e 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,10 +1,12 @@ # qALC three-program kernel — v1 -**Status: kernel v1, machine-verified, pre-review.** This is the -formalization gate demanded by `token.md` §4: the complete transition -table for a boolean-output qALC machine, step-indexed traces of the -three witness programs, and a column-Gram enumeration over the -reachable bases. All obligations pass. Verification was mechanized in +**Status: kernel v1.1 — machine-verified; conformance-reviewed +(thread `qalc-architecture`), blocker fixed; adversarial machine +review in flight.** This is the formalization gate demanded by +`token.md` §4: the complete transition table for a small-output qALC +machine, step-indexed traces of the three witness programs, and a +column-Gram enumeration over the structural reachable bases. All +enumerated kernel-scope checks pass. Verification was mechanized in a scratch superposition evolver (exact `ℤ[1/√2]` arithmetic, norm asserted equal to 1 at every global step; the evolver stays out of the tree per the no-code gate — reviewers should reproduce independently, @@ -14,9 +16,12 @@ which is stronger verification than sharing it). Scope limits are in ```text h (h 0̂) mass 1 on 0̂, single terminal configuration h (NOT′ (h 0̂)) mass 1 on 0̂, single terminal configuration -(λb. b I I) (h 0̂) two error configurations, 1/2 + 1/2, orthogonal - in residue AND in entry time — never merge -column-Gram orthonormal on every reachable basis tested +(λb. b I I) (h 0̂) Halt(I) in BOTH branches, 1/2 + 1/2: same + output normal form, orthogonal in residue AND + entry time — the noninjective-output dilation, + exactly as the negative witness asserts +column-Gram orthonormal on every structural reachable basis + (amplitude-blind BFS: cancelled targets included) ``` Two probes beyond the gate, both physics-correct: the selector @@ -27,24 +32,31 @@ equal ticks. ## 1. Scope -The kernel machine answers a single **root boolean question** about +The kernel machine answers a single **root output question** about the invocation `p h t`: initial state -`(root, ↓, log ε, tape •·•·ρ)`, halting sectors `Halt(0̂)`/`Halt(1̂)` -for boolean outputs and an absorbing error sector for everything -else (non-boolean normal forms land there — legitimate for the -kernel, whose three programs need only this; full normal-form -readback is the next design stage, not smuggled in here). The ring -is `ℤ[1/√2]` — `h` only; `t` is the same table with -`Q_t = diag(1, ω)` over `ℤ[ω]/√2^d` and its own tags, deliberately -left unexercised. Classical substrate: the eight λIAM rules exactly -as pinned in `token.md` §2. +`(root, ↓, log ε, tape •·•·ρ)`, output alphabet **{`0̂`, `1̂`, `I`}** +with typed halting sectors for each, an absorbing error sector for +species errors, and root arrivals outside the alphabet also entering +the error sector — a kernel-scope limitation flagged as such: the +architecture permits arbitrary normal-form outputs, and recognizing +them is the readback controller's job, not smuggled in here. `I` is +in the alphabet because the negative witness's output is a *valid +closed normal form* — classifying it as an error would make witness +8 vacuous (a conformance-review catch; v1.0 had exactly that bug). +Terminal entry is the normative two-step +`RunDone(nf, res) → Halt(nf, res, 0) → tick`, each a separate `U` +application. The ring is `ℤ[1/√2]` — `h` only; `t` is the same table +with `Q_t = diag(1, ω)` over `ℤ[ω]/√2^d` and its own tags, +deliberately left unexercised. Classical substrate: the eight λIAM +rules exactly as pinned in `token.md` §2. ## 2. State space ```text -Run ::= (pos, d, log, tape) — λIAM shape, plus VB phase - | (leaf, VB(g, b′, k), log, tape) k ∈ {0,1,2} -Done ::= RunDone/Halt(b, residue, tick) | Error(residue, tick) +Run ::= (pos, d, log, tape) — λIAM shape, plus VB phase + | (leaf, VB(g, b′, k), log, tape) k ∈ {0,1,2} +RunDone ::= RunDone(nf, residue) nf ∈ {0̂, 1̂, I, err} +Halt ::= Halt(nf, residue, tick) | Error(residue, tick) residue = the COMPLETE pre-entry state (pos, d, log, tape, VB phase) tape/log entries: • | logged position l | γ_g | μ_g | A_g(b′) @@ -96,12 +108,18 @@ vvar (g, VB(g,b′,2), L, T) → (g, ↑, L, •^(b′+1)·α_g(b′)·T One bullet pays the gate-application crossing; the rest encode the slot; α carries the return ticket. -root (root, ↑, ε, P_b·ρ) → RunDone(b̂) → Halt(b̂, res, 0) → tick - other ρ arrivals → Error (non-boolean output) +root (root, ↑, ε, P_b·ρ) → RunDone(b̂, res) + (root, ↑, ε, l·•·ρ) → RunDone(I, res) + one lambda consumed, head = its own binder, unapplied — + the I signature at depth-2 observation + other ρ arrivals → RunDone(err, res) [kernel-scope + limitation: outputs beyond {0̂,1̂,I} await real readback] +halt RunDone(nf, res) → Halt(nf, res, 0) [separate step] +ticks Halt/Error(…, k) → (…, k+1) errors VB with a non-• non-classifier tape top; ↓-stuck on μ/ρ (too many head lambdas); neutral constants under μ/ρ; - recall arity mismatch — all → Error, complete residue. -ticks Halt/Error(…, k) → (…, k+1) + species shapes at γ boundaries; recall arity mismatch — + all → Error via RunDone, complete residue. ``` ## 4. Where the design came from (load-bearing derivations) @@ -147,13 +165,27 @@ the tokens the machine already carries — no store, as designed. Mechanized runs, exact arithmetic, norm ≡ 1 asserted at every global step (a norm increase is a non-injectivity detector — see §6): -| program | sectors | support | terminal at | tick-aligned | +Timing convention (pinned, conformance-reviewed): `RunDone` entry and +`Halt(…, 0)` entry are separate `U` steps; "Halt at" below is the +`Halt(…, 0)` step. + +| program | sectors | support | Halt at | tick-aligned | |---|---|---|---|---| -| `h (h 0̂)` | `0̂`: 1 | 1 | t=48 | yes | -| `h (NOT′ (h 0̂))` | `0̂`: 1 | 1 | t=63 | yes | -| `(λb. b I I)(h 0̂)` | err: 1 | 2 | t=59 | no (Δ=2) | -| `h (selNOT (h 0̂))` | `0̂`: 1/2, `1̂`: 1/2 | 4 | t=78 | no (Δ=1) | -| `h 0̂` | `0̂`: 1/2, `1̂`: 1/2 | 2 | t=30 | yes | +| `h (h 0̂)` | `0̂`: 1 | 1 | t=49 | yes | +| `h (NOT′ (h 0̂))` | `0̂`: 1 | 1 | t=64 | yes | +| `(λb. b I I)(h 0̂)` | `I`: 1 | 2 | t=58, 60 | no (Δ=2) | +| `h (selNOT (h 0̂))` | `0̂`: 1/2, `1̂`: 1/2 | 4 | t=78, 79 | no (Δ=1) | +| `h 0̂` | `0̂`: 1/2, `1̂`: 1/2 | 2 | t=31 | yes | + +Output-density report (the kernel as output-operator prototype): the +negative witness's two branches halt with the *same* `nf = I` and +distinct residues — `ρ_output` is `|I⟩⟨I|` with the orthogonality in +the traced-out garbage/time, the noninjective-output dilation +exactly. Lone `h 0̂` halts at equal ticks but with `b`-dependent +residues (the `α` ticket survives), so `ρ_output` is exactly +diagonal `diag(1/2, 1/2)` — the bare coin's output coherence is +unearned, as the contract's economy demands; earning it would +require code that uncomputes the ticket. HH's `1̂` amplitudes cancel *at the outer fire step* (t=33): the two branches arrive at the boundary as a clean fibre — equal position, @@ -165,18 +197,25 @@ residues and enter the error sector two steps apart — orthogonal two ways over, as unitarity demands, and its four-state predecessor was the run that caught a real table bug (§6). -**Column-Gram enumeration**: for each program, the union of all -basis states reachable during evolution (ticks truncated at depth 2; -the tick shift is manifestly isometric beyond it), every column -checked unit-norm and every distinct pair orthogonal: - -| program | reachable basis | non-unit | non-orthogonal | -|---|---|---|---| -| HH | 61 | 0 | 0 | -| H–NOT–H | 83 | 0 | 0 | -| negative | 99 | 0 | 0 | -| selector | 131 | 0 | 0 | -| lone H | 49 | 0 | 0 | +**Column-Gram enumeration** (strengthened after conformance review): +the basis is the **structural** reachable graph — an amplitude-blind +BFS over column targets, so states that cancel to zero in the +aggregated evolution (e.g. the annihilated `A_h(1)` targets at HH's +outer fire) have their columns checked too. Ticks truncated at depth +2 (the tick shift is manifestly isometric beyond it); the +invocation-sector coordinate is suppressed in displayed states and +preserved trivially (the term is read-only), so per-program +enumeration plus sector orthogonality covers the direct sum. Every +column unit-norm, every distinct pair orthogonal, no stuck states +(totality): + +| program | structural basis | stuck | non-unit | non-orthogonal | +|---|---|---|---|---| +| HH | 82 | 0 | 0 | 0 | +| H–NOT–H | 104 | 0 | 0 | 0 | +| negative | 103 | 0 | 0 | 0 | +| selector | 135 | 0 | 0 | 0 | +| lone H | 53 | 0 | 0 | 0 | ## 6. Findings register @@ -196,13 +235,34 @@ checked unit-norm and every distinct pair orthogonal: table bugs found during construction announced themselves as norm violations in the negative witness — the witness battery works as designed, and `λb. b I I` specifically earns its place. +4. **Valid normal forms are not errors** (conformance blocker, + fixed in v1.1). v1.0's root classifier sent the negative + witness's output `I` to the error sector, which made witness 8 + vacuous — it tested error-entry injectivity rather than the + architecture's same-output-never-merges assertion. The output + alphabet gained `I`, both branches now halt as `Halt(I, …)` with + orthogonal residues and times, and the general lesson is pinned: + only a *gate applied to* a non-boolean is a species error; + output classification belongs to readback. +5. **The battery accounting, per conformance review**: items 2, 3, + 4 (finite instance), 6, 7, and 8 are discharged at kernel scope; + items 1 and 9 are not applicable (no code exists — not + "vacuously passed"); item 5 (effect-free conservativity) is not + exercised by the kernel set and remains open. ## 7. Honest scope and obligations discharged/remaining Discharged by the kernel: HH and H–NOT–H step-indexed traces; L2 -for `NOT′`; the negative witness; orthonormal columns on the tested -reachable bases; totality on every reachable state (the evolver -faults on stuck states; none occurred). +for `NOT′`; the negative witness (as of v1.1 — same halted `I`, +orthogonal configurations); orthonormal columns on the structural +reachable bases; totality on every structural state (zero stuck). +The erasures at `fire` and `recall` are, per the conformance +review's framing, *proved injective on the enumerated kernel +domains by the Gram check itself*; their general schemas remain +conditional on the re-entry and arrival-determinacy lemmas — and +the input boolean `b` must never be conservatively charged as +residue while those are open (retaining it would destroy the clean +fibre; the design keeps `b` as the consumed quantum coordinate). Remaining, inherited or newly exposed: @@ -287,7 +347,9 @@ t= 44 b4 1 ffb U log[] tape[b ah0 R] t= 45 b4 1 ff U log[] tape[b b ah0 R] t= 46 b3 1 f U log[] tape[b ah0 R] t= 47 b3 1 root U log[] tape[ah0 R] -t= 48 rootdone → RunDone(0̂) → Halt(0̂, residue (ah0·R), 0) → ticks. +t= 48 rootdone 1 RunDone(0̂, residue (ah0·R)) +t= 49 halt 1 Halt(0̂, residue, 0) [separate U step] +t= 50 tick 1 Halt(0̂, residue, 1) … Mass 1 on 0̂, amplitude 2/√2² = 1 exactly. ``` From 0c827af15cadbcf38ba766a585932b4b189d39c0 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 06:50:58 -0400 Subject: [PATCH 019/107] =?UTF-8?q?qalc:=20kernel=20v1=20adversarial=20ver?= =?UTF-8?q?dict=20=E2=80=94=20recall=20CONFIRMED-BROKEN?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Independent reimplementation reproduced all five results (substrate, fibres, HH, H-NOT'-H balance, negative witness HOLD), then broke the replay protocol: p* = \h.\t.((((h 0^) h) h) 0^) creates nested same-kind tickets and recall's b'-erasure aliases two reachable re-entry states (norm 3/2 at step 89, verified against both implementations; 3-coin regression shows the cross-time column collision). Re-entry determinacy refuted; verdict and repair directions registered in kernel.md par.9; token.md obligations and STATUS docket updated: reversible ticket cleaning is the docket head, p* and 3-coin are mandatory regressions. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 17 ++++- docs/ledger/2026-08.md | 32 ++++++++++ docs/quantum-algebraic/kernel.md | 104 +++++++++++++++++++++++++++---- docs/quantum-algebraic/token.md | 13 ++-- 4 files changed, 145 insertions(+), 21 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index d053d4d..7959fcd 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -437,11 +437,22 @@ output `I` as an error — fixed in v1.1 along with separate Gram, and two mandated architecture amendments (witness 7 pinned to the exact `NOT′` wire term; the stale strategy bullet). +The adversarial review returned: **FAIL for kernel v1, route +intact** — the reviewer's independent reimplementation reproduced +all five results (substrate, fibres, balance all HOLD), then broke +`recall` with `p★ = λh.λt. ((((h 0̂) h) h) 0̂)`: nested same-kind +tickets alias after the replay erases `b′` (norm 3/2 at step 89, +confirmed against both implementations; a 3-coin regression shows +the same collision across time slices). Re-entry determinacy is +refuted; verdict registered in `kernel.md` §9. + The open docket, in order: -1. the adversarial machine review (`qalc-token-machine`, independent - reimplementation requested — in flight); the sharpest open lemma - is re-entry determinacy (`recall` erases `b′`); +1. **repair the replay protocol** — reversible ticket cleaning: + the erased discriminator must persist (instance-indexed ticket / + partial-permutation replay / structural call-replay separation) + yet not decohere wanted interference; `p★` and the 3-coin + program are mandatory regressions; 2. the readback controller (full-NF halt sectors; the kernel's root classifier is its 1-bit case) and the `t` gate's `ℤ[ω]` scalars; 3. the clean coherent compilation theorem diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 511ddb6..ec673e1 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2073,3 +2073,35 @@ the `fire`/`recall` erasures injective on the enumerated domains, the general schemas stay conditional on the determinacy lemmas, and the input boolean must never be conservatively charged as residue (it is the consumed quantum coordinate). + +**Kernel v1 adversarial verdict: FAIL, route intact** (2026-08-09, +same session). The reviewer reimplemented the kernel table +independently from `kernel.md` §3 alone and reproduced all five +results exactly — classical substrate, gate fibres, HH cancellation, +H–NOT′–H balance, negative witness, the `+1` compensation through +identity plumbing: all HOLD. Then the killshot: +`p★ = λh.λt. ((((h 0̂) h) h) 0̂)` — a coin selecting between two +gate occurrences, the selected gate freshly applied — creates +nested same-kind tickets, and `recall` maps two reachable re-entry +states with identical position, log, and pending (differing only in +the `b′` it erases) to one target: norm 1 → 3/2 at global step 89, +verified bit-exactly against our own evolver; the mandated 3-coin +regression `λh.λt. ((h 0̂)(h 0̂)(h 0̂))` conserves aggregated norm +but its structural Gram exposes the same collision across time +slices (2 pairs, reproduced). The structural diagnosis: literal +booleans replay through *distinct code positions* — position itself +retains the discriminator — while the virtual replay parks both +answers at one leaf and erases the only remaining distinguisher; +classical irreversible erasure, not transport. Secondary breaks: +the `(kind, bit)` ticket cannot name its owning invocation +(same-kind nesting aliases), and `call`/`recall` domains overlap +(priority-resolved, not structural). Verdict registered in +`kernel.md` §9 with the repair directions: the discriminator must +persist — instance-indexed tickets, partial-permutation replay, or +structural call/replay separation — until a δ block consumes it, +and **reversible ticket cleaning is now the central design +problem**: the coherence-is-earned economy at the level of the +machine's own bookkeeping. Phase-1 scoreboard: two review rounds, +one conformance blocker fixed, one fatal countermodel registered; +the machine's substrate and fibre layers survived independent +reimplementation, the replay layer did not. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index c8b569e..c83b570 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,17 +1,24 @@ # qALC three-program kernel — v1 -**Status: kernel v1.1 — machine-verified; conformance-reviewed -(thread `qalc-architecture`), blocker fixed; adversarial machine -review in flight.** This is the formalization gate demanded by -`token.md` §4: the complete transition table for a small-output qALC -machine, step-indexed traces of the three witness programs, and a -column-Gram enumeration over the structural reachable bases. All -enumerated kernel-scope checks pass. Verification was mechanized in -a scratch superposition evolver (exact `ℤ[1/√2]` arithmetic, norm -asserted equal to 1 at every global step; the evolver stays out of the -tree per the no-code gate — reviewers should reproduce independently, -which is stronger verification than sharing it). Scope limits are in -§7; nothing here claims more than the kernel. +**Status: kernel v1.1 — reviewed; `recall` CONFIRMED-BROKEN, the +rest of the machine holds.** The adversarial review (thread +`qalc-token-machine`) independently reimplemented §3 from this +document alone and reproduced all five results exactly — the +classical substrate, gate fibres, HH cancellation, H–NOT′–H balance +(no padding), and the negative witness all HOLD — then broke the +virtual-boolean replay protocol with a reachable countermodel: in +`p★ = λh.λt. ((((h 0̂) h) h) 0̂)` (a coin selecting between two gate +occurrences, then a fresh application of the selected gate), two +valid nested re-entry states with identical position, log, and +pending differ only in the `b′` that `recall` erases — both map to +one target, norm 1 → 3/2 at global step 89, verified against both +implementations (§9). **The three-program gate is therefore not +passed**: the traces stand as finite results, but the replay +protocol is the kernel's unresolved central mechanism. Do not build +on §3's `recall` rule; the repair is the docket head. The +conformance review's earlier fixes (output alphabet {`0̂`,`1̂`,`I`}, +separate `RunDone`/`Halt` steps, structural Gram) are incorporated +and stand. ```text h (h 0̂) mass 1 on 0̂, single terminal configuration @@ -357,3 +364,76 @@ The H–NOT–H and negative-witness traces (63 and 59 steps) follow the same notation and are mechanically reproducible from the table; their checkpoints (fires, anshead/vvar windows, recall events in the negative witness, terminal entries) are as reported in §5. + +## 9. v1 review verdict (registered) + +**FAIL for kernel v1; the token-machine route is not implicated.** +The reviewer reimplemented §3 independently (adding the scratch +model's unstated `recall`-before-`call` priority) and reproduced all +five §5 results exactly. What holds, independently verified: HH +cancellation at the outer fire; H–NOT′–H step balance with no +padding (the slot-bullet-consumed-by-classifier derivation +confirmed); the negative witness's orthogonality; the +gate-application `+1` bullet count through one- and two-hop identity +plumbing. + +### 9.1 The countermodel + +`p★ = λh.λt. ((((h 0̂) h) h) 0̂)`: the first coin selects between +two `h` occurrences; the selected gate is freshly applied to `0̂`, +creating nested same-kind answer tickets. `recall` maps, for +identical retained `L, T`, + +```text +C₀ = (g, ↓, L, •·α_h(0)·T) C₁ = (g, ↓, L, •·•·α_h(1)·T) +``` + +to the identical `(g, ↑, L, •·•·•·T)`. Both are reachable in `p★` +at global step 89 with amplitude `1/(2√2)` each: mass 1/4 → 1/2 per +colliding pair, norm 1 → 3/2 — reproduced against our evolver +bit-exactly. A second mandated regression, +`λh.λt. ((h 0̂) (h 0̂) (h 0̂))`, conserves norm on the aggregated +run but its structural Gram exposes the same collision across time +slices (2 non-orthogonal column pairs, reproduced). Both programs +are now mandatory regressions for any successor table. + +### 9.2 The structural diagnosis + +Re-entry determinacy is **false**. The literal-boolean analogy +omitted the load-bearing part: literal `0̂`/`1̂` replay through +*distinct code positions*, and position retains the discriminator +through the replay. The virtual construction parks both answers at +the same gate leaf and then erases the only remaining discriminator +— classical irreversible erasure, not token transport. Two +secondary breaks: the `α` tag (gate kind, bit) cannot identify +which dynamic invocation owns a ticket, so same-kind nested +invocations alias; and `call`/`recall` source domains overlap +(every `recall` source is a `call` source), resolved only by +implementation priority — the formal table needs structural +disjointness. + +### 9.3 Gram-methodology gaps (for the general theorem) + +The five-program enumeration is a regression battery, not the +isometry theorem. A general verifier needs: structural source +disjointness; pairwise columns across every time slice's reachable +union; graph reachability before amplitude aggregation; arbitrary +nested exponential contexts and same-kind instances; `h`/`t` +cross-fibre and δ/non-δ range checks; the typed `RunDone → Halt` +entry checked mechanically; general ring amplitudes (the scratch +`(m, k)` representation cannot express `1 + 1/√2`); whole-term +identity in the sector coordinate. + +### 9.4 Repair directions (unadjudicated) + +`recall` cannot consume `α_g(b′)` into a common classical target. +Candidate shapes from the review: a dynamically instance-indexed +replay ticket (not merely gate kind + bit); a partial-permutation +replay retaining enough to reconstruct `b′`; structural separation +of fresh call from replay; erasure only where independent retained +state reconstructs the discriminator, or inside an actual unitary +block. A dedicated replay frame `R_g(instance, b′)` restores local +injectivity, but carrying it forever suppresses wanted interference: +**reversible ticket cleaning is now the central design problem** — +the same "coherence is earned" economy, now at the level of the +machine's own bookkeeping rather than user code. diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index b65227d..9490497 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -368,13 +368,14 @@ substrate's obstruction and the fork reopens. | Item | Status | |---|---| -| Three-program kernel (table + traces + Gram) | **v1 drafted and machine-verified — `kernel.md`; in review** | -| L1 arrival-residue determinacy | kernel-verified; general proof open | +| Three-program kernel | **v1.1 reviewed: traces + Gram hold (independently reproduced); `recall` CONFIRMED-BROKEN on `p★` — gate NOT passed** (`kernel.md` §9) | +| Replay protocol repair (reversible ticket cleaning) | **the docket head** — instance-indexed tickets vs partial-permutation replay vs structural call/replay separation (`kernel.md` §9.4) | +| Re-entry determinacy | **refuted** (`p★`: identical position/log/pending, differing `b′`) — the erased discriminator must live somewhere until a δ block consumes it | +| L1 arrival-residue determinacy | kernel-verified at `fire`; general proof open | | L2 pop timing / coherence return | confirmed for NOT′ (kernel); selector measured decoherent | -| Re-entry determinacy (replaces refuted C1) | kernel-verified; general proof open — sharpest lemma | +| `call`/`recall` structural domain disjointness | open (priority-resolved in scratch; formal table needs structure) | | Probe-exit classification totality | open (kernel error rules are catch-alls) | -| Totalization (norm-one successors everywhere) | verified on kernel bases; general proof open | -| Readback controller | undesigned — hardest open; kernel's root classifier is its 1-bit case | +| Readback controller | undesigned; kernel's root classifier is its 1-bit case | | `μ_p`/`Ω_qALC` on the token clock | pending readback design | -| Nonlinear reuse of a fired result | partially exercised (negative witness); general story open | +| Mandatory regressions | `p★` and the 3-coin program (`kernel.md` §9.1) for any successor table | | Bideterminism of §2 | verified vs arXiv:2002.05649 | From 1beee56e57b79a0806c28bc941bc2c9993e232f3 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 07:09:17 -0400 Subject: [PATCH 020/107] =?UTF-8?q?qalc:=20kernel=20v1.2=20=E2=80=94=20ine?= =?UTF-8?q?rt=20replay=20stack=20repair,=20full=20battery=20green?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit recall no longer erases its discriminator: Run gains a transport-inert replay stack RS that only recall pushes and nothing reads; terminal entry freezes it into the garbage factor. The p* collision pairs land on RS-distinct targets. All seven programs pass (five witnesses bit-unchanged — coherent code never creates an R-frame; p* norm 1 with the first coin mandatorily decohered; 3-coin clean) and the structural Gram is zero-defect on all seven bases (p* 458 states). Re-review dispatched with the refute-this challenge: find a program where recalled branches may legitimately merge. kernel.md par.9.5 registers the repair. Co-Authored-By: Claude Fable 5 --- docs/ledger/2026-08.md | 20 ++++++ docs/quantum-algebraic/kernel.md | 118 ++++++++++++++++++++++--------- 2 files changed, 104 insertions(+), 34 deletions(-) diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index ec673e1..51222e9 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2105,3 +2105,23 @@ machine's own bookkeeping. Phase-1 scoreboard: two review rounds, one conformance blocker fixed, one fatal countermodel registered; the machine's substrate and fibre layers survived independent reimplementation, the replay layer did not. + +**The v1.2 repair: inert replay stack** (2026-08-09, same session). +a9 chose to attempt the repair. `Run` gains a transport-inert replay +stack `RS`; `recall` moves its discriminator there instead of +erasing it (`R_g(b′)` pushed; nothing reads `RS`; terminal entry +freezes it into garbage). The p★ collision pairs now land on +`RS`-distinct targets. Full battery: the five witnesses unchanged — +HH and H–NOT′–H create no R-frames, so the repair is invisible to +coherent code — and both mandated regressions pass (p★: norm 1, +support 8, first coin mandatorily decohered, marginal (1/2, 1/2); +3-coin clean); structural Gram zero-defect on all seven bases (p★ +458 states). The design argument for inert-not-cleaned: a +re-interrogated coin has been consumed non-injectively by its +selection (p★'s branches reduce to the same term post-selection — +merging would violate norm), and no program was constructible where +recalled branches may legitimately merge later. That claim is the +load-bearing open question and rides to the re-review as an +explicit refute-this challenge; if refuted, reversible frame +cleaning becomes mandatory and the design reopens. Fork (A)'s +minimality program applies to R-frames verbatim. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index c83b570..3aa2bb6 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,24 +1,24 @@ # qALC three-program kernel — v1 -**Status: kernel v1.1 — reviewed; `recall` CONFIRMED-BROKEN, the -rest of the machine holds.** The adversarial review (thread -`qalc-token-machine`) independently reimplemented §3 from this -document alone and reproduced all five results exactly — the -classical substrate, gate fibres, HH cancellation, H–NOT′–H balance -(no padding), and the negative witness all HOLD — then broke the -virtual-boolean replay protocol with a reachable countermodel: in -`p★ = λh.λt. ((((h 0̂) h) h) 0̂)` (a coin selecting between two gate -occurrences, then a fresh application of the selected gate), two -valid nested re-entry states with identical position, log, and -pending differ only in the `b′` that `recall` erases — both map to -one target, norm 1 → 3/2 at global step 89, verified against both -implementations (§9). **The three-program gate is therefore not -passed**: the traces stand as finite results, but the replay -protocol is the kernel's unresolved central mechanism. Do not build -on §3's `recall` rule; the repair is the docket head. The -conformance review's earlier fixes (output alphabet {`0̂`,`1̂`,`I`}, -separate `RunDone`/`Halt` steps, structural Gram) are incorporated -and stand. +**Status: kernel v1.2 — the replay repair is applied and passes the +full battery including both mandated regressions; re-review in +flight.** History: v1 was reviewed adversarially (thread +`qalc-token-machine`, independent reimplementation) — the classical +substrate, gate fibres, HH cancellation, H–NOT′–H balance, and +negative witness all HOLD, but `recall` was CONFIRMED-BROKEN on +`p★ = λh.λt. ((((h 0̂) h) h) 0̂)`: nested same-kind tickets aliased +after the replay erased its `b′` discriminator (norm 3/2 at step +89, verified against both implementations — §9). **v1.2 repairs it +with the inert replay stack** (§9.5): `recall` moves the ticket to +a transport-inert residue component instead of erasing it; recalled +branches decohere mandatorily — which is the correct physics, since +a coin whose branches both select gate occurrences has been +consumed non-injectively — and the coherent witnesses never touch +the mechanism. All seven programs (five witnesses + `p★` + the +3-coin regression) now pass with norm 1 and structurally clean +column-Gram. The conformance review's earlier fixes (output +alphabet {`0̂`,`1̂`,`I`}, separate `RunDone`/`Halt` steps, +structural Gram) are incorporated and stand. ```text h (h 0̂) mass 1 on 0̂, single terminal configuration @@ -60,11 +60,14 @@ rules exactly as pinned in `token.md` §2. ## 2. State space ```text -Run ::= (pos, d, log, tape) — λIAM shape, plus VB phase - | (leaf, VB(g, b′, k), log, tape) k ∈ {0,1,2} +Run ::= (pos, d, log, tape, RS) — λIAM shape, plus VB phase + | (leaf, VB(g, b′, k), log, tape, RS) k ∈ {0,1,2} +RS ::= [R_g(b′), …] — transport-inert replay stack (v1.2): + no transport or classifier rule reads it; only `recall` + pushes; it joins the garbage factor at terminal entry RunDone ::= RunDone(nf, residue) nf ∈ {0̂, 1̂, I, err} Halt ::= Halt(nf, residue, tick) | Error(residue, tick) -residue = the COMPLETE pre-entry state (pos, d, log, tape, VB phase) +residue = the COMPLETE pre-entry state (pos, d, log, tape, VB, RS) tape/log entries: • | logged position l | γ_g | μ_g | A_g(b′) | α_g(b′) | ρ @@ -90,12 +93,22 @@ call (g, ↓, L, •·T) → (g, ↑, L, γ_g·•·•·μ_ crossing. Classical transport then delivers the probe to g's true argument through arbitrary dereference plumbing. -recall (g, ↓, L, •^(b′+1)·α_g(b′)·T) → (g, ↑, L, •·•·•·T) +recall (g, ↓, L, •^(b′+1)·α_g(b′)·T, RS) + → (g, ↑, L, •·•·•·T, R_g(b′)·RS) consistent replay of a fired instance off its ticket — no - fire. Mirrors the literal boolean's bt2-replay: consume the - slot-dependent re-descent bullets and the ticket, emit the - two virtual lambda crossings plus the gate-application - compensation. Bullet/ticket arity mismatch → Error. + fire, and (v1.2) **no erasure**: the discriminator moves to + the inert replay stack. Routing mirrors the literal + boolean's bt2-replay: consume the slot-dependent re-descent + bullets and the ticket, emit the two virtual lambda + crossings plus the gate-application compensation. Recalled + branches carry distinct R-frames forever — mandatory + decoherence, matching the physics (a re-interrogated coin + was consumed non-injectively by its selection). Bullet/ + ticket arity mismatch → Error. `call`'s domain excludes + recall's by the explicit guard "tape below the leading + bullet does not match •^k·α_g of this gate" — stated as a + side condition, structural disjointness still owed to the + formal table. arrive/ (m ends 'a', ↑, γ_g·L, P_b·μ_g·T) → fire Σ_b′ (Q_g)_{b′b} · (m, ↑, γ_g·L, A_g(b′)·T) @@ -176,13 +189,23 @@ Timing convention (pinned, conformance-reviewed): `RunDone` entry and `Halt(…, 0)` entry are separate `U` steps; "Halt at" below is the `Halt(…, 0)` step. -| program | sectors | support | Halt at | tick-aligned | +| program | sectors | support | Halt at | R-frames | |---|---|---|---|---| -| `h (h 0̂)` | `0̂`: 1 | 1 | t=49 | yes | -| `h (NOT′ (h 0̂))` | `0̂`: 1 | 1 | t=64 | yes | -| `(λb. b I I)(h 0̂)` | `I`: 1 | 2 | t=58, 60 | no (Δ=2) | -| `h (selNOT (h 0̂))` | `0̂`: 1/2, `1̂`: 1/2 | 4 | t=78, 79 | no (Δ=1) | -| `h 0̂` | `0̂`: 1/2, `1̂`: 1/2 | 2 | t=31 | yes | +| `h (h 0̂)` | `0̂`: 1 | 1 | t=49 | none | +| `h (NOT′ (h 0̂))` | `0̂`: 1 | 1 | t=64 | none | +| `(λb. b I I)(h 0̂)` | `I`: 1 | 2 | t=58, 60 | yes | +| `h (selNOT (h 0̂))` | `0̂`: 1/2, `1̂`: 1/2 | 4 | t=78, 79 | yes | +| `h 0̂` | `0̂`: 1/2, `1̂`: 1/2 | 2 | t=31 | none | +| `p★` (regression) | `0̂`: 1/2, `1̂`: 1/2 | 8 | t=99–103 | yes | +| 3-coin (regression) | `0̂`: 1/2, `1̂`: 1/2 | 4 | t=63, 65 | yes | + +The two coherent witnesses never create an R-frame — the repair +mechanism is invisible to coherent code, engaging exactly where +mandatory decoherence is the correct physics. `p★` completes at +norm 1 with the first coin decohered and the marginal (1/2, 1/2) — +the rewriting-picture sanity check: its branches both reduce to the +*same term* `h 0̂` post-selection, so any machine that merged them +would violate norm; refusing is correctness, not cost. Output-density report (the kernel as output-operator prototype): the negative witness's two branches halt with the *same* `nf = I` and @@ -221,8 +244,14 @@ column unit-norm, every distinct pair orthogonal, no stuck states | HH | 82 | 0 | 0 | 0 | | H–NOT–H | 104 | 0 | 0 | 0 | | negative | 103 | 0 | 0 | 0 | -| selector | 135 | 0 | 0 | 0 | +| selector | 173 | 0 | 0 | 0 | | lone H | 53 | 0 | 0 | 0 | +| `p★` | 458 | 0 | 0 | 0 | +| 3-coin | 180 | 0 | 0 | 0 | + +(v1.2 numbers; the v1 table had two non-orthogonal 3-coin pairs — +the cross-time `recall` collision — and `p★` broke the norm outright +at step 89. Both are clean under the inert replay stack.) ## 6. Findings register @@ -437,3 +466,24 @@ injectivity, but carrying it forever suppresses wanted interference: **reversible ticket cleaning is now the central design problem** — the same "coherence is earned" economy, now at the level of the machine's own bookkeeping rather than user code. + +### 9.5 The v1.2 repair (inert replay stack) + +`recall` no longer erases its discriminator: the state gains a +transport-inert replay stack `RS` that only `recall` pushes +(`R_g(b′)`), no transport or classifier rule reads, and terminal +entry freezes into the garbage factor. The countermodel pairs now +map to targets differing in `RS` — locally injective, and both +mandated regressions pass (norm 1; structural Gram clean, `p★` +basis 458). The design argument for *inert rather than cleaned*: +a re-interrogated coin has been consumed non-injectively by its +selection (in `p★` both branches reduce to the same term +post-selection, so merging them would violate norm — mandatory +decoherence is correctness), and no program has been found where a +recalled instance's branches may legitimately merge later; the +coherent witnesses never recall at all. If such a program exists, +the frame needs reversible cleaning and the design reopens — that +question rides to the re-review. Fork (A)'s minimality program +applies to R-frames verbatim: each is charged conservatively, and +any later transparency lemma that proves one recoverable removes it +and enlarges the raw-interfering class. From 92c2d0e134d627baa851448a4030c478f64e0984 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 07:26:26 -0400 Subject: [PATCH 021/107] =?UTF-8?q?qalc:=20v1.2=20re-review=20registered?= =?UTF-8?q?=20=E2=80=94=20transparency=20criterion=20adopted?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The p* repair is independently confirmed; the gate stays open on two new findings. q = \h.\t. h ((((h 0^) E) N) 0^) (E = eta-expanded id, N = selector NOT) transports the coin injectively through selection (H;id;H) and refutes mandatory decoherence — replaced by the transparency criterion: a replay frame is cleanable iff its bit is a function of the live core, cleaned inside the delta block with provenance-matched instance-indexed frames. Beneath it, an alpha/ gamma transport totality failure: q's 335-state graph has three stuck states (verified bit-exactly). kernel.md par.9.6 registers the verdict; v1.3 gate set (transport totality, instance frames, first transparency/pop rule, q at mass 1 on 0-hat); q joins the mandatory regressions. STATUS and token.md synced. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 20 +++++-- docs/ledger/2026-08.md | 32 +++++++++++ docs/quantum-algebraic/kernel.md | 98 ++++++++++++++++++++++++++------ docs/quantum-algebraic/token.md | 8 +-- 4 files changed, 133 insertions(+), 25 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 7959fcd..dac4fa6 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -446,13 +446,23 @@ confirmed against both implementations; a 3-coin regression shows the same collision across time slices). Re-entry determinacy is refuted; verdict registered in `kernel.md` §9. +The v1.2 repair (inert replay stack) fixed the p★ aliasing and is +independently confirmed, but the re-review refuted permanent +inertness with `q = λh.λt. h ((((h 0̂) E) N) 0̂)` — injective +selection (H;id;H) whose branches must re-interfere — and exposed +an α/γ transport totality failure beneath it (three stuck states on +`q`'s 335-state graph, verified). The governing principle is now +the **transparency criterion**: a replay frame is cleanable iff its +bit is a function of the live core, cleaned inside the δ block with +provenance-matched instance-indexed frames. + The open docket, in order: -1. **repair the replay protocol** — reversible ticket cleaning: - the erased discriminator must persist (instance-indexed ticket / - partial-permutation replay / structural call-replay separation) - yet not decohere wanted interference; `p★` and the 3-coin - program are mandatory regressions; +1. **kernel v1.3**: α/γ transport totality on `q`'s graph; correct + same-time slot arrivals; instance-indexed replay frames; the + first proved transparency/pop rule; `q` at mass 1 on `0̂` with + no residual discriminator (`p★`, 3-coin, `q` all mandatory + regressions); 2. the readback controller (full-NF halt sectors; the kernel's root classifier is its 1-bit case) and the `t` gate's `ℤ[ω]` scalars; 3. the clean coherent compilation theorem diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 51222e9..84f4142 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2125,3 +2125,35 @@ load-bearing open question and rides to the re-review as an explicit refute-this challenge; if refuted, reversible frame cleaning becomes mandatory and the design reopens. Fork (A)'s minimality program applies to R-frames verbatim. + +**v1.2 re-review: transparency, not inertness** (2026-08-09, same +session). Verdict FAIL for v1.2 as the gate, with the repair itself +independently confirmed (all seven Gram rows reproduced; push +injectivity kills the p★ pairs). The refute-this challenge was met: +with `E = λz. I z` and `N = λz. z 1̂ 0̂`, the program +`q = λh.λt. h ((((h 0̂) E) N) 0̂)` selects between identity and NOT +— `(((b E) N) 0̂) = b`, an *injective* transport of the coin +through selection, circuit H;id;H — so its branches must +re-interfere and the mandatory-decoherence premise is dead. In its +place the review supplied and we adopted the **transparency +criterion**: `R_g(b)` is transparent at a reachable boundary iff +`b` is a single-valued function of the non-R core there (mandatory +exactly where branch images overlap — p★; cleanable where the live +core carries the bit — q), with cleanup inside the δ block via +provenance-matched, dynamically instance-indexed frames +(`(kind, bit)` cannot name its owning invocation). Inert RS stands +as the sound conservative first point of fork (A)'s transparency +program — permanent freezing is selective full logging, not final +semantics. Deeper: `q` never even reaches the RS question on v1.2 — +its 335-state structural graph has three stuck states (α ticket at +the log head inside the selected function's plumbing; the +recall-under-deeper-γ case), the live run leaks norm before t=82, +and both outer arrivals misclassify as slot 0 — all verified +bit-exactly against our evolver. The v1.3 gate is set: transport +totality on q's graph, correct same-time slot arrivals, +instance-indexed frames, the first proved transparency/pop rule, +and q finishing at mass 1 on 0̂ with no residual discriminator; +`q` joins p★ and 3-coin as mandatory regressions. Registered in +`kernel.md` §9.6; the session's arc — kernel drafted, three review +rounds, two countermodels, each strictly sharpening the theory — +is the loop working exactly as built. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 3aa2bb6..bb78159 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,8 +1,16 @@ # qALC three-program kernel — v1 -**Status: kernel v1.2 — the replay repair is applied and passes the -full battery including both mandated regressions; re-review in -flight.** History: v1 was reviewed adversarially (thread +**Status: kernel v1.2 — re-reviewed: the p★ repair is confirmed +locally real, but the gate remains OPEN.** The re-review (§9.6) +refuted the mandatory-decoherence premise with the injective +selection program `q` (H;id;H through selected functions — physics +demands re-interference), supplied the governing **transparency +criterion** in its place, and found a deeper α/γ transport totality +failure (`q` reaches three stuck states before the replay question +even arises). The v1.3 gate is §9.6's list: transport totality on +`q`'s graph, instance-indexed frames, a proved transparency/pop +rule, and `q` at mass 1 on `0̂`. History: v1 was reviewed +adversarially (thread `qalc-token-machine`, independent reimplementation) — the classical substrate, gate fibres, HH cancellation, H–NOT′–H balance, and negative witness all HOLD, but `recall` was CONFIRMED-BROKEN on @@ -223,9 +231,9 @@ log, tape-below-slot, and time — so everything after t=33 is a single classical path. H–NOT–H does the same through NOT′'s real selection legs (residue popped, lengths equal — the L2 obligation confirmed for NOT′). The negative witness's branches keep distinct -residues and enter the error sector two steps apart — orthogonal two -ways over, as unitarity demands, and its four-state predecessor was -the run that caught a real table bug (§6). +residues and enter their `Halt(I)` chains two steps apart — +orthogonal two ways over, as unitarity demands, and its earlier +four-state form was the run that caught a real table bug (§6). **Column-Gram enumeration** (strengthened after conformance review): the basis is the **structural** reachable graph — an amplitude-blind @@ -292,13 +300,14 @@ Discharged by the kernel: HH and H–NOT–H step-indexed traces; L2 for `NOT′`; the negative witness (as of v1.1 — same halted `I`, orthogonal configurations); orthonormal columns on the structural reachable bases; totality on every structural state (zero stuck). -The erasures at `fire` and `recall` are, per the conformance -review's framing, *proved injective on the enumerated kernel -domains by the Gram check itself*; their general schemas remain -conditional on the re-entry and arrival-determinacy lemmas — and -the input boolean `b` must never be conservatively charged as -residue while those are open (retaining it would destroy the clean -fibre; the design keeps `b` as the consumed quantum coordinate). +The erasure at `fire` is, per the conformance review's framing, +*proved injective on the enumerated kernel domains by the Gram +check itself*; its general schema remains conditional on the +arrival-determinacy lemma — and the input boolean `b` must never be +conservatively charged as residue (retaining it would destroy the +clean fibre; the design keeps `b` as the consumed quantum +coordinate). `recall` no longer erases (v1.2, §9.5); the governing +question became the transparency criterion of §9.6. Remaining, inherited or newly exposed: @@ -307,9 +316,14 @@ Remaining, inherited or newly exposed: state. It holds on the kernel programs (the pending question carries branch-distinct positions) and needs a general proof — the sharpest open lemma, alongside general L1. -2. **Source-pattern disjointness is by rule priority in the scratch - model**; the formal table must make it structural (the Gram check - covers targets, not source overlap). +2. **Source-pattern disjointness**: `call`/`recall` partition by a + decidable negative premise — scan the maximal leading bullet + block; a same-gate `α_g(b)` beneath it means replay (arity + `b+1`) or arity-error, anything else means fresh call — but the + *semantic* implication (same-gate α after the block ⇒ replay of + the intended dynamic instance) is unproved without + instance-tagged tickets; other rule pairs remain + priority-ordered in the scratch model. 3. **The `•^(b′+1)·α` adjacency patterns** (recall trigger, arrival shapes) are verified on the kernel programs; their totality over all reachable shapes needs the general species-classification @@ -487,3 +501,55 @@ question rides to the re-review. Fork (A)'s minimality program applies to R-frames verbatim: each is charged conservatively, and any later transparency lemma that proves one recoverable removes it and enlarges the raw-interfering class. + +### 9.6 The v1.2 re-review: transparency, not inertness (registered) + +**Verdict: FAIL for v1.2 as the gate; the repair itself is locally +real** (independently reproduced: push injectivity fixes the p★ +pairs; all seven rows verified). Two deliveries: + +**The mandatory-decoherence claim is refuted.** With `E = λz. I z` +and `N = λz. z 1̂ 0̂`, + +```text +q = λh.λt. h ((((h 0̂) E) N) 0̂) +``` + +selects between identity and NOT, so `(((b E) N) 0̂) = b` on the +boolean basis — an *injective* transport of the coin through +selection; the circuit is H;id;H and physics demands the branches +re-interfere at the outer gate (mass 1 on 0̂). The blanket premise +"a recalled coin has been consumed non-injectively" is false. The +correct criterion (review-supplied, adopted): **`R_g(b)` is +transparent at a reachable boundary iff `b` is a single-valued +function of the non-R core there** — frames are mandatory exactly +on predecessor fibres where the branch images overlap (p★), and +cleanable where the live core still carries the bit (q). Cleanup +belongs *inside the δ block* with provenance matching: + +```text +|g, b, κ, R_i(b)·RS⟩ ↦ Σ_b′ Q_g[b′,b] |land, b′, J(κ), RS⟩ +``` + +which requires dynamically instance-indexed frames — `(kind, bit)` +cannot name its owning invocation. Inert RS stands as the sound +conservative first point of the transparency program, not as final +semantics; permanent freezing is selective full logging. + +**A more basic totality failure.** On the actual v1.2 table, `q` +never reaches the RS question: its structural graph (335 states) +has three stuck states — all with an `α` ticket at the log head +inside the selected function's plumbing (the uncovered +recall-under-deeper-γ case) — the live run leaks norm before t=82, +and both outer arrivals misclassify as slot 0. Verified bit-exactly +against our evolver. The α/γ transport layer does not yet carry a +recalled coin through distinct reversible selected functions. + +**The next gate** (review-mandated): `q` joins the mandatory +regressions; repair α/γ transport to totality on q's graph; +correct same-time slot-0/slot-1 outer arrivals; instance-indexed +replay frames; a first proved transparency/pop rule; and `q` +finishing at mass 1 on `0̂` with no residual replay discriminator. +Also open, restated: general `ℤ[1/√2]` amplitudes in the verifier +(`(m,k)` cannot express `1 + 1/√2`), H/T cross-fibres, effect-free +conservativity, general readback. diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index 9490497..9487069 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -368,14 +368,14 @@ substrate's obstruction and the fork reopens. | Item | Status | |---|---| -| Three-program kernel | **v1.1 reviewed: traces + Gram hold (independently reproduced); `recall` CONFIRMED-BROKEN on `p★` — gate NOT passed** (`kernel.md` §9) | -| Replay protocol repair (reversible ticket cleaning) | **the docket head** — instance-indexed tickets vs partial-permutation replay vs structural call/replay separation (`kernel.md` §9.4) | -| Re-entry determinacy | **refuted** (`p★`: identical position/log/pending, differing `b′`) — the erased discriminator must live somewhere until a δ block consumes it | +| Kernel | **v1.2: p★ repair (inert replay stack) confirmed locally real; gate still open on the `q` countermodel** (`kernel.md` §9.5–9.6) | +| α/γ transport totality | **broken on `q`** (three stuck states: α at log head inside selected-function plumbing) — v1.3's first job | +| Transparency criterion (replaces both C1 and mandatory-decoherence) | adopted: `R_g(b)` cleanable iff `b` is a function of the live core; cleanup inside the δ block with provenance-matched instance-indexed frames — the transparency/pop rule is the central design object | | L1 arrival-residue determinacy | kernel-verified at `fire`; general proof open | | L2 pop timing / coherence return | confirmed for NOT′ (kernel); selector measured decoherent | | `call`/`recall` structural domain disjointness | open (priority-resolved in scratch; formal table needs structure) | | Probe-exit classification totality | open (kernel error rules are catch-alls) | | Readback controller | undesigned; kernel's root classifier is its 1-bit case | | `μ_p`/`Ω_qALC` on the token clock | pending readback design | -| Mandatory regressions | `p★` and the 3-coin program (`kernel.md` §9.1) for any successor table | +| Mandatory regressions | `p★`, the 3-coin program, and `q = λh.λt. h ((((h 0̂) E) N) 0̂)` — the last must reach mass 1 on `0̂` with no residual discriminator (`kernel.md` §9.1, §9.6) | | Bideterminism of §2 | verified vs arXiv:2002.05649 | From e2e12e460553c99b004b7d5c34eadaef4fc92b50 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 08:02:32 -0400 Subject: [PATCH 022/107] =?UTF-8?q?qalc:=20kernel=20v1.3=20=E2=80=94=20rep?= =?UTF-8?q?lay=20rule,=20instance=20frames,=20transparency=20pop;=20the=20?= =?UTF-8?q?time=20register?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Transport totality restored on the whole battery via the replay rule (consumed-ticket re-seeks rederive their selection from the instance's frame, read nondestructively; derived from the literal visit-3 trace). Instance identity = the invoking occurrence's logged position, already at the log head on every gate-leaf entry; tickets and frames carry it. Transparency/pop implemented as certified fire-boundary cleanup, Gram-verified, with a negative control. q-family halts frame-free. Mass 1 on 0-hat is blocked by a new standing finding: branch arrival offsets are odd and even-pad-invariant — pattern-encoded slots are time-free, step-encoded selection skews the branch clock by the transported bit. v1.2 basis drift owned (double-call subgraphs; p-star support 8 was bug-inflated, correct 4). Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 40 ++++-- docs/ledger/2026-08.md | 59 ++++++++ docs/quantum-algebraic/kernel.md | 223 +++++++++++++++++++++++++++++-- docs/quantum-algebraic/token.md | 36 +++-- 4 files changed, 330 insertions(+), 28 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index dac4fa6..83dba12 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -456,18 +456,42 @@ the **transparency criterion**: a replay frame is cleanable iff its bit is a function of the live core, cleaned inside the δ block with provenance-matched instance-indexed frames. +**Kernel v1.3 is built and verified** (`kernel.md` §10, 2026-08-09): +the `replay` rule (a consumed-ticket re-seek rederives its selection +from the instance's frame, read nondestructively — derived from the +literal visit-3 trace) restores transport totality on the whole +ten-program battery; instances are the invoking occurrence's logged +position (structurally at the log head), discharging ticket +ownership; the transparency/pop rule strips slot-matched frames at +certified fire boundaries, verified sound by the structural Gram +with a negative control (an unsound certificate is caught as a +typed error, no unitarity damage). The `q`-family halts frame-free +— no residual replay discriminator — but mass 1 on `0̂` is blocked +by a **new standing finding, the time register**: branch arrival +offsets 35/7/3 (q / wire-balanced q′ / minimal q2), odd and +invariant under every even-cost program pad measured. Pattern- +encoded slots are time-free (HH, H–NOT′–H sync exactly); +step-encoded (geometric) selection skews the branch clock by the +transported bit. Conjecture to adjudicate: geometric selection +decoheres intrinsically; the coherent fragment is the +pattern-encoded routing class, and time-balance is a compiler +obligation. v1.2's p★ support-8 was transport-bug-inflated +(extra fire events measured); the correct support is 4. + The open docket, in order: -1. **kernel v1.3**: α/γ transport totality on `q`'s graph; correct - same-time slot arrivals; instance-indexed replay frames; the - first proved transparency/pop rule; `q` at mass 1 on `0̂` with - no residual discriminator (`p★`, 3-coin, `q` all mandatory - regressions); +1. **kernel v1.3 adversarial round**: independent re-verification of + the replay/pop rules and the odd-offset invariance (find an + odd-cost pad or prove none exists); then the parity claim as a + theorem candidate; 2. the readback controller (full-NF halt sectors; the kernel's root - classifier is its 1-bit case) and the `t` gate's `ℤ[ω]` scalars; + classifier is its 1-bit case) and the `t` gate's `ℤ[ω]` scalars — + with time-in-the-core added to the transparency theorem + statement; 3. the clean coherent compilation theorem - (`quantum-algebraic/architecture.md` §6) — gates any universality - claim; + (`quantum-algebraic/architecture.md` §6) — now including the + time-balancing pass over the pattern-encoded fragment — gates any + universality claim; 4. then `src/qalc/`: reference evaluator first, census later. ## Repository and release state diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 84f4142..17eab0d 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2157,3 +2157,62 @@ and q finishing at mass 1 on 0̂ with no residual discriminator; `kernel.md` §9.6; the session's arc — kernel drafted, three review rounds, two countermodels, each strictly sharpening the theory — is the loop working exactly as built. + +## 2026-08-09 — kernel v1.3: replay, instance frames, the pop rule — and the time register + +The v1.3 gate work, one sitting. Diagnosis first: the full 81-step +trajectory to `q`'s stuck state, aligned against the literal ground +truth (`q` with the coin literalized runs total both ways — 93/126 +basis states, zero stuck), gives a visit taxonomy: visit 1 = fresh +selection descent (virtualized fire + VB + vvar), visit 2 = ticket +transit (recall), visit 3 = a SECOND fresh descent for which the +literal machine re-derives the selection from the static term — and +the virtual coin's ticket is already consumed. v1.2 misclassified +visit 3 as a fresh call and re-fired (the t=70 fire in the buggy +trace); all three stuck states are downstream corpses. The repair +recognizes that after the first recall, the branch's selection +memory IS the replay frame: the new `replay` rule rederives a +consumed-ticket re-seek from the RS head, read nondestructively +(consume 3 bullets = 2 selection + 1 gate-app compensation, emit +`•^(b′+1)·α_i(b′)` — the exact literal episode, compressed). +Instance identity came for free: the invoking occurrence's logged +position sits at the log head on every gate-leaf entry (arg-entry +is structurally forced), and a logged position is λIAM's own name +for a dynamic subterm copy — tickets and frames now carry it, which +also discharges the review's ticket-ownership obligation +structurally. The transparency/pop rule is implemented as certified +cleanup at fire boundaries (strip slot-matched frames in the same +unitary; mismatch = typed `pop-err`), soundness verified by the +structural Gram itself, with p★-wrong-cert as the negative control +(err mass 1/2, zero Gram defects, no norm loss). Results: the +ten-program battery (seven v1.2 + q + wire-balanced q′ + minimal +q2) runs total, zero Gram defects, marginals correct; certified +q-family runs halt with EMPTY replay stacks — garbage-free halting, +no residual replay discriminator. The v1.2 basis drift is owned: +negative 103→83, selector 173→106, p★ 458→242 — the old counts +included wrong-semantics double-call subgraphs (p★ fire events +18/49/51/63/65 → 18/49/51; its reported support 8 was bug-inflated, +correct is 4). But mass 1 on 0̂ did NOT arrive, and the reason is a +finding, not a bug: the **time register**. Branch arrivals at the +outer boundary offset by 35 (q), 7 (q′), 3 (q2) steps — odd every +time — and every program-level pad measured shifts even (I-wraps ++8, NOT′ +16, η +16, literal-selection pads +12/+16; padding the +unselected function shifts nothing). Mechanism: slot bullets that +survive to the boundary as tape pattern are time-free — HH and +H–NOT′–H sync exactly, which is WHY they cancel — while bullets +consumed climbing the selection spine are steps; geometric +selection step-encodes, and the transported bit itself skews the +clock. Standing conjecture for the adversarial round: step-encoded +selection decoheres intrinsically in this machine class; the +coherent fragment is exactly the pattern-encoded routing class; +time-balance is a compiler obligation (no machine-level uniform +retiming exists — the consumed-bullet count is contextual, and the +classical substrate's timing is pinned). Guardrail 4 ("timing is +physical; length-unbalanced branches decohere honestly") was +written before we knew it had a parity theorem inside it. +Registered: `kernel.md` §10 (status header rewritten), `token.md` +§3.5/§3.7/§4 obligations register, STATUS docket. Scratch: +`kernel.py` v1.3, `kernel_v12.py` archived, `suite.py` (the +battery), `q_diag.py`. Next: the v1.3 adversarial round (find an +odd-cost pad or prove none exists), then readback with +time-in-the-core. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index bb78159..2e3ee80 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,15 +1,26 @@ # qALC three-program kernel — v1 -**Status: kernel v1.2 — re-reviewed: the p★ repair is confirmed -locally real, but the gate remains OPEN.** The re-review (§9.6) -refuted the mandatory-decoherence premise with the injective -selection program `q` (H;id;H through selected functions — physics -demands re-interference), supplied the governing **transparency -criterion** in its place, and found a deeper α/γ transport totality -failure (`q` reaches three stuck states before the replay question -even arises). The v1.3 gate is §9.6's list: transport totality on -`q`'s graph, instance-indexed frames, a proved transparency/pop -rule, and `q` at mass 1 on `0̂`. History: v1 was reviewed +**Status: kernel v1.3 — transport total, frames instance-indexed, +transparency/pop implemented and verified; the mass-1 question is +answered by a new finding: the time register.** §10 is the v1.3 +register. Of the re-review's six gate items: totality on `q`'s +graph ✓ (the `replay` rule, derived from the literal visit-3 +trace); correct slot-0/slot-1 outer arrivals ✓; instance-indexed +frames ✓ (instance = the log-head logged position, already present +at every gate-leaf entry); a transparency/pop rule ✓ (certified +per-program, falsification caught as a typed error, verified by +the Gram/norm pass, negative control included); `q`'s frames +cleaned with **no residual replay discriminator** ✓ — but mass 1 +on `0̂` does NOT follow, because the branches arrive at the outer +boundary at different global times, and the offset is **odd and +invariant under every program-level padding tried** (§10.4). +Slot routing that survives to a boundary as tape *pattern* is +time-free (HH, H–NOT′–H sync exactly); routing *consumed* as +transport steps skews the clock by the transported bit. The +standing conjecture: step-encoded (geometric) selection decoheres +intrinsically in this machine class; coherence is the +pattern-encoded routing class; time-balancing is a compiler +obligation, not a rule-level fixable. History: v1 was reviewed adversarially (thread `qalc-token-machine`, independent reimplementation) — the classical substrate, gate fibres, HH cancellation, H–NOT′–H balance, and @@ -553,3 +564,195 @@ finishing at mass 1 on `0̂` with no residual replay discriminator. Also open, restated: general `ℤ[1/√2]` amplitudes in the verifier (`(m,k)` cannot express `1 + 1/√2`), H/T cross-fibres, effect-free conservativity, general readback. + +## 10. v1.3 — replay, instance frames, the pop rule, and the time register + +Scratch artifacts: `kernel.py` (v1.3 evolver), `kernel_v12.py` +(archived v1.2), `suite.py` (the ten-program battery), `q_diag.py` +(the diagnosis run). All scratchpad-only per the no-code gate. + +### 10.1 The diagnosis: the ticket is single-use, replay is not + +The full 81-step trajectory to `q`'s first stuck state, read against +the literal ground truth (`q` with the coin replaced by literal +`0̂`/`1̂` — both literal variants run total, 93/126 basis states, +zero stuck), gives a clean taxonomy of coin visits: + +- **Visit 1** — fresh selection descent (`•2 •2 var (•4)`): the + literal consumes the two λ-crossings and emits the selection + variable's logged position. Virtualized by fire + VB + `vvar` + (the ticket `α` *is* that logged position). +- **Visit 2** — ticket transit (`•2 bt2 •4 •4`): the restored lp + re-enters and jumps through the coin. Virtualized by `recall` + (v1.1), which consumes the ticket. +- **Visit 3** — a SECOND fresh selection descent, exactly the + visit-1 episode again: the literal machine re-derives the + selection from the static term. The virtual coin has no term to + re-derive from, and the ticket is gone. v1.2 misclassified this + as a fresh call, re-fired the coin (extra fire measured at t=70), + and the mismatched ticket jammed in the selected function's + plumbing — all three stuck states are downstream corpses of that + one wrong classification. + +The repair insight: after the first recall, the branch's selection +memory is exactly the replay frame in RS. **The replay stack is not +just an injectivity dump; it is the replay memory, read +nondestructively.** + +### 10.2 The v1.3 rules + +**Instance identity.** The dynamic instance of a gate invocation is +the logged position of the invoking occurrence — in λIAM lineage, a +logged position is precisely the machine name of a dynamic subterm +copy. At every gate-leaf entry the invoking occurrence's lp sits at +the log head (arg-entry is structurally forced), so the identity is +already in hand: `i := log[0]`. Tickets and frames carry it: +`α_{g,i}(b)`, `R_{g,i}(b)`. + +**recall (v1.3).** Guard now requires the ticket's instance to +equal the current log-head lp — the review's "semantic ticket +ownership" obligation, discharged structurally. A same-gate +foreign-instance ticket is a typed error. Pushes `R_{g,i}(b)`. + +**replay (new).** At a gate leaf, `↓`, with a leading bullet block +of length ≥ 3, no same-instance ticket on the tape, and RS head +`R_{g,i}(b′)` with `i` = the current log-head lp: + +```text +(g, ↓, i·L, •³·T, R_{g,i}(b′)·RS) → (g, ↑, i·L, •^(b′+1)·α_{g,i}(b′)·T, R_{g,i}(b′)·RS) +``` + +Derived from the literal visit-3 episode: consume the two selection +bullets plus one gate-application compensation, emit a fresh +ticket; the frame is read, not popped — the fresh ticket may be +recalled again later, pushing another frame (measured: `q`'s +branches accumulate 2–3 same-bit frames). A leading block < 3 with +a same-instance frame (an under-applied re-seek) is a typed error, +out of v1.3 scope. + +**call.** Fires only when neither a same-instance ticket nor a +same-instance frame is present. A different instance's frame at the +RS head does not block a fresh call (p★'s second invocation). +Frame reading is head-only; interleaved re-seeks of distinct +recalled instances are out of scope (typed error). + +**pop (transparency cleanup).** `step` takes a per-program +certificate: a set of fire boundaries. At a certified boundary the +fire strips every frame whose bit equals the arrival slot, in the +same unitary step; a leftover mismatched frame falsifies the +certificate and becomes a typed error (`pop-err`), never a silent +reinterpretation. Soundness on the reachable span — injectivity of +fire-with-pop against every other source — is exactly what the +structural Gram verifies; the certificate's discovery is manual in +v1.3, its *verification* is the machine checker. This implements +§9.6's provenance-matched cleanup schema with the frame's bit as +the recovered function of the live core. + +### 10.3 Results + +The ten-program battery (`suite.py`), structural Gram +(amplitude-blind BFS, cancelled targets included, ticks truncated +at depth 2) plus dynamic evolution with per-step exact norm +assertion: + +```text +program basis stuck defects dynamic residue frames +HH 82 0 0 halt0 mass 1 none +H–NOT′–H 104 0 0 halt0 mass 1 none +negative 83 0 0 Halt(I) 1/2+1/2 R(0)/R(1) inert +selector 106 0 0 1/2, 1/2 R(0)/R(1) inert +lone h 53 0 0 1/2, 1/2 none +p★ 242 0 0 1/2, 1/2, support 4 R(0)/R(1) inert +3-coin 180 0 0 1/2, 1/2, support 4 R(0)/R(1) inert +q (cert) 218 0 0 1/2, 1/2, support 4 NONE — popped +q′ (cert) 246 0 0 1/2, 1/2, support 4 NONE — popped +q2 (cert) 115 0 0 1/2, 1/2, support 4 NONE — popped +``` + +- **Totality restored**: `q` runs total (0 stuck of 256 basis + states uncertified, 218 certified); slot-0/slot-1 outer arrivals + are correct per branch — the injective transport works. +- **v1.2 basis drift explained and owned**: negative 103→83, + selector 173→106, p★ 458→242. The v1.2 counts included + wrong-semantics double-call subgraphs (visit-3 re-seeks that + fresh-called and re-fired). Measured directly on p★: v1.2 has + five dynamic fire events (t = 18, 49, 51, 63, 65), v1.3 has + three (18, 49, 51); v1.2's reported support 8 was + transport-bug-inflated — the correct support is 4 with marginals + unchanged. HH / H–NOT′–H / lone / 3-coin are bit-identical to + v1.2 (no re-seek anywhere in their graphs). +- **The pop is sound and does real work**: certified `q`-family + runs halt with EMPTY replay stacks — garbage-free halting, the + bounded-garbage factorization the architecture requires — and + the Gram stays zero-defect with the pop enabled. p★'s frames + remain inert (mandatory, per the transparency criterion). +- **Negative control**: certifying p★'s boundaries (unsound — its + frames are mandatory) yields `err` mass 1/2 via `pop-err`, with + zero Gram defects and no norm loss: an unsound certificate is + caught as a typed error, not silent unitarity damage. + +### 10.4 The time register (new finding) + +With frames cleaned, `q`'s branches still do not interfere: they +arrive at the outer boundary at different global steps, and the +tick register makes any offset permanent decoherence. Arrival +telemetry (branch-0 vs branch-1): + +```text +q (Codex's, E = λz. I z) t = 84 vs 119 offset 35 +q′ (wire-balanced, E′ = λz. z 0̂ 1̂) t = 112 vs 119 offset 7 +q2 (minimal, h ((h 0̂) 0̂ 1̂)) t = 48 vs 51 offset 3 +``` + +Wire-balancing (E′ position-isomorphic to N = λz. z 1̂ 0̂, +differing only at two Var leaves — the NOT′ index-swap trick lifted +one level) removes the interior asymmetry (35 → 7); the residue is +the slot routing itself. + +**Mechanism — pattern vs step.** A slot bullet that survives to the +boundary as part of the arrival pattern (`•·l·μ` vs `l·μ`) costs no +time — this is why HH and H–NOT′–H arrive branch-synchronous and +cancel exactly. A slot bullet consumed by a `•3` crossing an +f-node of the selection spine is a step. Geometric selection +step-encodes; the transported bit itself skews the clock. + +**Odd-offset invariance (measured).** Every program-level padding +tried shifts branch-relative time by an EVEN amount: I-wraps +8 +per wrap (k = 0..4 measured), NOT′-wrap +16, η-expansion +16, +pre-decided literal-selection pads +12/+16; a pad inside the +unselected function shifts nothing (traversal-sensitivity +control). Reachable offsets for q′ sit in −7 + 4ℤ — never 0. Token +round trips cost even; the odd base offset traces to the odd +teleport savings of the `0̂` answer episode vs `1̂` (var jumps +distance 2 in one step). Conjecture, to be adjudicated: the +branch-relative offset of any step-encoded selection is odd — +mass-1 interference is unreachable by program padding under this +timing. + +**Consequences.** (1) A machine-level uniform retiming cannot fix +this: how many slot bullets are consumed as steps is contextual +(depends where the ticket surfaces), so no per-rule charge +equalizes all programs — and the classical substrate's timing is +pinned. (2) Time-balance is therefore a *compiler* obligation in +this machine class, and if odd-offset invariance holds, coherent +compilation must route data flow through pattern-encoded +(index/wire) transport only — which the H–NOT′–H witness already +inhabits — treating geometric selection as a decohering (classical) +primitive. (3) Review-gate item 6 splits: "no residual replay +discriminator" HOLDS (the pop delivers it); "mass 1 on 0̂" is +blocked by an independent, now-measured channel that the +transparency criterion must incorporate — the branch bit is +single-valued on the non-R core *per time slice*, and the time +slice itself carries the bit. The transparency theorem needs time +in the core. + +### 10.5 Scope and standing obligations + +Head-only frame reading (interleaved multi-instance re-seeks → +typed error, no reachable instance in the battery); under-applied +re-seeks (leading block < 3) → typed error; certificate discovery +manual (verification mechanical); γ/μ marks remain kind-only +(stack-paired by nesting discipline — Gram-policed per program; +instance-indexing them is mechanical if a countermodel appears). +Restated from §9: general ℤ[1/√2] amplitudes in the verifier, H/T +cross-fibres, effect-free conservativity, general readback. diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index 9487069..ad50541 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -287,10 +287,15 @@ negative witness does it). The literal boolean answers re-entry by `bt2`-replay on its selection ticket; the machine mirrors this with a `recall` rule that reads `b′` off the `α` ticket and replays without firing — consistency with no store, as this section hoped, -but through a rule, not a reachability argument. The residual -obligation is **re-entry determinacy**: `recall` erases `b′`, so -injectivity needs `b′` recoverable from the retained state -(kernel-verified; general proof open). +but through a rule, not a reachability argument. Re-entry +determinacy was then settled in two steps: v1.2's replay stack keeps +`b′` in a retained frame (no erasure), and v1.3 instance-indexes +tickets and frames by the invoking occurrence's logged position — +the λIAM name of a dynamic subterm copy, structurally present at the +log head on every gate-leaf entry — which also discharges ticket +ownership: a same-gate foreign-instance ticket is a typed error, and +a re-seek after the ticket is consumed replays off the instance's +own frame (`kernel.md` §10.2). ### 3.6 The negative witness, mechanically @@ -321,6 +326,15 @@ is no computable uniform padding for arbitrary untyped code, so the coherent fragment is a discipline, not a default — which is the "coherence is earned" economy, now with a concrete currency. +v1.3 measured the currency's structure (`kernel.md` §10.4): slot +routing that survives to a boundary as tape *pattern* is time-free +(HH, H–NOT′–H sync exactly); routing *consumed* as transport steps +skews the branch clock by the transported bit, and the measured +offset of geometric selection is odd and invariant under every +even-cost program pad tried — the standing conjecture is that +step-encoded selection decoheres intrinsically, making the coherent +fragment exactly the pattern-encoded (index/wire) routing class. + ### 3.8 Not yet designed - **The readback controller** — the largest open component: full-NF @@ -368,14 +382,16 @@ substrate's obstruction and the fork reopens. | Item | Status | |---|---| -| Kernel | **v1.2: p★ repair (inert replay stack) confirmed locally real; gate still open on the `q` countermodel** (`kernel.md` §9.5–9.6) | -| α/γ transport totality | **broken on `q`** (three stuck states: α at log head inside selected-function plumbing) — v1.3's first job | -| Transparency criterion (replaces both C1 and mandatory-decoherence) | adopted: `R_g(b)` cleanable iff `b` is a function of the live core; cleanup inside the δ block with provenance-matched instance-indexed frames — the transparency/pop rule is the central design object | +| Kernel | **v1.3: transport total on the whole battery, instance-indexed frames, transparency/pop implemented and verified; the mass-1 question resolved into the time-register finding** (`kernel.md` §10) | +| α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole ten-program battery runs total | +| Transparency criterion | **implemented as the pop rule**: certified fire boundaries strip frames matching the arrival slot in the same unitary; unsound certificates caught as typed `pop-err`; `q`-family halts garbage-free; p★'s frames stay inert (mandatory) — certificate discovery manual, verification mechanical | +| Instance identity | **structural**: instance = the invoking occurrence's logged position, at the log head on every gate-leaf entry; tickets/frames carry it; ticket ownership discharged | +| Time register | **new standing finding** (`kernel.md` §10.4): pattern-encoded slots are time-free, step-encoded selection skews the branch clock oddly; even-pad invariance measured; conjecture: geometric selection decoheres intrinsically; time-balance is a compiler obligation | | L1 arrival-residue determinacy | kernel-verified at `fire`; general proof open | -| L2 pop timing / coherence return | confirmed for NOT′ (kernel); selector measured decoherent | -| `call`/`recall` structural domain disjointness | open (priority-resolved in scratch; formal table needs structure) | +| L2 pop timing / coherence return | confirmed for NOT′ (kernel); selector measured decoherent; mechanism now understood via pattern-vs-step | +| `call`/`recall`/`replay` structural domain disjointness | guards structural in v1.3 (instance + rs-head checks); formal table presentation still owed | | Probe-exit classification totality | open (kernel error rules are catch-alls) | | Readback controller | undesigned; kernel's root classifier is its 1-bit case | | `μ_p`/`Ω_qALC` on the token clock | pending readback design | -| Mandatory regressions | `p★`, the 3-coin program, and `q = λh.λt. h ((((h 0̂) E) N) 0̂)` — the last must reach mass 1 on `0̂` with no residual discriminator (`kernel.md` §9.1, §9.6) | +| Mandatory regressions | `p★`, 3-coin, `q` (Codex's), `q′` (wire-balanced), `q2` (minimal geometric selection) — all total, Gram-clean, marginals correct; `q`-family certified runs halt frame-free with arrival telemetry 35/7/3 as the time-register record | | Bideterminism of §2 | verified vs arXiv:2002.05649 | From c5c2b74a5fe37418bc5e11950559ee605aef026a Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 08:15:40 -0400 Subject: [PATCH 023/107] =?UTF-8?q?qalc:=20v1.3=20review=20verdict=20regis?= =?UTF-8?q?tered=20=E2=80=94=20polarity=20theorem=20route;=20in-session=20?= =?UTF-8?q?corrections?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit FAIL as formalization gate / PASS for the replay repair; all numbers independently reproduced; no odd pad in 156 variants, composed selections stay odd; port-polarity coloring supplied as the parity theorem route. Corrections applied: buried same-instance frames and missing-instance entries now typed errors, TOP fallback removed, dup copy-discrimination probe added (battery bit-identical). v1.4 gate: encoded fibres, certificate soundness beyond Gram, canonical certificates, the coloring proof. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 24 ++++++-- docs/ledger/2026-08.md | 37 +++++++++++++ docs/quantum-algebraic/kernel.md | 94 +++++++++++++++++++++++++++++++- docs/quantum-algebraic/token.md | 16 +++--- 4 files changed, 158 insertions(+), 13 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 83dba12..d9d8b08 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -478,12 +478,28 @@ pattern-encoded routing class, and time-balance is a compiler obligation. v1.2's p★ support-8 was transport-bug-inflated (extra fire events measured); the correct support is 4. +The v1.3 adversarial round returned (2026-08-09, registered in +`kernel.md` §10.6): **FAIL as the formalization gate, PASS for the +replay repair** — every number independently reproduced; no odd pad +in a 156-variant search (composed selections stay odd: NOT∘NOT +Δ=1); a **port-polarity coloring** supplied as the parity theorem +route; instance-as-logged-position ratified with a new +copy-discrimination regression (`dup`). Review corrections applied +in-session: buried same-instance frames and missing-instance +entries are typed errors (both unreachable in the battery — it is +bit-identical), TOP fallback removed. + The open docket, in order: -1. **kernel v1.3 adversarial round**: independent re-verification of - the replay/pop rules and the odd-offset invariance (find an - odd-cost pad or prove none exists); then the parity claim as a - theorem candidate; +1. **kernel v1.4 gate** (`kernel.md` §10.6): the port-polarity + coloring proof over the full rule table; the encoded-fibre + theorem `E_m|b,κ⟩ = |b,F_m(b,κ),κ⟩` or an architecture + amendment (the pop's source spectator depends on `b`); + certificate soundness beyond Gram (zero reachable `pop-err` + + the RS-function property) with certificates as canonical proved + stack-shape predicates of the program; buried-frame resolution; + the two logged-position invariants; exact amplitudes beyond + `(m,k)` monomials; 2. the readback controller (full-NF halt sectors; the kernel's root classifier is its 1-bit case) and the `t` gate's `ℤ[ω]` scalars — with time-in-the-core added to the transparency theorem diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 17eab0d..fa83a0a 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2216,3 +2216,40 @@ Registered: `kernel.md` §10 (status header rewritten), `token.md` battery), `q_diag.py`. Next: the v1.3 adversarial round (find an odd-cost pad or prove none exists), then readback with time-in-the-core. + +## 2026-08-09 — v1.3 adversarial verdict: FAIL as gate, PASS for replay; polarity route supplied + +The fresh-run review (thread `qalc-token-machine`) reproduced every +v1.3 number exactly — all eleven basis counts, marginals, supports, +the corrected p★ fire events (63/65 confirmed spurious, support 8 +confirmed bug-inflated), the 35/7/3 arrival telemetry, and the +instance invariant on every graph. It then searched 156 closed +identity-context pads plus a coherent HH pad (+48) around q′'s +branch-0 function: every shift even, every offset odd; composed +geometric selections stay odd (id∘id 9, NOT∘NOT 1, id∘NOT 7, +NOT∘id 1) — odd selections do not cancel. Supplied the theorem +route: a **port-polarity coloring** (bipartite port polarity; every +ordinary transition flips it; closed same-interface pads are even; +geometric slots 0/1 end at opposite polarity; pattern encoding is +exceptional because the δ classifier consumes its slot bullet +without a transition — exactly why HH/H–NOT′–H sync). Verdict FAIL +on four blockers: the pop is an *encoded* fibre, not the frozen +clean fibre (source spectator depends on b — amend the contract or +decode the frames); Gram/norm is not certificate soundness (our own +negative control is the countermodel: the wrong cert passes Gram +perfectly while sending mass 1/2 to pop-err) — validity needs zero +reachable pop-err plus RS = F_m(b,κ), and certificates must be +canonical stack-shape predicates of the program, not external +knobs; the buried same-instance frame case was documented as a +typed error but fell through to fresh call in code (the v1.2 +double-fire class waiting) — FIXED in-session along with removing +the TOP instance fallback, battery bit-identical, and the review's +copy-discrimination probe `(λx. x x)(h 0̂)` added as the `dup` +regression (90 states, total, clean); parity remains +measured-not-proved pending the row-by-row coloring. Instance = +logged position ratified as the intended λIAM copy-naming +structure. The v1.4 gate is kernel.md §10.6's eight items. +Registered: kernel.md §10.6 + status header, token.md §4 register, +STATUS docket. The pattern held for the fourth straight round: +every countermodel bought a sharper theory — this one bought a +theorem route. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 2e3ee80..ea1ac95 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -2,7 +2,12 @@ **Status: kernel v1.3 — transport total, frames instance-indexed, transparency/pop implemented and verified; the mass-1 question is -answered by a new finding: the time register.** §10 is the v1.3 +answered by a new finding: the time register. Reviewed: FAIL as +the formalization gate, PASS for the replay repair — every number +independently reproduced, no odd pad found (156-variant search), +a port-polarity theorem route supplied; the v1.4 gate is §10.6's +eight items (encoded fibres, certificate soundness beyond Gram, +canonical certificates, the coloring proof).** §10 is the v1.3 register. Of the re-review's six gate items: totality on `q`'s graph ✓ (the `replay` rule, derived from the literal visit-3 trace); correct slot-0/slot-1 outer arrivals ✓; instance-indexed @@ -756,3 +761,90 @@ manual (verification mechanical); γ/μ marks remain kind-only instance-indexing them is mechanical if a countermodel appears). Restated from §9: general ℤ[1/√2] amplitudes in the verifier, H/T cross-fibres, effect-free conservativity, general readback. + +### 10.6 The v1.3 review verdict (registered) + +Adversarial round (thread `qalc-token-machine`, fresh independent +run, 2026-08-09): **FAIL as the formalization gate; PASS for the +replay repair.** Every v1.3 number was independently reproduced — +all basis counts, marginals, supports, the p★ fire events +(confirming t = 63/65 were spurious and support 8 was +bug-inflated), the q-family arrival telemetry, and the instance +invariant (every downward gate-leaf entry in every graph has an +ordinary lp at the log head; the TOP fallback never fires). + +**Parity: no odd pad found, and a theorem route supplied.** The +review searched 156 closed identity-context pad variants (up to +three nested applications of `I M`, `(λx.M) I`, `0̂ M I`, `1̂ I M`, +`λz.M z`) around q′'s branch-0 function plus a branch-local +coherent HH pad (`λz. h (h (E′ z))`, +48): every shift even, every +offset odd, no stuck states. Composed geometric selections stay +odd: id∘id Δ=9, NOT∘NOT Δ=1, id∘NOT Δ=7, NOT∘id Δ=1 — odd +selections do not cancel. The proposed proof shape is a +**port-polarity coloring**: give ports a bipartite polarity; each +ordinary transition crosses one interaction edge and flips +polarity; a closed pad entering and exiting through one interface +has equal endpoint polarity, hence even cost; a geometric boolean +route's two computational slots end at opposite polarity (the slot +bullet crossed a real f-node via `•3`); pattern encoding is +exceptional because the δ classifier consumes its slot bullet +without a machine transition, quotienting the one-step difference — +exactly why HH/H–NOT′–H synchronize. Status: odd-offset invariance +HOLDS empirically; the even-pad lemma is a promising theorem; "the +coherent fragment is exactly the pattern-encoded class" is NOT YET +PROVED — it needs the row-by-row coloring over the full extended +table, the compressed `replay` rule checked directly rather than +via its literal expansion. + +**Blocker 1 — the pop is not the frozen clean δ fibre.** At a +certified boundary the two logical inputs are +`|0, R_i(0)·…, κ₀⟩` and `|1, R_i(1)·…, κ₁⟩`: the source spectator +depends on `b`, so this is not `U|q,b,κ⟩ = Σ Q[b′,b]|b′,J(κ)⟩` +with a common κ. The correct object is an **encoded fibre**: an +isometry `E_m|b,κ⟩ = |b, F_m(b,κ), κ⟩` with certified reachable +range and `U·E_m|b,κ⟩ = Σ_b′ Q[b′,b]|b′, J_m(κ)⟩`. Either the +architecture's clean-fibre contract is amended to admit encoded +fibres, or replay frames become a formally decoded logical +coordinate outside κ. + +**Blocker 2 — Gram/norm is not certificate soundness.** Our own +negative control is the countermodel: the wrong p★ certificate +passes the structural Gram and norm perfectly while sending mass +1/2 to `pop-err`. Certificate validity must separately require: +zero structurally reachable `pop-err`; the complete RS stack being +the certified function `F_m(b,κ)`; no framed/frameless predecessor +collision after erasure; and preservation of the intended +non-error semantics. Certificates must also become **canonical**: +a frozen function of the immutable program sector (a proved +stack-shape predicate, not an externally supplied fire-position +set) — otherwise the same program denotes different dynamics under +different certificates and `U` is not well-defined. + +**Blocker 3 — buried same-instance frames (FIXED in-session).** +The registered scope text claimed interleaved re-seeks raise a +typed error; the code actually fell through to fresh `call` when a +same-instance frame sat under another instance's frame — the v1.2 +double-fire class waiting to recur. Corrected immediately: a +buried same-instance frame is now the typed error `buried-frame`, +and the silent TOP instance fallback is removed (`no-instance` +typed error). The full battery is bit-identical after both +corrections (neither state is reachable in it), and the review's +copy-discrimination probe `(λx. x x) (h 0̂)` — two dynamic +instances of one argument occurrence, distinguished only by log +slices — joins the battery (`dup`: 90 basis states, total, +zero-defect, sectors halt0 1/4 / halt1 1/4 / haltI 1/2). + +**Ratified**: instance = logged position is "exactly the λIAM +structure intended to name exponential copies"; owed as proofs: +every valid gate-leaf entry has an lp at the log head, and equal +lps name the same dynamic copy. + +**The v1.4 gate**: (1) formalize the port-polarity coloring and +check every rule row; (2) the encoded-fibre theorem or architecture +amendment; (3) certificate validity = zero reachable `pop-err` plus +the RS-function property, not Gram alone; (4) certificates as +proved stack-shape predicates; (5) the canonical +program→certificate relation; (6) buried-frame handling proved or +ruled out (typed error now, resolution owed); (7) the two +logged-position invariants; (8) exact verification beyond +single-monomial `(m,k)` amplitudes before general h-only claims. diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index ad50541..8ad3218 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -382,16 +382,16 @@ substrate's obstruction and the fork reopens. | Item | Status | |---|---| -| Kernel | **v1.3: transport total on the whole battery, instance-indexed frames, transparency/pop implemented and verified; the mass-1 question resolved into the time-register finding** (`kernel.md` §10) | -| α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole ten-program battery runs total | -| Transparency criterion | **implemented as the pop rule**: certified fire boundaries strip frames matching the arrival slot in the same unitary; unsound certificates caught as typed `pop-err`; `q`-family halts garbage-free; p★'s frames stay inert (mandatory) — certificate discovery manual, verification mechanical | -| Instance identity | **structural**: instance = the invoking occurrence's logged position, at the log head on every gate-leaf entry; tickets/frames carry it; ticket ownership discharged | -| Time register | **new standing finding** (`kernel.md` §10.4): pattern-encoded slots are time-free, step-encoded selection skews the branch clock oddly; even-pad invariance measured; conjecture: geometric selection decoheres intrinsically; time-balance is a compiler obligation | +| Kernel | **v1.3 reviewed: FAIL as the formalization gate, PASS for the replay repair** — every number independently reproduced; the v1.4 gate is `kernel.md` §10.6's eight items | +| α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | +| Transparency criterion | pop rule implemented and Gram-verified, but the review holds it to more: the pop is an **encoded fibre** `E_m\|b,κ⟩ = \|b,F_m(b,κ),κ⟩` (source spectator depends on `b` — the frozen clean-fibre contract needs amending or frames become a decoded coordinate); **Gram ≠ certificate soundness** (our own negative control is the countermodel — validity needs zero reachable `pop-err` + the RS-function property); certificates must be canonical stack-shape predicates of the program, not external fire-position sets | +| Instance identity | **ratified** ("exactly the λIAM structure intended to name exponential copies"); the `dup` probe `(λx. x x)(h 0̂)` verifies copy discrimination; owed as proofs: lp-at-log-head on every valid entry, equal lps = same dynamic copy; TOP fallback removed (typed `no-instance`), buried same-instance frames typed (`buried-frame`), resolution owed | +| Time register | **standing finding, independently confirmed** (`kernel.md` §10.4, §10.6): pattern-encoded slots time-free, step-encoded selection skews the branch clock oddly; no odd pad in a 156-variant search; composed selections stay odd (NOT∘NOT Δ=1); **port-polarity coloring** supplied as the theorem route — row-by-row proof over the extended table owed; "coherent fragment = pattern class" not yet proved | | L1 arrival-residue determinacy | kernel-verified at `fire`; general proof open | -| L2 pop timing / coherence return | confirmed for NOT′ (kernel); selector measured decoherent; mechanism now understood via pattern-vs-step | -| `call`/`recall`/`replay` structural domain disjointness | guards structural in v1.3 (instance + rs-head checks); formal table presentation still owed | +| L2 pop timing / coherence return | confirmed for NOT′ (kernel); selector measured decoherent; mechanism understood via pattern-vs-step | +| `call`/`recall`/`replay` structural domain disjointness | guards structural in v1.3 (instance + rs checks, buried-frame typed); formal table presentation still owed | | Probe-exit classification totality | open (kernel error rules are catch-alls) | | Readback controller | undesigned; kernel's root classifier is its 1-bit case | | `μ_p`/`Ω_qALC` on the token clock | pending readback design | -| Mandatory regressions | `p★`, 3-coin, `q` (Codex's), `q′` (wire-balanced), `q2` (minimal geometric selection) — all total, Gram-clean, marginals correct; `q`-family certified runs halt frame-free with arrival telemetry 35/7/3 as the time-register record | +| Mandatory regressions | `p★`, 3-coin, `q`, `q′`, `q2`, `dup` — all total, Gram-clean, marginals correct; `q`-family certified runs halt frame-free with arrival telemetry 35/7/3 as the time-register record | | Bideterminism of §2 | verified vs arXiv:2002.05649 | From f540e21224cdcaf2cb2991b8a6bbbcd14a2c55b8 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 11:48:13 -0400 Subject: [PATCH 024/107] =?UTF-8?q?qalc:=20v1.4=20=E2=80=94=20polarity=20t?= =?UTF-8?q?heorem=20with=20closed=20form;=20canonical=20certificates;=20ex?= =?UTF-8?q?act=20ring?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The coloring is a theorem: phi = depth + dir + weighted marks, uniform flip everywhere except fire (defect 1 − w(erased lp)); 1,518 edges verified zero-violation; branch-offset formula matches all measured offsets; the review's even-pad search becomes a corollary. Refined coherence condition: equal erased weights (HNH carries w=1 on both branches). New standing object: the weight-conservation conjecture — gate-free readback conserves w ≡ slot, gate-mediated routing is the parity-free class. Certificates canonical via discovery fixpoint (HAND==AUTO x11); validity strictly beyond Gram catches the negative control. Amplitudes exact Q[sqrt2]. Encoded-fibre amendment drafted. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 25 ++-- docs/ledger/2026-08.md | 48 ++++++++ docs/quantum-algebraic/kernel.md | 191 +++++++++++++++++++++++++++++-- docs/quantum-algebraic/token.md | 4 +- 4 files changed, 248 insertions(+), 20 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index d9d8b08..690adbd 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -491,15 +491,22 @@ bit-identical), TOP fallback removed. The open docket, in order: -1. **kernel v1.4 gate** (`kernel.md` §10.6): the port-polarity - coloring proof over the full rule table; the encoded-fibre - theorem `E_m|b,κ⟩ = |b,F_m(b,κ),κ⟩` or an architecture - amendment (the pop's source spectator depends on `b`); - certificate soundness beyond Gram (zero reachable `pop-err` + - the RS-function property) with certificates as canonical proved - stack-shape predicates of the program; buried-frame resolution; - the two logged-position invariants; exact amplitudes beyond - `(m,k)` monomials; +1. **kernel v1.4 close-out** (`kernel.md` §11): five of eight gate + items discharged same-day — the polarity coloring is a THEOREM + (closed-form φ; uniform flip; fire defect `1 − w(erased lp)`; + 1,518 edges verified, zero violations; branch-offset formula + matches all measured offsets; the review's even-pad search is + now a corollary), certificates are canonical (discovery + fixpoint, HAND==AUTO on all eleven programs, validity strictly + beyond Gram — the negative control properly caught), and + amplitudes are exact `ℚ[√2]`. Owed: adversarial review of the + coloring; encoded-fibre ratification (§11.7 draft, covers the + original arrival-lp erasure too); the §11.3 + **weight-conservation lemma** (gate-free readback conserves + `w ≡ slot` — geometric selection of classical data decoheres + intrinsically; gate-mediated routing is the parity-free pattern + class); buried-frame resolution and the two lp invariants + (typed fences + probes in place); 2. the readback controller (full-NF halt sectors; the kernel's root classifier is its 1-bit case) and the `t` gate's `ℤ[ω]` scalars — with time-in-the-core added to the transparency theorem diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index fa83a0a..85c78f8 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2253,3 +2253,51 @@ Registered: kernel.md §10.6 + status header, token.md §4 register, STATUS docket. The pattern held for the fourth straight round: every countermodel bought a sharper theory — this one bought a theorem route. + +## 2026-08-09 — v1.4: the polarity theorem lands; certificates canonical; conservation conjecture + +Same-day chase of the v1.4 gate, five of eight items discharged. +The centerpiece: the port-polarity coloring has a **closed form** — +φ = depth + [dir=↑] + Σw(tape,log,RS) + VB-phase, with bullets and +all gate marks weighing 0, answer tokens 1, and a logged position +weighing its own binder–occurrence distance plus its slice's nested +weights. Every rule of the extended table flips φ (the var/bt2 case +works because the lp carries its teleport distance as weight; the +constraint propagation fixes every mark weight uniquely) EXCEPT +fire, whose defect is exactly 1 − w(erased which-path lp). +Mechanically verified: 1,518 Run→Run edges across all eleven +graphs, zero violations, every fire defect as predicted. The +branch-offset theorem follows: len₀ − len₁ ≡ w(l₀) − w(l₁), matching +all measured offsets (35/7/3, parity 1); Codex's 156-variant +even-pad search is now a corollary (gate-free pads add no fires and +move no endpoint φ). The refined coherence condition is *equal* +erased weights, not zero — H–NOT′–H's fires carry w=1 on both +branches (its x/y occurrences both at distance 3: the index swap +moves occurrence depth in step with binder depth). Chasing the +existence of coherent geometric selection through answer-term +variants ((λλ.I x, 1̂) → offset 1!) exposed the conservation +mechanism: an a-step in the readback path adds 1 + w(captured lp), +and gate-free plumbing telescopes to w ≡ exit slot — while HNH's +slice captures the coin's virtual ticket (w 0 by fiat). Standing +**conservation conjecture**: gate-free readback of classical data +conserves w ≡ slot (geometric selection decoheres intrinsically); +gate-mediated routing is the parity-free pattern class. Items 3–5 +in one mechanism: `discover(term)` is a deterministic fixpoint +(admit a boundary iff frame bits match slots, RS single-valued per +fire-target fibre, non-vacuous) — HAND==AUTO on all eleven +programs, and certificates are thereby a frozen function of the +program (U well-defined); `validate` requires zero reachable +pop-err + the RS-function property, and now properly FAILS the +wrong-cert negative control (pop_err_reachable 1, rs_function +False) that Gram alone passes. Probes: h-applied-to-a-gate is a +total typed species error; nested coin-in-coin (263 states) is +total, clean, and correctly refused a certificate; buried-frame +and no-instance remain unreached everywhere. Item 8: amplitudes +are now exact ℚ[√2] pairs (1 + 1/√2 representable); battery, +polarity, and certification bit-identical under the new ring. +Registered as kernel.md §11 with the encoded-fibre amendment +drafted in §11.7 (it covers the v1-era arrival-lp erasure too — +the fire was always an encoded fibre). Owed: coloring review, +amendment ratification, the conservation lemma, the general lp +invariants. Next consults: coloring proof to qalc-token-machine, +encoded-fibre draft to qalc-architecture. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index ea1ac95..8a6fd1a 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,14 +1,20 @@ # qALC three-program kernel — v1 -**Status: kernel v1.3 — transport total, frames instance-indexed, -transparency/pop implemented and verified; the mass-1 question is -answered by a new finding: the time register. Reviewed: FAIL as -the formalization gate, PASS for the replay repair — every number -independently reproduced, no odd pad found (156-variant search), -a port-polarity theorem route supplied; the v1.4 gate is §10.6's -eight items (encoded fibres, certificate soundness beyond Gram, -canonical certificates, the coloring proof).** §10 is the v1.3 -register. Of the re-review's six gate items: totality on `q`'s +**Status: v1.4 in progress — §11 is the current register. The +polarity coloring is now a THEOREM with a closed form (uniform +flip, fire defect `1 − w(erased lp)`; 1,518 edges checked, zero +violations), the branch-offset formula is verified on all +measured offsets, Codex's even-pad search is a corollary, +certificates are canonical (discovery fixpoint, HAND==AUTO on all +eleven programs, validity strictly beyond Gram — the negative +control is properly caught), amplitudes are exact `ℚ[√2]`, and +the sharpened open object is the §11.3 weight-conservation +conjecture: gate-free readback conserves `w ≡ slot` (geometric +selection of classical data decoheres intrinsically), with +gate-mediated routing as the parity-free pattern class. Owed: +adversarial review of the coloring, encoded-fibre ratification +(§11.7), the conservation lemma, general lp invariants.** §10 is +the v1.3 register. Of the re-review's six gate items: totality on `q`'s graph ✓ (the `replay` rule, derived from the literal visit-3 trace); correct slot-0/slot-1 outer arrivals ✓; instance-indexed frames ✓ (instance = the log-head logged position, already present @@ -848,3 +854,170 @@ program→certificate relation; (6) buried-frame handling proved or ruled out (typed error now, resolution owed); (7) the two logged-position invariants; (8) exact verification beyond single-monomial `(m,k)` amplitudes before general h-only claims. + +## 11. v1.4 — the polarity theorem, canonical certificates, and the conservation conjecture + +Scratch artifacts: `polarity.py` (the coloring checker), `certify.py` +(canonical certificate discovery + validity), `kernel.py`/`suite.py` +upgraded to exact `ℚ[√2]` amplitudes. All scratchpad-only. + +### 11.1 The coloring, with its closed form (gate item 1) + +Define, on Run states of the full v1.3 table: + +```text +φ(s) = depth(pos) + [dir = ↑] + Σ w(tape) + Σ w(log) + Σ w(RS) + k_VB (mod 2) + +w(•) = w(γ) = w(μ) = w(α) = w(ρ) = w(R-frame) = 0 +w(A) = 1 +w(l) for l = (occ, slice) = (depth(occ) − depth(binder)) + Σ w(slice) +``` + +— a logged position carries its own binder–occurrence tree distance +plus, recursively, the weight of everything captured in its slice. + +**Theorem (uniform flip).** Every rule of the table with Run source +and Run target flips φ — the eight classical rules, `call`, +`recall`, `replay`, `anshead`, `vb2`, `vvar`, `bt1g` — EXCEPT +`fire`, whose defect is exactly `1 − w(l)` where `l` is the +which-path logged position erased at the boundary. Terminal entries +chain linearly off unique predecessors (complete residues) and flip +by assignment. + +*Proof* is per-row algebra, two lines each; the load-bearing case is +`var`/`bt2`, where the teleport's distance is absorbed by the lp +carrying that distance as weight (`Δφ = w(lp) − Σ slice − d + 1 = +1`), and the constraint propagation fixes the remaining weights +(`call` forces `w(γ)+w(μ) ≡ 0`; `recall`/`replay` force +`w(R) ≡ w(α) ≡ 0`; `anshead`+`vvar` force `w(γ)+w(A) ≡ 1`). +Mechanically verified: every Run→Run edge of all eleven reachable +graphs — 1,518 edges — has the predicted Δφ, zero violations, and +every fire edge's measured defect equals `1 − w(l)`. + +### 11.2 The branch-offset theorem (the parity result) + +For two branches created at one fire and meeting at a common later +boundary with no interior fires: + +```text +len₀ − len₁ ≡ w(l₀) − w(l₁) (mod 2) +``` + +where `l_b` is branch b's erased arrival lp. Verified: q/q′/q2 +offsets 35/7/3, all with `w(l₀)=0, w(l₁)=1` — parity 1 ✓. + +**Corollary (even pads — Codex's search, now a theorem).** A +gate-free pad adds no fires and leaves both endpoints' φ unchanged, +so it shifts branch-relative time by an even amount. The measured ++8/+12/+16 menu and the review's 156-variant all-even search are +instances; an odd gate-free pad that preserves the arrival lps +cannot exist. + +**Refined coherence condition.** Synchrony requires *equal* erased +weights, not zero: H–NOT′–H's fires show `w = 1` defects on BOTH +branches (its arrival lps are NOT′'s x/y occurrences, distances +3 and 3 — the index swap moves occurrence depth in step with binder +depth). The pattern class is the equal-weight class. + +### 11.3 The weight-conservation conjecture (what remains of "the coherent fragment") + +Answer-term variants that try to re-weight a literal boolean's +readback all fail — measured: `q2` (0̂,1̂) offset 3; (λλ.I x, 1̂) +offset 1; (0̂, λλ.I y) offset 7; both wrapped, offset 3 — every +variant keeps `(w₀, w₁) = (0, 1)` up to swap. The mechanism is the +slice: an `a`-step in the readback path adds `1 + w(captured lp)` +to the surfacing weight, and in gate-free plumbing the captured +lp's weight telescopes so that `w ≡ exit slot` is conserved. +H–NOT′–H evades conservation because its slice captures the coin's +*virtual ticket* (`w(α) = 0` by fiat) — gate-mediated routing is +the parity-free transport. + +**Conjecture (conservation).** Along gate-free readback of a +boolean value, the surfacing lp's weight is congruent to the exit +slot. Hence geometric selection of *classical data* always has odd +offset (decoheres intrinsically), and the coherent fragment is +exactly gate-mediated (pattern) routing. The proof target is a +telescoping lemma over the `a`-step capture algebra; the q3 variant +table is its evidence base. + +### 11.4 Canonical certificates (gate items 3, 4, 5) + +`discover(term)`: iterate to fixpoint — BFS under the current +certificate; admit a fire boundary iff over its reachable arrivals +(a) every frame bit equals the arrival slot, (b) RS is +single-valued per fire-target fibre `(path, log, slot, l, T)`, and +(c) some arrival carries a frame. Deterministic and terminating: +the certificate is a **frozen function of the program sector**, so +U is well-defined per program (item 5). The implied stack-shape +predicate — every frame bit equals the arrival slot — is checked, +not assumed (item 4). + +`validate(term, cert)` — the item-3 criterion, strictly beyond +Gram: zero structurally reachable `pop-err`, plus the RS-function +property on the certified graph, plus Gram totality/orthogonality. + +Results: discovery reproduces the hand certificates on **all +eleven programs** (q-family certified at exactly the outer +boundary; HH/HNH/negative/selector/lone/p★/3-coin/dup refused — +their frames, where present, never transit a later fire and stay +inert terminal garbage). The negative control now FAILS validation +properly: p★ under the wrong certificate reports +`pop_err_reachable = 1` and `rs_function = False` while Gram shows +zero defects — the criterion separates exactly where the review +demanded. + +### 11.5 Probes and fences (gate items 6, 7) + +`h` applied to a gate (`h t`, `h h`): total, resolves as a typed +species error — the probe meets a non-boolean. Nested coin-in-coin +(`h ((h 0̂) ((h 0̂) 0̂ 1̂) 1̂)`): 263 states, total, Gram-clean, +correct marginals, and correctly refused a certificate. +`buried-frame` and `no-instance` remain **unreached in every +program constructed to date**; both corners are typed errors, not +silent behavior. The general proofs (lp-at-log-head; equal lps = +same copy; buried frames unreachable or handled) remain owed. + +### 11.6 Exact amplitudes (gate item 8) + +The evolver now carries amplitudes as exact pairs +`(p, q) ∈ ℚ[√2]`, `p + q√2` — no monomial restriction; `1 + 1/√2` +is representable. Norm assertions compare against `(1, 0)` exactly. +The whole battery, the polarity check, and certificate discovery +are bit-identical under the new ring. + +### 11.7 The encoded-fibre statement (gate item 2 — draft, ratification owed) + +Proposed amendment to the architecture's clean-δ-fibre guardrail: + +> A δ event may be realized on an **encoded domain**. Let +> `E_m|b,κ⟩ = |b, G_m(b,κ), F_m(b,κ), κ⟩` adjoin the which-path +> arrival position `l = G_m(b,κ)` and the replay frames +> `RS = F_m(b,κ)`, where G and F are proved single-valued functions +> of `(b, κ)` on the reachable span at boundary m — the certificate +> conditions. Then the machine's fire-with-pop satisfies +> `U·E_m|b,κ⟩ = Σ_b′ Q[b′,b] |b′, J_m(κ)⟩`: the clean-fibre law +> holds after decoding, with landings and cross-fibre orthogonality +> unchanged. `E_m` is an isometry because its adjoined coordinates +> are functions of its arguments; certification is canonical by +> §11.4. + +Note this covers not only the v1.3 frames but the arrival lp +erasure the fire has performed since v1 — the original design was +already an encoded fibre in this sense. Ratification through +`qalc-architecture` before the contract text moves. + +### 11.8 The v1.4 scorecard + +| Gate item | Status | +|---|---| +| 1 coloring | **discharged** (closed form + per-row proof + 1,518-edge mechanical check) — adversarial review owed | +| 2 encoded fibre | statement drafted (§11.7); architecture ratification owed | +| 3 cert validity beyond Gram | **discharged** (`validate`: pop-err reachability + RS-function; negative control now caught) | +| 4 stack-shape predicate | **discharged** (checked predicate: frame bit = arrival slot) | +| 5 canonical program→cert | **discharged** (`discover` fixpoint; HAND==AUTO ×11) | +| 6 buried frames | typed fence + probes (unreached); general resolution owed | +| 7 lp invariants | probes + battery evidence; general proofs owed | +| 8 exact amplitudes | **discharged** (`ℚ[√2]` pairs; battery bit-identical) | + +New standing object: the **conservation conjecture** (§11.3) — the +sharpened form of "the coherent fragment is the pattern class." diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index 8ad3218..17b6277 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -382,11 +382,11 @@ substrate's obstruction and the fork reopens. | Item | Status | |---|---| -| Kernel | **v1.3 reviewed: FAIL as the formalization gate, PASS for the replay repair** — every number independently reproduced; the v1.4 gate is `kernel.md` §10.6's eight items | +| Kernel | **v1.4 in progress** (`kernel.md` §11): coloring theorem proved + mechanically verified; canonical certificates (HAND==AUTO ×11, validity beyond Gram); exact `ℚ[√2]` amplitudes; owed: coloring review, encoded-fibre ratification, the conservation lemma, general lp invariants | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | pop rule implemented and Gram-verified, but the review holds it to more: the pop is an **encoded fibre** `E_m\|b,κ⟩ = \|b,F_m(b,κ),κ⟩` (source spectator depends on `b` — the frozen clean-fibre contract needs amending or frames become a decoded coordinate); **Gram ≠ certificate soundness** (our own negative control is the countermodel — validity needs zero reachable `pop-err` + the RS-function property); certificates must be canonical stack-shape predicates of the program, not external fire-position sets | | Instance identity | **ratified** ("exactly the λIAM structure intended to name exponential copies"); the `dup` probe `(λx. x x)(h 0̂)` verifies copy discrimination; owed as proofs: lp-at-log-head on every valid entry, equal lps = same dynamic copy; TOP fallback removed (typed `no-instance`), buried same-instance frames typed (`buried-frame`), resolution owed | -| Time register | **standing finding, independently confirmed** (`kernel.md` §10.4, §10.6): pattern-encoded slots time-free, step-encoded selection skews the branch clock oddly; no odd pad in a 156-variant search; composed selections stay odd (NOT∘NOT Δ=1); **port-polarity coloring** supplied as the theorem route — row-by-row proof over the extended table owed; "coherent fragment = pattern class" not yet proved | +| Time register | **the coloring is a theorem** (`kernel.md` §11.1–11.3): closed-form φ, uniform flip, fire defect `1 − w(erased lp)`; branch-offset formula verified; even pads a corollary; refined coherence condition = equal erased weights (HNH: w=1 both branches); the sharpened open object is the **weight-conservation conjecture** — gate-free readback conserves `w ≡ slot`, gate-mediated routing is the parity-free class | | L1 arrival-residue determinacy | kernel-verified at `fire`; general proof open | | L2 pop timing / coherence return | confirmed for NOT′ (kernel); selector measured decoherent; mechanism understood via pattern-vs-step | | `call`/`recall`/`replay` structural domain disjointness | guards structural in v1.3 (instance + rs checks, buried-frame typed); formal table presentation still owed | From e674e33e84d82a2231fccbe68620d07281d5660e Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 11:54:01 -0400 Subject: [PATCH 025/107] =?UTF-8?q?qalc:=20encoded-fibre=20amendment=20rat?= =?UTF-8?q?ified-with-edits,=20applied=20to=20architecture=20=C2=A77?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Codex ratification round: construction sound; strengthened language applied verbatim — arrival-lp erasure subsumed (F_a-trivial case), seven-item per-boundary exhibition, source-fibre disjointness, pop as coherent decoding not deletion (negative-witness fence explicit), computability discipline (total certification over a proved over-approximation, conservative fallback, U never undefined). Gate item 2 discharged; six of eight v1.4 items closed. Co-Authored-By: Claude Fable 5 --- docs/ledger/2026-08.md | 34 +++++++++++++ docs/quantum-algebraic/architecture.md | 68 +++++++++++++++++++++++++- docs/quantum-algebraic/kernel.md | 41 +++++++++++++--- docs/quantum-algebraic/token.md | 7 +++ 4 files changed, 142 insertions(+), 8 deletions(-) diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 85c78f8..1ff2ad8 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2301,3 +2301,37 @@ the fire was always an encoded fibre). Owed: coloring review, amendment ratification, the conservation lemma, the general lp invariants. Next consults: coloring proof to qalc-token-machine, encoded-fibre draft to qalc-architecture. + +## 2026-08-09 — encoded-fibre amendment ratified and applied + +The `qalc-architecture` ratification round returned +RATIFY-WITH-EDITS with exact replacement language, now applied to +architecture §7 (guardrail 5 in token.md carries the summary). The +construction was graded mathematically sound; every edit is a +strengthening: the v1-era arrival-lp erasure is SUBSUMED (the +`F_a`-trivial case — treating it as clean under the old law while +encoding only frames would retain the inconsistency the amendment +repairs); a seven-item per-boundary exhibition obligation +(canonical `(b,G,F,κ)` decomposition through the full range +matrix), with `G`/`F` functions of the certified reachable *basis +domain* extended linearly; source-fibre disjointness `E_a†E_a′ = 0` +in addition to landing orthogonality (output orthogonality alone +cannot repair overlapping encoded sources — U would be ambiguous +before landings are considered); the pop recharacterized as +**coherent decoding, not deletion** (the event's inverse +reconstructs the coordinates through `E_a` after `Q_q†`; no copy +reaches garbage; fork-A minimal-residue aligned; explicitly NOT a +license to erase deterministic histories around non-injective maps +— the negative witness stays protected); and a computability +discipline — exact reachability being undecidable in general, +certification must be total and terminating over a proved +over-approximation of arrivals, free to reject valid certificates, +with rejection selecting the conservative nontransparent +transition so `U` is never undefined, and the certificate static +metadata fixed at initialization. The scratch `discover`/`validate` +satisfy the discipline on finite kernel graphs; the strengthened +validation checklist (G-function property, encoded-range coverage, +unique decoder, boolean pairing, source disjointness, landing/non-δ +disjointness) is registered as the checker's growth path. Gate +item 2 discharged; six of eight v1.4 items now closed. The +original clean-fibre law survives as `E_a = identity`. diff --git a/docs/quantum-algebraic/architecture.md b/docs/quantum-algebraic/architecture.md index 7ccb194..f3454e0 100644 --- a/docs/quantum-algebraic/architecture.md +++ b/docs/quantum-algebraic/architecture.md @@ -493,7 +493,73 @@ spectators. Boolean values encoded by token *position* are acceptable precisely when that pairing is exhibited; quantum control must reside in superposed token configurations — a classically-positioned token driving a hidden quantum payload register is the classical-control corner, not -this pillar. Second, halted dynamics has the §4.3 normative typed form. +this pillar. + +**Encoded clean δ fibres** (amendment, ratified-with-edits through +`qalc-architecture` 2026-08-09; the original law is the special case +`E_a = identity`). A δ event may act on a certified encoded arrival +subspace. For each program sector `p` and δ-boundary identifier +`a = (p, m, q)`, the machine must exhibit a logical spectator set `K_a` +and an isometric encoding + +```text +E_a : ℂ²_boolean ⊗ ℓ²(K_a) → H_run +E_a|b,κ⟩ = |b, G_a(b,κ), F_a(b,κ), κ⟩ +``` + +where `κ` is a canonical decomposition of all spectator state excluding +the explicitly encoded coordinates; `G_a` includes every bit-correlated +arrival-position component removed by the event, and `F_a` every +bit-correlated replay/control frame removed by it. The certified +arrival subspace is exactly `Ran(E_a)`, with `E_a†` its decoder, and + +```text +U E_a |b,κ⟩ = Σ_b′ (Q_q)_{b′b} |b′, J_a(κ)⟩ +``` + +with `J_a` an isometry independent of `b` and `b′`: the event +**coherently decodes** redundant which-path coordinates and then +applies `Q_q` — it does not irreversibly erase them; on `Ran(E_a)` the +encoded coordinates carry no independent degree of freedom, and the +event's inverse reconstructs them through `E_a` after `Q_q†`. No copy +moves to terminal garbage; halt factorization is unaffected; this is +aligned with minimal-information residue. This clause is **not** a +license to erase deterministic histories around a non-injective λ-map +(the negative witness's branches keep their distinct residues). + +The exhibition obligation is per certified boundary: identify `K_a`, +`E_a`, `G_a`, `F_a`, the certified arrival range, and `J_a`; establish +a canonical decomposition into `(b, G, F, κ)`; coverage of every +arrival on which the encoded rule fires; uniqueness of `(b,κ)` from +the physical arrival; single-valued `G_a(b,κ)` and `F_a(b,κ)` on the +certified reachable *basis domain*, extended linearly; the complete +boolean pairing including the counterfactual column exhibiting the +`Q_q` block; injectivity of `J_a`; and the full pairwise range matrix. +For distinct canonical fibres `a ≠ a′`, both `E_a† E_a′ = 0` (source +disjointness — overlapping encoded ranges are forbidden unless the +alleged fibres are definitionally one canonical fibre) and orthogonal +landing ranges, themselves orthogonal to every non-δ transition range. + +Certificate selection is a total, deterministic, **effectively +computable** function of the immutable program sector: `discover(p)` +terminates on every finite `p`, operates over a finite syntactic or +abstract domain, and is sound for a proved over-approximation of +runtime arrivals; rejection is allowed even when a certificate exists, +and selects a specified conservative nontransparent δ transition +retaining enough spectator control to remain isometric — `U` is never +undefined. Certification may not depend on runtime amplitudes or an +undecidable reachability oracle, and is static machine metadata fixed +at canonical initialization, never a branch-dependent runtime +register. Validation must prove encoded-range coverage, unique +decoding, the `G`- and `F`-function properties, absence of reachable +pop-error, and all source/range orthogonality obligations — Gram +enumeration alone is not certificate soundness. + +The v1-era arrival-position erasure is subsumed: it is the encoded +fibre with `F_a` trivial and `G_a` the certified arrival-position +function. + +Second, halted dynamics has the §4.3 normative typed form. Every qALC engine change must then satisfy: 1. `cargo test --release --all-features` and plain `cargo test --release`; diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 8a6fd1a..7410c28 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -11,9 +11,11 @@ control is properly caught), amplitudes are exact `ℚ[√2]`, and the sharpened open object is the §11.3 weight-conservation conjecture: gate-free readback conserves `w ≡ slot` (geometric selection of classical data decoheres intrinsically), with -gate-mediated routing as the parity-free pattern class. Owed: -adversarial review of the coloring, encoded-fibre ratification -(§11.7), the conservation lemma, general lp invariants.** §10 is +gate-mediated routing as the parity-free pattern class. The +encoded-fibre amendment is RATIFIED-WITH-EDITS and applied to +architecture §7 (§11.7). Owed: adversarial review of the coloring +(in flight), the conservation lemma, general lp invariants, the +strengthened validation checklist.** §10 is the v1.3 register. Of the re-review's six gate items: totality on `q`'s graph ✓ (the `replay` rule, derived from the literal visit-3 trace); correct slot-0/slot-1 outer arrivals ✓; instance-indexed @@ -985,7 +987,7 @@ is representable. Norm assertions compare against `(1, 0)` exactly. The whole battery, the polarity check, and certificate discovery are bit-identical under the new ring. -### 11.7 The encoded-fibre statement (gate item 2 — draft, ratification owed) +### 11.7 The encoded-fibre statement (gate item 2 — RATIFIED-WITH-EDITS, applied) Proposed amendment to the architecture's clean-δ-fibre guardrail: @@ -1003,15 +1005,40 @@ Proposed amendment to the architecture's clean-δ-fibre guardrail: Note this covers not only the v1.3 frames but the arrival lp erasure the fire has performed since v1 — the original design was -already an encoded fibre in this sense. Ratification through -`qalc-architecture` before the contract text moves. +already an encoded fibre in this sense. + +**Ratified with edits** (thread `qalc-architecture`, 2026-08-09) and +applied to architecture §7 in the reviewer's strengthened language. +The edits beyond the draft: subsume the arrival-lp erasure (v1 is +the `F_a`-trivial case) rather than split the law; a seven-item +per-boundary exhibition obligation (canonical `(b,G,F,κ)` +decomposition, coverage, unique decoding, single-valued `G`/`F` on +the certified reachable *basis domain* extended linearly, the +complete boolean pairing with the counterfactual column, `J_a` +injectivity, the full range matrix); source-fibre disjointness +`E_a†E_a′ = 0` in addition to landing orthogonality; "coherent +decoding, not deletion" — the inverse reconstructs the coordinates +through `E_a` after `Q_q†`, no copy reaches garbage, and the clause +is explicitly not a license to erase deterministic histories around +non-injective maps; and a computability discipline — certification +must be total, terminating, sound over a proved over-approximation +of arrivals (exact reachability is not decidable in general), free +to reject valid certificates, with rejection selecting the +conservative nontransparent transition so `U` is never undefined, +and the certificate static metadata fixed at initialization. The +scratch `discover`/`validate` satisfy the discipline on finite +kernel graphs (BFS is exact there, a valid over-approximation); +the strengthened validation checklist — `G`-function property, +encoded-range coverage, unique decoder, boolean pairing, source +disjointness, landing/non-δ disjointness — is registered as the +checker's growth path. ### 11.8 The v1.4 scorecard | Gate item | Status | |---|---| | 1 coloring | **discharged** (closed form + per-row proof + 1,518-edge mechanical check) — adversarial review owed | -| 2 encoded fibre | statement drafted (§11.7); architecture ratification owed | +| 2 encoded fibre | **discharged** — ratified-with-edits and applied to architecture §7; strengthened validation checklist registered | | 3 cert validity beyond Gram | **discharged** (`validate`: pop-err reachability + RS-function; negative control now caught) | | 4 stack-shape predicate | **discharged** (checked predicate: frame bit = arrival slot) | | 5 canonical program→cert | **discharged** (`discover` fixpoint; HAND==AUTO ×11) | diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index 17b6277..7891a3f 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -49,6 +49,13 @@ Any design is dead on arrival unless it respects: Boolean-as-position is acceptable precisely when that pairing is exhibited; a classically-positioned token driving a hidden quantum payload register is the classical-control corner, not this pillar. + Amended (ratified 2026-08-09): a δ event may act through a + certified **encoded fibre** `E_a|b,κ⟩ = |b, G_a(b,κ), F_a(b,κ), κ⟩` + — coherent decoding of bit-correlated arrival/replay coordinates + before `Q_q`, with per-boundary exhibition, source and landing + disjointness, and an effectively computable certification whose + rejection falls back to the conservative nontransparent transition; + the original law is `E_a = identity`. Full text in architecture §7. 6. **Full-NF effect-free conservativity** (observational): if rigid-atom leftmost-outermost normalization of `p X₁ X₂` reaches normal form `n`, the machine's internal readback halts with output From 44cb164dd5a8de75a0545acfadd698c60c268ac9 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 12:05:13 -0400 Subject: [PATCH 026/107] qalc: coloring theorem confirmed; C-collapse countermodel; the v1.5 encoded fire MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review verdict split on the dynamics/proof line: theorem PASS-WITH-CORRECTIONS (gauge uniqueness, interior-fire parity law), table FAIL on C = λb.λx.λy. b y y — same-slot arrivals with distinct lps collided through the v1-lineage fire's unsound erasure. v1.5 fire: conservative decode by default (D(l) on the inert ks stack, uniform φ-flip), certified erasure under the corrected fibre condition. Twelve programs total/clean; HNH's coherence now earned through its certified boundary; Ccoll decoheres Gram-clean; conservation conjecture refined to mark-free ancestry with the reviewer's exhaustive small-term enumeration behind it. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 37 +++++---- docs/ledger/2026-08.md | 39 ++++++++++ docs/quantum-algebraic/kernel.md | 124 ++++++++++++++++++++++++++++++- 3 files changed, 181 insertions(+), 19 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 690adbd..ec553ca 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -491,22 +491,27 @@ bit-identical), TOP fallback removed. The open docket, in order: -1. **kernel v1.4 close-out** (`kernel.md` §11): five of eight gate - items discharged same-day — the polarity coloring is a THEOREM - (closed-form φ; uniform flip; fire defect `1 − w(erased lp)`; - 1,518 edges verified, zero violations; branch-offset formula - matches all measured offsets; the review's even-pad search is - now a corollary), certificates are canonical (discovery - fixpoint, HAND==AUTO on all eleven programs, validity strictly - beyond Gram — the negative control properly caught), and - amplitudes are exact `ℚ[√2]`. Owed: adversarial review of the - coloring; encoded-fibre ratification (§11.7 draft, covers the - original arrival-lp erasure too); the §11.3 - **weight-conservation lemma** (gate-free readback conserves - `w ≡ slot` — geometric selection of classical data decoheres - intrinsically; gate-mediated routing is the parity-free pattern - class); buried-frame resolution and the two lp invariants - (typed fences + probes in place); +1. **kernel v1.5 → PASS gate** (`kernel.md` §12): the v1.4 round + closed with the coloring a confirmed theorem + (PASS-WITH-CORRECTIONS: gauge-only uniqueness; general parity + law with interior-fire charges) and the amendment ratified — + then the review's C-collapse countermodel + (`λb.λx.λy. b y y` — same-slot arrivals, distinct lps) exposed + the v1-lineage fire's unsound which-path erasure, fixed by the + **v1.5 encoded fire**: conservative decode by default (retain + `D(l)` on the inert `ks` stack; uniform φ-flip), certified + erasure under the corrected fibre condition (retained + `(slot,T,log)` determines erased `(l,RS)`). Twelve programs + total/clean; HNH's coherence is now *earned* through its + certified boundary — the coherence bar is a certified-fibre + phenomenon; `Ccoll` decoheres correctly with Gram clean. + Conservation conjecture refined to mark-free ancestry (reviewer + enumeration: 10,180 closed terms ≤ size 10, 708 ordinary + arrivals, zero mismatches); gate mediation necessary-not- + sufficient. Owed: the conservation lemma; mechanical + terminal-chain check; terminating conservative certificate + analysis (BFS discovery is finite-kernel-only — no all-program + Ω through semantic BFS); lp invariants; 2. the readback controller (full-NF halt sectors; the kernel's root classifier is its 1-bit case) and the `t` gate's `ℤ[ω]` scalars — with time-in-the-core added to the transparency theorem diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 1ff2ad8..ffc4186 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2335,3 +2335,42 @@ unique decoder, boolean pairing, source disjointness, landing/non-δ disjointness) is registered as the checker's growth path. Gate item 2 discharged; six of eight v1.4 items now closed. The original clean-fibre law survives as `E_a = identity`. + +## 2026-08-09 — coloring review: theorem confirmed, fire countermodeled; the v1.5 encoded fire + +The coloring review came back split exactly along the +dynamics/proof line: PASS-WITH-CORRECTIONS for the theorem (all +1,518 edges independently re-verified, the compressed replay row +checked directly, uniqueness demoted to gauge-uniqueness — c and +1+c pass equally — and the parity law generalized with +interior-fire charges), FAIL for the table on a fatal +countermodel: C = λb.λx.λy. b y y collapses both booleans, its two +same-slot outer arrivals carry distinct which-path lps, and the +v1-lineage fire erased them into identical columns — a reachable +non-injectivity sitting outside the battery since v1, found the +moment the encoded-fibre lens existed. The fix is the amendment +made flesh: the **v1.5 encoded fire** retains the decoded +spectator D(l) on a new inert ks stack by default (ticket-bit +redundancy decodes to (gate, instance); everything else retained +whole — and the conservative fire flips φ uniformly, migrating the +parity defect entirely to certified erasure), while certified +boundaries erase (l, RS) under the corrected fibre condition (the +review's catch: the old key included l, which the fire erases — +retained (slot, T, log) must determine the erased tuple). +Consequences measured: Ccoll joins the battery and decoheres with +Gram CLEAN; HNH decohered under the conservative fire and came +back to mass 1 through its own CERTIFIED boundary — the coherence +bar is an earned, certificate-bearing phenomenon now, not a +freebie of unsound erasure; HH stays free (pure ticket pattern); +q-family/p★/everything else unchanged. Canonical certificates +refrozen from the corrected discovery (12/12 reproduction). The +conservation conjecture survives refined: mark-free ancestry ⇒ +w ≡ slot (the countermodel's surfacing lp carries an α in its +slice — virtual ancestry), backed by the reviewer's exhaustive +enumeration (10,180 closed terms ≤ size 10, 708 ordinary +arrivals, zero mismatches), with gate mediation now necessary- +not-sufficient for coherence. Registered as kernel.md §12; the +v1.5→PASS gate lists the conservation lemma, the mechanical +terminal check, the terminating conservative certificate +analysis (semantic-BFS discovery cannot define all-program Ω), +and the lp invariants. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 7410c28..4aa1d9a 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -13,9 +13,16 @@ conjecture: gate-free readback conserves `w ≡ slot` (geometric selection of classical data decoheres intrinsically), with gate-mediated routing as the parity-free pattern class. The encoded-fibre amendment is RATIFIED-WITH-EDITS and applied to -architecture §7 (§11.7). Owed: adversarial review of the coloring -(in flight), the conservation lemma, general lp invariants, the -strengthened validation checklist.** §10 is +architecture §7 (§11.7). The coloring review returned +PASS-WITH-CORRECTIONS on the theorem and FAIL on the v1.4 table — +the C-collapse countermodel exposed the v1-lineage fire erasing +which-path lps unsoundly — fixed by the **v1.5 encoded fire** +(§12): conservative decode by default, certified erasure under the +corrected fibre condition; twelve programs total and clean; HNH's +coherence is now an *earned*, certificate-bearing phenomenon. +Owed: the mark-free-ancestry conservation lemma, terminal-chain +mechanical check, terminating conservative certificate analysis, +lp invariants.** §10 is the v1.3 register. Of the re-review's six gate items: totality on `q`'s graph ✓ (the `replay` rule, derived from the literal visit-3 trace); correct slot-0/slot-1 outer arrivals ✓; instance-indexed @@ -1048,3 +1055,114 @@ checker's growth path. New standing object: the **conservation conjecture** (§11.3) — the sharpened form of "the coherent fragment is the pattern class." + +## 12. The v1.4 review verdict and the v1.5 encoded fire (registered) + +The coloring review (thread `qalc-token-machine`, independent rerun, +2026-08-09) returned **FAIL for the v1.4 transition table** with a +fatal countermodel, while grading the coloring theorem itself +PASS-WITH-CORRECTIONS (all 1,518 edges independently verified, +including the compressed `replay` row directly). + +### 12.1 The C-collapse countermodel + +`C ≡ λb.λx.λy. b y y` maps both booleans to `1̂` non-injectively. +On `p ≡ h (C (h 0̂))`, two reachable outer arrivals share slot 1 +with **different** which-path lps (`w = 1` and `0`); the v1-lineage +fire erased the lp, mapping orthogonal sources onto identical +columns — a reachable column collision (105-state graph, 1 +non-orthogonal pair; the dynamic run hid it only because the +arrivals are one step apart). This was a defect of the fire since +v1, outside the battery until the encoded-fibre lens found it. + +### 12.2 The v1.5 fire: conservative decode by default, certified erasure + +The fire now implements the ratified encoded-fibre amendment +directly: + +- **Conservative (default)**: retain the decoded spectator `D(l)` + on a new inert spectator stack `ks`: a ticket whose bit matches + the slot decodes to `(gate, instance)` — the bit is redundant — + so HH's branches land at equal spectators and interfere free of + any certificate; anything else (real lp, mismatched ticket) is + retained whole, so same-slot arrivals with distinct which-path + data stay orthogonal. `w(D(l)) = w(l)` for retained lps, 0 for + decoded tickets — the conservative fire **flips φ uniformly**; + the parity defect now lives only at certified erasure. +- **Certified**: erase `(l, RS)` entirely — sound iff the corrected + fibre condition holds: within the boundary, the RETAINED key + `(slot, T, log)` determines the ENTIRE erased tuple `(l, RS)` + (the review's correction: the old condition keyed by `l`, which + the fire erases — not a sound local theorem). + +Results (twelve programs — `Ccoll` joins the battery): all total, +zero Gram defects, zero polarity violations, canonical certificates +reproduce 12/12. + +```text +HH 82 mass 1 free coherence (ticket pattern; no cert needed) +HNH 104 mass 1 EARNED coherence: its outer boundary is + certified (slot determines its real lps, + w = 1 both) — the coherence bar is a + certified-fibre phenomenon +Ccoll 143 1/2, 1/2 the countermodel: certification refused at + the collision boundary (same slot, distinct + l); conservative fire keeps the sources + orthogonal — Gram CLEAN, correct physics +q-family unchanged (certified; time-decohered by the + odd offset) +p★, 3coin, negative, selector, lone, dup unchanged +``` + +The theoretical upshot sharpens the coherence economy again: +**pattern-ticket coherence is free; coherence through real plumbing +is earned by exhibiting the encoded fibre** — the certificate is +not an optimization, it is what makes HNH's interference lawful. + +### 12.3 Corrections to §11 claims (review-mandated) + +- **Weight uniqueness is gauge-only.** `w_c(γ_g)=w_c(μ_g)=c`, + `w_c(A_g)=1+c` passes all edges for either `c` (mechanically + confirmed by the reviewer); `ρ` is unconstrained by Run→Run rows. + The coloring is unique after pinning conventions + (`w(A)=1, w(ρ)=0`). +- **General parity law with interior fires**: + `n₀ − n₁ ≡ w(l₀) − w(l₁) + Σ_{F∈branch₀} w(l_F) − Σ_{F∈branch₁} + w(l_F)` — interior gates supply parity corrections, so the + even-pad corollary is limited to fire-free plumbing, and gate + mediation is confirmed as the parity-escape route. +- **Conservation conjecture refined**: the literal gate-free form is + FALSE (the countermodel's surfacing lp has `(slot, w) = (1, 0)` — + its slice contains an α). Viable statement: *along a closed, + fire-free readback whose surfacing lp has entirely ordinary, + mark-free ancestry, its weight equals its canonical boolean exit + slot.* Reviewer's exhaustive enumeration: all 10,180 closed pure + λ-terms of syntax size ≤ 10; 708 ordinary mark-free arrivals; + **zero** weight/slot mismatches. Proof target: the telescoping + enter/return pairing, with the selected variable of the final + Church boolean as the only unpaired segment (distance 2 vs 1). + And the classification claim weakens to necessity: coherent + routing ⊆ routing with virtual ancestry or interior-fire charge — + gate mediation is necessary, not sufficient (`Ccoll` is + gate-mediated and must stay orthogonal). +- **Terminal chains**: to be checked mechanically (2-coloring the + terminal edges), not asserted from unique predecessors. +- **`discover` totality**: the BFS implementation is not the final + canonical mechanism — raw reachability may diverge on untyped + programs, the cap raises instead of returning conservatively, and + the fixpoint bound is unproved. The final mechanism is a + terminating conservative static analysis defaulting to no-pop + (the amendment's computability discipline); the BFS version is + exact and valid on finite kernel graphs only. Consequence, + registered: all-program Ω objects for qALC cannot be defined + through semantic-BFS certificates. + +### 12.4 The standing gate (v1.5 → PASS) + +Fixed this round: the encoded fire (conservative + certified), the +corrected fibre condition, `Ccoll` as a mandatory regression, +canonical certificates refrozen (the discovery output is machine +metadata). Still owed: the mark-free-ancestry conservation lemma; +the mechanical terminal-chain check; the gauge-pinned uniqueness +statement; the terminating conservative certificate analysis; the +lp invariants; H/T cross-fibres; the readback controller. From f8a0875037bc631f0792f2b292f31a0bf00487dd Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 12:32:40 -0400 Subject: [PATCH 027/107] =?UTF-8?q?qalc:=20kernel=20v1.6=20=E2=80=94=20the?= =?UTF-8?q?=20conservation=20theorem;=20PASS=20claimed=20for=20the=20h-fra?= =?UTF-8?q?gment?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Lemma A (attribution ledger, t = k+b+1 mod 2) + the S11.1 coloring give w = exit slot on mark-free fire-free readback; transfer corollary names every escape route (interior-fire charge, VB pattern birth, mark capture). Invariant-level mechanization: 41,272 closed terms, 55,727 surfacings, zero failures, lockstep conformance. Terminal chains, gauge-pinned uniqueness (4/256 = predicted orbit), discover_total (h-Omega conservative reject), guard-rule and (g,i)-aliasing sweeps all discharged. kernel.md S13 registers the PASS claim with typed fences, pending fresh-instance adversarial review. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 45 +++--- docs/ledger/2026-08.md | 40 +++++ docs/quantum-algebraic/kernel.md | 243 ++++++++++++++++++++++++++++--- docs/quantum-algebraic/token.md | 8 +- 4 files changed, 288 insertions(+), 48 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index ec553ca..a93cc98 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -489,29 +489,32 @@ in-session: buried same-instance frames and missing-instance entries are typed errors (both unreachable in the battery — it is bit-identical), TOP fallback removed. +**Kernel v1.6 claims PASS for the h-fragment** (`kernel.md` §13, +2026-08-09, pending fresh-instance adversarial review): the +conservation conjecture is now a **theorem** — an attribution-ledger +lemma (`t ≡ k + b + 1`: every λIAM step is the birth, death, or +transport of exactly one tape/log individual) meets the coloring +(`t ≡ 1 + w(l)`) to give `w ≡ exit slot` on mark-free fire-free +readback, with each hypothesis's failure mode a named mechanism +(interior-fire charge / VB pattern birth / mark capture). Mechanized +at the invariant level: 41,272 closed terms ≤ size 11, 55,727 +surfacings, per-step ledger checks in lockstep conformance with the +uninstrumented machine, zero failures; battery ancestry sweep clean +on all twelve programs. Also discharged mechanically: terminal +chains (in/out-degree 1 everywhere), gauge-pinned uniqueness (the +predicted 4-element orbit is exactly the passing set of all 256 +weight assignments), the terminating conservative certificate +analysis (`discover_total` — total on every program, `h Ω` +conservative-reject witness, frozen-CERTS agreement), and the lp +invariants (six guard rules swept unreachable; zero `(g,i)` +aliasing; lp-at-log-head structural for signature-abstracted +programs). Standing fences, typed: `buried-frame`, literal gate +application, the t-gate reservation. + The open docket, in order: -1. **kernel v1.5 → PASS gate** (`kernel.md` §12): the v1.4 round - closed with the coloring a confirmed theorem - (PASS-WITH-CORRECTIONS: gauge-only uniqueness; general parity - law with interior-fire charges) and the amendment ratified — - then the review's C-collapse countermodel - (`λb.λx.λy. b y y` — same-slot arrivals, distinct lps) exposed - the v1-lineage fire's unsound which-path erasure, fixed by the - **v1.5 encoded fire**: conservative decode by default (retain - `D(l)` on the inert `ks` stack; uniform φ-flip), certified - erasure under the corrected fibre condition (retained - `(slot,T,log)` determines erased `(l,RS)`). Twelve programs - total/clean; HNH's coherence is now *earned* through its - certified boundary — the coherence bar is a certified-fibre - phenomenon; `Ccoll` decoheres correctly with Gram clean. - Conservation conjecture refined to mark-free ancestry (reviewer - enumeration: 10,180 closed terms ≤ size 10, 708 ordinary - arrivals, zero mismatches); gate mediation necessary-not- - sufficient. Owed: the conservation lemma; mechanical - terminal-chain check; terminating conservative certificate - analysis (BFS discovery is finite-kernel-only — no all-program - Ω through semantic BFS); lp invariants; +1. **fresh-instance adversarial review of the v1.6 PASS claim** + (the §13 register: proof, mechanizations, scoping); 2. the readback controller (full-NF halt sectors; the kernel's root classifier is its 1-bit case) and the `t` gate's `ℤ[ω]` scalars — with time-in-the-core added to the transparency theorem diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index ffc4186..afa2743 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2374,3 +2374,43 @@ v1.5→PASS gate lists the conservation lemma, the mechanical terminal check, the terminating conservative certificate analysis (semantic-BFS discovery cannot define all-program Ω), and the lp invariants. + +## 2026-08-09 — kernel v1.6: the conservation theorem; PASS claimed for the h-fragment + +The §12.4 gate is discharged. The centerpiece: the conservation +conjecture is now a **theorem**, split so that each half is short. +Lemma A (attribution ledger): every pure λIAM step is the birth, +death, or transport of exactly one tape/log individual — bullets +via b1/b4/b2/b3, logged positions via var/bt2/arg/bt1, slice +capture and release riding at zero cost as suspension — and the +per-individual step ledger obeys count ≡ B + p while live, so a +k-probe surfacing with b tape bullets takes t ≡ k + b + 1 steps. +Lemma B is §11.1's coloring, already proven: t ≡ 1 + w(l). +Equate: **w(l) ≡ k + b — the exit slot, for booleans**. The +transfer corollary makes the mark-free-ancestry hypothesis do +exactly one job — a captured mark is the only way a probe segment +can cross its own γ boundary, so mark-free fire-free segments are +literally pure runs — and each failure mode is a named mechanism: +interior fires charge the coloring's defect, VB emissions birth a +whole pattern in one step (breaking one-step-one-individual — +why gate routing escapes parity), mark capture breaks closure. +The mechanization checks the LEDGER INVARIANT AT EVERY STEP in +lockstep conformance with the uninstrumented machine: 41,272 +closed terms ≤ size 11 (the ≤ 10 count, 10,180, matches the +reviewer's enumeration exactly), k ∈ {1,2,3}, 55,727 surfacings, +zero failures — and the invariant caught a real endpoint subtlety +within the first 707 terms (lps recirculate over step-born +bullets; the mod-2 identity absorbs it). Battery ancestry sweep: +zero mark-free violations across all twelve programs. The +smaller items all went mechanical: terminal chains in/out-degree +1 everywhere; gauge-pinned uniqueness swept — exactly the +predicted 4-element orbit passes of all 256 weight assignments; +discover_total is the amendment's terminating conservative +analysis (h Ω rejects conservatively; frozen CERTS reproduced); +the six guard rules swept unreachable with the negative control +still caught; zero (g,i) aliasing; lp-at-log-head structural for +signature-abstracted programs. kernel.md §13 claims **PASS for +the h-fragment** with typed fences (buried-frame, literal gate +application, t-gate reservation) — pending the fresh-instance +adversarial round a9 asked for, deliberately threadless so the +reviewer inherits no framing. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 4aa1d9a..7a6db4b 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,28 +1,25 @@ # qALC three-program kernel — v1 -**Status: v1.4 in progress — §11 is the current register. The -polarity coloring is now a THEOREM with a closed form (uniform -flip, fire defect `1 − w(erased lp)`; 1,518 edges checked, zero -violations), the branch-offset formula is verified on all -measured offsets, Codex's even-pad search is a corollary, -certificates are canonical (discovery fixpoint, HAND==AUTO on all -eleven programs, validity strictly beyond Gram — the negative -control is properly caught), amplitudes are exact `ℚ[√2]`, and -the sharpened open object is the §11.3 weight-conservation -conjecture: gate-free readback conserves `w ≡ slot` (geometric -selection of classical data decoheres intrinsically), with -gate-mediated routing as the parity-free pattern class. The -encoded-fibre amendment is RATIFIED-WITH-EDITS and applied to -architecture §7 (§11.7). The coloring review returned -PASS-WITH-CORRECTIONS on the theorem and FAIL on the v1.4 table — -the C-collapse countermodel exposed the v1-lineage fire erasing -which-path lps unsoundly — fixed by the **v1.5 encoded fire** -(§12): conservative decode by default, certified erasure under the -corrected fibre condition; twelve programs total and clean; HNH's -coherence is now an *earned*, certificate-bearing phenomenon. -Owed: the mark-free-ancestry conservation lemma, terminal-chain -mechanical check, terminating conservative certificate analysis, -lp invariants.** §10 is +**Status: v1.6 — §13 is the current register, and it claims PASS +for the h-fragment, pending fresh-instance adversarial review. +The §11.3 conservation conjecture is now a THEOREM (§13.1): an +attribution-ledger lemma (`t ≡ k + b + 1`, proved by +one-step-one-individual accounting) meets the coloring +(`t ≡ 1 + w(l)`) to give `w(l) ≡ exit slot` on mark-free +fire-free readback — mechanized at the invariant level over +41,272 closed terms with zero failures, and every hypothesis's +failure mode is a registered phenomenon (interior fires: the +defect law; VB pattern births: the parity escape; mark capture: +the excluded ancestry). Terminal chains, gauge-pinned uniqueness +(4/256 = the predicted orbit), the terminating conservative +certificate analysis (`discover_total`, `h Ω` witness), and the +lp invariants are all discharged mechanically (§13.2–13.4). +Fences: `buried-frame` (typed, unreached), literal gate +application, the t-gate reservation. Earlier registers: v1.5 +encoded fire §12 (conservative decode by default, certified +erasure — coherence is *earned*, certificate-bearing); v1.4 +coloring/certificates §11; encoded-fibre amendment +RATIFIED-WITH-EDITS, applied to architecture §7 (§11.7).** §10 is the v1.3 register. Of the re-review's six gate items: totality on `q`'s graph ✓ (the `replay` rule, derived from the literal visit-3 trace); correct slot-0/slot-1 outer arrivals ✓; instance-indexed @@ -1166,3 +1163,203 @@ metadata). Still owed: the mark-free-ancestry conservation lemma; the mechanical terminal-chain check; the gauge-pinned uniqueness statement; the terminating conservative certificate analysis; the lp invariants; H/T cross-fibres; the readback controller. + +## 13. v1.6 — the conservation theorem and the PASS claim + +The round that discharges §12.4. Everything below is mechanically +verified in the scratch battery (`conservation.py`, `polarity.py`, +`certify.py`, `suite.py`); no engine code exists, per the §9 gate. + +### 13.1 The conservation theorem (the §11.3 conjecture, proved) + +The proof splits into a step-counting lemma that knows nothing +about weights and the already-proven coloring that converts step +parity into weight parity. + +**Lemma A (attribution ledger).** In a pure λIAM run from a +k-probe start `(pos, D, L₀, •^k · base)` that surfaces at +`(pos′, U, L₀, tape · base)` with the log restored and the base +intact, the step count satisfies + + t ≡ k + b + 1 (mod 2) + +where `b` is the total number of bullets on the surface tape (the +surfacing lp may carry bullets both above and below it — see the +inventory note). *Proof.* Every rule is the birth, death, or +transport of exactly one tape/log **individual** — a bullet or a +logged position: `b1`/`b4` birth a bullet, `b2`/`b3` kill one, +`var` births an lp, `bt2` kills one, `arg`/`bt1` transport one. +Slice capture (during `var`) and slice release (during `bt2`) cost +nothing: cargo is suspended, not stepped. Give each individual `x` +a ledger `count(x)` of the steps attributed to it, `B(x) = 1` iff +step-born (0 for the k probe bullets), and a location parity +`p(x)` (0 on the tape, 1 on the log, frozen under suspension — +capture always takes log entries, release always restores them to +the log, so suspension preserves `p = 1`). The invariant, by +induction over the eight rules: `count(x) ≡ B(x) + p(x)` while +live, and `count(x) ≡ B(x) + 1` once dead or suspended (deaths +occur on the tape, `p = 0`, and add one step). Sum at the surface: +`t = Σ count` ≡ (k − r)·1 [dead probe bullets] + r·0 [surviving +probe bullets] + (b − r)·1 [live step-born bullets] + 1 [the +surfacing lp: step-born, on tape] + 0 [its suspended cargo, +transitively] ≡ k + b + 1, using `−r ≡ r (mod 2)`. ∎ + +**Lemma B (coloring, §11.1).** Every rule flips φ; probe tapes +weigh 0; the surfacing tape weighs `w(l)` (bullets weigh 0). So +`t ≡ φ_end − φ₀ ≡ 1 + w(l)`. + +**Theorem (conservation).** `w(l) ≡ k + b (mod 2)`. For the +boolean protocol (`k = 2`, arrival shapes `l·base` and `•·l·base` +with `b = slot`): **`w(l) ≡ exit slot`**. The `haltI` sector +(`l·•·base`, `b = 1`) gives `w(l) ≡ 1` — the identity's lp weight, +correctly. *Proof.* Equate Lemmas A and B. ∎ + +**Inventory note (found by the mechanization).** The naive +endpoint claim — surface bullets above the lp step-born, below it +probe survivors — is FALSE: lps recirculate tape → log → tape via +`arg`/`bt1`, so the surfacing lp can return on top of step-born +bullets. The ledger handles this because live step-born bullets +contribute 1 *wherever they sit*; only the mod-2 identity +`−r ≡ r` is needed. The per-step assertion caught this within the +first 707 terms. + +**Corollary (kernel transfer — the mark-free-ancestry lemma).** In +a kernel run, consider a probe segment from `(argpos, D, γ·i·L, +•·•·μ_g·T)` to its boundary arrival, and suppose the segment is +fire-free, VB-free, and **mark-free**: no `γ`/`α` is ever captured +into a slice. Then no `var` step reaches past the γ at the log +boundary (capturing it is the only way to cross), so the token +stays inside the probed argument, the frozen suffixes `μ_g·T` and +`γ·i·L` are untouched, and the segment is *literally* a pure λIAM +run of the argument against `•·•·μ` — Lemma A applies, Δφ across +the segment is `1 + w(l)` (same log, same suffixes), and +`w(l) ≡ slot`. Each hypothesis is load-bearing and each failure +mode is a registered phenomenon: an **interior fire** breaks +Lemma B's uniform flip by exactly the fire defect (the §12.3 +interior-fire parity law); a **VB episode** births a whole +`•^{b′+1}·α` pattern in one step, breaking Lemma A's +one-step-one-individual attribution (why pattern routing is the +parity escape); a **captured mark** breaks segment closure and is +precisely the excluded ancestry (why `w(α) = 0` decouples weight +from step count). Gate mediation being *necessary* for coherent +routing is now a theorem-shaped statement: mark-free geometric +readback has `w ≡ slot`, hence odd branch offset, hence intrinsic +decoherence by the §11.2 offset law. + +**Mechanical validation, at the invariant level.** The instrumented +pure machine checks the ledger invariant after *every step* of +*every run*, in lockstep conformance with the uninstrumented +stepper (same rule, same stripped state, asserted each step — +implementation drift is a hard error). Exhaustive sweep over all +closed pure terms: ≤ size 10, **10,180 terms** (independently +matching the reviewer's enumeration count exactly), and ≤ size 11, +**41,272 terms**, probed at k ∈ {1, 2, 3}: **55,727 surfacings, +zero Lemma-A failures, zero theorem failures, zero invariant +violations** (stuck runs validate the invariant on every step too; +Ω-class terms time out at the cap and contribute their prefixes). +Battery cross-check on the gated twelve: every classifier arrival +(gate boundaries and root, both cert modes) classified by +ancestry — **zero mark-free arrivals violate `w ≡ slot`** across +all twelve programs; marked arrivals split both ways, as virtual +ancestry predicts (HH/HNH's earned-coherence tickets among the +`w ≡ slot` equalities, the countermodels among the inequalities). + +### 13.2 Terminal chains and gauge-pinned uniqueness (mechanical) + +**Terminal chains.** Across all twelve programs × both cert modes: +every `RunDone` and `Done` state has in-degree exactly 1 and +out-degree exactly 1 in the reachable graph — zero violations. The +"unique predecessor" property §12.3 demanded be checked is now a +regression, and flip-by-assignment on the linear terminal chains is +well-defined. + +**Uniqueness as a swept theorem.** Parametrize the mark weights by +`v ∈ {0,1}⁸` over `(γ, μ, A, α, ρ, R, K₃, K₂-offset)` (entry +weights are linear in `v`, so each edge carries a profile vector +and assignments are dot products). The full flip/defect law was +evaluated under all 256 assignments over every Run→Run edge of all +twelve programs, both cert modes: **exactly 4 pass**, and they are +exactly the predicted gauge orbit `γ = μ = c`, `A = 1 + c`, +`ρ` free, `α = R = K₃ = K₂-offset = 0`. The rule-derived +constraints (`call`: γ+μ ≡ 0; `anshead`: γ+A ≡ 1; `vvar`: α ≡ 0; +`recall`: R ≡ α; conservative fire flip: K ≡ content) pin +everything except the global gauge `c` and the never-moved `ρ`. +**The coloring is unique after pinning `w(A) = 1`, `w(ρ) = 0`.** + +### 13.3 The terminating conservative certificate analysis + +`discover_total(term, state_cap, round_cap)`: at most `round_cap` +rounds, each one BFS over at most `state_cap` states; any cap hit +or non-convergence returns **no certificate**, which selects the +conservative nontransparent fire everywhere — always sound (the +v1.5 default), possibly suboptimal, exactly as the amendment's +computability discipline sanctions. `U` is therefore total and +well-defined on *every* program; the canonical certificate is +`discover_total` at frozen caps, a deterministic function of the +program fixed at initialization as static metadata. On finite +kernel graphs within the caps it equals the exact fixpoint. +Verified: reproduces the frozen certificates on all twelve; +the totality witness `h Ω` (infinite kernel graph) returns a +conservative reject rather than diverging or raising. The §12.3 +consequence stands unchanged: all-program Ω objects cannot be +defined through semantic-BFS certificates; the budgeted analysis +is the sanctioned mechanism, and its rejections are the price. + +### 13.4 The logged-position invariants + +**Soundness is carried by total typed guards, not by reachability +claims.** Every instance-consulting rule has a typed rejection +(`no-instance`, `alien-ticket`, `buried-frame`, `recall-err`, +`replay-err`, `pop-err`); there is no silent fallback path. On top +of that, now mechanical: across all twelve programs × both cert +modes, **none of the six guard rules is structurally reachable** +(and the negative control — p★ under the wrong certificate — still +reaches `pop-err`, so the check has teeth). + +**lp-at-log-head, scoped structural argument.** For +signature-abstracted programs (gates occur only as the wrapper +application's arguments — the entire program class the architecture +compiles), a gate leaf sits at an `a`-position, and the only rule +that enters an `a`-position going D is `arg`, which pushes the +transported tape head onto the log. When that head is an ordinary +lp it *is* the invoking occurrence's logged position — the +instance, at log head, structurally. When it is not an lp (a +`γ` probing a gate, an `α` in transit), the leaf's `instance()` +finds a non-lp head and rejects typed — never treats it as an +instance. Programs applying a gate literally (`App(Gate, …)`) +fall outside the scope statement and meet the same typed guards. + +**Equal lps = same dynamic copy.** The λIAM-lineage fact the +design imports (a logged position names a dynamic subterm copy; +token.md §2 pins the substrate). Its operational failure mode — +one `(g, i)` naming two different selections — is now a swept +regression: across every reachable state of all twelve programs, +**zero states** hold two instance-keyed entries (α tickets, R +frames) with equal `(g, i)` and different bits. `dup` (two dynamic +instances of one occurrence, distinct slices) remains the built +witness that distinct copies get distinct names. + +### 13.5 The v1.6 scorecard and the PASS claim + +| §12.4 item | Status | +|---|---| +| mark-free-ancestry conservation lemma | **PROVED** (§13.1: ledger + coloring + transfer), invariant-level mechanization, zero failures at ≤ 11 | +| mechanical terminal-chain check | **discharged** (in/out-degree 1, zero violations) | +| gauge-pinned uniqueness | **discharged as a swept theorem** (4/256 = the predicted orbit) | +| terminating conservative certificate analysis | **discharged** (`discover_total`; `h Ω` witness; frozen-CERTS agreement) | +| lp invariants | **discharged** (typed guards + swept unreachability + scoped structural argument + aliasing zero) | +| H/T cross-fibres | **deferred by scope**: the t-gate is structurally reserved (`NotImplementedError`, typed, never silent); cross-fibre exhibition belongs to the readback + t-gate milestone | +| readback controller | **deferred by scope**: next docket phase, not an h-kernel obligation | + +**The PASS claim, stated precisely:** the three-program kernel +gate (token.md §4) is claimed **PASS for the h-fragment** — full +transition table with typed totality; step-indexed HH / H–NOT′–H / +negative-witness traces verified plus nine more programs including +both adversarial countermodels; column-Gram enumeration clean on +every reachable basis; range disjointness via the encoded-fibre +certificates; and the conservation theorem closing the coherent +fragment's characterization. Standing fences, all typed and all +registered: `buried-frame` (unreached, semantics deliberately +unassigned), literal gate application (outside the scope +statement), the t-gate reservation. Pending: fresh-instance +adversarial review of this round. diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index 7891a3f..533feb9 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -389,11 +389,11 @@ substrate's obstruction and the fork reopens. | Item | Status | |---|---| -| Kernel | **v1.4 in progress** (`kernel.md` §11): coloring theorem proved + mechanically verified; canonical certificates (HAND==AUTO ×11, validity beyond Gram); exact `ℚ[√2]` amplitudes; owed: coloring review, encoded-fibre ratification, the conservation lemma, general lp invariants | +| Kernel | **v1.6 — PASS claimed for the h-fragment** (`kernel.md` §13), pending fresh-instance adversarial review: conservation theorem proved (ledger + coloring + transfer) and mechanized at the invariant level (41,272 closed terms, zero failures); terminal chains, gauge-pinned uniqueness (4/256 = predicted orbit), `discover_total`, and the lp invariants all discharged; fences typed and registered (buried-frame, literal gate application, t-gate reservation) | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | -| Transparency criterion | pop rule implemented and Gram-verified, but the review holds it to more: the pop is an **encoded fibre** `E_m\|b,κ⟩ = \|b,F_m(b,κ),κ⟩` (source spectator depends on `b` — the frozen clean-fibre contract needs amending or frames become a decoded coordinate); **Gram ≠ certificate soundness** (our own negative control is the countermodel — validity needs zero reachable `pop-err` + the RS-function property); certificates must be canonical stack-shape predicates of the program, not external fire-position sets | -| Instance identity | **ratified** ("exactly the λIAM structure intended to name exponential copies"); the `dup` probe `(λx. x x)(h 0̂)` verifies copy discrimination; owed as proofs: lp-at-log-head on every valid entry, equal lps = same dynamic copy; TOP fallback removed (typed `no-instance`), buried same-instance frames typed (`buried-frame`), resolution owed | -| Time register | **the coloring is a theorem** (`kernel.md` §11.1–11.3): closed-form φ, uniform flip, fire defect `1 − w(erased lp)`; branch-offset formula verified; even pads a corollary; refined coherence condition = equal erased weights (HNH: w=1 both branches); the sharpened open object is the **weight-conservation conjecture** — gate-free readback conserves `w ≡ slot`, gate-mediated routing is the parity-free class | +| Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §11.7, §12.2, §13.3): the v1.5 fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is pop-err reachability + the RS-function property, strictly beyond Gram (negative control caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness) | +| Instance identity | **ratified and discharged** (`kernel.md` §13.4): lp-at-log-head proved structurally for signature-abstracted programs (only `arg` enters an `a`-position going D); equal-lps-same-copy backed by the swept `(g,i)`-aliasing regression (zero states with one instance naming two selections) plus the `dup` witness; all six guard rules mechanically unreached on the twelve; `buried-frame` stays a typed fence, semantics deliberately unassigned | +| Time register | **the coloring AND the conservation law are theorems** (`kernel.md` §11.1–11.2, §13.1): closed-form φ, uniform flip, certified-erasure defect `1 − w(erased lp)`; branch-offset formula verified; mark-free fire-free readback conserves `w ≡ slot` (proved: attribution ledger + coloring), so geometric selection of classical data decoheres intrinsically and every escape route is a named mechanism (interior-fire charge, VB pattern birth, mark capture) | | L1 arrival-residue determinacy | kernel-verified at `fire`; general proof open | | L2 pop timing / coherence return | confirmed for NOT′ (kernel); selector measured decoherent; mechanism understood via pattern-vs-step | | `call`/`recall`/`replay` structural domain disjointness | guards structural in v1.3 (instance + rs checks, buried-frame typed); formal table presentation still owed | From 6b38273fceefafc603c44c6de7c0ccfed0168a57 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 13:01:04 -0400 Subject: [PATCH 028/107] =?UTF-8?q?qalc:=20v1.6=20fresh=20review=20registe?= =?UTF-8?q?red=20=E2=80=94=20core=20confirmed,=20h-fragment=20PASS=20withd?= =?UTF-8?q?rawn?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The threadless sol-tier round confirmed Lemma A (independent reimplementation), the transfer closure (153k-argument search, zero mark-free escapes), the gauge orbit (15-parameter solve), and discover_total — and corrected the theorem's missing depth term (w = k + b + |pos'| - |pos|; deployed specializations unaffected). The PASS scope was refuted: Q = ((h 0) SEL SEL)(h 0) reaches buried-frame from init with err mass 1 under a valid certificate and clean Gram. Q registered as the thirteenth battery program; validate gains semantic_coverage; mu-kind fire collision closed typed; well-formed-state preservation registered as an obligation. PASS stands for the three-program gate and the twelve sectors; v1.7 = the interleaved re-seek. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 54 +++++++----- docs/ledger/2026-08.md | 38 ++++++++ docs/quantum-algebraic/kernel.md | 147 +++++++++++++++++++++++++------ docs/quantum-algebraic/token.md | 4 +- 4 files changed, 191 insertions(+), 52 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index a93cc98..a53df50 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -489,32 +489,40 @@ in-session: buried same-instance frames and missing-instance entries are typed errors (both unreachable in the battery — it is bit-identical), TOP fallback removed. -**Kernel v1.6 claims PASS for the h-fragment** (`kernel.md` §13, -2026-08-09, pending fresh-instance adversarial review): the -conservation conjecture is now a **theorem** — an attribution-ledger -lemma (`t ≡ k + b + 1`: every λIAM step is the birth, death, or -transport of exactly one tape/log individual) meets the coloring -(`t ≡ 1 + w(l)`) to give `w ≡ exit slot` on mark-free fire-free -readback, with each hypothesis's failure mode a named mechanism -(interior-fire charge / VB pattern birth / mark capture). Mechanized -at the invariant level: 41,272 closed terms ≤ size 11, 55,727 -surfacings, per-step ledger checks in lockstep conformance with the -uninstrumented machine, zero failures; battery ancestry sweep clean -on all twelve programs. Also discharged mechanically: terminal -chains (in/out-degree 1 everywhere), gauge-pinned uniqueness (the -predicted 4-element orbit is exactly the passing set of all 256 -weight assignments), the terminating conservative certificate -analysis (`discover_total` — total on every program, `h Ω` -conservative-reject witness, frozen-CERTS agreement), and the lp -invariants (six guard rules swept unreachable; zero `(g,i)` -aliasing; lp-at-log-head structural for signature-abstracted -programs). Standing fences, typed: `buried-frame`, literal gate -application, the t-gate reservation. +**Kernel v1.6 is proved, reviewed, and scoped** (`kernel.md` §13, +2026-08-09): the conservation conjecture is now a **theorem** — an +attribution-ledger lemma (`t ≡ k + b + 1`: every λIAM step is the +birth, death, or transport of exactly one tape/log individual) +meets the coloring to give `w ≡ k + b + |pos′| − |pos|`, i.e. +`w ≡ exit slot` on mark-free fire-free readback, with each +hypothesis's failure mode a named mechanism (interior-fire charge / +VB pattern birth / mark capture). Mechanized at the invariant +level: 41,272 closed terms ≤ size 11, 55,727 surfacings, per-step +ledger checks in lockstep conformance, zero failures. Also +mechanical: terminal chains, gauge-pinned uniqueness (4/256 = the +predicted orbit), `discover_total` (total on every program, `h Ω` +conservative reject), guard-rule and `(g,i)`-aliasing sweeps. The +**fresh-instance adversarial round confirmed the entire +mathematical core** (Lemma A independently reimplemented; the +transfer closure searched over 153k arguments with zero mark-free +escapes; the gauge orbit re-derived under a 15-parameter solve; +one real correction — the theorem's depth term) **and refuted the +h-fragment PASS scope**: `Q = ((h 0̂) SEL SEL)(h 0̂)` is typed, +h-only, signature-abstracted, and reaches `buried-frame` from init +with err mass 1 under a valid certificate and clean Gram — the +interleaved re-seek is a missing semantic case, not an unreachable +fence. `Q` is the battery's thirteenth program; `validate` now +reports `semantic_coverage`; the μ-kind fire collision is closed +typed. **PASS stands for the three-program formalization gate and +the twelve registered sectors; the h-fragment claim is withdrawn.** The open docket, in order: -1. **fresh-instance adversarial review of the v1.6 PASS claim** - (the §13 register: proof, mechanizations, scoping); +1. **kernel v1.7 — the interleaved re-seek**: give `buried-frame` + semantics (the frame stack's discipline under two live + instances), or characterize statically the fragment excluding + it; plus the well-formed-state subtype + preservation proof + restoring global range disjointness over the raw state type; 2. the readback controller (full-NF halt sectors; the kernel's root classifier is its 1-bit case) and the `t` gate's `ℤ[ω]` scalars — with time-in-the-core added to the transparency theorem diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index afa2743..e32ff42 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2414,3 +2414,41 @@ the h-fragment** with typed fences (buried-frame, literal gate application, t-gate reservation) — pending the fresh-instance adversarial round a9 asked for, deliberately threadless so the reviewer inherits no framing. + +## 2026-08-09 — fresh-instance review: core CONFIRMED, h-fragment PASS withdrawn on the Q witness + +The deliberately threadless sol-tier round did exactly what it was +for. Verdict: FAIL for "PASS for the h-fragment," with the +mathematical core CONFIRMED at every surface — Lemma A's ledger +reimplemented independently (nesting depth 7, genuine lp recapture, +partition airtight), the transfer corollary confirmed via the +reviewer's own clean closure invariant (ordinary lps above γ = +level difference) and a 153k-argument search with zero mark-free +escapes and all 79,840 boundary crossings post-capture, the gauge +orbit re-derived under a broadened 15-parameter solve (slice +coefficient FORCED to 1, path coefficients forced to 1 — stronger +than our sweep), and discover_total's both rejection paths +exercised. One real mathematical correction: the theorem's Lemma B +combination dropped the launch/surfacing depth term — w ≡ k + b + +|pos′| − |pos| — with λ1 probed from its body as the one-step +countermodel; every deployed specialization has the term ≡ 0. +The kill: Q = ((h 0̂) SEL SEL)(h 0̂), typed, h-only, +signature-abstracted, reaches buried-frame from init with err mass +1 while its certificate validates and Gram is clean (basis 332, +zero defects — reproduced exactly before registering). Two live +instances interleave their re-seeks; the v1.3 fence is a missing +semantic case of the h-fragment, and the PASS claim narrows +honestly: the three-program formalization gate and the twelve +registered sectors stand; the h-fragment claim is withdrawn. +Corrections applied in-session: theorem statement fixed (§13.1), +checker docstring fixed, Q registered as the thirteenth battery +program with expected guards, validate now reports guard +reachability + err mass + a semantic_coverage conjunction (Q: +False — the regression proving certificates and Gram can be blind +to semantic failure), the μ-kind fire collision closed typed +(species-mu; reachable graphs bit-identical), and the +well-formed-state subtype + preservation proof registered as the +range-disjointness obligation. v1.7 object: the interleaved +re-seek — buried-frame semantics or a static characterization +excluding it. Five countermodels from five rounds; this one, like +the others, arrived exactly where the design said it was thinnest. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 7a6db4b..279a90c 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,25 +1,31 @@ # qALC three-program kernel — v1 -**Status: v1.6 — §13 is the current register, and it claims PASS -for the h-fragment, pending fresh-instance adversarial review. -The §11.3 conservation conjecture is now a THEOREM (§13.1): an -attribution-ledger lemma (`t ≡ k + b + 1`, proved by -one-step-one-individual accounting) meets the coloring -(`t ≡ 1 + w(l)`) to give `w(l) ≡ exit slot` on mark-free -fire-free readback — mechanized at the invariant level over -41,272 closed terms with zero failures, and every hypothesis's -failure mode is a registered phenomenon (interior fires: the -defect law; VB pattern births: the parity escape; mark capture: -the excluded ancestry). Terminal chains, gauge-pinned uniqueness -(4/256 = the predicted orbit), the terminating conservative -certificate analysis (`discover_total`, `h Ω` witness), and the -lp invariants are all discharged mechanically (§13.2–13.4). -Fences: `buried-frame` (typed, unreached), literal gate -application, the t-gate reservation. Earlier registers: v1.5 -encoded fire §12 (conservative decode by default, certified -erasure — coherence is *earned*, certificate-bearing); v1.4 -coloring/certificates §11; encoded-fibre amendment -RATIFIED-WITH-EDITS, applied to architecture §7 (§11.7).** §10 is +**Status: v1.6 reviewed — §13 is the current register. The +fresh-instance adversarial round (§13.6) returned FAIL for "PASS +for the h-fragment" while CONFIRMING the mathematical core: the +conservation theorem stands with a depth-term correction +(`w(l) ≡ k + b + |pos′| − |pos|`; deployed specializations +unaffected), Lemma A's attribution ledger verified airtight by +independent reimplementation, the transfer corollary confirmed +with the reviewer's own closure invariant and a 153k-argument +search (zero mark-free escapes), the gauge orbit confirmed under +a broadened 15-parameter solve, and `discover_total` confirmed +with both rejection paths exercised. The claim itself was +refuted by `Q = ((h 0̂) SEL SEL)(h 0̂)` — typed, h-only, +signature-abstracted, reaching `buried-frame` from init with err +mass 1 under a valid certificate and clean Gram: the interleaved +re-seek is a MISSING SEMANTIC CASE of the h-fragment, not an +unreachable fence. `Q` is the battery's thirteenth program; +`validate` now carries `semantic_coverage`; the μ-kind fire +collision is closed typed (`species-mu`, bit-identical reachable +graphs); the well-formed-state subtype + preservation proof is a +registered obligation. **PASS holds for the three-program +formalization gate and the twelve registered sectors; the +h-fragment claim is withdrawn; the v1.7 object is buried-frame +semantics or a static characterization excluding it.** Earlier +registers: v1.5 encoded fire §12 (coherence is *earned*, +certificate-bearing); v1.4 coloring/certificates §11; +encoded-fibre amendment applied to architecture §7 (§11.7). §10 is the v1.3 register. Of the re-review's six gate items: totality on `q`'s graph ✓ (the `replay` rule, derived from the literal visit-3 trace); correct slot-0/slot-1 outer arrivals ✓; instance-indexed @@ -1206,13 +1212,25 @@ transitively] ≡ k + b + 1, using `−r ≡ r (mod 2)`. ∎ **Lemma B (coloring, §11.1).** Every rule flips φ; probe tapes weigh 0; the surfacing tape weighs `w(l)` (bullets weigh 0). So -`t ≡ φ_end − φ₀ ≡ 1 + w(l)`. - -**Theorem (conservation).** `w(l) ≡ k + b (mod 2)`. For the -boolean protocol (`k = 2`, arrival shapes `l·base` and `•·l·base` -with `b = slot`): **`w(l) ≡ exit slot`**. The `haltI` sector -(`l·•·base`, `b = 1`) gives `w(l) ≡ 1` — the identity's lp weight, -correctly. *Proof.* Equate Lemmas A and B. ∎ +`t ≡ φ_end − φ₀ ≡ (|pos′| − |pos|) + 1 + w(l)` — the depth +difference between launch and surfacing positions is part of φ +and does NOT vanish in general (fresh-review correction: the +first §13.1 draft dropped it, and `λ1` probed from its body +position surfaces at the root in one `var` step with `w = 1`, +refuting the depth-free combination). + +**Theorem (conservation).** +`w(l) ≡ k + b + |pos′| − |pos| (mod 2)`. Every deployed +specialization launches and surfaces at the same position +(the root protocol at ε; boundary probes at the argument +position), where the depth term vanishes: `w(l) ≡ k + b`, so for +the boolean protocol (`k = 2`, arrival shapes `l·base` and +`•·l·base` with `b = slot`): **`w(l) ≡ exit slot`**. The `haltI` +sector (`l·•·base`, `b = 1`) gives `w(l) ≡ 1` — the identity's lp +weight, correctly. *Proof.* Equate Lemmas A and B. ∎ (Lemma A +itself is position-blind and needed no correction; the reviewer +confirmed it independently, including nested capture to depth 7 +and genuine lp recapture.) **Inventory note (found by the mechanization).** The naive endpoint claim — surface bullets above the lp step-born, below it @@ -1363,3 +1381,78 @@ registered: `buried-frame` (unreached, semantics deliberately unassigned), literal gate application (outside the scope statement), the t-gate reservation. Pending: fresh-instance adversarial review of this round. + +### 13.6 The fresh-instance review verdict (registered) — the h-fragment claim WITHDRAWN + +A deliberately threadless sol-tier review (2026-08-09, zero +inherited framing, full sources + rerun capability) returned: +**FAIL for "PASS for the h-fragment"; the mathematical core +CONFIRMED; the three-program formalization gate and the twelve +registered sectors stand.** Every advertised number was +independently reproduced. The verdict, by attack surface: + +- **Lemma A: CONFIRMED-SOUND.** The eight-rule attribution + partition verified airtight by independent trace scanning — + nesting depth 7 and genuine lp recapture observed, suspension + parity preserved, no duplicated individuals. +- **The theorem as first written: REFUTED, repaired in place.** + The Lemma B combination dropped the launch/surfacing depth term + `|pos′| − |pos|`; `λ1` probed from its body position is a + one-step counterexample. Corrected statement above (§13.1); all + deployed specializations have the term ≡ 0 and are unaffected. + A matching stale formula in the checker's docstring + (`(k−r)+m+1`, false when step-born bullets sit below the lp) is + fixed; the implemented `k+b+1` was already correct. +- **Transfer corollary: CONFIRMED-SOUND**, with "literally a pure + run" tightened to "rule-for-rule isomorphic after stripping + frozen prefixes/suffixes." The reviewer supplied the closure + invariant in its clean form — ordinary lps above γ = + level(path) − level(argpos) — and searched 41,272 closed plus + 111,508 open arguments under up to three enclosing binders: + zero mark-free escapes; all 79,840 boundary crossings occurred + after γ capture. +- **Gauge sweep: CONFIRMED-SOUND and strengthened.** Broadened to + 15 parameters (lp constant, six path coefficients, slice + coefficient, the eight mark weights): the slice coefficient is + forced to 1, the lp constant to 0, all path coefficients to 1; + rank 13, exactly the four predicted solutions. Uniqueness is + hereby scoped to the natural local additive family, explicitly. +- **`discover_total`: CONFIRMED-SOUND.** Both rejection paths + executable (`round_cap=1` on HH → None; `h Ω` → state cap); + "canonical" wording fixed to "the deterministic result at + frozen caps." +- **PASS scoping: REFUTED —** `Q = ((h 0̂) SEL SEL)(h 0̂)`, + `SEL = λb. b 1̂ 0̂`: typed, h-only, signature-abstracted, and it + reaches `buried-frame` from init with **err mass 1** while its + certificate validates and Gram is clean (basis 332, zero + defects, zero aliasing — reproduced exactly). Two live + instances interleave their re-seeks; the v1.3 fence is a + **missing semantic case of the h-fragment**, not an unreachable + corner. `Q` is registered as the battery's thirteenth program + (`buried`, expected guards `{buried-frame}`, expected dynamics + err 1) and is the program that withdraws the h-fragment claim. +- **Range disjointness over the raw state type: GAP.** Two + collision pairs among unrestricted `Run` states (a `vvar` + source and a `replay` source sharing a target; fire sources + differing only in μ-kind). The μ-kind collision is closed — the + fire now demands the probe frame's gate match the boundary γ + (typed `species-mu`; bit-identity on all reachable graphs + verified). The `vvar`/`replay` pair is excluded by the intended + reachable-state invariants; making the well-formed configuration + subtype explicit, with a preservation proof, is now a registered + obligation — global range disjointness is claimed only over + well-formed states until then. +- **Validation blindness: fixed.** `validate` now reports guard + reachability, `(g,i)` aliasing, and dynamic err mass, and its + `semantic_coverage` verdict is their conjunction — `Q` is the + regression proving a valid certificate and clean Gram can + coexist with total semantic failure. + +**Standing after the round:** PASS holds for the three-program +formalization gate and the twelve coherent/decoherent sectors; +the h-fragment claim is withdrawn with `Q` as the boundary +witness. The v1.7 object is the interleaved re-seek: give +`buried-frame` semantics (the frame stack's discipline under two +live instances), or characterize statically the fragment that +excludes it — and prove the well-formed-state preservation that +restores global range disjointness. diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index 533feb9..3f23aa8 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -389,10 +389,10 @@ substrate's obstruction and the fork reopens. | Item | Status | |---|---| -| Kernel | **v1.6 — PASS claimed for the h-fragment** (`kernel.md` §13), pending fresh-instance adversarial review: conservation theorem proved (ledger + coloring + transfer) and mechanized at the invariant level (41,272 closed terms, zero failures); terminal chains, gauge-pinned uniqueness (4/256 = predicted orbit), `discover_total`, and the lp invariants all discharged; fences typed and registered (buried-frame, literal gate application, t-gate reservation) | +| Kernel | **v1.6 reviewed** (`kernel.md` §13.6): the mathematical core CONFIRMED by a fresh-instance adversarial round (conservation theorem with the depth-term correction; Lemma A independently reimplemented; transfer closure searched over 153k arguments; gauge orbit re-derived at 15 parameters; `discover_total` both rejection paths) — but the h-fragment PASS **withdrawn**: `Q = ((h 0̂) SEL SEL)(h 0̂)` reaches `buried-frame` from init with err mass 1 under a valid certificate and clean Gram. PASS stands for the three-program gate and the twelve registered sectors; v1.7 = buried-frame semantics or a static exclusion, plus the well-formed-state preservation proof | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §11.7, §12.2, §13.3): the v1.5 fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is pop-err reachability + the RS-function property, strictly beyond Gram (negative control caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness) | -| Instance identity | **ratified and discharged** (`kernel.md` §13.4): lp-at-log-head proved structurally for signature-abstracted programs (only `arg` enters an `a`-position going D); equal-lps-same-copy backed by the swept `(g,i)`-aliasing regression (zero states with one instance naming two selections) plus the `dup` witness; all six guard rules mechanically unreached on the twelve; `buried-frame` stays a typed fence, semantics deliberately unassigned | +| Instance identity | **ratified; naming discharged, interleaving OPEN** (`kernel.md` §13.4, §13.6): lp-at-log-head proved structurally for signature-abstracted programs; equal-lps-same-copy backed by the swept `(g,i)`-aliasing regression plus the `dup` witness. But `buried-frame` is NOT an unreachable fence: the fresh review's `Q = ((h 0̂) SEL SEL)(h 0̂)` reaches it from init (err mass 1, typed, total) — two live instances interleaving re-seeks is the v1.7 design object | | Time register | **the coloring AND the conservation law are theorems** (`kernel.md` §11.1–11.2, §13.1): closed-form φ, uniform flip, certified-erasure defect `1 − w(erased lp)`; branch-offset formula verified; mark-free fire-free readback conserves `w ≡ slot` (proved: attribution ledger + coloring), so geometric selection of classical data decoheres intrinsically and every escape route is a named mechanism (interior-fire charge, VB pattern birth, mark capture) | | L1 arrival-residue determinacy | kernel-verified at `fire`; general proof open | | L2 pop timing / coherence return | confirmed for NOT′ (kernel); selector measured decoherent; mechanism understood via pattern-vs-step | From dc1030839ae3e04b0a3c2bcb40082b14349499fe Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 13:44:57 -0400 Subject: [PATCH 029/107] =?UTF-8?q?qalc:=20kernel=20v1.7=20=E2=80=94=20the?= =?UTF-8?q?=20replay=20record;=20WF=20subtype;=20h-fragment=20PASS=20re-cl?= =?UTF-8?q?aimed=20(audit-gated)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Q's trace showed frames accumulate as duplicates: the frame is a RECORD keyed by instance, not a stack entry. recall idempotent (frame-conflict typed), replay deep keyed lookup, rs canonical, buried-frame dissolved. Twelve bit-identical; Q heals to pre-predicted physics; stress set (weave/hweave/qq) all predicted then measured. WF subtype: six invariants, reachable within WF over 9,314 states, both v1.6 collisions closed. Certified-erasure cargo conditions: gamma-free enforced (zero cert changes), alpha-cargo scoped as a compile-time obligation (HNH's coherence depends on it). Fresh-context independent audit gates the claim. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 28 +++++- docs/ledger/2026-08.md | 34 +++++++ docs/quantum-algebraic/kernel.md | 151 ++++++++++++++++++++++++++++++- docs/quantum-algebraic/token.md | 4 +- 4 files changed, 209 insertions(+), 8 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index a53df50..5d8ccb5 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -516,13 +516,31 @@ reports `semantic_coverage`; the μ-kind fire collision is closed typed. **PASS stands for the three-program formalization gate and the twelve registered sectors; the h-fragment claim is withdrawn.** +**Kernel v1.7 is built and verified** (`kernel.md` §14, +2026-08-09): the replay RECORD gives the interleaved re-seek its +semantics — `recall`'s frame push is idempotent (the record is a +function of the instance; conflicting bits are a typed +`frame-conflict`), `replay` is a deep keyed lookup, the record set +is canonically sorted, and the `buried-frame` error class is +dissolved. The review's `Q` heals to physics predicted before +measurement ({1/2, 1/2}, support 4, certificate unchanged, +`semantic_coverage: True`); the twelve stay bit-identical; three +pointed stressors (`weave`, `hweave`, `qq` — three coins, +double-crossed re-seeks, support 8) all land on predicted +marginals. The WF subtype (six invariants; reachable ⊆ WF over +9,314 states; per-rule preservation) closes the v1.6 +range-disjointness gap — both review collisions dead (W4 excludes +the vvar source; `species-mu` types the μ-kind pair). Certified +erasure got its cargo conditions: γ-free cargo enforced in +certificate admission (zero changes), suspended-α cargo (HNH's +earned coherence depends on it) scoped under a named compile-time +obligation. The h-fragment PASS is re-claimed, **gated on a +fresh-context independent audit**. + The open docket, in order: -1. **kernel v1.7 — the interleaved re-seek**: give `buried-frame` - semantics (the frame stack's discipline under two live - instances), or characterize statically the fragment excluding - it; plus the well-formed-state subtype + preservation proof - restoring global range disjointness over the raw state type; +1. **the fresh-context independent audit of the v1.7 h-fragment + claim** (in flight; verdict to be registered in §14); 2. the readback controller (full-NF halt sectors; the kernel's root classifier is its 1-bit case) and the `t` gate's `ℤ[ω]` scalars — with time-in-the-core added to the transparency theorem diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index e32ff42..e584721 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2452,3 +2452,37 @@ range-disjointness obligation. v1.7 object: the interleaved re-seek — buried-frame semantics or a static characterization excluding it. Five countermodels from five rounds; this one, like the others, arrived exactly where the design said it was thinnest. + +## 2026-08-09 — kernel v1.7: the replay record; the WF subtype; h-fragment PASS re-claimed + +The interleaved re-seek round, run autonomously per a9's standing +instruction (audit-gated). The Q trace overturned the natural +design before it was built: the buried states hold the same +instance's frame TWICE — v1.3's replay/recall cycle accumulates +duplicates — so the frame was never a stack entry but a RECORD of +the instance's selection. v1.7 makes the structure match: recall's +push is idempotent (bit conflict = typed frame-conflict), replay +is a deep keyed lookup, rs is canonically sorted, and buried-frame +ceases to exist as an error class. The twelve are bit-identical; +Q heals to physics written down before running it ({1/2,1/2}, +support 4, same certificate, semantic_coverage True); the stress +set lands every prediction — weave, hweave (C-collapse holding +across an interleaving), and qq (Q nested in Q: three coins, +support 8, basis 2,192). The WF subtype makes the v1.6 +range-disjointness gap a theorem-shaped story: six invariants, +reachable ⊆ WF over 9,314 states, per-rule preservation, and both +review collisions dead (the vvar source violates W4; species-mu +types the μ-kind pair). Two lessons worth the ledger: (1) the +first W5 draft produced 460 false violations that were all the +same shape — captured γs are SUSPENDED cargo, the conservation +ledger's concept resurfacing as a machine invariant, and instance +keys are frozen names that must never be counted; (2) the W5 lens +exposed a question v1.5 never posed — certified erasure deletes +slice cargo, so γ-free cargo is now admission condition (d) (zero +certificate changes, measured), while suspended-α erasure is +PERMITTED because HNH's earned coherence depends on it, under a +named scoped condition (no post-erasure re-seek; else the v1.2 +double-fire class returns) registered as a compile-time obligation +for the compilation theorem. h-fragment PASS re-claimed, gated on +the fresh-context independent audit a9 asked for; verdict lands in +§14. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 279a90c..5fa79eb 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,15 @@ # qALC three-program kernel — v1 -**Status: v1.6 reviewed — §13 is the current register. The +**Status: v1.7 — §14 is the current register: the replay RECORD +(idempotent recall, deep keyed replay, canonical order) heals the +`Q` countermodel to its predicted physics and dissolves the +`buried-frame` error class; the WF subtype (six invariants, +reachable ⊆ WF over 9,314 states, per-rule preservation) closes +the range-disjointness gap; certified-erasure cargo conditions +measured and registered (γ-free locally enforced; α-cargo scoped +as a compile-time obligation). Sixteen-program battery total and +clean. The h-fragment PASS is re-claimed, gated on a fresh-context +independent audit.** Previous register — v1.6 (§13): the fresh-instance adversarial round (§13.6) returned FAIL for "PASS for the h-fragment" while CONFIRMING the mathematical core: the conservation theorem stands with a depth-term correction @@ -1456,3 +1465,143 @@ witness. The v1.7 object is the interleaved re-seek: give live instances), or characterize statically the fragment that excludes it — and prove the well-formed-state preservation that restores global range disjointness. + +## 14. v1.7 — the replay record, the WF subtype, and the healed h-fragment + +The interleaved re-seek round. Everything below is mechanically +verified in the scratch battery (`kernel.py`, `suite.py`, `wf.py`, +`certify.py`, `conservation.py`, `polarity.py`); no engine code +exists, per the §9 gate. The h-fragment PASS is RE-CLAIMED at the +end, gated on a fresh-context independent audit. + +### 14.1 The Q trace, and what it overturned + +Tracing `Q` to its `buried-frame` states gave the design its +ground truth — and refuted the natural first hypothesis. The +buried configurations hold **the same instance's frame twice** +(coin1's record duplicated, buried under coin2's): v1.3's re-seek +cycle *accumulates* — each `replay` re-emits a ticket, and each +ticket's later `recall` pushes another identical frame. The frame +was never a stack entry; it is a **record of the instance's +selection**, a function of the instance. The v1.7 rules make the +data structure match the semantics: + +- **`recall` (amended):** the frame push is **idempotent** — if a + same-`(g,i)` record exists, re-recording is a no-op; if it + exists with a *different bit*, that is the copy-identity failure + and a new typed error `frame-conflict`. The record set `rs` is + kept canonically sorted: state identity must not depend on the + order interleaved re-seeks happened to record in. +- **`replay` (amended):** deep keyed lookup — the unique + same-`(g,i)` record *wherever it sits*. LIFO position was never + semantic; the v1.3 head-only guard was conservatism awaiting a + literal trace, which `Q` supplied. **The `buried-frame` error + class no longer exists.** + +### 14.2 Results + +The **twelve are bit-identical** — every basis count, marginal, +support, and halt time unchanged (interleaving never occurs +there, so idempotency, deep lookup, and canonical order are all +invisible). `Q` (battery name `buried`) heals to exactly the +physics predicted before measurement: **basis 432, Gram clean, +`{halt0: 1/2, halt1: 1/2}`, support 4, t = 141** — coin1 consumed +non-injectively (two SEL occurrences), each branch running +geometric selection on coin2: four decohered terminals at 1/4. +Its certificate is UNCHANGED (`ffbbfffa` reproduces) and it now +validates with `semantic_coverage: True`. The stress set, each +predicted then measured: `weave` (interleaving through +wire-identities: 1/2 + 1/2, support 4), `hweave` (an outer gate +interrogating a woven core — the C-collapse class holds across an +interleaving: 1/2 + 1/2, support 4), `qq` (Q nested in Q's +argument: three coins, double-crossed re-seeks, **support 8**, +1/2 + 1/2, basis 2,192). All sixteen: zero stuck / non-unit / +non-orthogonal, zero guard rules reached, zero `(g,i)` aliasing; +the coloring, terminal chains, gauge orbit, `discover_total` +agreement, and the conservation battery all re-verified over the +sixteen; the negative control still catches `pop-err`. + +### 14.3 The well-formed configuration subtype + +`WF(term, s)`, six invariants — the domain the unitarity claims +quantify over: + +- **W1** log discipline: `|log| = level(path)` — every log entry + corresponds to one `a`-step. +- **W2** record uniqueness + canonicity: at most one frame per + `(g, i)`; `rs` canonically sorted. +- **W3** bit coherence: all instance-keyed entries with one + `(g, i)` carry one bit. +- **W4** first-interrogation exclusivity: a vb-active state at + instance `i` holds no `i`-frame and no `i`-ticket — forced by + the guard chain (ticket → `recall`, frame → `replay`, neither + reaches `call` → fire → `anshead` → vb). +- **W5** probe pairing: deep-counted γ (through slices and the + fire's retained `K(l)` records) = μ(tape) + answer + tokens(tape). A γ captured into a slice is **suspended cargo** + — the conservation ledger's concept — still in flight; its + probe cannot fire until `bt2` releases it. Ticket/frame + instance *keys* are frozen names, never counted (the live + original is accounted where it lives; keys would ghost-count + stale slices). The first, shallow draft of W5 produced 460 + false violations, all the same shape — the sweep taught the + invariant its own suspension structure. +- **W6** exactly one ρ, at the tape bottom. + +**Reachable ⊆ WF**: verified exhaustively — 9,314 Run-state +checks across all sixteen programs, both certificate modes, zero +violations; init is WF, so the sweep validates preservation on +every reachable edge. Per-rule preservation is by inspection: +classical rules move log/level in lockstep (W1) and +suspend/release γs in matched pairs (W5); `call` adds γ + μ +together; the fire consumes μ and mints the answer token +(retaining `l`'s cargo in `ks` — deep count preserved); +`recall`/`replay` touch only the record set under W2–W4's +discipline. + +**Collision closure.** The v1.6 review's two raw-state column +collisions are both dead: the `vvar`/`replay` pair because its +`vvar` source **violates W4** (holding its own instance's frame), +and the WF-repaired source's target then differs from the replay +target in `rs` content; the μ-kind pair because `species-mu` +types the mismatched fire away (no shared targets). Global range +disjointness is claimed over WF states, with reachable ⊆ WF +mechanical and the preservation argument registered. + +### 14.4 Certified erasure and suspended cargo (two conditions) + +The W5 lens exposed a soundness question v1.5 never posed: a +certified erasure deletes the arrival lp *with its slice cargo*. +Measured across all sixteen certified boundaries: **zero γ-cargo +erasures** — and the admission condition (d), *erased cargo must +be γ-free*, is now part of `transparent()` (a certified erasure +of an in-flight probe's γ would break W5: its μ survives, +unpaired). Zero certificate changes. **Suspended α cargo is +deliberately permitted**: HNH's earned coherence *depends* on +erasing captured ticket copies (two of its three certified +arrivals carry α cargo, measured). Its soundness condition is +scoped and named: **no post-erasure re-seek of the erased +ticket's instance** — a re-seek would find neither ticket nor +frame and fresh-`call` into a second fire (the v1.2 double-fire +class). In HNH the α-cargo erasures are terminal interrogations, +so the condition holds; in general it is a reachability property, +not a local stack shape, and is registered as a **compile-time +obligation for the compilation theorem** (the compiler certifies +only boundaries whose erased-ticket instances are never +re-interrogated). The fresh audit adjudicates whether this +scoping is adequate. + +### 14.5 The v1.7 claim + +**PASS for the h-fragment, re-claimed**: the `Q` countermodel is +healed with the physics predicted in advance; the sixteen-program +battery (twelve sectors + the review witness + three pointed +interleaving stressors) is total, Gram-clean, and +marginal-correct; the WF subtype closes the review's range +disjointness gap with reachable ⊆ WF mechanical; and the +certified-erasure cargo conditions are measured, one closed +locally and one scoped and registered. Standing fences, typed: +literal gate application, the t-gate reservation, and the α-cargo +compile-time obligation. This claim is **gated on a fresh-context +independent audit** (a9's instruction for the round); the audit +verdict will be registered here. diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index 3f23aa8..5c58d73 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -389,10 +389,10 @@ substrate's obstruction and the fork reopens. | Item | Status | |---|---| -| Kernel | **v1.6 reviewed** (`kernel.md` §13.6): the mathematical core CONFIRMED by a fresh-instance adversarial round (conservation theorem with the depth-term correction; Lemma A independently reimplemented; transfer closure searched over 153k arguments; gauge orbit re-derived at 15 parameters; `discover_total` both rejection paths) — but the h-fragment PASS **withdrawn**: `Q = ((h 0̂) SEL SEL)(h 0̂)` reaches `buried-frame` from init with err mass 1 under a valid certificate and clean Gram. PASS stands for the three-program gate and the twelve registered sectors; v1.7 = buried-frame semantics or a static exclusion, plus the well-formed-state preservation proof | +| Kernel | **v1.7** (`kernel.md` §14): the replay RECORD — recall idempotent, replay a deep keyed lookup, `rs` canonically sorted, `buried-frame` dissolved — heals `Q` to its pre-predicted physics ({1/2, 1/2}, support 4, same certificate, `semantic_coverage: True`); twelve bit-identical; stress set (`weave`/`hweave`/`qq`) all predicted-then-measured; the WF subtype (six invariants, reachable ⊆ WF over 9,314 states) closes the v1.6 range-disjointness gap; certified-erasure cargo conditions measured and registered. **h-fragment PASS re-claimed, gated on a fresh-context independent audit** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §11.7, §12.2, §13.3): the v1.5 fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is pop-err reachability + the RS-function property, strictly beyond Gram (negative control caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness) | -| Instance identity | **ratified; naming discharged, interleaving OPEN** (`kernel.md` §13.4, §13.6): lp-at-log-head proved structurally for signature-abstracted programs; equal-lps-same-copy backed by the swept `(g,i)`-aliasing regression plus the `dup` witness. But `buried-frame` is NOT an unreachable fence: the fresh review's `Q = ((h 0̂) SEL SEL)(h 0̂)` reaches it from init (err mass 1, typed, total) — two live instances interleaving re-seeks is the v1.7 design object | +| Instance identity | **ratified and discharged, interleaving included** (`kernel.md` §13.4, §14): lp-at-log-head structural for signature-abstracted programs; equal-lps-same-copy backed by the `(g,i)`-aliasing regression, the `dup` witness, and now the `frame-conflict` typed guard; the interleaved re-seek has semantics via the replay record — `Q`, `weave`, `hweave`, and `qq` all total, clean, and physical | | Time register | **the coloring AND the conservation law are theorems** (`kernel.md` §11.1–11.2, §13.1): closed-form φ, uniform flip, certified-erasure defect `1 − w(erased lp)`; branch-offset formula verified; mark-free fire-free readback conserves `w ≡ slot` (proved: attribution ledger + coloring), so geometric selection of classical data decoheres intrinsically and every escape route is a named mechanism (interior-fire charge, VB pattern birth, mark capture) | | L1 arrival-residue determinacy | kernel-verified at `fire`; general proof open | | L2 pop timing / coherence return | confirmed for NOT′ (kernel); selector measured decoherent; mechanism understood via pattern-vs-step | From 38711aeb72f6589de29b58b103e4f3d1fc058e29 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 14:28:01 -0400 Subject: [PATCH 030/107] =?UTF-8?q?qalc:=20v1.8=20=E2=80=94=20audit=20#1?= =?UTF-8?q?=20FAIL=20registered;=20decode=20records=20+=20refire=20guard;?= =?UTF-8?q?=20W7;=20typed=20fragment?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fresh audit #1 (sol-tier, threadless): physics CONFIRMED-SOUND, but two countermodels (WF fire collision; Pα post-erasure re-seek under an admitted certificate), an instance-key injectivity gap, a fuzzed duplicate fresh call via alpha-decode, and honesty defects. All reproduced locally before correction. v1.8 (kernel.md §15): certified erasure leaves branch-consistent decode records; the refire guard makes one-fire-per-instance a runtime machine invariant (v1.7's alpha-cargo compile-time obligation discharged and deleted); discover_total validates its fixpoint and refuses unsound certificates (Pα heals to {1/4, 3/4} via the conservative fallback); W7 fibre coherence + mechanized range disjointness; typecheck.py = the typed h-only fragment judgment (15/18; q itself untypable — qprime is its repair). The sixteen stay marginal-, support-, and basis-identical. Auditor's reproducer reruns clean; fuzz 250/250. PASS re-claim gated on fresh audit #2. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 29 ++++- docs/ledger/2026-08.md | 45 ++++++++ docs/quantum-algebraic/kernel.md | 191 +++++++++++++++++++++++++++++-- docs/quantum-algebraic/token.md | 6 +- 4 files changed, 256 insertions(+), 15 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 5d8ccb5..1b0eaeb 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -537,10 +537,35 @@ earned coherence depends on it) scoped under a named compile-time obligation. The h-fragment PASS is re-claimed, **gated on a fresh-context independent audit**. +**Fresh audit #1 returned FAIL; kernel v1.8 is the correction +round** (`kernel.md` §14.6, §15, 2026-08-09). The audit confirmed +the Q/weave/hweave/qq physics by independent recomputation but +landed two countermodels (a WF-but-colliding certified fire; `Pα`, +a typed in-fragment program whose admitted certificate erased an +α-cargo instance later re-sought — silently stuck), plus a fuzzed +duplicate fresh call through the fire's α-decode, an injectivity +gap, and honesty defects. v1.8 answers with one mechanism: decode +records at certified erasure + a `refire` guard in the fresh-call +arm make **one-fire-per-instance a runtime machine invariant** +(the α-cargo compile-time obligation is discharged and deleted); +`discover_total` now validates its own fixpoint and refuses +unsound certificates (`Pα` and the fuzz program fall back to the +conservative plain run — `Pα`'s canonical dynamics is its correct +physics, {1/4, 3/4}); W7 fibre coherence joins the WF subtype and +the range-disjointness theorem is mechanized; `typecheck.py` +supplies the typed h-only fragment judgment (15/18 typable — `q` +itself is out, the wire imbalance `qprime` fixed; `dup` and the +fuzz program out by construction). The sixteen prior programs are +marginal-, support-, and **basis-identical** (decode records are +branch-consistent constants — a bijection on the post-fire +subgraph, measured). The auditor's own reproducer reruns clean: +fuzz 250/250 no violation. The v1.2→v1.7 basis drift overclaim is +corrected and owned (§15.4). + The open docket, in order: -1. **the fresh-context independent audit of the v1.7 h-fragment - claim** (in flight; verdict to be registered in §14); +1. **fresh-context independent audit #2 of the v1.8 h-fragment + claim** (next action; verdict to be registered in §15.5); 2. the readback controller (full-NF halt sectors; the kernel's root classifier is its 1-bit case) and the `t` gate's `ℤ[ω]` scalars — with time-in-the-core added to the transparency theorem diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index e584721..41620ac 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2486,3 +2486,48 @@ double-fire class returns) registered as a compile-time obligation for the compilation theorem. h-fragment PASS re-claimed, gated on the fresh-context independent audit a9 asked for; verdict lands in §14. + +## 2026-08-09 — qALC kernel v1.8: audit #1 FAIL, one mechanism answers it + +Fresh audit #1 (threadless sol-tier Codex, the round a9's +instruction gates on) returned FAIL — the best kind: all four +interleaving-physics results CONFIRMED-SOUND by independent +recomputation, and the failures precise. Two countermodels (a +WF-but-colliding certified fire; Pα — typed, in-fragment, whose +admitted certificate erased an α-cargo instance later re-sought: +silently STUCK at t=180 where the plain run computes {1/4, 3/4}), +an injectivity gap for instance keys, honesty defects (the +"twelve bit-identical" overclaim — the v1.2→v1.7 basis drift on +negative/selector/pstar is real and marginal-identical; an "all +twelve" print; no type checker; kernel.md absent from the pack), +and — surfaced by their own fuzz at candidate 16 — a duplicate +fresh call through the fire's α-decode. Both countermodels and +the fuzz hit reproduced locally before any correction (standing +pattern). The diagnosis collapsed three coats into one disease: +selections erased with no recoverable record, re-seeks answered +by a silent second coin. v1.8 (kernel.md §15): certified erasure +leaves decode records ('K', g, i) for every erased ticket and +popped frame — branch-consistent constants (functions of the +retained fibre), so coherence is untouched and the sixteen stay +marginal-, support-, and BASIS-identical (a bijection on the +post-fire subgraph, measured not argued); the refire guard types +out any fresh call of a dead-storage instance, making +one-fire-per-instance a runtime machine invariant and discharging +the v1.7 compile-time obligation outright; discover_total +validates its own fixpoint (Pα and the fuzz program are refused — +their canonical dynamics is the conservative plain run, and Pα's +is exactly its physics); W7 fibre coherence joins WF and the +range-disjointness theorem is mechanized (the audit's collision +pair: W7-excluded AND target-disjoint, two independent layers); +typecheck.py supplies the judgment the claims quantify over — +algorithm W, gates as the polymorphic signature ∀a. Ba→Ba fresh +per occurrence — and finds 15/18 typable with a real discovery: +q ITSELF is untypable (E vs N wire imbalance — precisely what +qprime was built to repair), so the honest fragment table now +carries q as battery-only. The injectivity gap dissolves rather +than closes: every aliasing manifestation is typed +(frame-conflict / alien-ticket / refire) or value-correct, so lp +uniqueness downgrades to a completeness conjecture outside the +soundness perimeter. The auditor's reproducer reruns clean under +v1.8: collision targets disjoint, Pα scope clean, fuzz 250/250 no +violation. PASS re-claim gated on fresh audit #2. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 5fa79eb..b98e8be 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,15 +1,21 @@ # qALC three-program kernel — v1 -**Status: v1.7 — §14 is the current register: the replay RECORD -(idempotent recall, deep keyed replay, canonical order) heals the -`Q` countermodel to its predicted physics and dissolves the -`buried-frame` error class; the WF subtype (six invariants, -reachable ⊆ WF over 9,314 states, per-rule preservation) closes -the range-disjointness gap; certified-erasure cargo conditions -measured and registered (γ-free locally enforced; α-cargo scoped -as a compile-time obligation). Sixteen-program battery total and -clean. The h-fragment PASS is re-claimed, gated on a fresh-context -independent audit.** Previous register — v1.6 (§13): the +**Status: v1.8 — §15 is the current register: fresh audit #1 +returned FAIL (§14.6 — WF-collision and Pα countermodels, an +injectivity gap, honesty defects); v1.8 answers with one +mechanism: decode records at certified erasure + the refire guard +make one-fire-per-instance a runtime machine invariant (the +α-cargo compile-time obligation is discharged and deleted), +`discover_total` validates its own fixpoint (unsound certificates +refused, conservative None fallback), W7 fibre coherence joins the +WF subtype with the range-disjointness theorem mechanized, and +`typecheck.py` supplies the typed h-only fragment judgment (15/18 +typable; `q` itself is out — the wire imbalance `qprime` fixed). +Eighteen-program battery total and clean; the sixteen are +marginal-, support-, and basis-identical to v1.7. The PASS +re-claim is again gated on a fresh-context independent audit.** +Previous registers — v1.7 (§14): the replay record healed `Q` and +dissolved `buried-frame`; v1.6 (§13): the fresh-instance adversarial round (§13.6) returned FAIL for "PASS for the h-fragment" while CONFIRMING the mathematical core: the conservation theorem stands with a depth-term correction @@ -1605,3 +1611,168 @@ literal gate application, the t-gate reservation, and the α-cargo compile-time obligation. This claim is **gated on a fresh-context independent audit** (a9's instruction for the round); the audit verdict will be registered here. + +### 14.6 The fresh audit verdict: FAIL (registered 2026-08-09) + +Fresh-context independent audit #1 (gpt-5.6-sol, threadless, job +`cx-20260809-134605-79cc`, fed the full scratchpad + evidence +pack): **FAIL** for the h-fragment PASS. The scorecard, by charge: + +1. **Replay record — GAP.** No wrong deep-key lookup found (Q plus + 3,160 generated programs clean), but no injectivity theorem for + logged-position keys was supplied; deleting `buried-frame` was + validated only on explored orbits. +2. **Q / weave / hweave / qq physics — CONFIRMED-SOUND** by + independent recomputation, exact amplitude agreement. +3. **WF adequacy — REFUTED with countermodel.** W1–W6 do not make + certified fire injective: a reachable `lone` arrival plus one + extra slot-matching frame is WF, and both sources fired to + identical targets (columns with inner product 1). WF needed the + certificate's fibre relation as a domain subtype. +4. **Scoped α-cargo condition — REFUTED with countermodel.** + `Pα = (C I h) 1̂`, `C = h (h (NOT (h 0̂)))` — typed, h-only, + in-fragment. `discover` admitted a certificate whose α-cargo + erasure is followed (t=131, amplitudes ±1/2) by a fresh call of + the erased instance; the certified run goes STUCK at t=180 while + the plain run computes the correct `{1/4, 3/4}`. The no-reseek + condition cannot remain an unchecked compile-time obligation. +5. **Scoping honesty — REFUTED.** The §14.2 "twelve bit-identical" + overclaim (the v1.2 basis drift `negative` 103→83, `selector` + 173→106, `pstar` 458→242 is real, v1.7-era, marginal-identical); + an "all twelve" print over sixteen programs; the evidence pack + omitted this file; no typing checker existed. Their fuzz also + surfaced a sixth defect we adjudicated into round 2: a + **duplicate fresh call** — a ticket consumed by the fire's + α-decode (bit-free spectator), the same instance later re-sought + with neither ticket nor frame, silently fired twice. + +Both countermodels and the fuzz hit were reproduced locally before +any correction was designed. §15 is the correction round. + +## 15. v1.8 — decode records, the refire guard, and the typed fragment + +*(2026-08-09; the audit-correction round. Scratch evolver updated in +place; suite is eighteen programs; `typecheck.py` joins the +scaffolding. No qALC code in the tree — §9 gates still govern.)* + +### 15.1 One mechanism, not three patches + +The audit's two live countermodels and its fuzz hit are the same +disease in three coats: **an instance's selection was erased with no +recoverable record, and the machine then answered a later re-seek of +that instance by silently tossing a second coin.** Pα reached it +through certified α-cargo erasure; the fuzz duplicate through the +fire's α-decode (the bit-free spectator that buys HH's coherence); +the WF collision was its structural shadow (erasure that forgets the +frame's existence cannot be injective). The v1.8 mechanism: + +- **Decode records.** Certified erasure now retains `('K', g, i)` + for every live α nested in the erased cargo and for every popped + frame's instance (the fire's α-decode arm already retained its + `('K', g, i)`). The erased tuple is a function of the retained + `(slot, T, log)` fibre — discovery condition (b) — so its key-set + is too: the records are **branch-consistent constants**, coherence + is untouched, and erasure becomes injective on the ticket/frame + dimension. Measured sharp: all sixteen prior programs keep + identical marginals, supports, *and basis counts* — adding a + branch-constant record is a bijection on the post-fire subgraph, + so counts cannot move, and did not. +- **The refire guard.** The fresh-call arm now types out (`refire`) + any instance whose key is dead storage in `ks` — a decoded record, + or a ticket captured inside a retained-whole record. Arm order + (ticket → recall, frame → replay, else guard → call) plus the + fact that one `vvar` emits one ticket consumed by exactly one of + recall/decode/erasure means the guard can never shadow a + legitimate recall or replay. **One-fire-per-instance is now a + machine invariant enforced at runtime; the v1.7 α-cargo + compile-time obligation is discharged and deleted.** +- **Validated admission.** `discover_total` now runs the full + `validate()` (totality, guard reachability, Gram, err mass) on + its fixpoint and returns None — the conservative, sound fallback — + when coverage fails. Pα's and the fuzz program's exploratory + certificates exist but are *refused* by the canonical pipeline. + +### 15.2 The audit witnesses, healed and framed + +- **`palpha`**: canonical certificate None; canonical dynamics is + the plain run, `{halt0: 1/4, halt1: 3/4}`, support 3 — the + physics (`C = H·H·X·H|0⟩ = |+⟩`; the zero branch applies I to + `1̂`, the one branch H). The exploratory certified graph is now + *total and loud*: `refire` reached, err mass 1/2, + `semantic_coverage` False — the old silent STUCK at t=180 (a norm + leak) is gone. +- **`dupcall`** (the fuzz hit, registered): canonical certificate + None; the plain run rejects typed (`alien-ticket`, err 1/2 beside + a classical 1/4+1/4); under the v1.7-era certificate the refire + guard is REACHED with all-err dynamics — the suite's permanent + positive control. UNTYPABLE (below), so it was never inside the + fragment claim; the guard is defense-in-depth. +- **The WF collision**: the extra-frame source is `W7`-excluded + (§15.3) *and* no longer shares targets — the popped frame leaves + its decode record. Both layers close it independently. + +### 15.3 W7 and the range-disjointness theorem + +**W7 (certificate fibre coherence)** joins the subtype: at a +certified boundary, the erased `(l, RS)` must equal the +certificate's frozen fibre value at the retained key +`(pos, slot, T, log)`. Reachable ⊆ WF∧W7 sweeps clean over every +certified graph (the fibre map is discovery's own object; condition +(b) makes it single-valued). + +**Theorem (range disjointness on WF∧W7).** For two certified-fire +sources at one boundary: same `(T, log)` and slot ⇒ same erased +tuple (the fibre is a function) ⇒ the same source; same `(T, log)`, +other slot ⇒ the identical target pair carrying the two H rows — +orthogonal columns, which *is* the interference mechanism; different +`(T, log)` ⇒ disjoint targets, because targets embed `T` and `log` +verbatim. Mechanized (`cert_disjointness`): zero violations over +every certified graph. + +**The GAP, dissolved rather than closed.** Deep-lookup soundness +needs no instance-key injectivity theorem: if two dynamic copies +ever aliased one `(g, i)`, divergent selections are typed +(`frame-conflict` on both the recall push and the replay lookup) +and agreeing selections make the lookup value-correct. Every +aliasing manifestation is typed or harmless; λIAM logged-position +uniqueness downgrades to a **completeness conjecture**, outside the +soundness perimeter. + +### 15.4 The typed fragment, made real + +`typecheck.py` supplies the judgment the claims quantify over: +algorithm W with the gates as the polymorphic signature +`h, t : ∀a. (a→a→a) → (a→a→a)` instantiated fresh per occurrence +(the precise content of "signature-abstracted"), plain HM +elsewhere, result type free (`haltI`-sector programs are +function-typed). Measured: **15 of the 18 are typable h-only**. +Outside: `dup` (self-application — deliberately, the untyped copy +regression), `dupcall` (NOT′/EP branches ununifiable), and — a +finding — **`q` itself** (E = λz. I z vs N ununifiable: exactly the +wire imbalance `qprime` was built to repair; `qprime` types clean). +The three escapes (`h h` etc.) are untypable, as required. + +**The v1.8 coverage claim**: over programs that are (i) typable +h-only under the signature judgment and (ii) whose canonical +pipeline (`discover_total` + `validate`) reports +`semantic_coverage` — the kernel is total, Gram-clean, and +marginal-correct, with every failure mode outside (ii) typed and +visible, never silent. The §14.2 basis-drift overclaim is +corrected: v1.7's replay record moved `negative` 103→83, `selector` +173→106, `pstar` 458→242 against the v1.2 reference (canonical rs +sorting and the replay-arm restructure merge order-variant states); +marginals and supports never moved. + +### 15.5 Verification state and the audit gate + +Suite (18): sixteen marginal/support/basis-identical to v1.7, +guards silent; `palpha`/`dupcall` as above; refire + pop-err +negative controls PASS. `discover_total` == frozen CERTS on all 18; +`h(Ω)` → None. WF and W7 sweeps + disjointness: zero violations. +Conservation ledger: zero failures (k = 1..3, 14,452 surfacings). +Polarity, terminal chains, gauge orbit (4/256, exact): unchanged. +The auditor's own reproducer, rerun under v1.8: WF collision +targets disjoint; Pα scope clean, live calls none; sixteen +histories clean; fuzz 250/250 no violation (66 conservatively +refused). **The PASS re-claim is again gated on a fresh-context +independent audit; verdict to be registered here.** diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index 5c58d73..ac725e0 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -389,10 +389,10 @@ substrate's obstruction and the fork reopens. | Item | Status | |---|---| -| Kernel | **v1.7** (`kernel.md` §14): the replay RECORD — recall idempotent, replay a deep keyed lookup, `rs` canonically sorted, `buried-frame` dissolved — heals `Q` to its pre-predicted physics ({1/2, 1/2}, support 4, same certificate, `semantic_coverage: True`); twelve bit-identical; stress set (`weave`/`hweave`/`qq`) all predicted-then-measured; the WF subtype (six invariants, reachable ⊆ WF over 9,314 states) closes the v1.6 range-disjointness gap; certified-erasure cargo conditions measured and registered. **h-fragment PASS re-claimed, gated on a fresh-context independent audit** | +| Kernel | **v1.8** (`kernel.md` §15; audit #1 FAIL registered §14.6): decode records at certified erasure + the `refire` guard make one-fire-per-instance a runtime machine invariant (the α-cargo obligation discharged and deleted); `discover_total` validates its fixpoint and refuses unsound certificates (the audit's `Pα` heals to its physics {1/4, 3/4} via the conservative fallback); W7 fibre coherence + the mechanized range-disjointness theorem close the WF collision; `typecheck.py` is the typed h-only fragment judgment (15/18; `q` itself untypable — `qprime` is its wire-balanced repair). Sixteen prior programs marginal-, support-, and basis-identical. **PASS re-claim gated on fresh audit #2** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | -| Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §11.7, §12.2, §13.3): the v1.5 fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is pop-err reachability + the RS-function property, strictly beyond Gram (negative control caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness) | -| Instance identity | **ratified and discharged, interleaving included** (`kernel.md` §13.4, §14): lp-at-log-head structural for signature-abstracted programs; equal-lps-same-copy backed by the `(g,i)`-aliasing regression, the `dup` witness, and now the `frame-conflict` typed guard; the interleaved re-seek has semantics via the replay record — `Q`, `weave`, `hweave`, and `qq` all total, clean, and physical | +| Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §11.7, §12.2, §13.3): the v1.5 fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is pop-err reachability + the RS-function property, strictly beyond Gram (negative control caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and as of v1.8 **self-validating**: the fixpoint is admitted only if its certified graph passes full semantic coverage, else None | +| Instance identity | **ratified and discharged, interleaving included** (`kernel.md` §13.4, §14): lp-at-log-head structural for signature-abstracted programs; equal-lps-same-copy backed by the `(g,i)`-aliasing regression, the `dup` witness, and now the `frame-conflict` typed guard; the interleaved re-seek has semantics via the replay record — `Q`, `weave`, `hweave`, and `qq` all total, clean, and physical; v1.8 dissolves the audit's injectivity gap (aliasing manifestations are typed or value-correct — `frame-conflict`, `alien-ticket`, `refire`; lp uniqueness downgrades to a completeness conjecture) | | Time register | **the coloring AND the conservation law are theorems** (`kernel.md` §11.1–11.2, §13.1): closed-form φ, uniform flip, certified-erasure defect `1 − w(erased lp)`; branch-offset formula verified; mark-free fire-free readback conserves `w ≡ slot` (proved: attribution ledger + coloring), so geometric selection of classical data decoheres intrinsically and every escape route is a named mechanism (interior-fire charge, VB pattern birth, mark capture) | | L1 arrival-residue determinacy | kernel-verified at `fire`; general proof open | | L2 pop timing / coherence return | confirmed for NOT′ (kernel); selector measured decoherent; mechanism understood via pattern-vs-step | From ed857675218408dc672baabe6a6d2a24e1017831 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 14:30:47 -0400 Subject: [PATCH 031/107] =?UTF-8?q?qalc:=20=C2=A715.4=20=E2=80=94=20state?= =?UTF-8?q?=20the=20coverage=20claim=20exactly;=20register=20the=20HNH=20l?= =?UTF-8?q?oad-bearing=20certificate=20measurement?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Fable 5 --- docs/quantum-algebraic/kernel.md | 28 ++++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index b98e8be..9c7614c 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1752,12 +1752,28 @@ finding — **`q` itself** (E = λz. I z vs N ununifiable: exactly the wire imbalance `qprime` was built to repair; `qprime` types clean). The three escapes (`h h` etc.) are untypable, as required. -**The v1.8 coverage claim**: over programs that are (i) typable -h-only under the signature judgment and (ii) whose canonical -pipeline (`discover_total` + `validate`) reports -`semantic_coverage` — the kernel is total, Gram-clean, and -marginal-correct, with every failure mode outside (ii) typed and -visible, never silent. The §14.2 basis-drift overclaim is +**The v1.8 coverage claim, stated exactly.** Over programs that +are (i) typable h-only under the signature judgment and (ii) whose +canonical pipeline (`discover_total` + `validate`) reports +`semantic_coverage`: the kernel is **total and Gram-clean** (U an +isometry on the reachable basis), certified erasure is +**transparent** (fibre-proven, W7-coherent, disjointness +mechanized), and **every failure mode is typed and visible, never +silent**. Marginal-correctness against the ideal quantum +semantics is established **per-program against hand-computed +physics** for the eighteen (and was independently recomputed by +audit #1 for the interleaving set); the *general* +agreement-with-compilation-semantics theorem is explicitly the +compilation theorem's obligation (docket item 3), not claimed +here. One measured fact makes the distinction sharp: **the +certificate is semantically load-bearing for HNH** — certified +`{halt0: 1}` (the physics, H·X·H|0⟩ = |0⟩) versus plain +`{1/2, 1/2}` (the retained records decohere the earned +coherence). The conservative fallback is therefore sound *as a +machine* (total, unitary, typed) but not ideal-preserving; a +refused certificate degrades coherence, never soundness — which +is exactly why `discover_total` must refuse rather than admit an +unsound one. The §14.2 basis-drift overclaim is corrected: v1.7's replay record moved `negative` 103→83, `selector` 173→106, `pstar` 458→242 against the v1.2 reference (canonical rs sorting and the replay-arm restructure merge order-variant states); From 0193b65f94d04ac8567a530cb7fb606e50351af9 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 14:52:14 -0400 Subject: [PATCH 032/107] =?UTF-8?q?qalc:=20v1.9=20=E2=80=94=20working-revi?= =?UTF-8?q?ew=20corrections;=20docs=20rewritten=20current-only?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The sol-tier working review of v1.8 found two structural holes: per-slot bundle divergence (fix: cross-slot bundle equality as admission condition (e) + tagged KD bundles) and live representations shadowing bit-free dead records (fix: key-alias guard + W8 representation exclusivity + decode-arm record skip). Disjointness checker now constructs real fire targets and computes column inner products; validate() loses the empty-RS loophole and gains WF∧W7∧W8 + disjointness; typecheck enforces the syntactic language boundary. Eighteen programs bit-identical throughout; the review witnesses are permanent regressions. Docs current-only (a9's call): kernel.md 1794 -> ~490 lines as the v1.9 register with a chronicle table; STATUS qALC narrative collapsed; history lives in the ledger and git. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 176 +-- docs/ledger/2026-08.md | 47 + docs/quantum-algebraic/kernel.md | 2146 ++++++------------------------ docs/quantum-algebraic/token.md | 2 +- 4 files changed, 524 insertions(+), 1847 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 1b0eaeb..9191065 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -420,152 +420,42 @@ consistency) and a fresh-context feasibility review (thread promising-with-hard-open-problems, converging with the sketch on every load-bearing point; its checklist and exclusions are folded in. -**Kernel v1 is drafted and machine-verified** -(`quantum-algebraic/kernel.md`): full transition table over the λIAM -substrate, step-indexed traces, column-Gram orthonormal on every -tested reachable basis. HH halts with mass 1 on `0̂` by exact -cancellation at the outer fire; H–NOT–H passes the coherence bar -through NOT′; the negative witness's branches halt with the *same* -output `I` and stay orthogonal in residue and time. Measured -findings: the selector NOT decoheres by one-step desynchronization -(the coherence economy in token steps); re-interrogation is real -(C1 refuted) and handled by ticket-replay (`recall`) with no store. -The conformance review (thread `qalc-architecture`) returned -partial-conformance with one blocker — v1.0 misclassified the valid -output `I` as an error — fixed in v1.1 along with separate -`RunDone`/`Halt` steps, a structural (cancelled-targets-included) -Gram, and two mandated architecture amendments (witness 7 pinned to -the exact `NOT′` wire term; the stale strategy bullet). - -The adversarial review returned: **FAIL for kernel v1, route -intact** — the reviewer's independent reimplementation reproduced -all five results (substrate, fibres, balance all HOLD), then broke -`recall` with `p★ = λh.λt. ((((h 0̂) h) h) 0̂)`: nested same-kind -tickets alias after the replay erases `b′` (norm 3/2 at step 89, -confirmed against both implementations; a 3-coin regression shows -the same collision across time slices). Re-entry determinacy is -refuted; verdict registered in `kernel.md` §9. - -The v1.2 repair (inert replay stack) fixed the p★ aliasing and is -independently confirmed, but the re-review refuted permanent -inertness with `q = λh.λt. h ((((h 0̂) E) N) 0̂)` — injective -selection (H;id;H) whose branches must re-interfere — and exposed -an α/γ transport totality failure beneath it (three stuck states on -`q`'s 335-state graph, verified). The governing principle is now -the **transparency criterion**: a replay frame is cleanable iff its -bit is a function of the live core, cleaned inside the δ block with -provenance-matched instance-indexed frames. - -**Kernel v1.3 is built and verified** (`kernel.md` §10, 2026-08-09): -the `replay` rule (a consumed-ticket re-seek rederives its selection -from the instance's frame, read nondestructively — derived from the -literal visit-3 trace) restores transport totality on the whole -ten-program battery; instances are the invoking occurrence's logged -position (structurally at the log head), discharging ticket -ownership; the transparency/pop rule strips slot-matched frames at -certified fire boundaries, verified sound by the structural Gram -with a negative control (an unsound certificate is caught as a -typed error, no unitarity damage). The `q`-family halts frame-free -— no residual replay discriminator — but mass 1 on `0̂` is blocked -by a **new standing finding, the time register**: branch arrival -offsets 35/7/3 (q / wire-balanced q′ / minimal q2), odd and -invariant under every even-cost program pad measured. Pattern- -encoded slots are time-free (HH, H–NOT′–H sync exactly); -step-encoded (geometric) selection skews the branch clock by the -transported bit. Conjecture to adjudicate: geometric selection -decoheres intrinsically; the coherent fragment is the -pattern-encoded routing class, and time-balance is a compiler -obligation. v1.2's p★ support-8 was transport-bug-inflated -(extra fire events measured); the correct support is 4. - -The v1.3 adversarial round returned (2026-08-09, registered in -`kernel.md` §10.6): **FAIL as the formalization gate, PASS for the -replay repair** — every number independently reproduced; no odd pad -in a 156-variant search (composed selections stay odd: NOT∘NOT -Δ=1); a **port-polarity coloring** supplied as the parity theorem -route; instance-as-logged-position ratified with a new -copy-discrimination regression (`dup`). Review corrections applied -in-session: buried same-instance frames and missing-instance -entries are typed errors (both unreachable in the battery — it is -bit-identical), TOP fallback removed. - -**Kernel v1.6 is proved, reviewed, and scoped** (`kernel.md` §13, -2026-08-09): the conservation conjecture is now a **theorem** — an -attribution-ledger lemma (`t ≡ k + b + 1`: every λIAM step is the -birth, death, or transport of exactly one tape/log individual) -meets the coloring to give `w ≡ k + b + |pos′| − |pos|`, i.e. -`w ≡ exit slot` on mark-free fire-free readback, with each -hypothesis's failure mode a named mechanism (interior-fire charge / -VB pattern birth / mark capture). Mechanized at the invariant -level: 41,272 closed terms ≤ size 11, 55,727 surfacings, per-step -ledger checks in lockstep conformance, zero failures. Also -mechanical: terminal chains, gauge-pinned uniqueness (4/256 = the -predicted orbit), `discover_total` (total on every program, `h Ω` -conservative reject), guard-rule and `(g,i)`-aliasing sweeps. The -**fresh-instance adversarial round confirmed the entire -mathematical core** (Lemma A independently reimplemented; the -transfer closure searched over 153k arguments with zero mark-free -escapes; the gauge orbit re-derived under a 15-parameter solve; -one real correction — the theorem's depth term) **and refuted the -h-fragment PASS scope**: `Q = ((h 0̂) SEL SEL)(h 0̂)` is typed, -h-only, signature-abstracted, and reaches `buried-frame` from init -with err mass 1 under a valid certificate and clean Gram — the -interleaved re-seek is a missing semantic case, not an unreachable -fence. `Q` is the battery's thirteenth program; `validate` now -reports `semantic_coverage`; the μ-kind fire collision is closed -typed. **PASS stands for the three-program formalization gate and -the twelve registered sectors; the h-fragment claim is withdrawn.** - -**Kernel v1.7 is built and verified** (`kernel.md` §14, -2026-08-09): the replay RECORD gives the interleaved re-seek its -semantics — `recall`'s frame push is idempotent (the record is a -function of the instance; conflicting bits are a typed -`frame-conflict`), `replay` is a deep keyed lookup, the record set -is canonically sorted, and the `buried-frame` error class is -dissolved. The review's `Q` heals to physics predicted before -measurement ({1/2, 1/2}, support 4, certificate unchanged, -`semantic_coverage: True`); the twelve stay bit-identical; three -pointed stressors (`weave`, `hweave`, `qq` — three coins, -double-crossed re-seeks, support 8) all land on predicted -marginals. The WF subtype (six invariants; reachable ⊆ WF over -9,314 states; per-rule preservation) closes the v1.6 -range-disjointness gap — both review collisions dead (W4 excludes -the vvar source; `species-mu` types the μ-kind pair). Certified -erasure got its cargo conditions: γ-free cargo enforced in -certificate admission (zero changes), suspended-α cargo (HNH's -earned coherence depends on it) scoped under a named compile-time -obligation. The h-fragment PASS is re-claimed, **gated on a -fresh-context independent audit**. - -**Fresh audit #1 returned FAIL; kernel v1.8 is the correction -round** (`kernel.md` §14.6, §15, 2026-08-09). The audit confirmed -the Q/weave/hweave/qq physics by independent recomputation but -landed two countermodels (a WF-but-colliding certified fire; `Pα`, -a typed in-fragment program whose admitted certificate erased an -α-cargo instance later re-sought — silently stuck), plus a fuzzed -duplicate fresh call through the fire's α-decode, an injectivity -gap, and honesty defects. v1.8 answers with one mechanism: decode -records at certified erasure + a `refire` guard in the fresh-call -arm make **one-fire-per-instance a runtime machine invariant** -(the α-cargo compile-time obligation is discharged and deleted); -`discover_total` now validates its own fixpoint and refuses -unsound certificates (`Pα` and the fuzz program fall back to the -conservative plain run — `Pα`'s canonical dynamics is its correct -physics, {1/4, 3/4}); W7 fibre coherence joins the WF subtype and -the range-disjointness theorem is mechanized; `typecheck.py` -supplies the typed h-only fragment judgment (15/18 typable — `q` -itself is out, the wire imbalance `qprime` fixed; `dup` and the -fuzz program out by construction). The sixteen prior programs are -marginal-, support-, and **basis-identical** (decode records are -branch-consistent constants — a bijection on the post-fire -subgraph, measured). The auditor's own reproducer reruns clean: -fuzz 250/250 no violation. The v1.2→v1.7 basis drift overclaim is -corrected and owned (§15.4). +**The kernel is at v1.9** (`quantum-algebraic/kernel.md` — the +current-only register; round-by-round history in `ledger/2026-08.md` +and the file's git history): a scratch superposition evolver for the +typed h-only fragment — the eight λIAM rules plus instance-keyed +gate probes firing H rows in exact ℚ[√2], recall/replay/decode +machinery with one-fire-per-instance enforced as a runtime machine +invariant, self-validating canonical certificates (fibre conditions +(a)–(e) including cross-slot decode-bundle equality; unsound +fixpoints refused with a conservative fallback), an eight-invariant +WF subtype with the range-disjointness theorem mechanized against +actually-constructed fire targets, a syntactically-bounded typing +judgment (15/18 suite programs typable h-only; `q` itself is out — +the wire imbalance `qprime` repairs), and every failure mode typed. +The eighteen-program battery is total and Gram-clean with +hand-verified physics (HNH's certificate is measured +load-bearing: certified `{0̂: 1}` vs plain `{½, ½}`); conservation, +polarity, gauge, and both prior reviewers' reproducers all run +clean. Two fresh-context audits shaped it: audit #1 FAILed v1.7 +(Pα and WF-collision countermodels, an instance-alias gap, honesty +defects — all reproduced before correction), and a sol-tier working +review of the v1.8 fix caught two structural holes (per-slot bundle +divergence; live representations shadowing bit-free dead records) +now closed as condition (e) and the `key-alias`/W8 pair. What +remains open is stated, not hidden: the alias-tolerant transition +theorem (or λIAM logged-position uniqueness) is a conjecture the +soundness claims are conditional on; the general +marginal-correctness theorem is the compilation theorem's +obligation. **The PASS re-claim is gated on fresh audit #2.** The open docket, in order: -1. **fresh-context independent audit #2 of the v1.8 h-fragment - claim** (next action; verdict to be registered in §15.5); +1. **fresh-context independent audit #2 of the v1.9 h-fragment + claim** (next action; verdict to be registered in `kernel.md` + §9); then the alias-tolerant transition theorem or λIAM + logged-position uniqueness (`kernel.md` §7.5 — the standing + conditional); 2. the readback controller (full-NF halt sectors; the kernel's root classifier is its 1-bit case) and the `t` gate's `ℤ[ω]` scalars — with time-in-the-core added to the transparency theorem diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 41620ac..4d89081 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2531,3 +2531,50 @@ uniqueness downgrades to a completeness conjecture outside the soundness perimeter. The auditor's reproducer reruns clean under v1.8: collision targets disjoint, Pα scope clean, fuzz 250/250 no violation. PASS re-claim gated on fresh audit #2. + +## 2026-08-09 — qALC kernel v1.9: the working review, and the docs go current-only + +Before burning fresh audit #2 on v1.8, a working consult on the +qalc-token-machine thread (sol tier, full scratchpad) returned +FAIL-for-sign-off / PASS-for-the-regression-surface with two +structural holes in the correction itself — both raw-state +constructions, neither reachable on any measured orbit, both +disproving the stated theorems from their premises. (1) The +branch-consistency argument for decode records had a per-slot +quantifier error: the fibre function property permits +dead(0,T,L) ≠ dead(1,T,L), and divergent bundles across one H +fibre would silently decohere the interference the certificate +buys — invisible to Gram, which reads disjoint columns as +orthogonal. Fix: cross-slot bundle equality is admission +condition (e), and the certified fire emits one tagged +('KD', keys) bundle. (2) The refire guard ran after recall/replay +dispatch, so a live ticket or frame shadows a bit-free dead +record — which has discarded exactly the bit that would detect +divergent aliasing. Fix: the key-alias guard types every +cross-class encounter, W8 (representation exclusivity: answerable +XOR dead per key) joins the subtype, and the decode arm skips +record creation when a same-key frame exists — exclusivity by +construction. Also mandated and done: the disjointness checker +now actually constructs fire targets and computes column inner +products (the old one checked only the within-slot fibre +function); validate() lost its empty-RS transparency loophole and +gained WF∧W7∧W8 + disjointness; the type checker enforces the +syntactic language boundary (no gate literals in bodies, shell +args exactly h then t); the GAP verdict stands as a named +conditional — the alias-tolerant transition theorem or λIAM +lp-uniqueness, stated in the register, not hand-waved away. All +eighteen programs bit-identical through the whole correction +(marginals, supports, basis); the two review witnesses are +permanent regressions (doctored fibre REJECTED by (e); K+frame +state W8-flagged and key-alias-typed). And on a9's call, the docs +went current-only: kernel.md rewritten 1794 → ~490 lines as the +v1.9 register (contract, table, lifecycle, certificates, W1–W8, +theorems with premises, typed fragment, the claim + its stated +conditionals, verification state, chronicle), with the +round-by-round history living here and in git; STATUS's qALC +narrative collapsed to one current paragraph; scratchpad headers +rewritten current-only; the pre-measurement predictions file got +an explicit outcomes appendix (two predictions wrong, both +instructively); the v1.7 basis baseline is a provenance file +citing audit #1's independent numbers. Fresh audit #2 launches +against v1.9. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 9c7614c..953d26a 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,98 +1,25 @@ -# qALC three-program kernel — v1 - -**Status: v1.8 — §15 is the current register: fresh audit #1 -returned FAIL (§14.6 — WF-collision and Pα countermodels, an -injectivity gap, honesty defects); v1.8 answers with one -mechanism: decode records at certified erasure + the refire guard -make one-fire-per-instance a runtime machine invariant (the -α-cargo compile-time obligation is discharged and deleted), -`discover_total` validates its own fixpoint (unsound certificates -refused, conservative None fallback), W7 fibre coherence joins the -WF subtype with the range-disjointness theorem mechanized, and -`typecheck.py` supplies the typed h-only fragment judgment (15/18 -typable; `q` itself is out — the wire imbalance `qprime` fixed). -Eighteen-program battery total and clean; the sixteen are -marginal-, support-, and basis-identical to v1.7. The PASS -re-claim is again gated on a fresh-context independent audit.** -Previous registers — v1.7 (§14): the replay record healed `Q` and -dissolved `buried-frame`; v1.6 (§13): the -fresh-instance adversarial round (§13.6) returned FAIL for "PASS -for the h-fragment" while CONFIRMING the mathematical core: the -conservation theorem stands with a depth-term correction -(`w(l) ≡ k + b + |pos′| − |pos|`; deployed specializations -unaffected), Lemma A's attribution ledger verified airtight by -independent reimplementation, the transfer corollary confirmed -with the reviewer's own closure invariant and a 153k-argument -search (zero mark-free escapes), the gauge orbit confirmed under -a broadened 15-parameter solve, and `discover_total` confirmed -with both rejection paths exercised. The claim itself was -refuted by `Q = ((h 0̂) SEL SEL)(h 0̂)` — typed, h-only, -signature-abstracted, reaching `buried-frame` from init with err -mass 1 under a valid certificate and clean Gram: the interleaved -re-seek is a MISSING SEMANTIC CASE of the h-fragment, not an -unreachable fence. `Q` is the battery's thirteenth program; -`validate` now carries `semantic_coverage`; the μ-kind fire -collision is closed typed (`species-mu`, bit-identical reachable -graphs); the well-formed-state subtype + preservation proof is a -registered obligation. **PASS holds for the three-program -formalization gate and the twelve registered sectors; the -h-fragment claim is withdrawn; the v1.7 object is buried-frame -semantics or a static characterization excluding it.** Earlier -registers: v1.5 encoded fire §12 (coherence is *earned*, -certificate-bearing); v1.4 coloring/certificates §11; -encoded-fibre amendment applied to architecture §7 (§11.7). §10 is -the v1.3 register. Of the re-review's six gate items: totality on `q`'s -graph ✓ (the `replay` rule, derived from the literal visit-3 -trace); correct slot-0/slot-1 outer arrivals ✓; instance-indexed -frames ✓ (instance = the log-head logged position, already present -at every gate-leaf entry); a transparency/pop rule ✓ (certified -per-program, falsification caught as a typed error, verified by -the Gram/norm pass, negative control included); `q`'s frames -cleaned with **no residual replay discriminator** ✓ — but mass 1 -on `0̂` does NOT follow, because the branches arrive at the outer -boundary at different global times, and the offset is **odd and -invariant under every program-level padding tried** (§10.4). -Slot routing that survives to a boundary as tape *pattern* is -time-free (HH, H–NOT′–H sync exactly); routing *consumed* as -transport steps skews the clock by the transported bit. The -standing conjecture: step-encoded (geometric) selection decoheres -intrinsically in this machine class; coherence is the -pattern-encoded routing class; time-balancing is a compiler -obligation, not a rule-level fixable. History: v1 was reviewed -adversarially (thread -`qalc-token-machine`, independent reimplementation) — the classical -substrate, gate fibres, HH cancellation, H–NOT′–H balance, and -negative witness all HOLD, but `recall` was CONFIRMED-BROKEN on -`p★ = λh.λt. ((((h 0̂) h) h) 0̂)`: nested same-kind tickets aliased -after the replay erased its `b′` discriminator (norm 3/2 at step -89, verified against both implementations — §9). **v1.2 repairs it -with the inert replay stack** (§9.5): `recall` moves the ticket to -a transport-inert residue component instead of erasing it; recalled -branches decohere mandatorily — which is the correct physics, since -a coin whose branches both select gate occurrences has been -consumed non-injectively — and the coherent witnesses never touch -the mechanism. All seven programs (five witnesses + `p★` + the -3-coin regression) now pass with norm 1 and structurally clean -column-Gram. The conformance review's earlier fixes (output -alphabet {`0̂`,`1̂`,`I`}, separate `RunDone`/`Halt` steps, -structural Gram) are incorporated and stand. - -```text -h (h 0̂) mass 1 on 0̂, single terminal configuration -h (NOT′ (h 0̂)) mass 1 on 0̂, single terminal configuration -(λb. b I I) (h 0̂) Halt(I) in BOTH branches, 1/2 + 1/2: same - output normal form, orthogonal in residue AND - entry time — the noninjective-output dilation, - exactly as the negative witness asserts -column-Gram orthonormal on every structural reachable basis - (amplitude-blind BFS: cancelled targets included) -``` - -Two probes beyond the gate, both physics-correct: the selector -`λb. b 1̂ 0̂` interposed in H–NOT–H **decoheres** (1/2, 1/2 mixed, -branches one step desynchronized) — the first mechanical measurement -of the coherence-is-earned economy; and lone `h 0̂` gives 1/2, 1/2 at -equal ticks. +# qALC three-program kernel — current register (v1.9) + +**Status: v1.9.** The kernel is a scratch superposition evolver for +qALC's quantum-control fragment (λIAM lineage, `h`-only, exact +ℚ[√2]): the eight classical token rules plus gate probes that FIRE +at boundaries with H-row amplitudes, instance-keyed +ticket/frame/record machinery for re-interrogation, per-program +transparency certificates with a self-validating canonical +analysis, an eight-invariant well-formedness subtype, a typed +h-only fragment judgment, and every failure mode typed — never +silent. Two fresh-context independent audits and two working +reviews have shaped it (chronicle, §12); the standing PASS +re-claim is **gated on fresh audit #2**, whose verdict will be +registered here. + +This file is the current contract and register only. The +round-by-round history — countermodels, corrections, verdicts — +lives in `docs/ledger/2026-08.md` and this file's git history; +§12 is the map. The scratch implementation lives outside the tree +(the §9-gate no-code rule of `architecture.md` governs); the +machine designs behind it are `token.md` (active) and `machine.md` +(read-only failures). ## 1. Scope @@ -100,292 +27,446 @@ The kernel machine answers a single **root output question** about the invocation `p h t`: initial state `(root, ↓, log ε, tape •·•·ρ)`, output alphabet **{`0̂`, `1̂`, `I`}** with typed halting sectors for each, an absorbing error sector for -species errors, and root arrivals outside the alphabet also entering -the error sector — a kernel-scope limitation flagged as such: the -architecture permits arbitrary normal-form outputs, and recognizing -them is the readback controller's job, not smuggled in here. `I` is -in the alphabet because the negative witness's output is a *valid -closed normal form* — classifying it as an error would make witness -8 vacuous (a conformance-review catch; v1.0 had exactly that bug). -Terminal entry is the normative two-step -`RunDone(nf, res) → Halt(nf, res, 0) → tick`, each a separate `U` -application. The ring is `ℤ[1/√2]` — `h` only; `t` is the same table -with `Q_t = diag(1, ω)` over `ℤ[ω]/√2^d` and its own tags, -deliberately left unexercised. Classical substrate: the eight λIAM -rules exactly as pinned in `token.md` §2. +species/guard errors, and root arrivals outside the alphabet also +entering the error sector — a kernel-scope limitation flagged as +such: the architecture permits arbitrary normal-form outputs, and +recognizing them is the readback controller's job, not smuggled in +here. `I` is in the alphabet because the negative witness's output +is a *valid closed normal form*. Terminal entry is the normative +two-step `RunDone(nf, res) → Halt(nf, res, 0) → tick`, each a +separate `U` application. The ring is `ℤ[1/√2]` — `h` only; `t` is +the same table with `Q_t = diag(1, ω)` over `ℤ[ω]/√2^d` and its +own tags, deliberately left unexercised. Classical substrate: the +eight λIAM rules exactly as pinned in `token.md` §2. ## 2. State space ```text -Run ::= (pos, d, log, tape, RS) — λIAM shape, plus VB phase - | (leaf, VB(g, b′, k), log, tape, RS) k ∈ {0,1,2} -RS ::= [R_g(b′), …] — transport-inert replay stack (v1.2): - no transport or classifier rule reads it; only `recall` - pushes; it joins the garbage factor at terminal entry +Run ::= (pos, d, log, tape, VB, RS, KS) +VB ::= ∅ | (g, b′, k) k ∈ {0,1,2} — virtual-boolean phase +RS ::= canonically sorted set of replay RECORDS R_g(i, b′) + — one per (gate, instance); transport-inert; recall's + push is idempotent, replay reads it wherever it sits +KS ::= stack of decode records — inert dead storage: + ('K', g, i) one decoded ticket (fire's α-decode) + ('KD', {keys}) certified erasure's tagged bundle + ('K', l) a retained-whole which-path spectator RunDone ::= RunDone(nf, residue) nf ∈ {0̂, 1̂, I, err} -Halt ::= Halt(nf, residue, tick) | Error(residue, tick) -residue = the COMPLETE pre-entry state (pos, d, log, tape, VB, RS) +Halt ::= Halt(nf, residue, tick) +residue = the COMPLETE pre-entry state (injectivity of terminals) tape/log entries: • | logged position l | γ_g | μ_g | A_g(b′) - | α_g(b′) | ρ + | α_g(i, b′) | ρ ``` `γ_g` (gate boundary marker), `μ_g` (probe frame), `A_g(b′)` (fired -answer token), `α_g(b′)` (answer ticket — a logged-position-like -entry with empty slice), `ρ` (root frame). The classical transport -rules (`arg`, `bt1`) treat `γ` and `α` exactly like logged positions; +answer token), `α_g(i, b′)` (answer ticket, instance-tagged), `ρ` +(root frame). **Instance** `i` = the invoking occurrence's logged +position — always at log head when the token stands at the gate +leaf (arg-entry is structurally forced); a logged position names a +dynamic subterm copy (λIAM lineage). The classical transport rules +(`arg`, `bt1`) treat `γ` and `α` exactly like logged positions; `bt2` never matches them (no binder). `lp-like := l | γ | α`; -arrival classifiers accept `l | α` as the answer position, never `γ`. +arrival classifiers accept `l | α` as the answer position, never +`γ`. ## 3. The transition table Classical rules `•1 •2 •3 •4 var arg bt2` are unchanged from -`token.md` §2. `bt1` is restricted to non-`γ` log heads; the `γ`-head -case belongs to the gate boundary (arrive/retrace below). New rules — -every `Done` entry freezes the complete source state as residue: +`token.md` §2. `bt1` is restricted to non-`γ` log heads; the +`γ`-head case belongs to the gate boundary (arrive/retrace below). +Every error entry freezes the complete source state as residue. + +**At the gate leaf (↓, bullet head), in guard order:** + +```text + i := log-head lp; no lp at log head → no-instance. + dead := every (g, i) in KS (decoded records, KD + bundles, and tickets nested in retained-whole cargo). + +(head ticket) tape = •^j · α_g(i′, b′) · T: + i′ ≠ i → alien-ticket [foreign copy] + (g, i) ∈ dead → key-alias [live ticket must + never shadow a dead record: the + bit-free record has discarded the + bit that would detect divergent + aliasing] + same-key records with a different bit + → frame-conflict + j = b′+1 → recall: consume bullets+ticket, emit •·•·•·T, + record R_g(i, b′) — IDEMPOTENT (the record is a + function of the instance; a re-seek cycle's + re-recording is a no-op) + other j → recall-err + +(frame) R_g(i, b′) anywhere in RS (deep keyed lookup — LIFO + position was never semantic): + (g, i) ∈ dead → key-alias + conflicting bits → frame-conflict + j ≥ 3 → replay: emit •^(b′+1) · α_g(i, b′) · tape[3:] + j < 3 → replay-err + +(fresh) neither ticket nor frame: + (g, i) ∈ dead → refire [the selection + was erased bit-free; a fresh call + would fire the same copy twice — + one-fire-per-instance is a MACHINE + INVARIANT, enforced here] + else → call: (g, ↑, L, γ_g·•·•·μ_g·T) +``` + +**At a certified/gate boundary (`↑` at an 'a'-position, γ log +head):** ```text -call (g, ↓, L, •·T) → (g, ↑, L, γ_g·•·•·μ_g·T) - g's leaf position; the top • is the query's application - crossing. Classical transport then delivers the probe to - g's true argument through arbitrary dereference plumbing. - -recall (g, ↓, L, •^(b′+1)·α_g(b′)·T, RS) - → (g, ↑, L, •·•·•·T, R_g(b′)·RS) - consistent replay of a fired instance off its ticket — no - fire, and (v1.2) **no erasure**: the discriminator moves to - the inert replay stack. Routing mirrors the literal - boolean's bt2-replay: consume the slot-dependent re-descent - bullets and the ticket, emit the two virtual lambda - crossings plus the gate-application compensation. Recalled - branches carry distinct R-frames forever — mandatory - decoherence, matching the physics (a re-interrogated coin - was consumed non-injectively by its selection). Bullet/ - ticket arity mismatch → Error. `call`'s domain excludes - recall's by the explicit guard "tape below the leading - bullet does not match •^k·α_g of this gate" — stated as a - side condition, structural disjointness still owed to the - formal table. - -arrive/ (m ends 'a', ↑, γ_g·L, P_b·μ_g·T) → -fire Σ_b′ (Q_g)_{b′b} · (m, ↑, γ_g·L, A_g(b′)·T) - P_0 = l· P_1 = •·l· (l ∈ {logged position, α}) - the δ block, directly on arrival states; Q_h = H. - Other tape shapes at a γ boundary → Error (species). - -retrace (m ends 'a', ↑, γ_g·L, A_g(b′)·T) → (parent+'f', ↓, - L, γ_g·A_g(b′)·T) [bt1's action on the γ head] - Classical rules then retrace the inward transit to the leaf. - -anshead (g, ↓, L, γ_g·A_g(b′)·T) → (g, VB(g, b′, 0), L, T) -vb2 (g, VB(g,b′,k<2), L, •·T) → (g, VB(g,b′,k+1), L, T) -vvar (g, VB(g,b′,2), L, T) → (g, ↑, L, •^(b′+1)·α_g(b′)·T) - the balanced virtual answer: consume the outer question's - two bullets as the two virtual lambdas, then emit the seek. - One bullet pays the gate-application crossing; the rest - encode the slot; α carries the return ticket. - -root (root, ↑, ε, P_b·ρ) → RunDone(b̂, res) - (root, ↑, ε, l·•·ρ) → RunDone(I, res) - one lambda consumed, head = its own binder, unapplied — - the I signature at depth-2 observation - other ρ arrivals → RunDone(err, res) [kernel-scope - limitation: outputs beyond {0̂,1̂,I} await real readback] -halt RunDone(nf, res) → Halt(nf, res, 0) [separate step] -ticks Halt/Error(…, k) → (…, k+1) -errors VB with a non-• non-classifier tape top; ↓-stuck on μ/ρ - (too many head lambdas); neutral constants under μ/ρ; - species shapes at γ boundaries; recall arity mismatch — - all → Error via RunDone, complete residue. +arrive/fire tape = P_b · μ_g · T, P_0 = l· P_1 = •·l· + μ's gate kind ≠ γ's → species-mu + CERTIFIED boundary (pos ∈ certificate): + any RS frame with bit ≠ b → pop-err + erase (l, RS); leave ('KD', keys) — one tagged bundle + naming every live α nested in l and every popped frame's + (g, i) [sound under fibre conditions (a)–(e), §6] + else, l = α_g(i, b) with bit = slot (DECODE): + retain ('K', g, i) — bit-free, branch-equal — UNLESS a + same-key frame exists (the ticket was replay-re-emitted; + the frame remains the answerable representation, no record: + W8 exclusivity by construction) + else (RETAIN-WHOLE): keep ('K', l) — same-slot arrivals with + different which-path data stay orthogonal + then fire: targets (pos, ↑, γ_g·L, A_g(b′)·T′), amplitudes the + Q_g row for input b; Q_h = H. Other shapes → species. + +retrace (pos, ↑, γ_g·L, A_g(b′)·T) → (parent+'f', ↓, L, + γ_g·A_g(b′)·T) [bt1's action on the γ head] + +anshead (g, ↓, L, γ_g·A_g(b′)·T) → (g, VB(g, b′, 0), L, T) +vb2 (g, VB(g,b′,k<2), L, •·T) → (g, VB(g,b′,k+1), L, T) +vvar (g, VB(g,b′,2), L, T) → (g, ↑, L, •^(b′+1)·α_g(i,b′)·T) + one bullet pays the gate application, the rest encode + the slot; the ticket carries the instance. + +root (root, ↑, ε, P_b·ρ) → RunDone(b̂, res) + (root, ↑, ε, l·•·ρ) → RunDone(I, res) + other ρ arrivals → RunDone(err, res) +halt/ticks RunDone → Halt(nf, res, 0) → tick → … +errors VB with a non-• non-classifier tape top; ↓-stuck on + μ/ρ; neutral constants under μ/ρ — all typed, complete + residue. ``` -## 4. Where the design came from (load-bearing derivations) - -**Classical transport is the whole protocol.** `call` does not move -the token to the argument; it flips ↑ at the leaf with `γ_g` on top, -and the untouched classical rules carry the probe through any -var/arg dereference plumbing to the gate's true argument — verified -through double indirection (`((λg.g) h) 0̂` style). Dually, after -`fire`, `retrace` is one rule and the classical rules run the inward -transit backward to the leaf — bideterminism doing what v1's entire -hand-built reverse machine failed to do. - -**The gate-application compensation (+1 bullet).** A literal -boolean's lambdas are real tree nodes: its answer exits by real `•4` -crossings that later pay real `•3` crossings. The virtual boolean -sits one application *deeper* (at the gate leaf, function of its own -application node), so every virtual exit emits one extra bullet to -pay that crossing: `vvar` emits `•^(b′+1)·α` (one for the gate app, -`b′` for the slot skip), `recall` emits `•••` (two virtual lambdas -plus the gate app). Both derived by replaying the literal-boolean -ground-truth traces, not stipulated. - -**Balance needs no padding.** The classical `0̂`/`1̂` exits are one -step apart (the `•4` for the deeper binder). In the virtual answer -the slot-2 bullet is consumed by the arrival *classifier*, not by a -step, so both branches take identical step counts from fire to the -next boundary. The earlier design guess (a pad rule) was wrong and -is gone. - -**Re-interrogation is real; the no-store mechanism works.** -Conjecture C1 of `token.md` §3.5 is **false**: an output's variable -can seek its argument by backtracking *through* the boolean -selection, re-dereferencing to the gate leaf (the negative witness -does this). The literal boolean answers re-entry by `bt2` on the -selection ticket — replaying its structure, net tape-neutral. -`recall` is the virtual mirror: it reads `b′` off the `α` ticket and -replays without firing. The outcome of a fired gate lives only in -the tokens the machine already carries — no store, as designed. - -## 5. Verification results - -Mechanized runs, exact arithmetic, norm ≡ 1 asserted at every global -step (a norm increase is a non-injectivity detector — see §6): - -Timing convention (pinned, conformance-reviewed): `RunDone` entry and -`Halt(…, 0)` entry are separate `U` steps; "Halt at" below is the -`Halt(…, 0)` step. - -| program | sectors | support | Halt at | R-frames | -|---|---|---|---|---| -| `h (h 0̂)` | `0̂`: 1 | 1 | t=49 | none | -| `h (NOT′ (h 0̂))` | `0̂`: 1 | 1 | t=64 | none | -| `(λb. b I I)(h 0̂)` | `I`: 1 | 2 | t=58, 60 | yes | -| `h (selNOT (h 0̂))` | `0̂`: 1/2, `1̂`: 1/2 | 4 | t=78, 79 | yes | -| `h 0̂` | `0̂`: 1/2, `1̂`: 1/2 | 2 | t=31 | none | -| `p★` (regression) | `0̂`: 1/2, `1̂`: 1/2 | 8 | t=99–103 | yes | -| 3-coin (regression) | `0̂`: 1/2, `1̂`: 1/2 | 4 | t=63, 65 | yes | - -The two coherent witnesses never create an R-frame — the repair -mechanism is invisible to coherent code, engaging exactly where -mandatory decoherence is the correct physics. `p★` completes at -norm 1 with the first coin decohered and the marginal (1/2, 1/2) — -the rewriting-picture sanity check: its branches both reduce to the -*same term* `h 0̂` post-selection, so any machine that merged them -would violate norm; refusing is correctness, not cost. - -Output-density report (the kernel as output-operator prototype): the -negative witness's two branches halt with the *same* `nf = I` and -distinct residues — `ρ_output` is `|I⟩⟨I|` with the orthogonality in -the traced-out garbage/time, the noninjective-output dilation -exactly. Lone `h 0̂` halts at equal ticks but with `b`-dependent -residues (the `α` ticket survives), so `ρ_output` is exactly -diagonal `diag(1/2, 1/2)` — the bare coin's output coherence is -unearned, as the contract's economy demands; earning it would -require code that uncomputes the ticket. - -HH's `1̂` amplitudes cancel *at the outer fire step* (t=33): the two -branches arrive at the boundary as a clean fibre — equal position, -log, tape-below-slot, and time — so everything after t=33 is a -single classical path. H–NOT–H does the same through NOT′'s real -selection legs (residue popped, lengths equal — the L2 obligation -confirmed for NOT′). The negative witness's branches keep distinct -residues and enter their `Halt(I)` chains two steps apart — -orthogonal two ways over, as unitarity demands, and its earlier -four-state form was the run that caught a real table bug (§6). - -**Column-Gram enumeration** (strengthened after conformance review): -the basis is the **structural** reachable graph — an amplitude-blind -BFS over column targets, so states that cancel to zero in the -aggregated evolution (e.g. the annihilated `A_h(1)` targets at HH's -outer fire) have their columns checked too. Ticks truncated at depth -2 (the tick shift is manifestly isometric beyond it); the -invocation-sector coordinate is suppressed in displayed states and -preserved trivially (the term is read-only), so per-program -enumeration plus sector orthogonality covers the direct sum. Every -column unit-norm, every distinct pair orthogonal, no stuck states -(totality): - -| program | structural basis | stuck | non-unit | non-orthogonal | -|---|---|---|---|---| -| HH | 82 | 0 | 0 | 0 | -| H–NOT–H | 104 | 0 | 0 | 0 | -| negative | 103 | 0 | 0 | 0 | -| selector | 173 | 0 | 0 | 0 | -| lone H | 53 | 0 | 0 | 0 | -| `p★` | 458 | 0 | 0 | 0 | -| 3-coin | 180 | 0 | 0 | 0 | - -(v1.2 numbers; the v1 table had two non-orthogonal 3-coin pairs — -the cross-time `recall` collision — and `p★` broke the norm outright -at step 89. Both are clean under the inert replay stack.) - -## 6. Findings register - -1. **The selector decoheres — the economy is measurable.** `NOT′` - (path-balanced) preserves coherence; `λb. b 1̂ 0̂` routes through - literal booleans whose step counts differ by one, and the machine - returns the mixed 1/2, 1/2 — mechanically deriving what the - rewriting drafts could only predict. "Coherence is earned" now - has a unit: token steps. -2. **Error residue must be the complete state — including control - phase.** The first negative-witness run produced norm 3/2: two - branches differing only in the VB `b′` register collided in an - error entry whose residue dropped the register. Third recurrence - of this bug class (v0 E1, v1 E1, here); the lesson is now a rule - shape: `Done` residues freeze the whole state, no exceptions. -3. **The norm assertion is a live non-injectivity detector.** Both - table bugs found during construction announced themselves as - norm violations in the negative witness — the witness battery - works as designed, and `λb. b I I` specifically earns its place. -4. **Valid normal forms are not errors** (conformance blocker, - fixed in v1.1). v1.0's root classifier sent the negative - witness's output `I` to the error sector, which made witness 8 - vacuous — it tested error-entry injectivity rather than the - architecture's same-output-never-merges assertion. The output - alphabet gained `I`, both branches now halt as `Halt(I, …)` with - orthogonal residues and times, and the general lesson is pinned: - only a *gate applied to* a non-boolean is a species error; - output classification belongs to readback. -5. **The battery accounting, per conformance review**: items 2, 3, - 4 (finite instance), 6, 7, and 8 are discharged at kernel scope; - items 1 and 9 are not applicable (no code exists — not - "vacuously passed"); item 5 (effect-free conservativity) is not - exercised by the kernel set and remains open. - -## 7. Honest scope and obligations discharged/remaining - -Discharged by the kernel: HH and H–NOT–H step-indexed traces; L2 -for `NOT′`; the negative witness (as of v1.1 — same halted `I`, -orthogonal configurations); orthonormal columns on the structural -reachable bases; totality on every structural state (zero stuck). -The erasure at `fire` is, per the conformance review's framing, -*proved injective on the enumerated kernel domains by the Gram -check itself*; its general schema remains conditional on the -arrival-determinacy lemma — and the input boolean `b` must never be -conservatively charged as residue (retaining it would destroy the -clean fibre; the design keeps `b` as the consumed quantum -coordinate). `recall` no longer erases (v1.2, §9.5); the governing -question became the transparency criterion of §9.6. - -Remaining, inherited or newly exposed: - -1. **Re-entry determinacy (new, replaces C1).** `recall` absorbs - `α_g(b′)`; injectivity needs `b′` recoverable from the retained - state. It holds on the kernel programs (the pending question - carries branch-distinct positions) and needs a general proof — - the sharpest open lemma, alongside general L1. -2. **Source-pattern disjointness**: `call`/`recall` partition by a - decidable negative premise — scan the maximal leading bullet - block; a same-gate `α_g(b)` beneath it means replay (arity - `b+1`) or arity-error, anything else means fresh call — but the - *semantic* implication (same-gate α after the block ⇒ replay of - the intended dynamic instance) is unproved without - instance-tagged tickets; other rule pairs remain - priority-ordered in the scratch model. -3. **The `•^(b′+1)·α` adjacency patterns** (recall trigger, arrival - shapes) are verified on the kernel programs; their totality over - all reachable shapes needs the general species-classification - proof. -4. **Boolean-output halt only** — the readback controller - (`token.md` §3.8) remains the largest undesigned component; the - root classifier here is its 1-bit special case. -5. **`t` unexercised** (needs `ℤ[ω]` scalars; table shape ready). -6. Gram enumeration is per-program reachable bases, not an - all-programs theorem — that is exactly the orthonormal-columns - proof obligation of architecture §9 item 1. - -## 8. Appendix — HH step-indexed trace +The guard family — `no-instance`, `alien-ticket`, `frame-conflict`, +`recall-err`, `replay-err`, `pop-err`, `species-mu`, `refire`, +`key-alias` — is the machine's whole answer to aliasing and misuse: +**every detectable manifestation is a typed error, never a silent +reinterpretation.** + +## 4. Instance identity and the selection lifecycle + +One `vvar` emits one ticket per fire. The ticket is consumed by +exactly one of: **recall** (→ replay frame, bit kept), **decode** +(→ bit-free `K` record, dead), or **certified erasure** (→ `KD` +bundle, dead). Replay re-emits fresh tickets off the frame; a +re-emitted ticket that decodes leaves no record while its frame +lives (W8). So per instance, the selection has at most one +*answerable* representation (ticket and/or frame, bit-carrying) +XOR *dead storage* (bit-free record) — and the leaf's guard order +makes every cross-class encounter typed (`key-alias`) and every +dead-key fresh call typed (`refire`). + +**Load-bearing derivations** (from the literal-boolean ground +truth, not stipulated): classical transport is the whole delivery +protocol — `call` only flips ↑ at the leaf and the untouched +classical rules carry the probe through arbitrary dereference +plumbing, dually for retrace (bideterminism); the +1 bullet in +`vvar`/`recall` pays the gate-application crossing a literal +boolean's real `•3`/`•4` pairs would pay; balance needs no padding +(the slot-2 bullet is consumed by the arrival classifier, not a +step); re-interrogation is real and store-free — the outcome of a +fired gate lives only in the tokens the machine already carries. + +## 5. Certificates: the fibre conditions and the canonical pipeline + +A certificate is a set of fire positions where erasure of `(l, RS)` +is proven transparent. Admission conditions, checked over the +certified reachable graph's arrivals: + +- **(a)** every RS frame's bit equals its arrival slot; +- **(b)** the retained key `(slot, T, log)` determines the entire + erased tuple `(l, RS)` — the fibre is a function; +- **(c)** non-vacuous: certification erases something the + conservative fire would retain; +- **(d)** erased cargo is γ-free (deleting an in-flight probe's γ + would break W5 — its μ survives unpaired); +- **(e)** **cross-slot bundle equality**: whenever both slots are + present at one `(T, log)`, the dead-key bundles agree — + `Dead(l₀, RS₀) = Dead(l₁, RS₁)`. The fibre function property is + per-slot, so nothing else forces the two H columns of one + intended fibre to leave equal decode bundles; divergent bundles + would silently decohere the interference the certificate exists + to buy, invisible to Gram (disjoint columns read as orthogonal). + +**The canonical pipeline.** `discover_total` iterates admission to +a fixpoint under hard caps (any cap hit or non-convergence → None) +and then **validates its own fixpoint**: the certified graph must +pass totality, zero guard reachability, clean Gram, zero err mass, +unconditional transparency at certified positions, reachable ⊆ +WF∧W7∧W8, and the mechanized disjointness check — else None. None +selects the conservative machine: total, unitary, typed — sound as +a machine, not ideal-preserving. U is total and well-defined on +every program (`h Ω` → None); the certificate is frozen machine +metadata, a deterministic function of the program. + +**The certificate is semantically load-bearing** (measured): HNH +certified computes `{halt0: 1}` — the physics, H·X·H|0⟩ = |0⟩ — +while its plain run decoheres to `{1/2, 1/2}`. A refused +certificate degrades coherence, never soundness; that is exactly +why admission must refuse rather than admit an unsound one. + +## 6. The invariant catalog (WF, the well-formed subtype) + +For Run states; reachable ⊆ WF is machine-checked per program, and +the machine's unitarity claims quantify over the subtype: + +- **W1** (log discipline): `|log| = level(pos)`. +- **W2** (record uniqueness + canonicity): at most one frame per + `(g, i)` in RS; RS canonically sorted (state identity is + order-free). +- **W3** (bit coherence): all instance-keyed entries with one + `(g, i)` — frames, tickets — carry one bit. +- **W4** (first-interrogation exclusivity): a VB-active state at + instance `i` holds no `i`-frame and no `i`-ticket (the guard + chain forces this). +- **W5** (probe pairing): deep-counted γ (through lp slices and + retained `K(l)` records; instance KEYS are frozen names, never + counted) = #μ(tape) + #A(tape) — every in-flight probe's γ is + matched by its μ or its answer token. +- **W6** (root frame): exactly one ρ, at the tape bottom. +- **W7** (certificate fibre coherence): at a certified boundary, + the erased `(l, RS)` equals the certificate's frozen fibre value + at the retained key `(pos, slot, T, log)`. States outside the + fibre relation are outside the certified domain subtype; the + domain lemma (reachable certified arrivals are in-domain) is the + per-program sweep. +- **W8** (representation exclusivity): per `(g, i)`, answerable + representations (live α anywhere in tape/log including suspended + slice cargo; RS frames) never coexist with dead storage (K/KD + records). Preserved by construction (§4); its boundary is the + typed `key-alias`. + +## 7. Theorems + +### 7.1 The coloring (closed form + uniform flip) + +```text +φ(s) = depth(pos) + [d = ↑] + Σ w(tape) + Σ w(log) + Σ w(RS) + k_VB (mod 2) +w(•) = w(γ) = w(μ) = w(α) = w(ρ) = w(R) = 0; w(A) = 1 +w(l) for l = (occ, slice) = (depth(occ) − depth(binder)) + Σ w(slice) +``` + +**Theorem (uniform flip).** Every Run→Run rule flips φ EXCEPT +`fire`, whose defect is exactly `1 − w(l)` for the erased/decoded +arrival lp. Proof is per-row algebra; the load-bearing case is +`var`/`bt2` (the teleport's distance is absorbed by the lp carrying +it as weight). Mechanically verified on every reachable Run→Run +edge of the battery, zero violations; every fire edge's measured +defect equals `1 − w(l)`. The weight assignment is **gauge-pinned**: +of all 256 assignments over the mark alphabet, exactly the +4-element orbit generated by two symmetries survives, and the orbit +fixes every deployed consequence. + +### 7.2 The branch-offset law + +Two branches created at one fire, meeting at a common later +boundary with no interior fires: +`len₀ − len₁ ≡ w(l₀) − w(l₁) (mod 2)`. Corollary: gate-free pads +shift branch-relative time evenly; synchrony requires *equal* +erased weights (H–NOT′–H fires with `w = 1` on both branches). +Interior fires shift parity by exactly the fire defect. + +### 7.3 The conservation theorem + +**Lemma A (attribution ledger).** In a pure λIAM run from a +k-probe start `(pos, ↓, L₀, •^k·base)` surfacing at +`(pos′, ↑, L₀, tape·base)`: `t ≡ k + b + 1 (mod 2)`, `b` = ALL +surface-tape bullets. *Proof:* every rule is the birth, death, or +transport of exactly one tape/log individual; slice +capture/release is zero-cost suspension preserving location parity +`p = 1`; the invariant `count(x) ≡ B(x) + p(x)` live, +`≡ B(x) + 1` dead/suspended, summed at the surface with +`−r ≡ r (mod 2)` absorbing probe-bullet survival. (Position-blind; +lps recirculate tape→log→tape, and the ledger is indifferent.) + +**Lemma B (coloring).** `t ≡ (|pos′| − |pos|) + 1 + w(l)` — the +depth term is real (`λ1` probed from its body surfaces at the root +in one step with `w = 1`). + +**Theorem.** `w(l) ≡ k + b + |pos′| − |pos| (mod 2)`. Deployed +specializations launch and surface at the same position, so +`w(l) ≡ k + b`: the boolean protocol (k = 2) gives +**`w(l) ≡ exit slot`**; the haltI sector gives `w ≡ 1`. + +**Corollary (kernel transfer).** A fire-free, VB-free, mark-free +probe segment is literally a pure λIAM run of the argument (no +`var` can cross the log's γ without capturing it), so `w ≡ slot` +transfers to the kernel. Each hypothesis is load-bearing and each +failure mode is a named mechanism: interior fires (the defect +law), VB pattern births (one-step-one-individual breaks — why gate +routing is the parity escape), mark capture (segment closure +breaks — why `w(α) = 0` decouples weight from step count). +Mark-free geometric readback of classical data therefore has odd +branch offset — **intrinsic decoherence; coherent routing is +exactly gate-mediated**. + +**Mechanization.** The ledger invariant is asserted after every +step of every run in lockstep conformance with the uninstrumented +stepper. Exhaustive: all closed pure terms ≤ size 11 (41,272), +k ∈ {1,2,3} probes — 55,727 surfacings at ≤10, 14,452 at the +current sweep tier, zero failures. Battery cross-check: zero +mark-free arrivals violate `w ≡ slot`; marked arrivals split both +ways as virtual ancestry predicts. + +### 7.4 Range disjointness (on WF∧W7, corrected statement) + +For two certified-fire sources at one boundary: + +```text +different retained spectator (pos, log, T, incoming KS) + ⇒ disjoint targets (targets embed all of it verbatim); +same spectator, same slot + ⇒ the SAME source (W7: the fibre is a function; state identity); +same spectator, opposite slots + ⇒ identical target pair — requires equal decode bundles, which + is admission condition (e) — carrying the two H rows: + orthogonal columns (computed inner product 0). This case IS + the interference mechanism, not a defect. +``` + +Mechanized for real: the checker collects reachable sources with +full state, constructs their fire targets via the step function, +compares decode bundles cross-slot, and computes column inner +products. Zero violations over every certified graph. Two audit +countermodels are permanent regressions here: the extra-frame +collision (W7-excluded AND target-disjoint — the popped frame +leaves its record) and the doctored bundle-divergent fibre +(rejected by condition (e)). + +### 7.5 What is NOT claimed (the alias gap) + +No injectivity theorem for logged-position instance keys is +claimed or assumed. If two dynamic copies alias one `(g, i)`: +divergent selections between bit-carrying representations are +typed (`frame-conflict`); cross-class encounters are typed +(`key-alias`); dead-key fresh calls are typed (`refire`). What +remains open: an **alias-tolerant local transition theorem** — +that agreeing-bit aliases cannot silently merge histories that +should stay orthogonal. λIAM logged-position uniqueness (which +would close this outright) is a **conjecture**; until one of the +two is proven, the soundness claims are conditional on it, stated +as such, with every *detectable* manifestation typed. + +## 8. The typed fragment + +The judgment (`typecheck.py`): programs have the shell form +`(λh.λt. body) h t` with shell arguments syntactically exactly +`Gate('h')` then `Gate('t')` and **no gate literal inside the +body**; the shell binders are SIGNATURE bindings — +`h, t : ∀a. (a→a→a) → (a→a→a)` instantiated fresh at every +occurrence (rank-2 with respect to the shell); the body is +inferred by first-order unification with occurrence-polymorphic +signature constants (no lets, no generalization); the result type +is free (haltI-sector programs are function-typed). **h-only** +additionally requires no occurrence resolve to the `t` binder. + +Fragment table (18-program suite): **15 typable h-only**. Outside: +`dup` (self-application — deliberately, the untyped copy +regression), `q` (E = λz.Iz vs N branch types ununifiable — the +wire imbalance `qprime` was built to repair; `qprime` types +clean), `dupcall` (NOT′/EP ununifiable). All escapes — `h h`, +gate literals in bodies, swapped or doubled shell arguments — +rejected. + +## 9. The claim + +Over programs that are (i) typable h-only under the signature +judgment and (ii) whose canonical pipeline reports +`semantic_coverage`: **the kernel is total and Gram-clean (U an +isometry on the reachable basis), certified erasure is transparent +(fibre-proven, W7-coherent, disjointness mechanized), and every +failure mode is typed and visible — never silent.** +Marginal-correctness against ideal quantum semantics is +established per-program against hand-computed physics for the +eighteen (independently recomputed by audit #1 for the +interleaving set); the *general* agreement theorem is explicitly +the compilation theorem's obligation (STATUS docket), not claimed +here. The claim is conditional on the alias gap (§7.5), stated as +such. + +Standing fences, all typed: literal gate application (untypable), +the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback +controller's job), and every guard in §3. + +**The PASS re-claim is gated on fresh-context independent audit +#2; the verdict will be registered here.** + +## 10. Verification state + +Eighteen-program suite (twelve sectors + the audit witnesses +`buried`/`palpha`/`dupcall` + stressors `weave`/`hweave`/`qq`): + +| program | basis | dynamics | note | +|---|---|---|---| +| HH | 82 | 0̂: 1 | earned coherence (inner cert + decode) | +| HNH | 104 | 0̂: 1 | certificate load-bearing (plain: ½/½) | +| negative | 83 | I: 1 | haltI sector; recall regression | +| selector | 106 | ½ / ½ | | +| lone | 53 | ½ / ½ | | +| pstar | 242 | ½ / ½, sup 4 | replay regression | +| 3coin | 180 | ½ / ½, sup 4 | | +| q | 218 | ½ / ½, sup 4 | untyped (battery-only); time offset 35 | +| qprime | 246 | ½ / ½, sup 4 | q's typed repair; offset 7 | +| q2 | 115 | ½ / ½, sup 4 | offset 3 | +| dup | 90 | ¼ / ¼ / I ½ | untyped copy-discrimination regression | +| Ccoll | 143 | ½ / ½ | C-collapse class (decoheres, correctly) | +| buried | 432 | ½ / ½, sup 4 | audit-1 witness, healed (replay record) | +| weave | 290 | ½ / ½, sup 4 | interleaving stressor | +| hweave | 225 | ½ / ½, sup 4 | coherence across an interleaving | +| qq | 2,192 | ½ / ½, sup 8 | Q in Q, double-crossed re-seeks | +| palpha | 474 | ¼ / ¾, sup 3 | audit-2 witness: cert refused, physics via fallback | +| dupcall | 632 | typed err ½ + ¼/¼ | untyped; refire positive control | + +All: zero stuck / non-unit / non-orthogonal columns; guards silent +except `dupcall` (expected). `discover_total` == frozen CERTS on +all 18; `h(Ω)` → None. Negative controls: pstar × wrong +certificate reaches `pop-err`; dupcall × v1.7-era certificate +reaches `refire`, all-err. WF/W7/W8 sweeps + disjointness: zero +violations; three permanent collision regressions. Conservation: +zero failures. Polarity/terminal chains/gauge: zero violations, +orbit exact. Audit #1's independent reproducer, rerun: all probes +clean or typed; fuzz 250/250 no violation (66 conservatively +refused). Basis counts vs v1.2 reference: `negative` 103→83, +`selector` 173→106, `pstar` 458→242 — v1.7-era, real, owned +(canonical RS sorting + replay-arm restructure merge order-variant +states); marginals and supports never moved. All measurements +seconds-scale on the M5 Max. + +## 11. Chronicle + +Full narratives: `docs/ledger/2026-08.md` (and 2026-07); complete +superseded registers: this file's git history (through commit +`ed85767`). + +| version | one line | verdict that shaped it | +|---|---|---| +| v1.0–v1.2 | three-program kernel; review killed store-shaped replay; inert replay stack | Codex review: transparency, not inertness | +| v1.3 | instance-indexed tickets/frames, replay, certified pop, time register | review registered | +| v1.4 | polarity coloring closed form, canonical certificates, conservation conjecture | C-collapse countermodel | +| v1.5 | encoded fire: conservative decode default, certified erasure | ratified amendment | +| v1.6 | conservation theorem proved + mechanized; gauge pinned; discover_total | fresh review: math CONFIRMED, scope FAILED (Q) | +| v1.7 | the replay record (idempotent recall, deep keyed replay); WF subtype; cargo conditions | **fresh audit #1: FAIL** (WF collision, Pα, alias gap, honesty) | +| v1.8 | decode records + refire guard; self-validating admission; W7; typed fragment | working review: two structural holes | +| v1.9 | KD bundles + condition (e); key-alias guard + W8; real disjointness checker; syntactic fragment boundary; docs current-only | **fresh audit #2: pending** | + +## 12. Appendix — HH step-indexed trace Notation: `b` = bullet, `L(path|n)` = logged position (slice length n), `gh/mh` = `γ_h`/`μ_h`, `Ahb′` = `A_h(b′)`, `ahb′` = `α_h(b′)`, @@ -451,1344 +532,3 @@ t= 49 halt 1 Halt(0̂, residue, 0) [separate U step] t= 50 tick 1 Halt(0̂, residue, 1) … Mass 1 on 0̂, amplitude 2/√2² = 1 exactly. ``` - -The H–NOT–H and negative-witness traces (63 and 59 steps) follow the -same notation and are mechanically reproducible from the table; their -checkpoints (fires, anshead/vvar windows, recall events in the -negative witness, terminal entries) are as reported in §5. - -## 9. v1 review verdict (registered) - -**FAIL for kernel v1; the token-machine route is not implicated.** -The reviewer reimplemented §3 independently (adding the scratch -model's unstated `recall`-before-`call` priority) and reproduced all -five §5 results exactly. What holds, independently verified: HH -cancellation at the outer fire; H–NOT′–H step balance with no -padding (the slot-bullet-consumed-by-classifier derivation -confirmed); the negative witness's orthogonality; the -gate-application `+1` bullet count through one- and two-hop identity -plumbing. - -### 9.1 The countermodel - -`p★ = λh.λt. ((((h 0̂) h) h) 0̂)`: the first coin selects between -two `h` occurrences; the selected gate is freshly applied to `0̂`, -creating nested same-kind answer tickets. `recall` maps, for -identical retained `L, T`, - -```text -C₀ = (g, ↓, L, •·α_h(0)·T) C₁ = (g, ↓, L, •·•·α_h(1)·T) -``` - -to the identical `(g, ↑, L, •·•·•·T)`. Both are reachable in `p★` -at global step 89 with amplitude `1/(2√2)` each: mass 1/4 → 1/2 per -colliding pair, norm 1 → 3/2 — reproduced against our evolver -bit-exactly. A second mandated regression, -`λh.λt. ((h 0̂) (h 0̂) (h 0̂))`, conserves norm on the aggregated -run but its structural Gram exposes the same collision across time -slices (2 non-orthogonal column pairs, reproduced). Both programs -are now mandatory regressions for any successor table. - -### 9.2 The structural diagnosis - -Re-entry determinacy is **false**. The literal-boolean analogy -omitted the load-bearing part: literal `0̂`/`1̂` replay through -*distinct code positions*, and position retains the discriminator -through the replay. The virtual construction parks both answers at -the same gate leaf and then erases the only remaining discriminator -— classical irreversible erasure, not token transport. Two -secondary breaks: the `α` tag (gate kind, bit) cannot identify -which dynamic invocation owns a ticket, so same-kind nested -invocations alias; and `call`/`recall` source domains overlap -(every `recall` source is a `call` source), resolved only by -implementation priority — the formal table needs structural -disjointness. - -### 9.3 Gram-methodology gaps (for the general theorem) - -The five-program enumeration is a regression battery, not the -isometry theorem. A general verifier needs: structural source -disjointness; pairwise columns across every time slice's reachable -union; graph reachability before amplitude aggregation; arbitrary -nested exponential contexts and same-kind instances; `h`/`t` -cross-fibre and δ/non-δ range checks; the typed `RunDone → Halt` -entry checked mechanically; general ring amplitudes (the scratch -`(m, k)` representation cannot express `1 + 1/√2`); whole-term -identity in the sector coordinate. - -### 9.4 Repair directions (unadjudicated) - -`recall` cannot consume `α_g(b′)` into a common classical target. -Candidate shapes from the review: a dynamically instance-indexed -replay ticket (not merely gate kind + bit); a partial-permutation -replay retaining enough to reconstruct `b′`; structural separation -of fresh call from replay; erasure only where independent retained -state reconstructs the discriminator, or inside an actual unitary -block. A dedicated replay frame `R_g(instance, b′)` restores local -injectivity, but carrying it forever suppresses wanted interference: -**reversible ticket cleaning is now the central design problem** — -the same "coherence is earned" economy, now at the level of the -machine's own bookkeeping rather than user code. - -### 9.5 The v1.2 repair (inert replay stack) - -`recall` no longer erases its discriminator: the state gains a -transport-inert replay stack `RS` that only `recall` pushes -(`R_g(b′)`), no transport or classifier rule reads, and terminal -entry freezes into the garbage factor. The countermodel pairs now -map to targets differing in `RS` — locally injective, and both -mandated regressions pass (norm 1; structural Gram clean, `p★` -basis 458). The design argument for *inert rather than cleaned*: -a re-interrogated coin has been consumed non-injectively by its -selection (in `p★` both branches reduce to the same term -post-selection, so merging them would violate norm — mandatory -decoherence is correctness), and no program has been found where a -recalled instance's branches may legitimately merge later; the -coherent witnesses never recall at all. If such a program exists, -the frame needs reversible cleaning and the design reopens — that -question rides to the re-review. Fork (A)'s minimality program -applies to R-frames verbatim: each is charged conservatively, and -any later transparency lemma that proves one recoverable removes it -and enlarges the raw-interfering class. - -### 9.6 The v1.2 re-review: transparency, not inertness (registered) - -**Verdict: FAIL for v1.2 as the gate; the repair itself is locally -real** (independently reproduced: push injectivity fixes the p★ -pairs; all seven rows verified). Two deliveries: - -**The mandatory-decoherence claim is refuted.** With `E = λz. I z` -and `N = λz. z 1̂ 0̂`, - -```text -q = λh.λt. h ((((h 0̂) E) N) 0̂) -``` - -selects between identity and NOT, so `(((b E) N) 0̂) = b` on the -boolean basis — an *injective* transport of the coin through -selection; the circuit is H;id;H and physics demands the branches -re-interfere at the outer gate (mass 1 on 0̂). The blanket premise -"a recalled coin has been consumed non-injectively" is false. The -correct criterion (review-supplied, adopted): **`R_g(b)` is -transparent at a reachable boundary iff `b` is a single-valued -function of the non-R core there** — frames are mandatory exactly -on predecessor fibres where the branch images overlap (p★), and -cleanable where the live core still carries the bit (q). Cleanup -belongs *inside the δ block* with provenance matching: - -```text -|g, b, κ, R_i(b)·RS⟩ ↦ Σ_b′ Q_g[b′,b] |land, b′, J(κ), RS⟩ -``` - -which requires dynamically instance-indexed frames — `(kind, bit)` -cannot name its owning invocation. Inert RS stands as the sound -conservative first point of the transparency program, not as final -semantics; permanent freezing is selective full logging. - -**A more basic totality failure.** On the actual v1.2 table, `q` -never reaches the RS question: its structural graph (335 states) -has three stuck states — all with an `α` ticket at the log head -inside the selected function's plumbing (the uncovered -recall-under-deeper-γ case) — the live run leaks norm before t=82, -and both outer arrivals misclassify as slot 0. Verified bit-exactly -against our evolver. The α/γ transport layer does not yet carry a -recalled coin through distinct reversible selected functions. - -**The next gate** (review-mandated): `q` joins the mandatory -regressions; repair α/γ transport to totality on q's graph; -correct same-time slot-0/slot-1 outer arrivals; instance-indexed -replay frames; a first proved transparency/pop rule; and `q` -finishing at mass 1 on `0̂` with no residual replay discriminator. -Also open, restated: general `ℤ[1/√2]` amplitudes in the verifier -(`(m,k)` cannot express `1 + 1/√2`), H/T cross-fibres, effect-free -conservativity, general readback. - -## 10. v1.3 — replay, instance frames, the pop rule, and the time register - -Scratch artifacts: `kernel.py` (v1.3 evolver), `kernel_v12.py` -(archived v1.2), `suite.py` (the ten-program battery), `q_diag.py` -(the diagnosis run). All scratchpad-only per the no-code gate. - -### 10.1 The diagnosis: the ticket is single-use, replay is not - -The full 81-step trajectory to `q`'s first stuck state, read against -the literal ground truth (`q` with the coin replaced by literal -`0̂`/`1̂` — both literal variants run total, 93/126 basis states, -zero stuck), gives a clean taxonomy of coin visits: - -- **Visit 1** — fresh selection descent (`•2 •2 var (•4)`): the - literal consumes the two λ-crossings and emits the selection - variable's logged position. Virtualized by fire + VB + `vvar` - (the ticket `α` *is* that logged position). -- **Visit 2** — ticket transit (`•2 bt2 •4 •4`): the restored lp - re-enters and jumps through the coin. Virtualized by `recall` - (v1.1), which consumes the ticket. -- **Visit 3** — a SECOND fresh selection descent, exactly the - visit-1 episode again: the literal machine re-derives the - selection from the static term. The virtual coin has no term to - re-derive from, and the ticket is gone. v1.2 misclassified this - as a fresh call, re-fired the coin (extra fire measured at t=70), - and the mismatched ticket jammed in the selected function's - plumbing — all three stuck states are downstream corpses of that - one wrong classification. - -The repair insight: after the first recall, the branch's selection -memory is exactly the replay frame in RS. **The replay stack is not -just an injectivity dump; it is the replay memory, read -nondestructively.** - -### 10.2 The v1.3 rules - -**Instance identity.** The dynamic instance of a gate invocation is -the logged position of the invoking occurrence — in λIAM lineage, a -logged position is precisely the machine name of a dynamic subterm -copy. At every gate-leaf entry the invoking occurrence's lp sits at -the log head (arg-entry is structurally forced), so the identity is -already in hand: `i := log[0]`. Tickets and frames carry it: -`α_{g,i}(b)`, `R_{g,i}(b)`. - -**recall (v1.3).** Guard now requires the ticket's instance to -equal the current log-head lp — the review's "semantic ticket -ownership" obligation, discharged structurally. A same-gate -foreign-instance ticket is a typed error. Pushes `R_{g,i}(b)`. - -**replay (new).** At a gate leaf, `↓`, with a leading bullet block -of length ≥ 3, no same-instance ticket on the tape, and RS head -`R_{g,i}(b′)` with `i` = the current log-head lp: - -```text -(g, ↓, i·L, •³·T, R_{g,i}(b′)·RS) → (g, ↑, i·L, •^(b′+1)·α_{g,i}(b′)·T, R_{g,i}(b′)·RS) -``` - -Derived from the literal visit-3 episode: consume the two selection -bullets plus one gate-application compensation, emit a fresh -ticket; the frame is read, not popped — the fresh ticket may be -recalled again later, pushing another frame (measured: `q`'s -branches accumulate 2–3 same-bit frames). A leading block < 3 with -a same-instance frame (an under-applied re-seek) is a typed error, -out of v1.3 scope. - -**call.** Fires only when neither a same-instance ticket nor a -same-instance frame is present. A different instance's frame at the -RS head does not block a fresh call (p★'s second invocation). -Frame reading is head-only; interleaved re-seeks of distinct -recalled instances are out of scope (typed error). - -**pop (transparency cleanup).** `step` takes a per-program -certificate: a set of fire boundaries. At a certified boundary the -fire strips every frame whose bit equals the arrival slot, in the -same unitary step; a leftover mismatched frame falsifies the -certificate and becomes a typed error (`pop-err`), never a silent -reinterpretation. Soundness on the reachable span — injectivity of -fire-with-pop against every other source — is exactly what the -structural Gram verifies; the certificate's discovery is manual in -v1.3, its *verification* is the machine checker. This implements -§9.6's provenance-matched cleanup schema with the frame's bit as -the recovered function of the live core. - -### 10.3 Results - -The ten-program battery (`suite.py`), structural Gram -(amplitude-blind BFS, cancelled targets included, ticks truncated -at depth 2) plus dynamic evolution with per-step exact norm -assertion: - -```text -program basis stuck defects dynamic residue frames -HH 82 0 0 halt0 mass 1 none -H–NOT′–H 104 0 0 halt0 mass 1 none -negative 83 0 0 Halt(I) 1/2+1/2 R(0)/R(1) inert -selector 106 0 0 1/2, 1/2 R(0)/R(1) inert -lone h 53 0 0 1/2, 1/2 none -p★ 242 0 0 1/2, 1/2, support 4 R(0)/R(1) inert -3-coin 180 0 0 1/2, 1/2, support 4 R(0)/R(1) inert -q (cert) 218 0 0 1/2, 1/2, support 4 NONE — popped -q′ (cert) 246 0 0 1/2, 1/2, support 4 NONE — popped -q2 (cert) 115 0 0 1/2, 1/2, support 4 NONE — popped -``` - -- **Totality restored**: `q` runs total (0 stuck of 256 basis - states uncertified, 218 certified); slot-0/slot-1 outer arrivals - are correct per branch — the injective transport works. -- **v1.2 basis drift explained and owned**: negative 103→83, - selector 173→106, p★ 458→242. The v1.2 counts included - wrong-semantics double-call subgraphs (visit-3 re-seeks that - fresh-called and re-fired). Measured directly on p★: v1.2 has - five dynamic fire events (t = 18, 49, 51, 63, 65), v1.3 has - three (18, 49, 51); v1.2's reported support 8 was - transport-bug-inflated — the correct support is 4 with marginals - unchanged. HH / H–NOT′–H / lone / 3-coin are bit-identical to - v1.2 (no re-seek anywhere in their graphs). -- **The pop is sound and does real work**: certified `q`-family - runs halt with EMPTY replay stacks — garbage-free halting, the - bounded-garbage factorization the architecture requires — and - the Gram stays zero-defect with the pop enabled. p★'s frames - remain inert (mandatory, per the transparency criterion). -- **Negative control**: certifying p★'s boundaries (unsound — its - frames are mandatory) yields `err` mass 1/2 via `pop-err`, with - zero Gram defects and no norm loss: an unsound certificate is - caught as a typed error, not silent unitarity damage. - -### 10.4 The time register (new finding) - -With frames cleaned, `q`'s branches still do not interfere: they -arrive at the outer boundary at different global steps, and the -tick register makes any offset permanent decoherence. Arrival -telemetry (branch-0 vs branch-1): - -```text -q (Codex's, E = λz. I z) t = 84 vs 119 offset 35 -q′ (wire-balanced, E′ = λz. z 0̂ 1̂) t = 112 vs 119 offset 7 -q2 (minimal, h ((h 0̂) 0̂ 1̂)) t = 48 vs 51 offset 3 -``` - -Wire-balancing (E′ position-isomorphic to N = λz. z 1̂ 0̂, -differing only at two Var leaves — the NOT′ index-swap trick lifted -one level) removes the interior asymmetry (35 → 7); the residue is -the slot routing itself. - -**Mechanism — pattern vs step.** A slot bullet that survives to the -boundary as part of the arrival pattern (`•·l·μ` vs `l·μ`) costs no -time — this is why HH and H–NOT′–H arrive branch-synchronous and -cancel exactly. A slot bullet consumed by a `•3` crossing an -f-node of the selection spine is a step. Geometric selection -step-encodes; the transported bit itself skews the clock. - -**Odd-offset invariance (measured).** Every program-level padding -tried shifts branch-relative time by an EVEN amount: I-wraps +8 -per wrap (k = 0..4 measured), NOT′-wrap +16, η-expansion +16, -pre-decided literal-selection pads +12/+16; a pad inside the -unselected function shifts nothing (traversal-sensitivity -control). Reachable offsets for q′ sit in −7 + 4ℤ — never 0. Token -round trips cost even; the odd base offset traces to the odd -teleport savings of the `0̂` answer episode vs `1̂` (var jumps -distance 2 in one step). Conjecture, to be adjudicated: the -branch-relative offset of any step-encoded selection is odd — -mass-1 interference is unreachable by program padding under this -timing. - -**Consequences.** (1) A machine-level uniform retiming cannot fix -this: how many slot bullets are consumed as steps is contextual -(depends where the ticket surfaces), so no per-rule charge -equalizes all programs — and the classical substrate's timing is -pinned. (2) Time-balance is therefore a *compiler* obligation in -this machine class, and if odd-offset invariance holds, coherent -compilation must route data flow through pattern-encoded -(index/wire) transport only — which the H–NOT′–H witness already -inhabits — treating geometric selection as a decohering (classical) -primitive. (3) Review-gate item 6 splits: "no residual replay -discriminator" HOLDS (the pop delivers it); "mass 1 on 0̂" is -blocked by an independent, now-measured channel that the -transparency criterion must incorporate — the branch bit is -single-valued on the non-R core *per time slice*, and the time -slice itself carries the bit. The transparency theorem needs time -in the core. - -### 10.5 Scope and standing obligations - -Head-only frame reading (interleaved multi-instance re-seeks → -typed error, no reachable instance in the battery); under-applied -re-seeks (leading block < 3) → typed error; certificate discovery -manual (verification mechanical); γ/μ marks remain kind-only -(stack-paired by nesting discipline — Gram-policed per program; -instance-indexing them is mechanical if a countermodel appears). -Restated from §9: general ℤ[1/√2] amplitudes in the verifier, H/T -cross-fibres, effect-free conservativity, general readback. - -### 10.6 The v1.3 review verdict (registered) - -Adversarial round (thread `qalc-token-machine`, fresh independent -run, 2026-08-09): **FAIL as the formalization gate; PASS for the -replay repair.** Every v1.3 number was independently reproduced — -all basis counts, marginals, supports, the p★ fire events -(confirming t = 63/65 were spurious and support 8 was -bug-inflated), the q-family arrival telemetry, and the instance -invariant (every downward gate-leaf entry in every graph has an -ordinary lp at the log head; the TOP fallback never fires). - -**Parity: no odd pad found, and a theorem route supplied.** The -review searched 156 closed identity-context pad variants (up to -three nested applications of `I M`, `(λx.M) I`, `0̂ M I`, `1̂ I M`, -`λz.M z`) around q′'s branch-0 function plus a branch-local -coherent HH pad (`λz. h (h (E′ z))`, +48): every shift even, every -offset odd, no stuck states. Composed geometric selections stay -odd: id∘id Δ=9, NOT∘NOT Δ=1, id∘NOT Δ=7, NOT∘id Δ=1 — odd -selections do not cancel. The proposed proof shape is a -**port-polarity coloring**: give ports a bipartite polarity; each -ordinary transition crosses one interaction edge and flips -polarity; a closed pad entering and exiting through one interface -has equal endpoint polarity, hence even cost; a geometric boolean -route's two computational slots end at opposite polarity (the slot -bullet crossed a real f-node via `•3`); pattern encoding is -exceptional because the δ classifier consumes its slot bullet -without a machine transition, quotienting the one-step difference — -exactly why HH/H–NOT′–H synchronize. Status: odd-offset invariance -HOLDS empirically; the even-pad lemma is a promising theorem; "the -coherent fragment is exactly the pattern-encoded class" is NOT YET -PROVED — it needs the row-by-row coloring over the full extended -table, the compressed `replay` rule checked directly rather than -via its literal expansion. - -**Blocker 1 — the pop is not the frozen clean δ fibre.** At a -certified boundary the two logical inputs are -`|0, R_i(0)·…, κ₀⟩` and `|1, R_i(1)·…, κ₁⟩`: the source spectator -depends on `b`, so this is not `U|q,b,κ⟩ = Σ Q[b′,b]|b′,J(κ)⟩` -with a common κ. The correct object is an **encoded fibre**: an -isometry `E_m|b,κ⟩ = |b, F_m(b,κ), κ⟩` with certified reachable -range and `U·E_m|b,κ⟩ = Σ_b′ Q[b′,b]|b′, J_m(κ)⟩`. Either the -architecture's clean-fibre contract is amended to admit encoded -fibres, or replay frames become a formally decoded logical -coordinate outside κ. - -**Blocker 2 — Gram/norm is not certificate soundness.** Our own -negative control is the countermodel: the wrong p★ certificate -passes the structural Gram and norm perfectly while sending mass -1/2 to `pop-err`. Certificate validity must separately require: -zero structurally reachable `pop-err`; the complete RS stack being -the certified function `F_m(b,κ)`; no framed/frameless predecessor -collision after erasure; and preservation of the intended -non-error semantics. Certificates must also become **canonical**: -a frozen function of the immutable program sector (a proved -stack-shape predicate, not an externally supplied fire-position -set) — otherwise the same program denotes different dynamics under -different certificates and `U` is not well-defined. - -**Blocker 3 — buried same-instance frames (FIXED in-session).** -The registered scope text claimed interleaved re-seeks raise a -typed error; the code actually fell through to fresh `call` when a -same-instance frame sat under another instance's frame — the v1.2 -double-fire class waiting to recur. Corrected immediately: a -buried same-instance frame is now the typed error `buried-frame`, -and the silent TOP instance fallback is removed (`no-instance` -typed error). The full battery is bit-identical after both -corrections (neither state is reachable in it), and the review's -copy-discrimination probe `(λx. x x) (h 0̂)` — two dynamic -instances of one argument occurrence, distinguished only by log -slices — joins the battery (`dup`: 90 basis states, total, -zero-defect, sectors halt0 1/4 / halt1 1/4 / haltI 1/2). - -**Ratified**: instance = logged position is "exactly the λIAM -structure intended to name exponential copies"; owed as proofs: -every valid gate-leaf entry has an lp at the log head, and equal -lps name the same dynamic copy. - -**The v1.4 gate**: (1) formalize the port-polarity coloring and -check every rule row; (2) the encoded-fibre theorem or architecture -amendment; (3) certificate validity = zero reachable `pop-err` plus -the RS-function property, not Gram alone; (4) certificates as -proved stack-shape predicates; (5) the canonical -program→certificate relation; (6) buried-frame handling proved or -ruled out (typed error now, resolution owed); (7) the two -logged-position invariants; (8) exact verification beyond -single-monomial `(m,k)` amplitudes before general h-only claims. - -## 11. v1.4 — the polarity theorem, canonical certificates, and the conservation conjecture - -Scratch artifacts: `polarity.py` (the coloring checker), `certify.py` -(canonical certificate discovery + validity), `kernel.py`/`suite.py` -upgraded to exact `ℚ[√2]` amplitudes. All scratchpad-only. - -### 11.1 The coloring, with its closed form (gate item 1) - -Define, on Run states of the full v1.3 table: - -```text -φ(s) = depth(pos) + [dir = ↑] + Σ w(tape) + Σ w(log) + Σ w(RS) + k_VB (mod 2) - -w(•) = w(γ) = w(μ) = w(α) = w(ρ) = w(R-frame) = 0 -w(A) = 1 -w(l) for l = (occ, slice) = (depth(occ) − depth(binder)) + Σ w(slice) -``` - -— a logged position carries its own binder–occurrence tree distance -plus, recursively, the weight of everything captured in its slice. - -**Theorem (uniform flip).** Every rule of the table with Run source -and Run target flips φ — the eight classical rules, `call`, -`recall`, `replay`, `anshead`, `vb2`, `vvar`, `bt1g` — EXCEPT -`fire`, whose defect is exactly `1 − w(l)` where `l` is the -which-path logged position erased at the boundary. Terminal entries -chain linearly off unique predecessors (complete residues) and flip -by assignment. - -*Proof* is per-row algebra, two lines each; the load-bearing case is -`var`/`bt2`, where the teleport's distance is absorbed by the lp -carrying that distance as weight (`Δφ = w(lp) − Σ slice − d + 1 = -1`), and the constraint propagation fixes the remaining weights -(`call` forces `w(γ)+w(μ) ≡ 0`; `recall`/`replay` force -`w(R) ≡ w(α) ≡ 0`; `anshead`+`vvar` force `w(γ)+w(A) ≡ 1`). -Mechanically verified: every Run→Run edge of all eleven reachable -graphs — 1,518 edges — has the predicted Δφ, zero violations, and -every fire edge's measured defect equals `1 − w(l)`. - -### 11.2 The branch-offset theorem (the parity result) - -For two branches created at one fire and meeting at a common later -boundary with no interior fires: - -```text -len₀ − len₁ ≡ w(l₀) − w(l₁) (mod 2) -``` - -where `l_b` is branch b's erased arrival lp. Verified: q/q′/q2 -offsets 35/7/3, all with `w(l₀)=0, w(l₁)=1` — parity 1 ✓. - -**Corollary (even pads — Codex's search, now a theorem).** A -gate-free pad adds no fires and leaves both endpoints' φ unchanged, -so it shifts branch-relative time by an even amount. The measured -+8/+12/+16 menu and the review's 156-variant all-even search are -instances; an odd gate-free pad that preserves the arrival lps -cannot exist. - -**Refined coherence condition.** Synchrony requires *equal* erased -weights, not zero: H–NOT′–H's fires show `w = 1` defects on BOTH -branches (its arrival lps are NOT′'s x/y occurrences, distances -3 and 3 — the index swap moves occurrence depth in step with binder -depth). The pattern class is the equal-weight class. - -### 11.3 The weight-conservation conjecture (what remains of "the coherent fragment") - -Answer-term variants that try to re-weight a literal boolean's -readback all fail — measured: `q2` (0̂,1̂) offset 3; (λλ.I x, 1̂) -offset 1; (0̂, λλ.I y) offset 7; both wrapped, offset 3 — every -variant keeps `(w₀, w₁) = (0, 1)` up to swap. The mechanism is the -slice: an `a`-step in the readback path adds `1 + w(captured lp)` -to the surfacing weight, and in gate-free plumbing the captured -lp's weight telescopes so that `w ≡ exit slot` is conserved. -H–NOT′–H evades conservation because its slice captures the coin's -*virtual ticket* (`w(α) = 0` by fiat) — gate-mediated routing is -the parity-free transport. - -**Conjecture (conservation).** Along gate-free readback of a -boolean value, the surfacing lp's weight is congruent to the exit -slot. Hence geometric selection of *classical data* always has odd -offset (decoheres intrinsically), and the coherent fragment is -exactly gate-mediated (pattern) routing. The proof target is a -telescoping lemma over the `a`-step capture algebra; the q3 variant -table is its evidence base. - -### 11.4 Canonical certificates (gate items 3, 4, 5) - -`discover(term)`: iterate to fixpoint — BFS under the current -certificate; admit a fire boundary iff over its reachable arrivals -(a) every frame bit equals the arrival slot, (b) RS is -single-valued per fire-target fibre `(path, log, slot, l, T)`, and -(c) some arrival carries a frame. Deterministic and terminating: -the certificate is a **frozen function of the program sector**, so -U is well-defined per program (item 5). The implied stack-shape -predicate — every frame bit equals the arrival slot — is checked, -not assumed (item 4). - -`validate(term, cert)` — the item-3 criterion, strictly beyond -Gram: zero structurally reachable `pop-err`, plus the RS-function -property on the certified graph, plus Gram totality/orthogonality. - -Results: discovery reproduces the hand certificates on **all -eleven programs** (q-family certified at exactly the outer -boundary; HH/HNH/negative/selector/lone/p★/3-coin/dup refused — -their frames, where present, never transit a later fire and stay -inert terminal garbage). The negative control now FAILS validation -properly: p★ under the wrong certificate reports -`pop_err_reachable = 1` and `rs_function = False` while Gram shows -zero defects — the criterion separates exactly where the review -demanded. - -### 11.5 Probes and fences (gate items 6, 7) - -`h` applied to a gate (`h t`, `h h`): total, resolves as a typed -species error — the probe meets a non-boolean. Nested coin-in-coin -(`h ((h 0̂) ((h 0̂) 0̂ 1̂) 1̂)`): 263 states, total, Gram-clean, -correct marginals, and correctly refused a certificate. -`buried-frame` and `no-instance` remain **unreached in every -program constructed to date**; both corners are typed errors, not -silent behavior. The general proofs (lp-at-log-head; equal lps = -same copy; buried frames unreachable or handled) remain owed. - -### 11.6 Exact amplitudes (gate item 8) - -The evolver now carries amplitudes as exact pairs -`(p, q) ∈ ℚ[√2]`, `p + q√2` — no monomial restriction; `1 + 1/√2` -is representable. Norm assertions compare against `(1, 0)` exactly. -The whole battery, the polarity check, and certificate discovery -are bit-identical under the new ring. - -### 11.7 The encoded-fibre statement (gate item 2 — RATIFIED-WITH-EDITS, applied) - -Proposed amendment to the architecture's clean-δ-fibre guardrail: - -> A δ event may be realized on an **encoded domain**. Let -> `E_m|b,κ⟩ = |b, G_m(b,κ), F_m(b,κ), κ⟩` adjoin the which-path -> arrival position `l = G_m(b,κ)` and the replay frames -> `RS = F_m(b,κ)`, where G and F are proved single-valued functions -> of `(b, κ)` on the reachable span at boundary m — the certificate -> conditions. Then the machine's fire-with-pop satisfies -> `U·E_m|b,κ⟩ = Σ_b′ Q[b′,b] |b′, J_m(κ)⟩`: the clean-fibre law -> holds after decoding, with landings and cross-fibre orthogonality -> unchanged. `E_m` is an isometry because its adjoined coordinates -> are functions of its arguments; certification is canonical by -> §11.4. - -Note this covers not only the v1.3 frames but the arrival lp -erasure the fire has performed since v1 — the original design was -already an encoded fibre in this sense. - -**Ratified with edits** (thread `qalc-architecture`, 2026-08-09) and -applied to architecture §7 in the reviewer's strengthened language. -The edits beyond the draft: subsume the arrival-lp erasure (v1 is -the `F_a`-trivial case) rather than split the law; a seven-item -per-boundary exhibition obligation (canonical `(b,G,F,κ)` -decomposition, coverage, unique decoding, single-valued `G`/`F` on -the certified reachable *basis domain* extended linearly, the -complete boolean pairing with the counterfactual column, `J_a` -injectivity, the full range matrix); source-fibre disjointness -`E_a†E_a′ = 0` in addition to landing orthogonality; "coherent -decoding, not deletion" — the inverse reconstructs the coordinates -through `E_a` after `Q_q†`, no copy reaches garbage, and the clause -is explicitly not a license to erase deterministic histories around -non-injective maps; and a computability discipline — certification -must be total, terminating, sound over a proved over-approximation -of arrivals (exact reachability is not decidable in general), free -to reject valid certificates, with rejection selecting the -conservative nontransparent transition so `U` is never undefined, -and the certificate static metadata fixed at initialization. The -scratch `discover`/`validate` satisfy the discipline on finite -kernel graphs (BFS is exact there, a valid over-approximation); -the strengthened validation checklist — `G`-function property, -encoded-range coverage, unique decoder, boolean pairing, source -disjointness, landing/non-δ disjointness — is registered as the -checker's growth path. - -### 11.8 The v1.4 scorecard - -| Gate item | Status | -|---|---| -| 1 coloring | **discharged** (closed form + per-row proof + 1,518-edge mechanical check) — adversarial review owed | -| 2 encoded fibre | **discharged** — ratified-with-edits and applied to architecture §7; strengthened validation checklist registered | -| 3 cert validity beyond Gram | **discharged** (`validate`: pop-err reachability + RS-function; negative control now caught) | -| 4 stack-shape predicate | **discharged** (checked predicate: frame bit = arrival slot) | -| 5 canonical program→cert | **discharged** (`discover` fixpoint; HAND==AUTO ×11) | -| 6 buried frames | typed fence + probes (unreached); general resolution owed | -| 7 lp invariants | probes + battery evidence; general proofs owed | -| 8 exact amplitudes | **discharged** (`ℚ[√2]` pairs; battery bit-identical) | - -New standing object: the **conservation conjecture** (§11.3) — the -sharpened form of "the coherent fragment is the pattern class." - -## 12. The v1.4 review verdict and the v1.5 encoded fire (registered) - -The coloring review (thread `qalc-token-machine`, independent rerun, -2026-08-09) returned **FAIL for the v1.4 transition table** with a -fatal countermodel, while grading the coloring theorem itself -PASS-WITH-CORRECTIONS (all 1,518 edges independently verified, -including the compressed `replay` row directly). - -### 12.1 The C-collapse countermodel - -`C ≡ λb.λx.λy. b y y` maps both booleans to `1̂` non-injectively. -On `p ≡ h (C (h 0̂))`, two reachable outer arrivals share slot 1 -with **different** which-path lps (`w = 1` and `0`); the v1-lineage -fire erased the lp, mapping orthogonal sources onto identical -columns — a reachable column collision (105-state graph, 1 -non-orthogonal pair; the dynamic run hid it only because the -arrivals are one step apart). This was a defect of the fire since -v1, outside the battery until the encoded-fibre lens found it. - -### 12.2 The v1.5 fire: conservative decode by default, certified erasure - -The fire now implements the ratified encoded-fibre amendment -directly: - -- **Conservative (default)**: retain the decoded spectator `D(l)` - on a new inert spectator stack `ks`: a ticket whose bit matches - the slot decodes to `(gate, instance)` — the bit is redundant — - so HH's branches land at equal spectators and interfere free of - any certificate; anything else (real lp, mismatched ticket) is - retained whole, so same-slot arrivals with distinct which-path - data stay orthogonal. `w(D(l)) = w(l)` for retained lps, 0 for - decoded tickets — the conservative fire **flips φ uniformly**; - the parity defect now lives only at certified erasure. -- **Certified**: erase `(l, RS)` entirely — sound iff the corrected - fibre condition holds: within the boundary, the RETAINED key - `(slot, T, log)` determines the ENTIRE erased tuple `(l, RS)` - (the review's correction: the old condition keyed by `l`, which - the fire erases — not a sound local theorem). - -Results (twelve programs — `Ccoll` joins the battery): all total, -zero Gram defects, zero polarity violations, canonical certificates -reproduce 12/12. - -```text -HH 82 mass 1 free coherence (ticket pattern; no cert needed) -HNH 104 mass 1 EARNED coherence: its outer boundary is - certified (slot determines its real lps, - w = 1 both) — the coherence bar is a - certified-fibre phenomenon -Ccoll 143 1/2, 1/2 the countermodel: certification refused at - the collision boundary (same slot, distinct - l); conservative fire keeps the sources - orthogonal — Gram CLEAN, correct physics -q-family unchanged (certified; time-decohered by the - odd offset) -p★, 3coin, negative, selector, lone, dup unchanged -``` - -The theoretical upshot sharpens the coherence economy again: -**pattern-ticket coherence is free; coherence through real plumbing -is earned by exhibiting the encoded fibre** — the certificate is -not an optimization, it is what makes HNH's interference lawful. - -### 12.3 Corrections to §11 claims (review-mandated) - -- **Weight uniqueness is gauge-only.** `w_c(γ_g)=w_c(μ_g)=c`, - `w_c(A_g)=1+c` passes all edges for either `c` (mechanically - confirmed by the reviewer); `ρ` is unconstrained by Run→Run rows. - The coloring is unique after pinning conventions - (`w(A)=1, w(ρ)=0`). -- **General parity law with interior fires**: - `n₀ − n₁ ≡ w(l₀) − w(l₁) + Σ_{F∈branch₀} w(l_F) − Σ_{F∈branch₁} - w(l_F)` — interior gates supply parity corrections, so the - even-pad corollary is limited to fire-free plumbing, and gate - mediation is confirmed as the parity-escape route. -- **Conservation conjecture refined**: the literal gate-free form is - FALSE (the countermodel's surfacing lp has `(slot, w) = (1, 0)` — - its slice contains an α). Viable statement: *along a closed, - fire-free readback whose surfacing lp has entirely ordinary, - mark-free ancestry, its weight equals its canonical boolean exit - slot.* Reviewer's exhaustive enumeration: all 10,180 closed pure - λ-terms of syntax size ≤ 10; 708 ordinary mark-free arrivals; - **zero** weight/slot mismatches. Proof target: the telescoping - enter/return pairing, with the selected variable of the final - Church boolean as the only unpaired segment (distance 2 vs 1). - And the classification claim weakens to necessity: coherent - routing ⊆ routing with virtual ancestry or interior-fire charge — - gate mediation is necessary, not sufficient (`Ccoll` is - gate-mediated and must stay orthogonal). -- **Terminal chains**: to be checked mechanically (2-coloring the - terminal edges), not asserted from unique predecessors. -- **`discover` totality**: the BFS implementation is not the final - canonical mechanism — raw reachability may diverge on untyped - programs, the cap raises instead of returning conservatively, and - the fixpoint bound is unproved. The final mechanism is a - terminating conservative static analysis defaulting to no-pop - (the amendment's computability discipline); the BFS version is - exact and valid on finite kernel graphs only. Consequence, - registered: all-program Ω objects for qALC cannot be defined - through semantic-BFS certificates. - -### 12.4 The standing gate (v1.5 → PASS) - -Fixed this round: the encoded fire (conservative + certified), the -corrected fibre condition, `Ccoll` as a mandatory regression, -canonical certificates refrozen (the discovery output is machine -metadata). Still owed: the mark-free-ancestry conservation lemma; -the mechanical terminal-chain check; the gauge-pinned uniqueness -statement; the terminating conservative certificate analysis; the -lp invariants; H/T cross-fibres; the readback controller. - -## 13. v1.6 — the conservation theorem and the PASS claim - -The round that discharges §12.4. Everything below is mechanically -verified in the scratch battery (`conservation.py`, `polarity.py`, -`certify.py`, `suite.py`); no engine code exists, per the §9 gate. - -### 13.1 The conservation theorem (the §11.3 conjecture, proved) - -The proof splits into a step-counting lemma that knows nothing -about weights and the already-proven coloring that converts step -parity into weight parity. - -**Lemma A (attribution ledger).** In a pure λIAM run from a -k-probe start `(pos, D, L₀, •^k · base)` that surfaces at -`(pos′, U, L₀, tape · base)` with the log restored and the base -intact, the step count satisfies - - t ≡ k + b + 1 (mod 2) - -where `b` is the total number of bullets on the surface tape (the -surfacing lp may carry bullets both above and below it — see the -inventory note). *Proof.* Every rule is the birth, death, or -transport of exactly one tape/log **individual** — a bullet or a -logged position: `b1`/`b4` birth a bullet, `b2`/`b3` kill one, -`var` births an lp, `bt2` kills one, `arg`/`bt1` transport one. -Slice capture (during `var`) and slice release (during `bt2`) cost -nothing: cargo is suspended, not stepped. Give each individual `x` -a ledger `count(x)` of the steps attributed to it, `B(x) = 1` iff -step-born (0 for the k probe bullets), and a location parity -`p(x)` (0 on the tape, 1 on the log, frozen under suspension — -capture always takes log entries, release always restores them to -the log, so suspension preserves `p = 1`). The invariant, by -induction over the eight rules: `count(x) ≡ B(x) + p(x)` while -live, and `count(x) ≡ B(x) + 1` once dead or suspended (deaths -occur on the tape, `p = 0`, and add one step). Sum at the surface: -`t = Σ count` ≡ (k − r)·1 [dead probe bullets] + r·0 [surviving -probe bullets] + (b − r)·1 [live step-born bullets] + 1 [the -surfacing lp: step-born, on tape] + 0 [its suspended cargo, -transitively] ≡ k + b + 1, using `−r ≡ r (mod 2)`. ∎ - -**Lemma B (coloring, §11.1).** Every rule flips φ; probe tapes -weigh 0; the surfacing tape weighs `w(l)` (bullets weigh 0). So -`t ≡ φ_end − φ₀ ≡ (|pos′| − |pos|) + 1 + w(l)` — the depth -difference between launch and surfacing positions is part of φ -and does NOT vanish in general (fresh-review correction: the -first §13.1 draft dropped it, and `λ1` probed from its body -position surfaces at the root in one `var` step with `w = 1`, -refuting the depth-free combination). - -**Theorem (conservation).** -`w(l) ≡ k + b + |pos′| − |pos| (mod 2)`. Every deployed -specialization launches and surfaces at the same position -(the root protocol at ε; boundary probes at the argument -position), where the depth term vanishes: `w(l) ≡ k + b`, so for -the boolean protocol (`k = 2`, arrival shapes `l·base` and -`•·l·base` with `b = slot`): **`w(l) ≡ exit slot`**. The `haltI` -sector (`l·•·base`, `b = 1`) gives `w(l) ≡ 1` — the identity's lp -weight, correctly. *Proof.* Equate Lemmas A and B. ∎ (Lemma A -itself is position-blind and needed no correction; the reviewer -confirmed it independently, including nested capture to depth 7 -and genuine lp recapture.) - -**Inventory note (found by the mechanization).** The naive -endpoint claim — surface bullets above the lp step-born, below it -probe survivors — is FALSE: lps recirculate tape → log → tape via -`arg`/`bt1`, so the surfacing lp can return on top of step-born -bullets. The ledger handles this because live step-born bullets -contribute 1 *wherever they sit*; only the mod-2 identity -`−r ≡ r` is needed. The per-step assertion caught this within the -first 707 terms. - -**Corollary (kernel transfer — the mark-free-ancestry lemma).** In -a kernel run, consider a probe segment from `(argpos, D, γ·i·L, -•·•·μ_g·T)` to its boundary arrival, and suppose the segment is -fire-free, VB-free, and **mark-free**: no `γ`/`α` is ever captured -into a slice. Then no `var` step reaches past the γ at the log -boundary (capturing it is the only way to cross), so the token -stays inside the probed argument, the frozen suffixes `μ_g·T` and -`γ·i·L` are untouched, and the segment is *literally* a pure λIAM -run of the argument against `•·•·μ` — Lemma A applies, Δφ across -the segment is `1 + w(l)` (same log, same suffixes), and -`w(l) ≡ slot`. Each hypothesis is load-bearing and each failure -mode is a registered phenomenon: an **interior fire** breaks -Lemma B's uniform flip by exactly the fire defect (the §12.3 -interior-fire parity law); a **VB episode** births a whole -`•^{b′+1}·α` pattern in one step, breaking Lemma A's -one-step-one-individual attribution (why pattern routing is the -parity escape); a **captured mark** breaks segment closure and is -precisely the excluded ancestry (why `w(α) = 0` decouples weight -from step count). Gate mediation being *necessary* for coherent -routing is now a theorem-shaped statement: mark-free geometric -readback has `w ≡ slot`, hence odd branch offset, hence intrinsic -decoherence by the §11.2 offset law. - -**Mechanical validation, at the invariant level.** The instrumented -pure machine checks the ledger invariant after *every step* of -*every run*, in lockstep conformance with the uninstrumented -stepper (same rule, same stripped state, asserted each step — -implementation drift is a hard error). Exhaustive sweep over all -closed pure terms: ≤ size 10, **10,180 terms** (independently -matching the reviewer's enumeration count exactly), and ≤ size 11, -**41,272 terms**, probed at k ∈ {1, 2, 3}: **55,727 surfacings, -zero Lemma-A failures, zero theorem failures, zero invariant -violations** (stuck runs validate the invariant on every step too; -Ω-class terms time out at the cap and contribute their prefixes). -Battery cross-check on the gated twelve: every classifier arrival -(gate boundaries and root, both cert modes) classified by -ancestry — **zero mark-free arrivals violate `w ≡ slot`** across -all twelve programs; marked arrivals split both ways, as virtual -ancestry predicts (HH/HNH's earned-coherence tickets among the -`w ≡ slot` equalities, the countermodels among the inequalities). - -### 13.2 Terminal chains and gauge-pinned uniqueness (mechanical) - -**Terminal chains.** Across all twelve programs × both cert modes: -every `RunDone` and `Done` state has in-degree exactly 1 and -out-degree exactly 1 in the reachable graph — zero violations. The -"unique predecessor" property §12.3 demanded be checked is now a -regression, and flip-by-assignment on the linear terminal chains is -well-defined. - -**Uniqueness as a swept theorem.** Parametrize the mark weights by -`v ∈ {0,1}⁸` over `(γ, μ, A, α, ρ, R, K₃, K₂-offset)` (entry -weights are linear in `v`, so each edge carries a profile vector -and assignments are dot products). The full flip/defect law was -evaluated under all 256 assignments over every Run→Run edge of all -twelve programs, both cert modes: **exactly 4 pass**, and they are -exactly the predicted gauge orbit `γ = μ = c`, `A = 1 + c`, -`ρ` free, `α = R = K₃ = K₂-offset = 0`. The rule-derived -constraints (`call`: γ+μ ≡ 0; `anshead`: γ+A ≡ 1; `vvar`: α ≡ 0; -`recall`: R ≡ α; conservative fire flip: K ≡ content) pin -everything except the global gauge `c` and the never-moved `ρ`. -**The coloring is unique after pinning `w(A) = 1`, `w(ρ) = 0`.** - -### 13.3 The terminating conservative certificate analysis - -`discover_total(term, state_cap, round_cap)`: at most `round_cap` -rounds, each one BFS over at most `state_cap` states; any cap hit -or non-convergence returns **no certificate**, which selects the -conservative nontransparent fire everywhere — always sound (the -v1.5 default), possibly suboptimal, exactly as the amendment's -computability discipline sanctions. `U` is therefore total and -well-defined on *every* program; the canonical certificate is -`discover_total` at frozen caps, a deterministic function of the -program fixed at initialization as static metadata. On finite -kernel graphs within the caps it equals the exact fixpoint. -Verified: reproduces the frozen certificates on all twelve; -the totality witness `h Ω` (infinite kernel graph) returns a -conservative reject rather than diverging or raising. The §12.3 -consequence stands unchanged: all-program Ω objects cannot be -defined through semantic-BFS certificates; the budgeted analysis -is the sanctioned mechanism, and its rejections are the price. - -### 13.4 The logged-position invariants - -**Soundness is carried by total typed guards, not by reachability -claims.** Every instance-consulting rule has a typed rejection -(`no-instance`, `alien-ticket`, `buried-frame`, `recall-err`, -`replay-err`, `pop-err`); there is no silent fallback path. On top -of that, now mechanical: across all twelve programs × both cert -modes, **none of the six guard rules is structurally reachable** -(and the negative control — p★ under the wrong certificate — still -reaches `pop-err`, so the check has teeth). - -**lp-at-log-head, scoped structural argument.** For -signature-abstracted programs (gates occur only as the wrapper -application's arguments — the entire program class the architecture -compiles), a gate leaf sits at an `a`-position, and the only rule -that enters an `a`-position going D is `arg`, which pushes the -transported tape head onto the log. When that head is an ordinary -lp it *is* the invoking occurrence's logged position — the -instance, at log head, structurally. When it is not an lp (a -`γ` probing a gate, an `α` in transit), the leaf's `instance()` -finds a non-lp head and rejects typed — never treats it as an -instance. Programs applying a gate literally (`App(Gate, …)`) -fall outside the scope statement and meet the same typed guards. - -**Equal lps = same dynamic copy.** The λIAM-lineage fact the -design imports (a logged position names a dynamic subterm copy; -token.md §2 pins the substrate). Its operational failure mode — -one `(g, i)` naming two different selections — is now a swept -regression: across every reachable state of all twelve programs, -**zero states** hold two instance-keyed entries (α tickets, R -frames) with equal `(g, i)` and different bits. `dup` (two dynamic -instances of one occurrence, distinct slices) remains the built -witness that distinct copies get distinct names. - -### 13.5 The v1.6 scorecard and the PASS claim - -| §12.4 item | Status | -|---|---| -| mark-free-ancestry conservation lemma | **PROVED** (§13.1: ledger + coloring + transfer), invariant-level mechanization, zero failures at ≤ 11 | -| mechanical terminal-chain check | **discharged** (in/out-degree 1, zero violations) | -| gauge-pinned uniqueness | **discharged as a swept theorem** (4/256 = the predicted orbit) | -| terminating conservative certificate analysis | **discharged** (`discover_total`; `h Ω` witness; frozen-CERTS agreement) | -| lp invariants | **discharged** (typed guards + swept unreachability + scoped structural argument + aliasing zero) | -| H/T cross-fibres | **deferred by scope**: the t-gate is structurally reserved (`NotImplementedError`, typed, never silent); cross-fibre exhibition belongs to the readback + t-gate milestone | -| readback controller | **deferred by scope**: next docket phase, not an h-kernel obligation | - -**The PASS claim, stated precisely:** the three-program kernel -gate (token.md §4) is claimed **PASS for the h-fragment** — full -transition table with typed totality; step-indexed HH / H–NOT′–H / -negative-witness traces verified plus nine more programs including -both adversarial countermodels; column-Gram enumeration clean on -every reachable basis; range disjointness via the encoded-fibre -certificates; and the conservation theorem closing the coherent -fragment's characterization. Standing fences, all typed and all -registered: `buried-frame` (unreached, semantics deliberately -unassigned), literal gate application (outside the scope -statement), the t-gate reservation. Pending: fresh-instance -adversarial review of this round. - -### 13.6 The fresh-instance review verdict (registered) — the h-fragment claim WITHDRAWN - -A deliberately threadless sol-tier review (2026-08-09, zero -inherited framing, full sources + rerun capability) returned: -**FAIL for "PASS for the h-fragment"; the mathematical core -CONFIRMED; the three-program formalization gate and the twelve -registered sectors stand.** Every advertised number was -independently reproduced. The verdict, by attack surface: - -- **Lemma A: CONFIRMED-SOUND.** The eight-rule attribution - partition verified airtight by independent trace scanning — - nesting depth 7 and genuine lp recapture observed, suspension - parity preserved, no duplicated individuals. -- **The theorem as first written: REFUTED, repaired in place.** - The Lemma B combination dropped the launch/surfacing depth term - `|pos′| − |pos|`; `λ1` probed from its body position is a - one-step counterexample. Corrected statement above (§13.1); all - deployed specializations have the term ≡ 0 and are unaffected. - A matching stale formula in the checker's docstring - (`(k−r)+m+1`, false when step-born bullets sit below the lp) is - fixed; the implemented `k+b+1` was already correct. -- **Transfer corollary: CONFIRMED-SOUND**, with "literally a pure - run" tightened to "rule-for-rule isomorphic after stripping - frozen prefixes/suffixes." The reviewer supplied the closure - invariant in its clean form — ordinary lps above γ = - level(path) − level(argpos) — and searched 41,272 closed plus - 111,508 open arguments under up to three enclosing binders: - zero mark-free escapes; all 79,840 boundary crossings occurred - after γ capture. -- **Gauge sweep: CONFIRMED-SOUND and strengthened.** Broadened to - 15 parameters (lp constant, six path coefficients, slice - coefficient, the eight mark weights): the slice coefficient is - forced to 1, the lp constant to 0, all path coefficients to 1; - rank 13, exactly the four predicted solutions. Uniqueness is - hereby scoped to the natural local additive family, explicitly. -- **`discover_total`: CONFIRMED-SOUND.** Both rejection paths - executable (`round_cap=1` on HH → None; `h Ω` → state cap); - "canonical" wording fixed to "the deterministic result at - frozen caps." -- **PASS scoping: REFUTED —** `Q = ((h 0̂) SEL SEL)(h 0̂)`, - `SEL = λb. b 1̂ 0̂`: typed, h-only, signature-abstracted, and it - reaches `buried-frame` from init with **err mass 1** while its - certificate validates and Gram is clean (basis 332, zero - defects, zero aliasing — reproduced exactly). Two live - instances interleave their re-seeks; the v1.3 fence is a - **missing semantic case of the h-fragment**, not an unreachable - corner. `Q` is registered as the battery's thirteenth program - (`buried`, expected guards `{buried-frame}`, expected dynamics - err 1) and is the program that withdraws the h-fragment claim. -- **Range disjointness over the raw state type: GAP.** Two - collision pairs among unrestricted `Run` states (a `vvar` - source and a `replay` source sharing a target; fire sources - differing only in μ-kind). The μ-kind collision is closed — the - fire now demands the probe frame's gate match the boundary γ - (typed `species-mu`; bit-identity on all reachable graphs - verified). The `vvar`/`replay` pair is excluded by the intended - reachable-state invariants; making the well-formed configuration - subtype explicit, with a preservation proof, is now a registered - obligation — global range disjointness is claimed only over - well-formed states until then. -- **Validation blindness: fixed.** `validate` now reports guard - reachability, `(g,i)` aliasing, and dynamic err mass, and its - `semantic_coverage` verdict is their conjunction — `Q` is the - regression proving a valid certificate and clean Gram can - coexist with total semantic failure. - -**Standing after the round:** PASS holds for the three-program -formalization gate and the twelve coherent/decoherent sectors; -the h-fragment claim is withdrawn with `Q` as the boundary -witness. The v1.7 object is the interleaved re-seek: give -`buried-frame` semantics (the frame stack's discipline under two -live instances), or characterize statically the fragment that -excludes it — and prove the well-formed-state preservation that -restores global range disjointness. - -## 14. v1.7 — the replay record, the WF subtype, and the healed h-fragment - -The interleaved re-seek round. Everything below is mechanically -verified in the scratch battery (`kernel.py`, `suite.py`, `wf.py`, -`certify.py`, `conservation.py`, `polarity.py`); no engine code -exists, per the §9 gate. The h-fragment PASS is RE-CLAIMED at the -end, gated on a fresh-context independent audit. - -### 14.1 The Q trace, and what it overturned - -Tracing `Q` to its `buried-frame` states gave the design its -ground truth — and refuted the natural first hypothesis. The -buried configurations hold **the same instance's frame twice** -(coin1's record duplicated, buried under coin2's): v1.3's re-seek -cycle *accumulates* — each `replay` re-emits a ticket, and each -ticket's later `recall` pushes another identical frame. The frame -was never a stack entry; it is a **record of the instance's -selection**, a function of the instance. The v1.7 rules make the -data structure match the semantics: - -- **`recall` (amended):** the frame push is **idempotent** — if a - same-`(g,i)` record exists, re-recording is a no-op; if it - exists with a *different bit*, that is the copy-identity failure - and a new typed error `frame-conflict`. The record set `rs` is - kept canonically sorted: state identity must not depend on the - order interleaved re-seeks happened to record in. -- **`replay` (amended):** deep keyed lookup — the unique - same-`(g,i)` record *wherever it sits*. LIFO position was never - semantic; the v1.3 head-only guard was conservatism awaiting a - literal trace, which `Q` supplied. **The `buried-frame` error - class no longer exists.** - -### 14.2 Results - -The **twelve are bit-identical** — every basis count, marginal, -support, and halt time unchanged (interleaving never occurs -there, so idempotency, deep lookup, and canonical order are all -invisible). `Q` (battery name `buried`) heals to exactly the -physics predicted before measurement: **basis 432, Gram clean, -`{halt0: 1/2, halt1: 1/2}`, support 4, t = 141** — coin1 consumed -non-injectively (two SEL occurrences), each branch running -geometric selection on coin2: four decohered terminals at 1/4. -Its certificate is UNCHANGED (`ffbbfffa` reproduces) and it now -validates with `semantic_coverage: True`. The stress set, each -predicted then measured: `weave` (interleaving through -wire-identities: 1/2 + 1/2, support 4), `hweave` (an outer gate -interrogating a woven core — the C-collapse class holds across an -interleaving: 1/2 + 1/2, support 4), `qq` (Q nested in Q's -argument: three coins, double-crossed re-seeks, **support 8**, -1/2 + 1/2, basis 2,192). All sixteen: zero stuck / non-unit / -non-orthogonal, zero guard rules reached, zero `(g,i)` aliasing; -the coloring, terminal chains, gauge orbit, `discover_total` -agreement, and the conservation battery all re-verified over the -sixteen; the negative control still catches `pop-err`. - -### 14.3 The well-formed configuration subtype - -`WF(term, s)`, six invariants — the domain the unitarity claims -quantify over: - -- **W1** log discipline: `|log| = level(path)` — every log entry - corresponds to one `a`-step. -- **W2** record uniqueness + canonicity: at most one frame per - `(g, i)`; `rs` canonically sorted. -- **W3** bit coherence: all instance-keyed entries with one - `(g, i)` carry one bit. -- **W4** first-interrogation exclusivity: a vb-active state at - instance `i` holds no `i`-frame and no `i`-ticket — forced by - the guard chain (ticket → `recall`, frame → `replay`, neither - reaches `call` → fire → `anshead` → vb). -- **W5** probe pairing: deep-counted γ (through slices and the - fire's retained `K(l)` records) = μ(tape) + answer - tokens(tape). A γ captured into a slice is **suspended cargo** - — the conservation ledger's concept — still in flight; its - probe cannot fire until `bt2` releases it. Ticket/frame - instance *keys* are frozen names, never counted (the live - original is accounted where it lives; keys would ghost-count - stale slices). The first, shallow draft of W5 produced 460 - false violations, all the same shape — the sweep taught the - invariant its own suspension structure. -- **W6** exactly one ρ, at the tape bottom. - -**Reachable ⊆ WF**: verified exhaustively — 9,314 Run-state -checks across all sixteen programs, both certificate modes, zero -violations; init is WF, so the sweep validates preservation on -every reachable edge. Per-rule preservation is by inspection: -classical rules move log/level in lockstep (W1) and -suspend/release γs in matched pairs (W5); `call` adds γ + μ -together; the fire consumes μ and mints the answer token -(retaining `l`'s cargo in `ks` — deep count preserved); -`recall`/`replay` touch only the record set under W2–W4's -discipline. - -**Collision closure.** The v1.6 review's two raw-state column -collisions are both dead: the `vvar`/`replay` pair because its -`vvar` source **violates W4** (holding its own instance's frame), -and the WF-repaired source's target then differs from the replay -target in `rs` content; the μ-kind pair because `species-mu` -types the mismatched fire away (no shared targets). Global range -disjointness is claimed over WF states, with reachable ⊆ WF -mechanical and the preservation argument registered. - -### 14.4 Certified erasure and suspended cargo (two conditions) - -The W5 lens exposed a soundness question v1.5 never posed: a -certified erasure deletes the arrival lp *with its slice cargo*. -Measured across all sixteen certified boundaries: **zero γ-cargo -erasures** — and the admission condition (d), *erased cargo must -be γ-free*, is now part of `transparent()` (a certified erasure -of an in-flight probe's γ would break W5: its μ survives, -unpaired). Zero certificate changes. **Suspended α cargo is -deliberately permitted**: HNH's earned coherence *depends* on -erasing captured ticket copies (two of its three certified -arrivals carry α cargo, measured). Its soundness condition is -scoped and named: **no post-erasure re-seek of the erased -ticket's instance** — a re-seek would find neither ticket nor -frame and fresh-`call` into a second fire (the v1.2 double-fire -class). In HNH the α-cargo erasures are terminal interrogations, -so the condition holds; in general it is a reachability property, -not a local stack shape, and is registered as a **compile-time -obligation for the compilation theorem** (the compiler certifies -only boundaries whose erased-ticket instances are never -re-interrogated). The fresh audit adjudicates whether this -scoping is adequate. - -### 14.5 The v1.7 claim - -**PASS for the h-fragment, re-claimed**: the `Q` countermodel is -healed with the physics predicted in advance; the sixteen-program -battery (twelve sectors + the review witness + three pointed -interleaving stressors) is total, Gram-clean, and -marginal-correct; the WF subtype closes the review's range -disjointness gap with reachable ⊆ WF mechanical; and the -certified-erasure cargo conditions are measured, one closed -locally and one scoped and registered. Standing fences, typed: -literal gate application, the t-gate reservation, and the α-cargo -compile-time obligation. This claim is **gated on a fresh-context -independent audit** (a9's instruction for the round); the audit -verdict will be registered here. - -### 14.6 The fresh audit verdict: FAIL (registered 2026-08-09) - -Fresh-context independent audit #1 (gpt-5.6-sol, threadless, job -`cx-20260809-134605-79cc`, fed the full scratchpad + evidence -pack): **FAIL** for the h-fragment PASS. The scorecard, by charge: - -1. **Replay record — GAP.** No wrong deep-key lookup found (Q plus - 3,160 generated programs clean), but no injectivity theorem for - logged-position keys was supplied; deleting `buried-frame` was - validated only on explored orbits. -2. **Q / weave / hweave / qq physics — CONFIRMED-SOUND** by - independent recomputation, exact amplitude agreement. -3. **WF adequacy — REFUTED with countermodel.** W1–W6 do not make - certified fire injective: a reachable `lone` arrival plus one - extra slot-matching frame is WF, and both sources fired to - identical targets (columns with inner product 1). WF needed the - certificate's fibre relation as a domain subtype. -4. **Scoped α-cargo condition — REFUTED with countermodel.** - `Pα = (C I h) 1̂`, `C = h (h (NOT (h 0̂)))` — typed, h-only, - in-fragment. `discover` admitted a certificate whose α-cargo - erasure is followed (t=131, amplitudes ±1/2) by a fresh call of - the erased instance; the certified run goes STUCK at t=180 while - the plain run computes the correct `{1/4, 3/4}`. The no-reseek - condition cannot remain an unchecked compile-time obligation. -5. **Scoping honesty — REFUTED.** The §14.2 "twelve bit-identical" - overclaim (the v1.2 basis drift `negative` 103→83, `selector` - 173→106, `pstar` 458→242 is real, v1.7-era, marginal-identical); - an "all twelve" print over sixteen programs; the evidence pack - omitted this file; no typing checker existed. Their fuzz also - surfaced a sixth defect we adjudicated into round 2: a - **duplicate fresh call** — a ticket consumed by the fire's - α-decode (bit-free spectator), the same instance later re-sought - with neither ticket nor frame, silently fired twice. - -Both countermodels and the fuzz hit were reproduced locally before -any correction was designed. §15 is the correction round. - -## 15. v1.8 — decode records, the refire guard, and the typed fragment - -*(2026-08-09; the audit-correction round. Scratch evolver updated in -place; suite is eighteen programs; `typecheck.py` joins the -scaffolding. No qALC code in the tree — §9 gates still govern.)* - -### 15.1 One mechanism, not three patches - -The audit's two live countermodels and its fuzz hit are the same -disease in three coats: **an instance's selection was erased with no -recoverable record, and the machine then answered a later re-seek of -that instance by silently tossing a second coin.** Pα reached it -through certified α-cargo erasure; the fuzz duplicate through the -fire's α-decode (the bit-free spectator that buys HH's coherence); -the WF collision was its structural shadow (erasure that forgets the -frame's existence cannot be injective). The v1.8 mechanism: - -- **Decode records.** Certified erasure now retains `('K', g, i)` - for every live α nested in the erased cargo and for every popped - frame's instance (the fire's α-decode arm already retained its - `('K', g, i)`). The erased tuple is a function of the retained - `(slot, T, log)` fibre — discovery condition (b) — so its key-set - is too: the records are **branch-consistent constants**, coherence - is untouched, and erasure becomes injective on the ticket/frame - dimension. Measured sharp: all sixteen prior programs keep - identical marginals, supports, *and basis counts* — adding a - branch-constant record is a bijection on the post-fire subgraph, - so counts cannot move, and did not. -- **The refire guard.** The fresh-call arm now types out (`refire`) - any instance whose key is dead storage in `ks` — a decoded record, - or a ticket captured inside a retained-whole record. Arm order - (ticket → recall, frame → replay, else guard → call) plus the - fact that one `vvar` emits one ticket consumed by exactly one of - recall/decode/erasure means the guard can never shadow a - legitimate recall or replay. **One-fire-per-instance is now a - machine invariant enforced at runtime; the v1.7 α-cargo - compile-time obligation is discharged and deleted.** -- **Validated admission.** `discover_total` now runs the full - `validate()` (totality, guard reachability, Gram, err mass) on - its fixpoint and returns None — the conservative, sound fallback — - when coverage fails. Pα's and the fuzz program's exploratory - certificates exist but are *refused* by the canonical pipeline. - -### 15.2 The audit witnesses, healed and framed - -- **`palpha`**: canonical certificate None; canonical dynamics is - the plain run, `{halt0: 1/4, halt1: 3/4}`, support 3 — the - physics (`C = H·H·X·H|0⟩ = |+⟩`; the zero branch applies I to - `1̂`, the one branch H). The exploratory certified graph is now - *total and loud*: `refire` reached, err mass 1/2, - `semantic_coverage` False — the old silent STUCK at t=180 (a norm - leak) is gone. -- **`dupcall`** (the fuzz hit, registered): canonical certificate - None; the plain run rejects typed (`alien-ticket`, err 1/2 beside - a classical 1/4+1/4); under the v1.7-era certificate the refire - guard is REACHED with all-err dynamics — the suite's permanent - positive control. UNTYPABLE (below), so it was never inside the - fragment claim; the guard is defense-in-depth. -- **The WF collision**: the extra-frame source is `W7`-excluded - (§15.3) *and* no longer shares targets — the popped frame leaves - its decode record. Both layers close it independently. - -### 15.3 W7 and the range-disjointness theorem - -**W7 (certificate fibre coherence)** joins the subtype: at a -certified boundary, the erased `(l, RS)` must equal the -certificate's frozen fibre value at the retained key -`(pos, slot, T, log)`. Reachable ⊆ WF∧W7 sweeps clean over every -certified graph (the fibre map is discovery's own object; condition -(b) makes it single-valued). - -**Theorem (range disjointness on WF∧W7).** For two certified-fire -sources at one boundary: same `(T, log)` and slot ⇒ same erased -tuple (the fibre is a function) ⇒ the same source; same `(T, log)`, -other slot ⇒ the identical target pair carrying the two H rows — -orthogonal columns, which *is* the interference mechanism; different -`(T, log)` ⇒ disjoint targets, because targets embed `T` and `log` -verbatim. Mechanized (`cert_disjointness`): zero violations over -every certified graph. - -**The GAP, dissolved rather than closed.** Deep-lookup soundness -needs no instance-key injectivity theorem: if two dynamic copies -ever aliased one `(g, i)`, divergent selections are typed -(`frame-conflict` on both the recall push and the replay lookup) -and agreeing selections make the lookup value-correct. Every -aliasing manifestation is typed or harmless; λIAM logged-position -uniqueness downgrades to a **completeness conjecture**, outside the -soundness perimeter. - -### 15.4 The typed fragment, made real - -`typecheck.py` supplies the judgment the claims quantify over: -algorithm W with the gates as the polymorphic signature -`h, t : ∀a. (a→a→a) → (a→a→a)` instantiated fresh per occurrence -(the precise content of "signature-abstracted"), plain HM -elsewhere, result type free (`haltI`-sector programs are -function-typed). Measured: **15 of the 18 are typable h-only**. -Outside: `dup` (self-application — deliberately, the untyped copy -regression), `dupcall` (NOT′/EP branches ununifiable), and — a -finding — **`q` itself** (E = λz. I z vs N ununifiable: exactly the -wire imbalance `qprime` was built to repair; `qprime` types clean). -The three escapes (`h h` etc.) are untypable, as required. - -**The v1.8 coverage claim, stated exactly.** Over programs that -are (i) typable h-only under the signature judgment and (ii) whose -canonical pipeline (`discover_total` + `validate`) reports -`semantic_coverage`: the kernel is **total and Gram-clean** (U an -isometry on the reachable basis), certified erasure is -**transparent** (fibre-proven, W7-coherent, disjointness -mechanized), and **every failure mode is typed and visible, never -silent**. Marginal-correctness against the ideal quantum -semantics is established **per-program against hand-computed -physics** for the eighteen (and was independently recomputed by -audit #1 for the interleaving set); the *general* -agreement-with-compilation-semantics theorem is explicitly the -compilation theorem's obligation (docket item 3), not claimed -here. One measured fact makes the distinction sharp: **the -certificate is semantically load-bearing for HNH** — certified -`{halt0: 1}` (the physics, H·X·H|0⟩ = |0⟩) versus plain -`{1/2, 1/2}` (the retained records decohere the earned -coherence). The conservative fallback is therefore sound *as a -machine* (total, unitary, typed) but not ideal-preserving; a -refused certificate degrades coherence, never soundness — which -is exactly why `discover_total` must refuse rather than admit an -unsound one. The §14.2 basis-drift overclaim is -corrected: v1.7's replay record moved `negative` 103→83, `selector` -173→106, `pstar` 458→242 against the v1.2 reference (canonical rs -sorting and the replay-arm restructure merge order-variant states); -marginals and supports never moved. - -### 15.5 Verification state and the audit gate - -Suite (18): sixteen marginal/support/basis-identical to v1.7, -guards silent; `palpha`/`dupcall` as above; refire + pop-err -negative controls PASS. `discover_total` == frozen CERTS on all 18; -`h(Ω)` → None. WF and W7 sweeps + disjointness: zero violations. -Conservation ledger: zero failures (k = 1..3, 14,452 surfacings). -Polarity, terminal chains, gauge orbit (4/256, exact): unchanged. -The auditor's own reproducer, rerun under v1.8: WF collision -targets disjoint; Pα scope clean, live calls none; sixteen -histories clean; fuzz 250/250 no violation (66 conservatively -refused). **The PASS re-claim is again gated on a fresh-context -independent audit; verdict to be registered here.** diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index ac725e0..8af0912 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -389,7 +389,7 @@ substrate's obstruction and the fork reopens. | Item | Status | |---|---| -| Kernel | **v1.8** (`kernel.md` §15; audit #1 FAIL registered §14.6): decode records at certified erasure + the `refire` guard make one-fire-per-instance a runtime machine invariant (the α-cargo obligation discharged and deleted); `discover_total` validates its fixpoint and refuses unsound certificates (the audit's `Pα` heals to its physics {1/4, 3/4} via the conservative fallback); W7 fibre coherence + the mechanized range-disjointness theorem close the WF collision; `typecheck.py` is the typed h-only fragment judgment (15/18; `q` itself untypable — `qprime` is its wire-balanced repair). Sixteen prior programs marginal-, support-, and basis-identical. **PASS re-claim gated on fresh audit #2** | +| Kernel | **v1.9** (`kernel.md`, now the current-only register; history in the ledger + git): one-fire-per-instance a runtime machine invariant (decode records incl. tagged KD bundles + `refire`/`key-alias` guards + W8 exclusivity); self-validating canonical certificates with cross-slot bundle equality (condition (e)); W7 + the range-disjointness theorem mechanized against constructed fire targets; syntactically-bounded typing judgment (15/18 h-only; `q` untypable — `qprime` its repair); HNH's certificate measured load-bearing. Audit #1 FAIL and the sol-tier working review both fully absorbed; the alias-tolerant transition theorem is the stated standing conditional. **PASS re-claim gated on fresh audit #2** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §11.7, §12.2, §13.3): the v1.5 fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is pop-err reachability + the RS-function property, strictly beyond Gram (negative control caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and as of v1.8 **self-validating**: the fixpoint is admitted only if its certified graph passes full semantic coverage, else None | | Instance identity | **ratified and discharged, interleaving included** (`kernel.md` §13.4, §14): lp-at-log-head structural for signature-abstracted programs; equal-lps-same-copy backed by the `(g,i)`-aliasing regression, the `dup` witness, and now the `frame-conflict` typed guard; the interleaved re-seek has semantics via the replay record — `Q`, `weave`, `hweave`, and `qq` all total, clean, and physical; v1.8 dissolves the audit's injectivity gap (aliasing manifestations are typed or value-correct — `frame-conflict`, `alien-ticket`, `refire`; lp uniqueness downgrades to a completeness conjecture) | From 1c81b649a6ad9d7b26b0563fb1b65ddec3edb831 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 15:51:35 -0400 Subject: [PATCH 033/107] =?UTF-8?q?qalc:=20v1.10=20=E2=80=94=20hybrid=20pi?= =?UTF-8?q?peline,=20instance-directed=20certificates,=20B=20healed,=20W?= =?UTF-8?q?=20registered=20placement-open?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fresh audit #2 FAILed v1.9 (the W fatal witness: clean validation, wrong physics — a zero-amplitude structural refire vetoing B's coherence-restoring certificate; W8 preservation; (e) grouping; checker totality). Working-thread verdict on the design fork: amplitudes decide run success, never isometry; no bare-term ideal oracle exists. v1.10: structural admission/isometry mandatory + per-step dynamic cleanliness of the frozen certificate; instance-directed erasure (popkeys/spectators) with validation-adjudicated admission; deep W3 + key-state algebra; machine_coverage + written-first physics table. B heals to {halt1: 1}; W measured inexpressible (staged uncomputation) and registered as the standing placement limitation. Twenty programs green; sixteen bit-identical since v1.7. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 64 +++--- docs/ledger/2026-08.md | 52 +++++ docs/quantum-algebraic/kernel.md | 337 +++++++++++++++++++++---------- docs/quantum-algebraic/token.md | 3 +- 4 files changed, 314 insertions(+), 142 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 9191065..386fc5f 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -420,42 +420,46 @@ consistency) and a fresh-context feasibility review (thread promising-with-hard-open-problems, converging with the sketch on every load-bearing point; its checklist and exclusions are folded in. -**The kernel is at v1.9** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.10** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` -and the file's git history): a scratch superposition evolver for the -typed h-only fragment — the eight λIAM rules plus instance-keyed -gate probes firing H rows in exact ℚ[√2], recall/replay/decode -machinery with one-fire-per-instance enforced as a runtime machine -invariant, self-validating canonical certificates (fibre conditions -(a)–(e) including cross-slot decode-bundle equality; unsound -fixpoints refused with a conservative fallback), an eight-invariant -WF subtype with the range-disjointness theorem mechanized against -actually-constructed fire targets, a syntactically-bounded typing -judgment (15/18 suite programs typable h-only; `q` itself is out — -the wire imbalance `qprime` repairs), and every failure mode typed. -The eighteen-program battery is total and Gram-clean with -hand-verified physics (HNH's certificate is measured -load-bearing: certified `{0̂: 1}` vs plain `{½, ½}`); conservation, -polarity, gauge, and both prior reviewers' reproducers all run -clean. Two fresh-context audits shaped it: audit #1 FAILed v1.7 -(Pα and WF-collision countermodels, an instance-alias gap, honesty -defects — all reproduced before correction), and a sol-tier working -review of the v1.8 fix caught two structural holes (per-slot bundle -divergence; live representations shadowing bit-free dead records) -now closed as condition (e) and the `key-alias`/W8 pair. What -remains open is stated, not hidden: the alias-tolerant transition -theorem (or λIAM logged-position uniqueness) is a conjecture the -soundness claims are conditional on; the general -marginal-correctness theorem is the compilation theorem's -obligation. **The PASS re-claim is gated on fresh audit #2.** +and git). Fresh audit #2 FAILed v1.9 with a fatal witness: `W`, a +typed program whose nonempty certificate validated clean while +computing decohered marginals — the root cause being a +zero-amplitude structural `refire` vetoing the coherence-restoring +certificate of its core `B`. The round's design fork (is there an +ideal reference semantics to validate against?) was adjudicated on +the working thread: the auditor's own term-level ideal evaluator is +provably broken (non-normalized masses — Church elimination +discards controls and spuriously interferes), no total bare-term +reference exists, and the sound hybrid is "amplitudes decide +whether a run succeeds, never whether the machine is an isometry." +v1.10 implements it: structural admission and structural isometry +mandatory; the frozen certificate's exact run must carry zero +guard/err amplitude at every step; certificates became +INSTANCE-DIRECTED (per-boundary popkeys with retained spectators — +the blocker for compositional certification) with joint-first, +per-key-refined, validation-adjudicated spectator admission; +`semantic_coverage` renamed `machine_coverage` with physics +agreement moved to a written-first per-program table; deep W3 and +the completed key-state algebra fix the audit's W8-preservation +refutation; condition (e) groups by the full retained spectator; +the checker is total. Outcomes: `B` HEALS to its physics +({halt1: 1}); `W` is measured inexpressible in the certificate +language (every subset/exclusion trial re-seeks an erased instance +— loud) and is registered as the standing COHERENCE-PLACEMENT +limitation, machine-covered, docketed for the compilation theorem +(staged uncomputation). Twenty-program battery green; the sixteen +remain bit-identical; both prior auditors' reproducers rerun clean +under v1.10. The open docket, in order: -1. **fresh-context independent audit #2 of the v1.9 h-fragment +1. **fresh-context independent audit #3 of the v1.10 h-fragment claim** (next action; verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM - logged-position uniqueness (`kernel.md` §7.5 — the standing - conditional); + logged-position uniqueness (the standing conditional), and the + staged-uncomputation certificate extension for the `W` + placement class (feeds the compilation theorem); 2. the readback controller (full-NF halt sectors; the kernel's root classifier is its 1-bit case) and the `t` gate's `ℤ[ω]` scalars — with time-in-the-core added to the transparency theorem diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 4d89081..7da471d 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2578,3 +2578,55 @@ an explicit outcomes appendix (two predictions wrong, both instructively); the v1.7 basis baseline is a provenance file citing audit #1's independent numbers. Fresh audit #2 launches against v1.9. + +## 2026-08-09 — qALC kernel v1.10: audit #2's fatal witness, the hybrid verdict, and the placement limitation + +Fresh audit #2 FAILed v1.9 with the sharpest countermodel of the +campaign: W = (H 0̂) E E B — typable, h-only, NONEMPTY canonical +certificate, every validation field clean, computing {1/4, 3/4} +against the hand ideal {halt1: 1}. Diagnosis: W's core B has a +coherence-restoring certificate that v1.9's validation vetoed +because refire was STRUCTURALLY reachable on a branch whose +amplitude is exactly zero — the structural graph includes states +the physics never enters. The audit also refuted W8 preservation +(retained-whole burial of a ticket beside its live frame — W3 +scanned only the surface), showed condition (e) over-rejects +(grouping blind to incoming ks), and found the checker non-total. +All reproduced before correction. The round's design fork — should +validation compare against an ideal semantics? — went to the +working thread and came back decisive: the auditor's own term +evaluator is provably broken (non-normalized masses on half the +suite; Church elimination discards controls and spuriously +interferes — a no-deleting violation), no total bare-term +reference exists (the eliminator's physical reading is absent from +syntax; that IS the compilation theorem), and the sound hybrid is +one sentence: amplitudes decide whether a run succeeds, never +whether the machine is an isometry — with a raw countermodel +(T|0⟩=T|1⟩=|1⟩ preserves orbit norm while collapsing columns) +killing my amplitude-cone draft before it shipped. v1.10 +implements the hybrid: structural admission and structural +isometry mandatory; the frozen certificate's exact run must carry +zero guard/err amplitude at every step (residue-injectivity rules +out cancellation masking). Getting W's inner boundaries admissible +forced certificates to become INSTANCE-DIRECTED — per-boundary +popkeys with retained spectator frames (an outer coin's frame +around an inner interference is slot-uncorrelated and must survive +the pop) — with joint-first, per-key-exclusion-refined, +validation-adjudicated spectator admission, deterministic +throughout. Outcomes, predictions written first: B HEALS exactly +({halt1: 1}, its structural refire at amplitude zero now expected +and annotated); W does NOT — measured exhaustively, every +subset/exclusion trial erases a ticket whose instance is re-sought +later (refire, loud) — so W's coherent reading needs staged +uncomputation the certificate language cannot express, and it is +registered as the standing COHERENCE-PLACEMENT limitation: +machine-covered, physics table marked placement-open, docketed for +the compilation theorem. My consult prediction of W → {1:1} was +wrong; the miss is the finding. Also landed: deep W3 + the +complete key-state algebra (the four coexistence rows, each typed +or bit-adjudicated), condition (e) over full spectators, +machine_coverage replacing semantic_coverage with physics +agreement moved to a written-first per-program table +(theorem-backed vs designated-witness provenance), a total checker, +and twenty programs green with the sixteen still bit-identical to +v1.7 through three correction rounds. Fresh audit #3 next. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 953d26a..b285d70 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,17 +1,23 @@ -# qALC three-program kernel — current register (v1.9) +# qALC three-program kernel — current register (v1.10) -**Status: v1.9.** The kernel is a scratch superposition evolver for -qALC's quantum-control fragment (λIAM lineage, `h`-only, exact +**Status: v1.10.** The kernel is a scratch superposition evolver +for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed -ticket/frame/record machinery for re-interrogation, per-program -transparency certificates with a self-validating canonical -analysis, an eight-invariant well-formedness subtype, a typed -h-only fragment judgment, and every failure mode typed — never -silent. Two fresh-context independent audits and two working -reviews have shaped it (chronicle, §12); the standing PASS -re-claim is **gated on fresh audit #2**, whose verdict will be -registered here. +ticket/frame/record machinery for re-interrogation, +**instance-directed** per-program transparency certificates with a +hybrid canonical pipeline — structural admission and structural +isometry mandatory, exact-amplitude dynamic cleanliness deciding +run success ("amplitudes decide whether a run succeeds, never +whether the machine is an isometry") — an eight-invariant +well-formedness subtype, a typed h-only fragment judgment with a +syntactic language boundary, a written-first per-program physics +table, and every failure mode typed — never silent. Three +fresh-context audits and three working reviews have shaped it +(chronicle, §11); the audit-#2 fatal witness `B` is healed and +`W` is the registered coherence-placement limitation (§9). The +standing PASS re-claim is **gated on fresh audit #3**, whose +verdict will be registered here. This file is the current contract and register only. The round-by-round history — countermodels, corrections, verdicts — @@ -81,16 +87,19 @@ Every error entry freezes the complete source state as residue. ```text i := log-head lp; no lp at log head → no-instance. - dead := every (g, i) in KS (decoded records, KD - bundles, and tickets nested in retained-whole cargo). + bitfree := (g, i) keys of K/KD records (bit + discarded); dead := bitfree ∪ keys of tickets buried + in retained-whole K(l) cargo (bit present but + unreachable — ks is inert). (head ticket) tape = •^j · α_g(i′, b′) · T: i′ ≠ i → alien-ticket [foreign copy] - (g, i) ∈ dead → key-alias [live ticket must - never shadow a dead record: the - bit-free record has discarded the - bit that would detect divergent - aliasing] + (g, i) ∈ bitfree → key-alias [a live + representation must never shadow a + BIT-FREE record: it has discarded + the bit that would detect divergent + aliasing; bit-carrying burials are + adjudicated by deep W3 instead] same-key records with a different bit → frame-conflict j = b′+1 → recall: consume bullets+ticket, emit •·•·•·T, @@ -101,7 +110,7 @@ Every error entry freezes the complete source state as residue. (frame) R_g(i, b′) anywhere in RS (deep keyed lookup — LIFO position was never semantic): - (g, i) ∈ dead → key-alias + (g, i) ∈ bitfree → key-alias conflicting bits → frame-conflict j ≥ 3 → replay: emit •^(b′+1) · α_g(i, b′) · tape[3:] j < 3 → replay-err @@ -121,11 +130,19 @@ head):** ```text arrive/fire tape = P_b · μ_g · T, P_0 = l· P_1 = •·l· μ's gate kind ≠ γ's → species-mu - CERTIFIED boundary (pos ∈ certificate): - any RS frame with bit ≠ b → pop-err - erase (l, RS); leave ('KD', keys) — one tagged bundle - naming every live α nested in l and every popped frame's - (g, i) [sound under fibre conditions (a)–(e), §6] + any (g, i) with two bits among cargo-nested α and RS frames + → key-alias [deep bit coherence at + the boundary: a fire must never + erase or bury a disagreement] + CERTIFIED boundary (pos ∈ certificate, v1.10 INSTANCE-DIRECTED): + the certificate names popkeys(pos); frames split into + P = RS ∩ popkeys (erased) and Q = RS \ popkeys (retained + SPECTATORS — which-path data of unrelated instances, e.g. + an outer coin's frame around an inner interference) + any P frame with bit ≠ b → pop-err + erase (l, P); rs' = Q; leave ('KD', keys) — one tagged + bundle naming every live α nested in l and every popped + frame's (g, i) [sound under fibre conditions (a)–(f), §5] else, l = α_g(i, b) with bit = slot (DECODE): retain ('K', g, i) — bit-free, branch-equal — UNLESS a same-key frame exists (the ticket was replay-re-emitted; @@ -162,16 +179,26 @@ reinterpretation.** ## 4. Instance identity and the selection lifecycle -One `vvar` emits one ticket per fire. The ticket is consumed by -exactly one of: **recall** (→ replay frame, bit kept), **decode** -(→ bit-free `K` record, dead), or **certified erasure** (→ `KD` -bundle, dead). Replay re-emits fresh tickets off the frame; a -re-emitted ticket that decodes leaves no record while its frame -lives (W8). So per instance, the selection has at most one -*answerable* representation (ticket and/or frame, bit-carrying) -XOR *dead storage* (bit-free record) — and the leaf's guard order -makes every cross-class encounter typed (`key-alias`) and every -dead-key fresh call typed (`refire`). +One `vvar` emits one ticket per fire. The ticket then rests in +exactly one of FOUR places: consumed by **recall** (→ replay +frame, bit kept), consumed by **decode** (→ bit-free `K` record, +dead), erased by **certified erasure** (→ `KD` bundle, dead), or +**buried whole** inside a retained `K(l)` record (bit present but +unreachable — dead for recall/replay, adjudicated by deep W3). +Replay re-emits fresh tickets off the frame; a re-emitted ticket +that decodes leaves no record while its frame lives. The key-state +algebra (audit-#2/working-review completion): + + answerable + bit-free dead → typed (key-alias) + answerable + bit-carrying burial → allowed iff bits agree + (deep W3; conflict typed) + two bit-carrying burials → allowed iff bits agree + bit-free + bit-carrying same key → typed at the boundary + fresh call of ANY dead key → typed (refire) + +A bit-carrying burial blocking a fresh call is sound but +conservatively incomplete — in principle an explicit decoder could +support replay from it; registered as future work. **Load-bearing derivations** (from the literal-boolean ground truth, not stipulated): classical transport is the whole delivery @@ -184,43 +211,79 @@ boolean's real `•3`/`•4` pairs would pay; balance needs no padding step); re-interrogation is real and store-free — the outcome of a fired gate lives only in the tokens the machine already carries. -## 5. Certificates: the fibre conditions and the canonical pipeline - -A certificate is a set of fire positions where erasure of `(l, RS)` -is proven transparent. Admission conditions, checked over the -certified reachable graph's arrivals: - -- **(a)** every RS frame's bit equals its arrival slot; -- **(b)** the retained key `(slot, T, log)` determines the entire - erased tuple `(l, RS)` — the fibre is a function; -- **(c)** non-vacuous: certification erases something the - conservative fire would retain; -- **(d)** erased cargo is γ-free (deleting an in-flight probe's γ - would break W5 — its μ survives unpaired); -- **(e)** **cross-slot bundle equality**: whenever both slots are - present at one `(T, log)`, the dead-key bundles agree — - `Dead(l₀, RS₀) = Dead(l₁, RS₁)`. The fibre function property is - per-slot, so nothing else forces the two H columns of one - intended fibre to leave equal decode bundles; divergent bundles - would silently decohere the interference the certificate exists - to buy, invisible to Gram (disjoint columns read as orthogonal). - -**The canonical pipeline.** `discover_total` iterates admission to -a fixpoint under hard caps (any cap hit or non-convergence → None) -and then **validates its own fixpoint**: the certified graph must -pass totality, zero guard reachability, clean Gram, zero err mass, -unconditional transparency at certified positions, reachable ⊆ -WF∧W7∧W8, and the mechanized disjointness check — else None. None -selects the conservative machine: total, unitary, typed — sound as -a machine, not ideal-preserving. U is total and well-defined on -every program (`h Ω` → None); the certificate is frozen machine -metadata, a deterministic function of the program. - -**The certificate is semantically load-bearing** (measured): HNH -certified computes `{halt0: 1}` — the physics, H·X·H|0⟩ = |0⟩ — -while its plain run decoheres to `{1/2, 1/2}`. A refused -certificate degrades coherence, never soundness; that is exactly -why admission must refuse rather than admit an unsound one. +## 5. Certificates: instance-directed erasure and the hybrid pipeline + +A certificate is a map from fire positions to **popkeys** — the +instance keys whose frames it erases there; other frames are +retained spectators. Admission conditions, checked over the +STRUCTURAL certified graph's arrivals (with P = frames in popkeys, +Q = the spectators): + +- **(a)** every popped frame's bit equals its arrival slot + (slot-correlation = the redundancy erasure needs); +- **(b)** the retained key `(slot, T, log, ks, Q)` determines the + erased tuple `(l, P)` — the fibre is a function; +- **(c)** non-vacuous: something is actually erased; +- **(d)** erased cargo is γ-free (W5); +- **(e)** cross-slot decode-bundle equality per retained-spectator + group `(T, log, ks, Q)` — the fibre function property is + per-slot, and divergent bundles across one H fibre would + silently decohere the interference the certificate buys, + invisible to Gram; +- **(f)** deep bit coherence: cargo-nested α bits and frame bits + agree per key (a conflicted arrival is never admitted; the + kernel also types it). + +**The canonical pipeline** (`discover_total`, the v1.10 hybrid — +"amplitudes decide whether a run succeeds, never whether the +machine is an isometry"): + +1. **Legacy-conservative structural fixpoint**: admit only + boundaries whose every frame key is slot-correlated + (pop-everything), iterated under hard caps. Amplitude support + never drives admission (self-supporting certificate cycles). +2. **Spectator admission, validation-adjudicated**: boundaries + admissible only in instance-directed mode are tried joint-first + then greedily, with per-key exclusion refinement + (slot-correlation makes a key poppable, not always safe — an + erased selection re-sought later reaches `refire`, loud, and + the trial is dropped). Every acceptance requires the full + validation to stay clean. Deterministic and bounded. +3. **Final validation** of the frozen certificate; None unless + `machine_coverage` holds — the conservative, sound fallback. + +**Validation** (`validate`) splits per the working-review verdict: +the STRUCTURAL side — totality, Gram orthonormality on the +structural reachable basis, unconditional transparency, reachable +⊆ WF∧W7∧W8, mechanized disjointness — is mandatory and +isometry-bearing (orbit-norm preservation alone is NOT isometry: +`T|0⟩ = T|1⟩ = |1⟩` holds norm 1 forever from `|0⟩` while +collapsing columns). The DYNAMIC side — exact evolution of the +frozen candidate with **zero guard/err amplitude at every step** +(residue-injectivity prevents cancellation masking a guard fire), +termination, zero final err mass — decides run success and no +longer lets zero-amplitude structural branches veto +coherence-restoring certificates (the audit-#2 `B` witness). +`machine_coverage` is the conjunction; it claims machine soundness +and clean execution, **never** agreement with an external ideal +semantics — no such total reference exists for bare λ-terms (the +eliminator's physical reading — wire, measurement, garbage, +promised uncomputation — is absent from the syntax); per-program +physics expectations live in the suite's written-first table, each +marked hand-derived or audit-confirmed. What certification proves +is: **every admitted erasure has a checked reversible decoding +from the retained coordinate and spectator state, and the +resulting columns remain orthonormal** — not that the certificate +found the maximally coherent placement (§9). + +**Measured facts that pin the design**: the certificate is +semantically load-bearing for HNH (certified `{halt0: 1}` = the +physics vs plain `{1/2, 1/2}`); `B`'s coherence-restoring +certificate is admitted by the hybrid (structural `refire` at +amplitude exactly zero, dynamic mass zero — canonical +`{halt1: 1}`); the sixteen prior programs are measurably +bit-identical between the legacy set reading and the canonical +dicts (the identity sweep). ## 6. The invariant catalog (WF, the well-formed subtype) @@ -231,8 +294,10 @@ the machine's unitarity claims quantify over the subtype: - **W2** (record uniqueness + canonicity): at most one frame per `(g, i)` in RS; RS canonically sorted (state identity is order-free). -- **W3** (bit coherence): all instance-keyed entries with one - `(g, i)` — frames, tickets — carry one bit. +- **W3** (bit coherence, DEEP as of v1.10): one bit per `(g, i)` + across ALL bit-carrying representations — frames, top-level and + slice-suspended tickets on tape and log, and tickets buried in + retained-whole `K(l)` records. - **W4** (first-interrogation exclusivity): a VB-active state at instance `i` holds no `i`-frame and no `i`-ticket (the guard chain forces this). @@ -242,16 +307,19 @@ the machine's unitarity claims quantify over the subtype: matched by its μ or its answer token. - **W6** (root frame): exactly one ρ, at the tape bottom. - **W7** (certificate fibre coherence): at a certified boundary, - the erased `(l, RS)` equals the certificate's frozen fibre value - at the retained key `(pos, slot, T, log)`. States outside the - fibre relation are outside the certified domain subtype; the - domain lemma (reachable certified arrivals are in-domain) is the - per-program sweep. -- **W8** (representation exclusivity): per `(g, i)`, answerable - representations (live α anywhere in tape/log including suspended - slice cargo; RS frames) never coexist with dead storage (K/KD - records). Preserved by construction (§4); its boundary is the - typed `key-alias`. + the erased `(l, P)` equals the certificate's frozen fibre value + at the retained key `(pos, slot, T, log, ks, Q)` — the full + retained spectator including incoming dead storage and retained + frames. States outside the fibre relation are outside the + certified domain subtype; the domain lemma (reachable certified + arrivals are in-domain) is the per-program sweep. +- **W8** (representation exclusivity, v1.10 restatement): per + `(g, i)`, answerable representations (live α anywhere in + tape/log including suspended slice cargo; RS frames) never + coexist with **bit-free** dead storage (K/KD records) — the + shadowing hazard is bit loss. Bit-carrying burials coexist under + deep W3's adjudication (the key-state algebra, §4). Preserved by + construction; its boundary is the typed `key-alias`. ## 7. Theorems @@ -330,7 +398,7 @@ ways as virtual ancestry predicts. For two certified-fire sources at one boundary: ```text -different retained spectator (pos, log, T, incoming KS) +different retained spectator (pos, log, T, incoming KS, retained Q) ⇒ disjoint targets (targets embed all of it verbatim); same spectator, same slot ⇒ the SAME source (W7: the fibre is a function; state identity); @@ -385,28 +453,60 @@ clean), `dupcall` (NOT′/EP ununifiable). All escapes — `h h`, gate literals in bodies, swapped or doubled shell arguments — rejected. -## 9. The claim - -Over programs that are (i) typable h-only under the signature -judgment and (ii) whose canonical pipeline reports -`semantic_coverage`: **the kernel is total and Gram-clean (U an -isometry on the reachable basis), certified erasure is transparent -(fibre-proven, W7-coherent, disjointness mechanized), and every -failure mode is typed and visible — never silent.** -Marginal-correctness against ideal quantum semantics is -established per-program against hand-computed physics for the -eighteen (independently recomputed by audit #1 for the -interleaving set); the *general* agreement theorem is explicitly -the compilation theorem's obligation (STATUS docket), not claimed -here. The claim is conditional on the alias gap (§7.5), stated as -such. - -Standing fences, all typed: literal gate application (untypable), -the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback -controller's job), and every guard in §3. +## 9. The claim, and the registered placement limitation + +**The v1.10 coverage claim.** Over programs that are (i) typable +h-only under the signature judgment (with the syntactic boundary: +shell args exactly `Gate(h)` then `Gate(t)`, no gate literals in +bodies, closed bodies) and (ii) whose canonical pipeline reports +`machine_coverage`: **the kernel is total and Gram-clean on the +structural reachable basis (U an isometry there), every admitted +erasure is reversibly decodable from its retained fibre +coordinate, the frozen certificate's exact run carries zero +guard/err amplitude at every step, and every failure mode is +typed and visible — never silent.** The claim is conditional on +the instance-alias gap below, stated as such. + +`machine_coverage` does NOT claim agreement with an ideal quantum +semantics — no total reference exists for bare λ-terms; which +eliminations are wires is the compilation theorem's question. +Physics agreement is claimed program-by-program in the suite's +written-first table (hand-derived circuit readings, several +independently confirmed by the audits). + +**The registered placement limitation (`W`).** Audit #2's fatal +witness `W = (H 0̂) E E B` wraps the healed witness `B` in a +branch-equal selector. Its hand ideal is `{halt1: 1}`; the +canonical machine computes `{1/4, 3/4}` — machine-covered, +decohered. Measured exhaustively: certifying ANY of `W`'s inner +boundaries (joint, pairs, singles, with every per-key pop +exclusion) erases a ticket whose instance is re-sought later — +`refire`, loud, trial rejected. `W`'s coherent reading needs +**staged uncomputation** — erasure-with-answerability across +certified boundaries — which the certificate language cannot yet +express. This is a registered COVERAGE limitation of the +certificate language, not a kernel soundness defect: the machine +never computes wrong amplitudes, it fails to realize achievable +coherence, says so in the physics table, and the mechanism is +docketed for the compilation theorem. + +**The instance-alias gap (unchanged in kind, narrowed in +surface).** No injectivity theorem for logged-position keys is +claimed. Every detectable manifestation is typed +(`frame-conflict`, `alien-ticket`, `key-alias`, `refire`; deep W3 +adjudicates bit-carrying coexistence). Open: an alias-tolerant +local transition theorem — that agreeing-bit aliases cannot +silently merge histories that should stay orthogonal — or λIAM +logged-position uniqueness. The soundness claims are conditional +on it. + +Standing fences, all typed: literal gate application and open +bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond +{0̂, 1̂, I} (readback controller), every §3 guard, and the `W`-class +placement limitation above. **The PASS re-claim is gated on fresh-context independent audit -#2; the verdict will be registered here.** +#3; the verdict will be registered here.** ## 10. Verification state @@ -433,10 +533,17 @@ Eighteen-program suite (twelve sectors + the audit witnesses | qq | 2,192 | ½ / ½, sup 8 | Q in Q, double-crossed re-seeks | | palpha | 474 | ¼ / ¾, sup 3 | audit-2 witness: cert refused, physics via fallback | | dupcall | 632 | typed err ½ + ¼/¼ | untyped; refire positive control | - -All: zero stuck / non-unit / non-orthogonal columns; guards silent -except `dupcall` (expected). `discover_total` == frozen CERTS on -all 18; `h(Ω)` → None. Negative controls: pstar × wrong +| B | 186 | 1̂: 1 | audit-2 witness, HEALED (hybrid admits the cert; structural refire at amplitude 0) | +| W | 1,262 | ¼ / ¾, sup 12 | audit-2 fatal witness; machine-covered; PLACEMENT-OPEN (hand ideal 1̂: 1) | + +All twenty: zero stuck / non-unit / non-orthogonal columns; guards +silent except `dupcall` (expected: `alien-ticket`) and `B` +(expected: structural `refire` at amplitude exactly zero — the +hybrid's core case). The written-first physics table passes on all +twenty (W's entry records the placement-open verdict). +`discover_total` == frozen CERTS on all 20 (the sixteen as +position sets, measured identical to their canonical dicts; `B` +frozen as its spectator-mode dict); `h(Ω)` → None. Negative controls: pstar × wrong certificate reaches `pop-err`; dupcall × v1.7-era certificate reaches `refire`, all-err. WF/W7/W8 sweeps + disjointness: zero violations; three permanent collision regressions. Conservation: @@ -452,8 +559,15 @@ seconds-scale on the M5 Max. ## 11. Chronicle Full narratives: `docs/ledger/2026-08.md` (and 2026-07); complete -superseded registers: this file's git history (through commit -`ed85767`). +superseded registers: this file's git history (v1.9's last full +text at `0193b65`, the layered pre-v1.9 registers through +`ed85767`). Audit verdicts in one line each: audit #1 (v1.7): +FAIL — Pα + WF-collision countermodels, alias gap, honesty +defects. Audit #2 (v1.9): FAIL — the `W` fatal witness (validated +certificate, wrong physics), W8 preservation, (e) over-rejection. +Working reviews: v1.8 design (two structural holes), v1.10 design +fork (the hybrid verdict: amplitudes decide success, never +isometry; no bare-term ideal oracle). | version | one line | verdict that shaped it | |---|---|---| @@ -464,7 +578,8 @@ superseded registers: this file's git history (through commit | v1.6 | conservation theorem proved + mechanized; gauge pinned; discover_total | fresh review: math CONFIRMED, scope FAILED (Q) | | v1.7 | the replay record (idempotent recall, deep keyed replay); WF subtype; cargo conditions | **fresh audit #1: FAIL** (WF collision, Pα, alias gap, honesty) | | v1.8 | decode records + refire guard; self-validating admission; W7; typed fragment | working review: two structural holes | -| v1.9 | KD bundles + condition (e); key-alias guard + W8; real disjointness checker; syntactic fragment boundary; docs current-only | **fresh audit #2: pending** | +| v1.9 | KD bundles + condition (e); key-alias guard + W8; real disjointness checker; syntactic fragment boundary; docs current-only | **fresh audit #2: FAIL** (the `W` fatal witness — clean validation, wrong physics via a zero-amplitude structural veto on `B`-class certificates; W8 preservation refuted; (e) over-rejection; checker totality) | +| v1.10 | the hybrid pipeline (structural isometry mandatory; dynamic cleanliness decides success); instance-directed erasure with validation-adjudicated spectator admission; deep W3 + the key-state algebra; machine_coverage rename + the physics table; `B` healed, `W` registered placement-open | **fresh audit #3: pending** | ## 12. Appendix — HH step-indexed trace diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index 8af0912..1c2a4be 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -389,7 +389,8 @@ substrate's obstruction and the fork reopens. | Item | Status | |---|---| -| Kernel | **v1.9** (`kernel.md`, now the current-only register; history in the ledger + git): one-fire-per-instance a runtime machine invariant (decode records incl. tagged KD bundles + `refire`/`key-alias` guards + W8 exclusivity); self-validating canonical certificates with cross-slot bundle equality (condition (e)); W7 + the range-disjointness theorem mechanized against constructed fire targets; syntactically-bounded typing judgment (15/18 h-only; `q` untypable — `qprime` its repair); HNH's certificate measured load-bearing. Audit #1 FAIL and the sol-tier working review both fully absorbed; the alias-tolerant transition theorem is the stated standing conditional. **PASS re-claim gated on fresh audit #2** | +| Kernel | **v1.10** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates (per-boundary popkeys, retained spectators, validation-adjudicated admission); deep W3 + the key-state algebra; `machine_coverage` + a written-first physics table (no bare-term ideal oracle exists — adjudicated on-thread). Audit #2's `B` healed ({1̂: 1}); `W` registered as the coherence-placement limitation (staged uncomputation → compilation theorem). Twenty programs green, sixteen bit-identical since v1.7. **PASS re-claim gated on fresh audit #3** | + | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §11.7, §12.2, §13.3): the v1.5 fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is pop-err reachability + the RS-function property, strictly beyond Gram (negative control caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and as of v1.8 **self-validating**: the fixpoint is admitted only if its certified graph passes full semantic coverage, else None | | Instance identity | **ratified and discharged, interleaving included** (`kernel.md` §13.4, §14): lp-at-log-head structural for signature-abstracted programs; equal-lps-same-copy backed by the `(g,i)`-aliasing regression, the `dup` witness, and now the `frame-conflict` typed guard; the interleaved re-seek has semantics via the replay record — `Q`, `weave`, `hweave`, and `qq` all total, clean, and physical; v1.8 dissolves the audit's injectivity gap (aliasing manifestations are typed or value-correct — `frame-conflict`, `alien-ticket`, `refire`; lp uniqueness downgrades to a completeness conjecture) | From b995df71e503828669e2f0c63b7810b8443e612c Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 16:25:02 -0400 Subject: [PATCH 034/107] =?UTF-8?q?qalc:=20kernel=20v1.11=20=E2=80=94=20au?= =?UTF-8?q?dit=20#3=20FAIL=20inverts=20W;=20spectator=20transition=20wired?= =?UTF-8?q?=20literally;=20W=20healed=20at=20{halt1:1}?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fresh audit #3 found the v1.10 fire arm computed the P/Q spectator split and discarded it (KD from all of RS, rs'=()), yielding a real isometry countermodel (retained-Q columns collapsed to inner product 1) and explaining W: the registered placement limitation measured the defect, not the certificate language. Under the literal register transition W is fully certified — four boundaries, inner popping the inner coin's two instances, outer frames retained as spectators — computing its hand ideal {halt1: 1}. Staged-uncomputation inexpressibility RETRACTED; the consult prediction ledgered wrong last round was right about the design. v1.11: split wired through; all twenty certificates re-frozen as exact dicts (most boundaries pop nothing; q family/B/W pop exactly the interfering instances); W9 live-ticket key uniqueness (the duplicate-ticket algebra row); validate(None) contract gap closed; two new permanent regressions; six honesty corrections (B/W attribution, 20/17 fragment, transposed conservation counts, semantic_coverage doc, audit counts, identity-sweep retraction). All predictions written first, all six held. PASS re-claim gated on fresh audit #4. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 68 ++++----- docs/ledger/2026-08.md | 62 +++++++++ docs/quantum-algebraic/kernel.md | 229 ++++++++++++++++++++----------- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 246 insertions(+), 115 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 386fc5f..5737316 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -420,46 +420,46 @@ consistency) and a fresh-context feasibility review (thread promising-with-hard-open-problems, converging with the sketch on every load-bearing point; its checklist and exclusions are folded in. -**The kernel is at v1.10** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.11** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` -and git). Fresh audit #2 FAILed v1.9 with a fatal witness: `W`, a -typed program whose nonempty certificate validated clean while -computing decohered marginals — the root cause being a -zero-amplitude structural `refire` vetoing the coherence-restoring -certificate of its core `B`. The round's design fork (is there an -ideal reference semantics to validate against?) was adjudicated on -the working thread: the auditor's own term-level ideal evaluator is -provably broken (non-normalized masses — Church elimination -discards controls and spuriously interferes), no total bare-term -reference exists, and the sound hybrid is "amplitudes decide -whether a run succeeds, never whether the machine is an isometry." -v1.10 implements it: structural admission and structural isometry -mandatory; the frozen certificate's exact run must carry zero -guard/err amplitude at every step; certificates became -INSTANCE-DIRECTED (per-boundary popkeys with retained spectators — -the blocker for compositional certification) with joint-first, -per-key-refined, validation-adjudicated spectator admission; -`semantic_coverage` renamed `machine_coverage` with physics -agreement moved to a written-first per-program table; deep W3 and -the completed key-state algebra fix the audit's W8-preservation -refutation; condition (e) groups by the full retained spectator; -the checker is total. Outcomes: `B` HEALS to its physics -({halt1: 1}); `W` is measured inexpressible in the certificate -language (every subset/exclusion trial re-seeks an erased instance -— loud) and is registered as the standing COHERENCE-PLACEMENT -limitation, machine-covered, docketed for the compilation theorem -(staged uncomputation). Twenty-program battery green; the sixteen -remain bit-identical; both prior auditors' reproducers rerun clean -under v1.10. +and git). Fresh audit #3 FAILed v1.10 with a finding that inverted +the previous round's headline: the fire arm computed the +instance-directed `P`/`Q` spectator split and then discarded it +(`KD` from all of RS, `rs′ = ()`), so every retained spectator was +erased bit-free — a real isometry countermodel (two sources +differing only in a retained frame's bit collapsed to identical +columns) AND the explanation of `W`: v1.10's registered +"placement limitation" (staged uncomputation inexpressible) had +measured the defect, not the certificate language. Under the +register's own literal transition, `W` is fully certified — +four boundaries, the inner popping exactly the inner coin's two +branch-dependent instances while the outer coin's frames ride +through as retained spectators — computing its hand ideal +`{halt1: 1}`; the audit measured the healing before the fix +landed, and the consult-round prediction it vindicates is +corrected in the provenance record. v1.11 wires the split through +literally, re-discovers and freezes all twenty canonical +certificates as exact dicts (parsimonious: most boundaries pop +nothing; only the q family, `B`, `W` pop keys), retracts the +staged-uncomputation limitation and the legacy-identity claim +(an artifact of the defect), adds W9 (live-ticket key uniqueness +— the duplicate-ticket alias row audit #3 found in the key-state +algebra, now statically excluded), closes the `validate(None)` +contract gap, adds two permanent regressions (retained-Q +disjointness; duplicate-ticket W9), and fixes six register +honesty defects (B/W witness attribution, fragment counts 20/17, +transposed conservation counts, stale `semantic_coverage` doc, +audit-count consistency, the identity-sweep claim). Physics table +passes on all twenty with `W = {halt1: 1}`; the sixteen originals' +marginals never moved; all three prior audit kits rerun clean. The open docket, in order: -1. **fresh-context independent audit #3 of the v1.10 h-fragment +1. **fresh-context independent audit #4 of the v1.11 h-fragment claim** (next action; verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM - logged-position uniqueness (the standing conditional), and the - staged-uncomputation certificate extension for the `W` - placement class (feeds the compilation theorem); + logged-position uniqueness (the standing conditional — W9 + is its newly checkable ticket-dimension face); 2. the readback controller (full-NF halt sectors; the kernel's root classifier is its 1-bit case) and the `t` gate's `ℤ[ω]` scalars — with time-in-the-core added to the transparency theorem diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 7da471d..af7282d 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2630,3 +2630,65 @@ agreement moved to a written-first per-program table (theorem-backed vs designated-witness provenance), a total checker, and twenty programs green with the sixteen still bit-identical to v1.7 through three correction rounds. Fresh audit #3 next. + +## 2026-08-09 — qALC kernel v1.11: audit #3 inverts the W story — the "limitation" was a bug, and the design was right + +Fresh audit #3 (independent instance, sol tier, the v1.10 pack) +returned FAIL with the sharpest finding of the loop so far: the +fire arm computed the instance-directed P/Q spectator split and +then threw it away — `dk` built from ALL of RS, `rs′ = ()` — so +every "retained" spectator was erased into a bit-free KD record. +Two consequences, both reproduced bit-exactly before any change. +First, a genuine isometry countermodel: two WF, transparent, +same-slot certified-fire sources differing only in a retained-Q +frame's bit produced IDENTICAL target columns (inner product 1). +Second — the inversion — W's registered "coherence-placement +limitation" was this defect wearing a theory costume: the v1.10 +exhaustive subset/exclusion sweep that "proved" staged +uncomputation inexpressible had erased, in every trial, the outer +frames whose retention the inner coherence needed. The auditor +applied the register's own literal transition in memory and W +healed completely: a four-boundary certificate (the inner boundary +pops the inner coin's two branch-dependent instance names; the +outer coin's frames ride through as retained spectators), clean +validation, {halt1: 1} = the hand ideal. The consult-round +prediction ledgered as WRONG last round was right about the design; +what it measured was the implementation. Both provenance files +carry postscripts; the retraction is registered in kernel.md §9. + +v1.11 is the correction round: the split wired through literally +(five-line fix); all twenty canonical certificates re-discovered +and frozen as exact dicts — and the shape is lovely: most +boundaries pop nothing (cargo-only certification, every frame +retained), with only the q family, B, and W popping keys, in each +case exactly the inner-coin instance(s) whose interference needs +the frame gone. discover_total(W) reproduces the auditor's +certificate bit-for-bit. Also from the audit: W9 (live-ticket key +uniqueness — the duplicate-ticket coexistence row the four-row +algebra missed; two agreeing live tickets pass W3∧W8 yet decode +into a W8 violation, so the row is excluded statically and W8 +preservation now honestly quantifies over W9-clean sources); +validate(None) runs the real reachable-WF sweep (the contract gap); +two new permanent regressions (retained-Q disjointness with a true +Gram-entry-0 check; duplicate-ticket W9); and six honesty +corrections (W not B was audit #2's fatal witness; four audits not +three; 20 programs / 17 typable; the transposed conservation counts +— 14,452 at ≤10, 55,727 at ≤11; certify.py's stale +semantic_coverage doc; the legacy-identity claim retracted as a +defect artifact). One incidental: the round-2 collision regression +pinned 'W7-fibre', and under instance-directed certificates the +extra-frame source is excluded at 'W7-domain' instead — same +theorem, sharper mechanism; the regression accepts either clause. + +Predictions were written first (v111-predictions.md); all six +HELD, two stronger than predicted (B keeps its exact frozen +certificate; W matches the auditor's dict bit-for-bit). Physics +table passes on all twenty with W = {halt1: 1}; the sixteen +originals' marginals and supports never moved through FOUR +correction rounds; certified basis counts unchanged (pstar 242, +qq 2,192); all three prior audits' kits rerun clean (audit #2's +term-evaluator mismatches remain that evaluator's adjudicated +non-normalization; it now shows W mass 2). WF/W7/W8/W9 + +disjointness + conservation + polarity/gauge: zero violations. +Register, STATUS, token.md updated; fresh audit #4 next — the +PASS re-claim stays gated on it. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index b285d70..84fdcda 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ -# qALC three-program kernel — current register (v1.10) +# qALC three-program kernel — current register (v1.11) -**Status: v1.10.** The kernel is a scratch superposition evolver +**Status: v1.11.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -9,14 +9,18 @@ ticket/frame/record machinery for re-interrogation, hybrid canonical pipeline — structural admission and structural isometry mandatory, exact-amplitude dynamic cleanliness deciding run success ("amplitudes decide whether a run succeeds, never -whether the machine is an isometry") — an eight-invariant +whether the machine is an isometry") — a nine-invariant well-formedness subtype, a typed h-only fragment judgment with a syntactic language boundary, a written-first per-program physics -table, and every failure mode typed — never silent. Three +table, and every failure mode typed — never silent. Four fresh-context audits and three working reviews have shaped it -(chronicle, §11); the audit-#2 fatal witness `B` is healed and -`W` is the registered coherence-placement limitation (§9). The -standing PASS re-claim is **gated on fresh audit #3**, whose +(chronicle, §11). The audit-#2 fatal witness `W` — and `B`, its +decomposition — are both **healed**: audit #3 found that v1.10's +fire arm computed the retained-spectator split and then discarded +it, so W's registered "placement limitation" measured an +implementation defect, not the certificate language; under the +register's own transition W is fully certified at {halt1: 1} (§9). +The standing PASS re-claim is **gated on fresh audit #4**, whose verdict will be registered here. This file is the current contract and register only. The @@ -195,6 +199,17 @@ algebra (audit-#2/working-review completion): two bit-carrying burials → allowed iff bits agree bit-free + bit-carrying same key → typed at the boundary fresh call of ANY dead key → typed (refire) + two live tickets, one key → alias state, excluded + statically (W9) + +The last row is audit #3's addition: two agreeing live tickets for +one key pass deep W3 (one bit) and W8 (no dead record), yet +decoding one leaves the other answerable beside the fresh bit-free +record — so the algebra is complete only over W9-clean states, and +W9 makes that hypothesis checkable rather than assumed. The +duplicate-ticket source is the registered agreeing-alias gap's +ticket-dimension face; it was never reached in any sweep or fuzz +run, consistent with lp-uniqueness (§9). A bit-carrying burial blocking a fresh call is sound but conservatively incomplete — in principle an explicit decoder could @@ -234,7 +249,8 @@ Q = the spectators): agree per key (a conflicted arrival is never admitted; the kernel also types it). -**The canonical pipeline** (`discover_total`, the v1.10 hybrid — +**The canonical pipeline** (`discover_total`, the v1.10 hybrid, its +spectator transition implemented literally as of v1.11 — "amplitudes decide whether a run succeeds, never whether the machine is an isometry"): @@ -251,11 +267,16 @@ machine is an isometry"): validation to stay clean. Deterministic and bounded. 3. **Final validation** of the frozen certificate; None unless `machine_coverage` holds — the conservative, sound fallback. + A None result IS the fallback (the plain reading); its coverage + verdict is `validate(term, None)`, which as of v1.11 runs the + same reachable-WF sweep with an empty certified domain (audit + #3's contract gap: the no-certificate path previously reported + the sweeps as zero without running them). **Validation** (`validate`) splits per the working-review verdict: the STRUCTURAL side — totality, Gram orthonormality on the structural reachable basis, unconditional transparency, reachable -⊆ WF∧W7∧W8, mechanized disjointness — is mandatory and +⊆ WF∧W7∧W8∧W9, mechanized disjointness — is mandatory and isometry-bearing (orbit-norm preservation alone is NOT isometry: `T|0⟩ = T|1⟩ = |1⟩` holds norm 1 forever from `|0⟩` while collapsing columns). The DYNAMIC side — exact evolution of the @@ -278,12 +299,19 @@ found the maximally coherent placement (§9). **Measured facts that pin the design**: the certificate is semantically load-bearing for HNH (certified `{halt0: 1}` = the -physics vs plain `{1/2, 1/2}`); `B`'s coherence-restoring -certificate is admitted by the hybrid (structural `refire` at -amplitude exactly zero, dynamic mass zero — canonical -`{halt1: 1}`); the sixteen prior programs are measurably -bit-identical between the legacy set reading and the canonical -dicts (the identity sweep). +physics vs plain `{1/2, 1/2}`); `B` and `W`'s coherence-restoring +certificates are admitted by the hybrid (structural `refire` at +amplitude exactly zero, dynamic mass zero — canonical `{halt1: 1}` +for both); all twenty canonical certificates are frozen as exact +dicts and reproduced exactly by `discover_total`. The frozen shape +is parsimonious: most certified boundaries pop nothing (cargo-only +certification, every frame retained); only the q family, `B`, and +`W` pop keys — in each case exactly the inner-coin instance(s) +whose interference needs the frame erased. The v1.10 claim that +the legacy pop-everything reading was "measured identical" to the +canonical dicts is RETRACTED: that identity was an artifact of the +spectator-transition defect (dict certificates also erased all of +RS), not a theorem, and no such identity is claimed now. ## 6. The invariant catalog (WF, the well-formed subtype) @@ -318,8 +346,19 @@ the machine's unitarity claims quantify over the subtype: tape/log including suspended slice cargo; RS frames) never coexist with **bit-free** dead storage (K/KD records) — the shadowing hazard is bit loss. Bit-carrying burials coexist under - deep W3's adjudication (the key-state algebra, §4). Preserved by - construction; its boundary is the typed `key-alias`. + deep W3's adjudication (the key-state algebra, §4). Preserved on + W9-clean sources; its boundary is the typed `key-alias`. + Preservation is NOT unconditional (audit #3): a duplicate-ticket + alias source decodes into a W8 violation, which is exactly what + W9 excludes statically. +- **W9** (live-ticket key uniqueness, v1.11): at most one live α + ticket per `(g, i)` across tape and log, deep through slice + cargo. Two agreeing live tickets pass W3 and W8 yet are an alias + state — the agreeing-alias gap's ticket-dimension face, made + checkable. Zero violations on every reachable state of the + twenty-program battery and all fuzz sweeps (empirical + lp-uniqueness); ticket+frame (replay re-emission) and + ticket+burial remain legitimate, adjudicated by W2/W3/W8. ## 7. Theorems @@ -388,8 +427,9 @@ exactly gate-mediated**. **Mechanization.** The ledger invariant is asserted after every step of every run in lockstep conformance with the uninstrumented stepper. Exhaustive: all closed pure terms ≤ size 11 (41,272), -k ∈ {1,2,3} probes — 55,727 surfacings at ≤10, 14,452 at the -current sweep tier, zero failures. Battery cross-check: zero +k ∈ {1,2,3} probes — 14,452 surfacings at ≤10 (10,180 terms), +55,727 at ≤11, zero failures (the v1.10 register transposed these +two counts; audit #3 caught it). Battery cross-check: zero mark-free arrivals violate `w ≡ slot`; marked arrivals split both ways as virtual ancestry predicts. @@ -412,11 +452,16 @@ same spectator, opposite slots Mechanized for real: the checker collects reachable sources with full state, constructs their fire targets via the step function, compares decode bundles cross-slot, and computes column inner -products. Zero violations over every certified graph. Two audit +products. Zero violations over every certified graph. Three audit countermodels are permanent regressions here: the extra-frame -collision (W7-excluded AND target-disjoint — the popped frame -leaves its record) and the doctored bundle-divergent fibre -(rejected by condition (e)). +collision (W7-excluded AND target-disjoint; since v1.11 the +exclusion clause is W7-domain — the added frame is a +retained-spectator coordinate that leaves the certified fibre +domain), the doctored bundle-divergent fibre (rejected by +condition (e)), and audit #3's retained-Q collision (two WF, +transparent, same-slot sources differing only in a retained +frame's bit — zero shared targets, true Gram entry 0; the v1.10 +fire arm collapsed these columns to inner product 1). ### 7.5 What is NOT claimed (the alias gap) @@ -445,17 +490,18 @@ signature constants (no lets, no generalization); the result type is free (haltI-sector programs are function-typed). **h-only** additionally requires no occurrence resolve to the `t` binder. -Fragment table (18-program suite): **15 typable h-only**. Outside: -`dup` (self-application — deliberately, the untyped copy -regression), `q` (E = λz.Iz vs N branch types ununifiable — the -wire imbalance `qprime` was built to repair; `qprime` types -clean), `dupcall` (NOT′/EP ununifiable). All escapes — `h h`, -gate literals in bodies, swapped or doubled shell arguments — -rejected. +Fragment table (twenty-program suite): **17 typable h-only** +(including `B` and `W`). Outside: `dup` (self-application — +deliberately, the untyped copy regression), `q` (E = λz.Iz vs N +branch types ununifiable — the wire imbalance `qprime` was built +to repair; `qprime` types clean), `dupcall` (NOT′/EP ununifiable). +All escapes — `h h`, gate literals in bodies, swapped or doubled +shell arguments — rejected. (The v1.10 register said "18-program / +15 typable", a stale pre-`B`/`W` count; audit #3 caught it.) -## 9. The claim, and the registered placement limitation +## 9. The claim, the healed witness, and the alias gap -**The v1.10 coverage claim.** Over programs that are (i) typable +**The v1.11 coverage claim.** Over programs that are (i) typable h-only under the signature judgment (with the syntactic boundary: shell args exactly `Gate(h)` then `Gate(t)`, no gate literals in bodies, closed bodies) and (ii) whose canonical pipeline reports @@ -474,21 +520,31 @@ Physics agreement is claimed program-by-program in the suite's written-first table (hand-derived circuit readings, several independently confirmed by the audits). -**The registered placement limitation (`W`).** Audit #2's fatal -witness `W = (H 0̂) E E B` wraps the healed witness `B` in a -branch-equal selector. Its hand ideal is `{halt1: 1}`; the -canonical machine computes `{1/4, 3/4}` — machine-covered, -decohered. Measured exhaustively: certifying ANY of `W`'s inner -boundaries (joint, pairs, singles, with every per-key pop -exclusion) erases a ticket whose instance is re-sought later — -`refire`, loud, trial rejected. `W`'s coherent reading needs -**staged uncomputation** — erasure-with-answerability across -certified boundaries — which the certificate language cannot yet -express. This is a registered COVERAGE limitation of the -certificate language, not a kernel soundness defect: the machine -never computes wrong amplitudes, it fails to realize achievable -coherence, says so in the physics table, and the mechanism is -docketed for the compilation theorem. +**The healed witness (`W`) and the retracted limitation.** Audit +#2's fatal witness `W = (H 0̂) E E B` wraps its decomposition `B` +in a branch-equal selector; hand ideal `{halt1: 1}`. v1.10 +registered `W` as a "placement limitation" — its exhaustive +subset/exclusion sweep found every inner-boundary certificate +rejected via `refire` — and claimed staged uncomputation was +inexpressible in the certificate language. **Audit #3 refuted the +registration's causal story**: the v1.10 fire arm computed the +`P`/`Q` split and then discarded it (`KD` from ALL of RS, +`rs′ = ()`), so every "retained" spectator was erased bit-free and +every trial destroyed the outer-coin frames whose retention the +inner coherence needed. Under the register's own literal +transition — implemented in v1.11 — the canonical pipeline +discovers `W`'s four-boundary certificate (the inner boundary pops +the inner coin's two branch-dependent instances; the outer frames +ride through as retained spectators), validation is clean with +structural `refire` at amplitude exactly zero, and the canonical +dynamics is **`{halt1: 1}` = the hand ideal**. The +staged-uncomputation limitation is RETRACTED — the certificate +language expressed it all along. What remains true and registered: +a user cannot tell from `machine_coverage` alone whether a +program's canonical placement reaches its circuit ideal — that +adjudication lives in the written-first physics table, and the +general question ("which eliminations are wires") remains the +compilation theorem's. **The instance-alias gap (unchanged in kind, narrowed in surface).** No injectivity theorem for logged-position keys is @@ -502,16 +558,16 @@ on it. Standing fences, all typed: literal gate application and open bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond -{0̂, 1̂, I} (readback controller), every §3 guard, and the `W`-class -placement limitation above. +{0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#3; the verdict will be registered here.** +#4; the verdict will be registered here.** ## 10. Verification state -Eighteen-program suite (twelve sectors + the audit witnesses -`buried`/`palpha`/`dupcall` + stressors `weave`/`hweave`/`qq`): +Twenty-program suite (twelve sectors + the audit witnesses +`buried`/`palpha`/`dupcall`/`B`/`W` + stressors +`weave`/`hweave`/`qq`): | program | basis | dynamics | note | |---|---|---|---| @@ -533,41 +589,53 @@ Eighteen-program suite (twelve sectors + the audit witnesses | qq | 2,192 | ½ / ½, sup 8 | Q in Q, double-crossed re-seeks | | palpha | 474 | ¼ / ¾, sup 3 | audit-2 witness: cert refused, physics via fallback | | dupcall | 632 | typed err ½ + ¼/¼ | untyped; refire positive control | -| B | 186 | 1̂: 1 | audit-2 witness, HEALED (hybrid admits the cert; structural refire at amplitude 0) | -| W | 1,262 | ¼ / ¾, sup 12 | audit-2 fatal witness; machine-covered; PLACEMENT-OPEN (hand ideal 1̂: 1) | +| B | 186 | 1̂: 1 | audit-2 decomposition witness, HEALED v1.10 (hybrid admits the cert; structural refire at amplitude 0); audit-3 confirmed | +| W | 498 | 1̂: 1 | audit-2 FATAL witness, HEALED v1.11 (four-boundary instance-directed cert; inner boundary pops the inner coin's two instances, outer frames ride as spectators; structural refire at amplitude 0); audit-3 measured this healing before the fix landed | All twenty: zero stuck / non-unit / non-orthogonal columns; guards -silent except `dupcall` (expected: `alien-ticket`) and `B` +silent except `dupcall` (expected: `alien-ticket`) and `B`/`W` (expected: structural `refire` at amplitude exactly zero — the hybrid's core case). The written-first physics table passes on all -twenty (W's entry records the placement-open verdict). -`discover_total` == frozen CERTS on all 20 (the sixteen as -position sets, measured identical to their canonical dicts; `B` -frozen as its spectator-mode dict); `h(Ω)` → None. Negative controls: pstar × wrong -certificate reaches `pop-err`; dupcall × v1.7-era certificate -reaches `refire`, all-err. WF/W7/W8 sweeps + disjointness: zero -violations; three permanent collision regressions. Conservation: -zero failures. Polarity/terminal chains/gauge: zero violations, -orbit exact. Audit #1's independent reproducer, rerun: all probes -clean or typed; fuzz 250/250 no violation (66 conservatively -refused). Basis counts vs v1.2 reference: `negative` 103→83, -`selector` 173→106, `pstar` 458→242 — v1.7-era, real, owned -(canonical RS sorting + replay-arm restructure merge order-variant -states); marginals and supports never moved. All measurements -seconds-scale on the M5 Max. +twenty. `discover_total` == frozen CERTS on all 20 — every +certificate frozen as its exact canonical dict, compared exactly; +`h(Ω)` → None. Negative controls: pstar × wrong certificate +reaches `pop-err`; dupcall × v1.7-era certificate reaches +`refire`, all-err. WF/W7/W8/W9 sweeps + disjointness: zero +violations; **seven permanent regressions** (extra-frame collision +— now excluded at W7-domain, the retained-spectator coordinate, +rather than W7-fibre; doctored bundle divergence; K+frame alias; +the v1.6 pair; audit-3's retained-Q disjointness — two sources +differing only in a spectator bit must share zero targets; audit- +3's duplicate-ticket W9). Conservation: zero failures. +Polarity/terminal chains/gauge: zero violations, orbit exact. All +three prior audits' independent reproducers rerun clean or typed +(audit #1's fuzz 250/250 no violation; audit #2's kit clean on +every lifecycle, its own term-evaluator mismatches adjudicated as +that evaluator's non-normalization; audit #3's kit: spectator +columns now share zero targets, W under the literal rule == +current behavior). Basis counts vs v1.2 reference: `negative` +103→83, `selector` 173→106, `pstar` 458→242 — v1.7-era, real, +owned (canonical RS sorting + replay-arm restructure merge +order-variant states); marginals and supports never moved. All +measurements seconds-scale on the M5 Max. ## 11. Chronicle Full narratives: `docs/ledger/2026-08.md` (and 2026-07); complete -superseded registers: this file's git history (v1.9's last full -text at `0193b65`, the layered pre-v1.9 registers through -`ed85767`). Audit verdicts in one line each: audit #1 (v1.7): -FAIL — Pα + WF-collision countermodels, alias gap, honesty -defects. Audit #2 (v1.9): FAIL — the `W` fatal witness (validated -certificate, wrong physics), W8 preservation, (e) over-rejection. -Working reviews: v1.8 design (two structural holes), v1.10 design -fork (the hybrid verdict: amplitudes decide success, never -isometry; no bare-term ideal oracle). +superseded registers: this file's git history (v1.10's last full +text at `1c81b64`, v1.9's at `0193b65`, the layered pre-v1.9 +registers through `ed85767`). Audit verdicts in one line each: +audit #1 (v1.7): FAIL — Pα + WF-collision countermodels, alias +gap, honesty defects. Audit #2 (v1.9): FAIL — the `W` fatal +witness (validated certificate, wrong physics), W8 preservation, +(e) over-rejection. Audit #3 (v1.10): FAIL — the fire arm +discarded the P/Q split it computed (spectators erased bit-free; +isometry countermodel), which also refuted the W registration's +causal story (W heals under the literal rule); plus the +validate(None) contract gap, the duplicate-ticket W8 row, and six +honesty defects. Working reviews: v1.8 design (two structural +holes), v1.10 design fork (the hybrid verdict: amplitudes decide +success, never isometry; no bare-term ideal oracle). | version | one line | verdict that shaped it | |---|---|---| @@ -579,7 +647,8 @@ isometry; no bare-term ideal oracle). | v1.7 | the replay record (idempotent recall, deep keyed replay); WF subtype; cargo conditions | **fresh audit #1: FAIL** (WF collision, Pα, alias gap, honesty) | | v1.8 | decode records + refire guard; self-validating admission; W7; typed fragment | working review: two structural holes | | v1.9 | KD bundles + condition (e); key-alias guard + W8; real disjointness checker; syntactic fragment boundary; docs current-only | **fresh audit #2: FAIL** (the `W` fatal witness — clean validation, wrong physics via a zero-amplitude structural veto on `B`-class certificates; W8 preservation refuted; (e) over-rejection; checker totality) | -| v1.10 | the hybrid pipeline (structural isometry mandatory; dynamic cleanliness decides success); instance-directed erasure with validation-adjudicated spectator admission; deep W3 + the key-state algebra; machine_coverage rename + the physics table; `B` healed, `W` registered placement-open | **fresh audit #3: pending** | +| v1.10 | the hybrid pipeline (structural isometry mandatory; dynamic cleanliness decides success); instance-directed erasure with validation-adjudicated spectator admission; deep W3 + the key-state algebra; machine_coverage rename + the physics table; `B` healed, `W` registered placement-open | **fresh audit #3: FAIL** (the fire arm computed P/Q and discarded it — retained spectators erased bit-free; retained-Q isometry countermodel; W's "limitation" was this defect and heals under the literal rule; validate(None) gap; duplicate-ticket W8 row; six honesty defects) | +| v1.11 | the P/Q spectator transition implemented literally (KD from P, rs′ = Q); all twenty certificates re-discovered and frozen as exact dicts (most boundaries pop nothing; q family/B/W pop exactly the interfering inner-coin instances); `W` HEALED at {halt1: 1}, the staged-uncomputation retraction; W9 + the algebra's duplicate-ticket row; validate(None) runs the real sweep; two new permanent regressions; honesty corrections (B/W attribution, 20/17 fragment, conservation counts, identity-sweep retraction) | **fresh audit #4: pending** | ## 12. Appendix — HH step-indexed trace diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index 1c2a4be..954713c 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -389,7 +389,7 @@ substrate's obstruction and the fork reopens. | Item | Status | |---|---| -| Kernel | **v1.10** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates (per-boundary popkeys, retained spectators, validation-adjudicated admission); deep W3 + the key-state algebra; `machine_coverage` + a written-first physics table (no bare-term ideal oracle exists — adjudicated on-thread). Audit #2's `B` healed ({1̂: 1}); `W` registered as the coherence-placement limitation (staged uncomputation → compilation theorem). Twenty programs green, sixteen bit-identical since v1.7. **PASS re-claim gated on fresh audit #3** | +| Kernel | **v1.11** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates whose spectator transition is now implemented literally (audit #3's fatal finding: v1.10 computed the P/Q split and discarded it, erasing every retained spectator bit-free). Audit #2's fatal witness `W` HEALED at {1̂: 1} — the v1.10 "staged uncomputation inexpressible" registration retracted, the language expressed it all along; `B` healed since v1.10. All twenty certificates frozen as exact dicts (most boundaries pop nothing; q family/B/W pop exactly the interfering inner-coin instances); nine-invariant WF (W9 = live-ticket key uniqueness); physics table passes on all twenty. **PASS re-claim gated on fresh audit #4** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §11.7, §12.2, §13.3): the v1.5 fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is pop-err reachability + the RS-function property, strictly beyond Gram (negative control caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and as of v1.8 **self-validating**: the fixpoint is admitted only if its certified graph passes full semantic coverage, else None | From bf7c8306a1c4dd6f3eac88e9d489c9ae3e754517 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 16:59:14 -0400 Subject: [PATCH 035/107] =?UTF-8?q?qalc:=20kernel=20v1.12=20=E2=80=94=20KD?= =?UTF-8?q?=20names=20only=20representation-free=20keys;=20parsimony=20ret?= =?UTF-8?q?racted;=20register=20current-only?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fresh audit #4 CONFIRMED the W healing (refire amplitudes verified zero per-step; four hand physics recomputations; 46 generated programs identical across arms) while countermodeling the KD bundle: bit-free death was recorded for keys whose bit-carrying representation survived the fire (retained-Q frame; retained-whole burial) — W8 hazards in the targets, the burial case invisible to all nine invariants. v1.12: dk = (alpha(l) | keys(P)) - keys(Q) - burial-keys(ks); the decode arm's record-skip lifts to burials; W8 extends to bitfree intersect burial; certify.erased_keys computes the bundle actually left so condition (e) compares reality. Parsimony language retracted: canonical = deterministic maximal-certified fixpoint, not minimal (measured: single-boundary empty-pop certs reach B and W's physics); 18 dicts + 2 canonical Nones stated exactly. Both countermodels healed per written-first predictions (all six held); nothing reachable moved (certs, marginals, basis counts bit-identical); nine permanent regressions. Register decrufted current-only at a9's suggestion. PASS re-claim gated on fresh audit #5. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 64 ++++--- docs/ledger/2026-08.md | 55 ++++++ docs/quantum-algebraic/kernel.md | 309 ++++++++++++++++--------------- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 246 insertions(+), 184 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 5737316..d047213 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -420,46 +420,44 @@ consistency) and a fresh-context feasibility review (thread promising-with-hard-open-problems, converging with the sketch on every load-bearing point; its checklist and exclusions are folded in. -**The kernel is at v1.11** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.12** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` -and git). Fresh audit #3 FAILed v1.10 with a finding that inverted -the previous round's headline: the fire arm computed the -instance-directed `P`/`Q` spectator split and then discarded it -(`KD` from all of RS, `rs′ = ()`), so every retained spectator was -erased bit-free — a real isometry countermodel (two sources -differing only in a retained frame's bit collapsed to identical -columns) AND the explanation of `W`: v1.10's registered -"placement limitation" (staged uncomputation inexpressible) had -measured the defect, not the certificate language. Under the -register's own literal transition, `W` is fully certified — -four boundaries, the inner popping exactly the inner coin's two -branch-dependent instances while the outer coin's frames ride -through as retained spectators — computing its hand ideal -`{halt1: 1}`; the audit measured the healing before the fix -landed, and the consult-round prediction it vindicates is -corrected in the provenance record. v1.11 wires the split through -literally, re-discovers and freezes all twenty canonical -certificates as exact dicts (parsimonious: most boundaries pop -nothing; only the q family, `B`, `W` pop keys), retracts the -staged-uncomputation limitation and the legacy-identity claim -(an artifact of the defect), adds W9 (live-ticket key uniqueness -— the duplicate-ticket alias row audit #3 found in the key-state -algebra, now statically excluded), closes the `validate(None)` -contract gap, adds two permanent regressions (retained-Q -disjointness; duplicate-ticket W9), and fixes six register -honesty defects (B/W witness attribution, fragment counts 20/17, -transposed conservation counts, stale `semantic_coverage` doc, -audit-count consistency, the identity-sweep claim). Physics table -passes on all twenty with `W = {halt1: 1}`; the sixteen originals' -marginals never moved; all three prior audit kits rerun clean. +and git). The last two audit rounds resolved the `W` saga: audit +#3 found the v1.10 fire arm computed the instance-directed `P`/`Q` +spectator split and discarded it — so v1.10's registered "W +placement limitation" (staged uncomputation inexpressible) had +measured that defect, not the certificate language — and v1.11 +wired the split through literally, healing audit #2's fatal +witness at its hand ideal `{halt1: 1}` (the retraction is +registered; the wrongly-ledgered consult prediction is corrected +in provenance). Audit #4 then CONFIRMED the healing (refire +amplitudes verified zero per-step; four independent physics +recomputations; 46 generated programs identical across arms) while +countermodeling the KD bundle's bookkeeping: bit-free death was +recorded for keys whose bit-carrying representation survived the +fire (a retained-Q frame; a retained-whole burial) — both W8 +hazards in the target. v1.12 subtracts: the bundle names only +representation-free keys, the decode arm's record-skip lifts to +burials, W8 extends to bitfree ∩ burial, condition (e) compares +the bundle actually left. Audit #4 also refuted the v1.11 +parsimony language — the canonical certificate is the +deterministic MAXIMAL-certified fixpoint, not minimal (measured: +single-boundary ∅-pop certificates reach B and W's physics); +minimal canonical certificates are docketed. Nothing reachable +moved: all frozen certificates, marginals, and basis counts are +bit-identical under the fix; nine permanent regressions; the +register is decrufted current-only again. Physics table passes on +all twenty with `W = {halt1: 1}`; all four prior audit kits rerun +clean. The open docket, in order: -1. **fresh-context independent audit #4 of the v1.11 h-fragment +1. **fresh-context independent audit #5 of the v1.12 h-fragment claim** (next action; verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 - is its newly checkable ticket-dimension face); + is its newly checkable ticket-dimension face), and minimal + canonical certificates; 2. the readback controller (full-NF halt sectors; the kernel's root classifier is its 1-bit case) and the `t` gate's `ℤ[ω]` scalars — with time-in-the-core added to the transparency theorem diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index af7282d..55d7f1f 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2692,3 +2692,58 @@ non-normalization; it now shows W mass 2). WF/W7/W8/W9 + disjointness + conservation + polarity/gauge: zero violations. Register, STATUS, token.md updated; fresh audit #4 next — the PASS re-claim stays gated on it. + +## 2026-08-09 — qALC kernel v1.12: audit #4 confirms the healing, countermodels the bundle bookkeeping + +Fresh audit #4 (independent instance, sol tier, the v1.11 pack) +returned FAIL with a split verdict that reads like the loop +working exactly as designed: the load-bearing novelty of the last +two rounds — W's healing — CONFIRMED from every angle (the exact +frozen certificate recomputed live; all four structural refire +sources verified at amplitude exactly zero per-step; the hand +derivation W = B = |1⟩; 46 generated typable programs identical +across the old and new fire arms; a 1,146-program W9 fuzz clean), +while the freshly implemented transition's BOOKKEEPING took two +countermodels. Both are the same shape: the KD bundle recorded +bit-free death for a key whose bit-carrying representation +survived the fire. A retained-Q frame (the explicitly legitimate +replay-re-emission class) left the fire answerable beside a +bit-free KD naming its key — W8 in both targets; a retained-whole +burial did the same one representation class down, and nothing in +W1–W9 even flagged it, contradicting the algebra's registered +"bit-free + bit-carrying → typed" row. Also refuted: v1.11's +parsimony language. The canonical certificate is the greedy +MAXIMAL-certified fixpoint, not minimal — a single-boundary, +zero-pop certificate {ffbbafffa} reaches W's {halt1: 1} (basis +734 vs the canonical 498), and B likewise — so "pops exactly what +interference needs" was unsupported, and "all twenty frozen as +dicts" was miscounted (eighteen dicts; palpha/dupcall canonically +None). Plus version-string and comment cruft in kernel.py and +suite.py, including a suite comment still claiming W could not +reach its ideal. + +v1.12, predictions written first, all six held: dk = (alpha(l) ∪ +keys(P)) − keys(Q) − burial-keys(ks) — the bundle names only +representation-free keys; a retained frame stays the answerable +representation (the decode arm's frame-skip lifted to certified +erasure) and a burial stays the sole bit-carrying dead record +(refire unaffected: burials are already in the dead-key set); the +decode arm's record-skip likewise lifts to burials; W8 extends to +bitfree ∩ burial (making the missed hazard statically visible); +certify.erased_keys now computes the bundle ACTUALLY left, so +condition (e) compares reality. Both countermodels healed exactly +as predicted — the retained-frame fire leaves an EMPTY bundle, +the burial case leaves the burial alone — and became permanent +regressions (nine total). Nothing reachable moved: discover_total +== frozen CERTS on all twenty, physics table bit-identical, +extended-W8 sweeps zero violations. + +At a9's suggestion the register went current-only again before +the pack: the round narration ("v1.10 said X, audit #N caught +it") compressed into §11 and this ledger; §3 now states the +subtraction rule as THE transition; §5/§9 register +maximal-certified (not minimal) with the measured +single-boundary facts and docket minimality; the fragment, +count, and conservation numbers stand bare. Registered, ledgered, +committed; fresh audit #5 launched — the PASS re-claim stays +gated on it. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 84fdcda..6f39d41 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC three-program kernel — current register (v1.11) -**Status: v1.11.** The kernel is a scratch superposition evolver +**Status: v1.12.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -12,15 +12,11 @@ run success ("amplitudes decide whether a run succeeds, never whether the machine is an isometry") — a nine-invariant well-formedness subtype, a typed h-only fragment judgment with a syntactic language boundary, a written-first per-program physics -table, and every failure mode typed — never silent. Four -fresh-context audits and three working reviews have shaped it -(chronicle, §11). The audit-#2 fatal witness `W` — and `B`, its -decomposition — are both **healed**: audit #3 found that v1.10's -fire arm computed the retained-spectator split and then discarded -it, so W's registered "placement limitation" measured an -implementation defect, not the certificate language; under the -register's own transition W is fully certified at {halt1: 1} (§9). -The standing PASS re-claim is **gated on fresh audit #4**, whose +table, and every failure mode typed — never silent. Five +fresh-context audits and three working reviews have shaped it; +the round-by-round history, including the healing of audit #2's +fatal witness `W`, lives in the chronicle (§11) and the ledger. +The standing PASS re-claim is **gated on fresh audit #5**, whose verdict will be registered here. This file is the current contract and register only. The @@ -145,13 +141,22 @@ arrive/fire tape = P_b · μ_g · T, P_0 = l· P_1 = •·l· an outer coin's frame around an inner interference) any P frame with bit ≠ b → pop-err erase (l, P); rs' = Q; leave ('KD', keys) — one tagged - bundle naming every live α nested in l and every popped - frame's (g, i) [sound under fibre conditions (a)–(f), §5] + bundle naming every key that died with NO surviving + bit-carrying representation: + keys = (α-keys(l) ∪ keys(P)) \ keys(Q) \ burial-keys(ks) + a cargo ticket whose frame is retained in Q stays answerable + through the frame (the decode arm's frame-skip, lifted); + a key buried in a retained-whole K(l′) record keeps the + burial as its bit-carrying dead record (refire consults + burials via the dead-key set). An empty bundle is omitted. + [sound under fibre conditions (a)–(f), §5] else, l = α_g(i, b) with bit = slot (DECODE): retain ('K', g, i) — bit-free, branch-equal — UNLESS a same-key frame exists (the ticket was replay-re-emitted; - the frame remains the answerable representation, no record: - W8 exclusivity by construction) + the frame remains the answerable representation) or a + same-key burial exists (the buried ticket remains the + bit-carrying dead record); either way no record is + created: W8 exclusivity by construction else (RETAIN-WHOLE): keep ('K', l) — same-slot arrivals with different which-path data stay orthogonal then fire: targets (pos, ↑, γ_g·L, A_g(b′)·T′), amplitudes the @@ -197,19 +202,26 @@ algebra (audit-#2/working-review completion): answerable + bit-carrying burial → allowed iff bits agree (deep W3; conflict typed) two bit-carrying burials → allowed iff bits agree - bit-free + bit-carrying same key → typed at the boundary + bit-free + bit-carrying same key → NEVER CREATED (fire and + decode subtract keys with a + surviving bit-carrying + representation; the burial + or frame stays the sole + record); leaf encounters + with pre-existing bit-free + storage remain typed fresh call of ANY dead key → typed (refire) two live tickets, one key → alias state, excluded statically (W9) -The last row is audit #3's addition: two agreeing live tickets for -one key pass deep W3 (one bit) and W8 (no dead record), yet -decoding one leaves the other answerable beside the fresh bit-free -record — so the algebra is complete only over W9-clean states, and -W9 makes that hypothesis checkable rather than assumed. The -duplicate-ticket source is the registered agreeing-alias gap's -ticket-dimension face; it was never reached in any sweep or fuzz -run, consistent with lp-uniqueness (§9). +Two agreeing live tickets for one key pass deep W3 (one bit) and +W8 (no dead record), yet decoding one would leave the other +answerable beside the fresh bit-free record — the algebra is +therefore complete over W9-clean states, and W9 makes that +hypothesis checkable rather than assumed. The duplicate-ticket +configuration is the agreeing-alias gap's ticket-dimension face; +it has never been reached in any sweep or fuzz run, consistent +with lp-uniqueness (§9). A bit-carrying burial blocking a fresh call is sound but conservatively incomplete — in principle an explicit decoder could @@ -249,8 +261,7 @@ Q = the spectators): agree per key (a conflicted arrival is never admitted; the kernel also types it). -**The canonical pipeline** (`discover_total`, the v1.10 hybrid, its -spectator transition implemented literally as of v1.11 — +**The canonical pipeline** (`discover_total`, the hybrid — "amplitudes decide whether a run succeeds, never whether the machine is an isometry"): @@ -268,10 +279,19 @@ machine is an isometry"): 3. **Final validation** of the frozen certificate; None unless `machine_coverage` holds — the conservative, sound fallback. A None result IS the fallback (the plain reading); its coverage - verdict is `validate(term, None)`, which as of v1.11 runs the - same reachable-WF sweep with an empty certified domain (audit - #3's contract gap: the no-certificate path previously reported - the sweeps as zero without running them). + verdict is `validate(term, None)`, which runs the same + reachable-WF sweep with an empty certified domain (W7 and + disjointness vacuous, the WF check itself never skipped). + +The canonical certificate is deterministic (measured seed- and +order-independent) and **maximal-certified, not minimal**: the +greedy admission certifies every boundary that stays clean, so +smaller clean certificates with identical physics exist (measured: +`W` reaches `{halt1: 1}` with the single ∅-pop boundary +`ffbbafffa`, basis 734 vs the canonical 498; `B` likewise with +`ffbbfffa` alone). No parsimony or necessity is claimed for the +frozen maps beyond determinism and validated cleanliness; minimal +canonical certificates are docketed future work. **Validation** (`validate`) splits per the working-review verdict: the STRUCTURAL side — totality, Gram orthonormality on the @@ -301,17 +321,16 @@ found the maximally coherent placement (§9). semantically load-bearing for HNH (certified `{halt0: 1}` = the physics vs plain `{1/2, 1/2}`); `B` and `W`'s coherence-restoring certificates are admitted by the hybrid (structural `refire` at -amplitude exactly zero, dynamic mass zero — canonical `{halt1: 1}` -for both); all twenty canonical certificates are frozen as exact -dicts and reproduced exactly by `discover_total`. The frozen shape -is parsimonious: most certified boundaries pop nothing (cargo-only -certification, every frame retained); only the q family, `B`, and -`W` pop keys — in each case exactly the inner-coin instance(s) -whose interference needs the frame erased. The v1.10 claim that -the legacy pop-everything reading was "measured identical" to the -canonical dicts is RETRACTED: that identity was an artifact of the -spectator-transition defect (dict certificates also erased all of -RS), not a theorem, and no such identity is claimed now. +amplitude exactly zero — verified per-step, all refire sources at +exact amplitude 0 — canonical `{halt1: 1}` for both). Eighteen of +the twenty programs freeze exact canonical dicts reproduced +bit-for-bit by `discover_total`; `palpha` and `dupcall` canonically +return None (validation rejects their exploratory fixpoints — the +refusal working as designed) and run the plain reading. In the +frozen maps most certified boundaries pop nothing (cargo-only +certification, every frame retained); the q family, `B`, and `W` +pop inner-coin instances. No identity between the legacy +pop-everything reading and the canonical dicts is claimed. ## 6. The invariant catalog (WF, the well-formed subtype) @@ -322,7 +341,7 @@ the machine's unitarity claims quantify over the subtype: - **W2** (record uniqueness + canonicity): at most one frame per `(g, i)` in RS; RS canonically sorted (state identity is order-free). -- **W3** (bit coherence, DEEP as of v1.10): one bit per `(g, i)` +- **W3** (bit coherence, deep): one bit per `(g, i)` across ALL bit-carrying representations — frames, top-level and slice-suspended tickets on tape and log, and tickets buried in retained-whole `K(l)` records. @@ -341,24 +360,26 @@ the machine's unitarity claims quantify over the subtype: frames. States outside the fibre relation are outside the certified domain subtype; the domain lemma (reachable certified arrivals are in-domain) is the per-program sweep. -- **W8** (representation exclusivity, v1.10 restatement): per - `(g, i)`, answerable representations (live α anywhere in - tape/log including suspended slice cargo; RS frames) never - coexist with **bit-free** dead storage (K/KD records) — the - shadowing hazard is bit loss. Bit-carrying burials coexist under - deep W3's adjudication (the key-state algebra, §4). Preserved on - W9-clean sources; its boundary is the typed `key-alias`. - Preservation is NOT unconditional (audit #3): a duplicate-ticket - alias source decodes into a W8 violation, which is exactly what - W9 excludes statically. -- **W9** (live-ticket key uniqueness, v1.11): at most one live α - ticket per `(g, i)` across tape and log, deep through slice - cargo. Two agreeing live tickets pass W3 and W8 yet are an alias - state — the agreeing-alias gap's ticket-dimension face, made - checkable. Zero violations on every reachable state of the - twenty-program battery and all fuzz sweeps (empirical - lp-uniqueness); ticket+frame (replay re-emission) and - ticket+burial remain legitimate, adjudicated by W2/W3/W8. +- **W8** (representation exclusivity): per `(g, i)`, bit-free dead + storage (K/KD records) coexists with NEITHER answerable + representations (live α anywhere in tape/log including suspended + slice cargo; RS frames) NOR bit-carrying burials — in both cases + the bit-free record has discarded exactly the bit that would + adjudicate aliasing. Answerable + burial coexistence is + legitimate under deep W3. The fire and decode arms preserve W8 + by construction on W9-clean sources (the KD subtraction and + record-skips of §3); a duplicate-ticket alias source would + decode into a W8 violation, which is exactly what W9 excludes + statically. Leaf encounters with bit-free storage are typed + (`key-alias`). +- **W9** (live-ticket key uniqueness): at most one live α ticket + per `(g, i)` across tape and log, deep through slice cargo. Two + agreeing live tickets pass W3 and W8 yet are an alias state — + the agreeing-alias gap's ticket-dimension face, made checkable. + Zero violations on every reachable state of the twenty-program + battery and all fuzz sweeps (empirical lp-uniqueness); + ticket+frame (replay re-emission) and ticket+burial remain + legitimate, adjudicated by W2/W3/W8. ## 7. Theorems @@ -428,8 +449,7 @@ exactly gate-mediated**. step of every run in lockstep conformance with the uninstrumented stepper. Exhaustive: all closed pure terms ≤ size 11 (41,272), k ∈ {1,2,3} probes — 14,452 surfacings at ≤10 (10,180 terms), -55,727 at ≤11, zero failures (the v1.10 register transposed these -two counts; audit #3 caught it). Battery cross-check: zero +55,727 at ≤11, zero failures. Battery cross-check: zero mark-free arrivals violate `w ≡ slot`; marked arrivals split both ways as virtual ancestry predicts. @@ -451,17 +471,17 @@ same spectator, opposite slots Mechanized for real: the checker collects reachable sources with full state, constructs their fire targets via the step function, -compares decode bundles cross-slot, and computes column inner -products. Zero violations over every certified graph. Three audit -countermodels are permanent regressions here: the extra-frame -collision (W7-excluded AND target-disjoint; since v1.11 the -exclusion clause is W7-domain — the added frame is a -retained-spectator coordinate that leaves the certified fibre -domain), the doctored bundle-divergent fibre (rejected by -condition (e)), and audit #3's retained-Q collision (two WF, -transparent, same-slot sources differing only in a retained -frame's bit — zero shared targets, true Gram entry 0; the v1.10 -fire arm collapsed these columns to inner product 1). +compares decode bundles cross-slot (bundles computed with the §3 +subtraction — the bundle actually left), and computes column inner +products. Zero violations over every certified graph. The audit +countermodels guarding this theorem are permanent regressions +(§10): the extra-frame collision (W7-excluded at the domain +clause — an added frame is a retained-spectator coordinate that +leaves the certified fibre domain — with disjoint targets), the +doctored bundle-divergent fibre (rejected by condition (e)), and +the retained-Q collision (two WF, transparent, same-slot sources +differing only in a retained frame's bit — zero shared targets, +true Gram entry 0). ### 7.5 What is NOT claimed (the alias gap) @@ -496,12 +516,11 @@ deliberately, the untyped copy regression), `q` (E = λz.Iz vs N branch types ununifiable — the wire imbalance `qprime` was built to repair; `qprime` types clean), `dupcall` (NOT′/EP ununifiable). All escapes — `h h`, gate literals in bodies, swapped or doubled -shell arguments — rejected. (The v1.10 register said "18-program / -15 typable", a stale pre-`B`/`W` count; audit #3 caught it.) +shell arguments — rejected. -## 9. The claim, the healed witness, and the alias gap +## 9. The claim and the alias gap -**The v1.11 coverage claim.** Over programs that are (i) typable +**The v1.12 coverage claim.** Over programs that are (i) typable h-only under the signature judgment (with the syntactic boundary: shell args exactly `Gate(h)` then `Gate(t)`, no gate literals in bodies, closed bodies) and (ii) whose canonical pipeline reports @@ -518,50 +537,28 @@ semantics — no total reference exists for bare λ-terms; which eliminations are wires is the compilation theorem's question. Physics agreement is claimed program-by-program in the suite's written-first table (hand-derived circuit readings, several -independently confirmed by the audits). - -**The healed witness (`W`) and the retracted limitation.** Audit -#2's fatal witness `W = (H 0̂) E E B` wraps its decomposition `B` -in a branch-equal selector; hand ideal `{halt1: 1}`. v1.10 -registered `W` as a "placement limitation" — its exhaustive -subset/exclusion sweep found every inner-boundary certificate -rejected via `refire` — and claimed staged uncomputation was -inexpressible in the certificate language. **Audit #3 refuted the -registration's causal story**: the v1.10 fire arm computed the -`P`/`Q` split and then discarded it (`KD` from ALL of RS, -`rs′ = ()`), so every "retained" spectator was erased bit-free and -every trial destroyed the outer-coin frames whose retention the -inner coherence needed. Under the register's own literal -transition — implemented in v1.11 — the canonical pipeline -discovers `W`'s four-boundary certificate (the inner boundary pops -the inner coin's two branch-dependent instances; the outer frames -ride through as retained spectators), validation is clean with -structural `refire` at amplitude exactly zero, and the canonical -dynamics is **`{halt1: 1}` = the hand ideal**. The -staged-uncomputation limitation is RETRACTED — the certificate -language expressed it all along. What remains true and registered: -a user cannot tell from `machine_coverage` alone whether a -program's canonical placement reaches its circuit ideal — that -adjudication lives in the written-first physics table, and the -general question ("which eliminations are wires") remains the -compilation theorem's. - -**The instance-alias gap (unchanged in kind, narrowed in -surface).** No injectivity theorem for logged-position keys is -claimed. Every detectable manifestation is typed -(`frame-conflict`, `alien-ticket`, `key-alias`, `refire`; deep W3 -adjudicates bit-carrying coexistence). Open: an alias-tolerant -local transition theorem — that agreeing-bit aliases cannot -silently merge histories that should stay orthogonal — or λIAM -logged-position uniqueness. The soundness claims are conditional -on it. +independently confirmed by the audits). A user cannot tell from +`machine_coverage` alone whether a program's canonical placement +reaches its circuit ideal — that adjudication lives in the +physics table. Nor is the canonical certificate minimal (§5): it +is the deterministic maximal-certified fixpoint, nothing more. + +**The instance-alias gap.** No injectivity theorem for +logged-position keys is claimed. Every detectable manifestation +is typed (`frame-conflict`, `alien-ticket`, `key-alias`, +`refire`; deep W3 adjudicates bit-carrying coexistence; W9 +excludes duplicate live tickets statically). Open: an +alias-tolerant local transition theorem — that agreeing-bit +aliases cannot silently merge histories that should stay +orthogonal — or λIAM logged-position uniqueness. The soundness +claims are conditional on it. Standing fences, all typed: literal gate application and open bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#4; the verdict will be registered here.** +#5; the verdict will be registered here.** ## 10. Verification state @@ -589,53 +586,64 @@ Twenty-program suite (twelve sectors + the audit witnesses | qq | 2,192 | ½ / ½, sup 8 | Q in Q, double-crossed re-seeks | | palpha | 474 | ¼ / ¾, sup 3 | audit-2 witness: cert refused, physics via fallback | | dupcall | 632 | typed err ½ + ¼/¼ | untyped; refire positive control | -| B | 186 | 1̂: 1 | audit-2 decomposition witness, HEALED v1.10 (hybrid admits the cert; structural refire at amplitude 0); audit-3 confirmed | -| W | 498 | 1̂: 1 | audit-2 FATAL witness, HEALED v1.11 (four-boundary instance-directed cert; inner boundary pops the inner coin's two instances, outer frames ride as spectators; structural refire at amplitude 0); audit-3 measured this healing before the fix landed | +| B | 186 | 1̂: 1 | audit-2 decomposition witness, healed (structural refire at amplitude 0) | +| W | 498 | 1̂: 1 | audit-2 fatal witness, healed (inner boundary pops the inner coin's two instances; outer frames retained spectators; structural refire at amplitude 0, verified per-step) | All twenty: zero stuck / non-unit / non-orthogonal columns; guards silent except `dupcall` (expected: `alien-ticket`) and `B`/`W` (expected: structural `refire` at amplitude exactly zero — the hybrid's core case). The written-first physics table passes on all -twenty. `discover_total` == frozen CERTS on all 20 — every -certificate frozen as its exact canonical dict, compared exactly; +twenty. `discover_total` == frozen CERTS on all 20: eighteen exact +canonical dicts compared bit-for-bit; `palpha`/`dupcall` +canonically None (validation rejects, plain-reading fallback); `h(Ω)` → None. Negative controls: pstar × wrong certificate reaches `pop-err`; dupcall × v1.7-era certificate reaches -`refire`, all-err. WF/W7/W8/W9 sweeps + disjointness: zero -violations; **seven permanent regressions** (extra-frame collision -— now excluded at W7-domain, the retained-spectator coordinate, -rather than W7-fibre; doctored bundle divergence; K+frame alias; -the v1.6 pair; audit-3's retained-Q disjointness — two sources -differing only in a spectator bit must share zero targets; audit- -3's duplicate-ticket W9). Conservation: zero failures. -Polarity/terminal chains/gauge: zero violations, orbit exact. All -three prior audits' independent reproducers rerun clean or typed -(audit #1's fuzz 250/250 no violation; audit #2's kit clean on -every lifecycle, its own term-evaluator mismatches adjudicated as -that evaluator's non-normalization; audit #3's kit: spectator -columns now share zero targets, W under the literal rule == -current behavior). Basis counts vs v1.2 reference: `negative` -103→83, `selector` 173→106, `pstar` 458→242 — v1.7-era, real, -owned (canonical RS sorting + replay-arm restructure merge -order-variant states); marginals and supports never moved. All +`refire`, all-err. WF/W7/W8/W9 sweeps + mechanized disjointness: +zero violations; **nine permanent regressions** (the v1.6 pair; +extra-frame collision, W7-excluded with disjoint targets; +doctored bundle divergence; K+frame alias; retained-Q +disjointness — spectator-bit columns share zero targets; +duplicate-ticket W9; retained-Q KD — a cargo key with a retained +frame leaves an EMPTY bundle, targets WF-clean; bitfree-burial — +a buried key stays the sole bit-carrying record, no KD beside +it). Conservation: exhaustive ≤ size 11, 14,452 surfacings at +≤10 / 55,727 at ≤11, zero failures. Polarity/terminal +chains/gauge: zero violations, orbit exact. All four prior +audits' independent reproducers rerun clean or typed (audit #1's +fuzz 250/250; audit #2's kit clean on every lifecycle, its +term-evaluator mismatches adjudicated as that evaluator's +non-normalization; audit #3's spectator columns share zero +targets; audit #4's countermodel pair healed per the predictions, +its W-healing verification — per-step zero refire amplitude, 46 +generated programs identical across old/new arms, 1,146-program +W9 fuzz clean — carried forward). Basis counts vs v1.2 reference: +`negative` 103→83, `selector` 173→106, `pstar` 458→242 — +v1.7-era, real, owned; marginals and supports never moved. All measurements seconds-scale on the M5 Max. ## 11. Chronicle Full narratives: `docs/ledger/2026-08.md` (and 2026-07); complete -superseded registers: this file's git history (v1.10's last full -text at `1c81b64`, v1.9's at `0193b65`, the layered pre-v1.9 -registers through `ed85767`). Audit verdicts in one line each: -audit #1 (v1.7): FAIL — Pα + WF-collision countermodels, alias -gap, honesty defects. Audit #2 (v1.9): FAIL — the `W` fatal -witness (validated certificate, wrong physics), W8 preservation, -(e) over-rejection. Audit #3 (v1.10): FAIL — the fire arm -discarded the P/Q split it computed (spectators erased bit-free; -isometry countermodel), which also refuted the W registration's -causal story (W heals under the literal rule); plus the -validate(None) contract gap, the duplicate-ticket W8 row, and six -honesty defects. Working reviews: v1.8 design (two structural -holes), v1.10 design fork (the hybrid verdict: amplitudes decide -success, never isometry; no bare-term ideal oracle). +superseded registers: this file's git history (v1.11's last full +text at `b995df7`, v1.10's at `1c81b64`, v1.9's at `0193b65`, the +layered pre-v1.9 registers through `ed85767`). Audit verdicts in +one line each: audit #1 (v1.7): FAIL — Pα + WF-collision +countermodels, alias gap, honesty defects. Audit #2 (v1.9): FAIL +— the `W` fatal witness (validated certificate, wrong physics), +W8 preservation, (e) over-rejection. Audit #3 (v1.10): FAIL — the +fire arm discarded the P/Q split it computed (spectators erased +bit-free; isometry countermodel), which also refuted the W +registration's causal story (W heals under the literal rule); +plus the validate(None) contract gap, the duplicate-ticket W8 +row, and six honesty defects. Audit #4 (v1.11): FAIL — the KD +bundle recorded bit-free death for keys with surviving +bit-carrying representations (retained-Q frame and burial +countermodels, both W8 hazards); the parsimony claim refuted +(single-boundary ∅-pop W certificate reaches the physics); +W-healing and all physics CONFIRMED. Working reviews: v1.8 design +(two structural holes), v1.10 design fork (the hybrid verdict: +amplitudes decide success, never isometry; no bare-term ideal +oracle). | version | one line | verdict that shaped it | |---|---|---| @@ -648,7 +656,8 @@ success, never isometry; no bare-term ideal oracle). | v1.8 | decode records + refire guard; self-validating admission; W7; typed fragment | working review: two structural holes | | v1.9 | KD bundles + condition (e); key-alias guard + W8; real disjointness checker; syntactic fragment boundary; docs current-only | **fresh audit #2: FAIL** (the `W` fatal witness — clean validation, wrong physics via a zero-amplitude structural veto on `B`-class certificates; W8 preservation refuted; (e) over-rejection; checker totality) | | v1.10 | the hybrid pipeline (structural isometry mandatory; dynamic cleanliness decides success); instance-directed erasure with validation-adjudicated spectator admission; deep W3 + the key-state algebra; machine_coverage rename + the physics table; `B` healed, `W` registered placement-open | **fresh audit #3: FAIL** (the fire arm computed P/Q and discarded it — retained spectators erased bit-free; retained-Q isometry countermodel; W's "limitation" was this defect and heals under the literal rule; validate(None) gap; duplicate-ticket W8 row; six honesty defects) | -| v1.11 | the P/Q spectator transition implemented literally (KD from P, rs′ = Q); all twenty certificates re-discovered and frozen as exact dicts (most boundaries pop nothing; q family/B/W pop exactly the interfering inner-coin instances); `W` HEALED at {halt1: 1}, the staged-uncomputation retraction; W9 + the algebra's duplicate-ticket row; validate(None) runs the real sweep; two new permanent regressions; honesty corrections (B/W attribution, 20/17 fragment, conservation counts, identity-sweep retraction) | **fresh audit #4: pending** | +| v1.11 | the P/Q spectator transition implemented literally (KD from P, rs′ = Q); certificates re-discovered and frozen as exact dicts; `W` HEALED at {halt1: 1}, the staged-uncomputation retraction; W9 + the algebra's duplicate-ticket row; validate(None) runs the real sweep; two new permanent regressions; honesty corrections | **fresh audit #4: FAIL** (KD bundle bit-free-records keys with surviving bit-carrying representations — retained-Q frame + burial countermodels; parsimony refuted; W healing + physics CONFIRMED) | +| v1.12 | the KD subtraction (bundle names only representation-free keys; decode's record-skip lifted to burials); W8 extended to bitfree ∩ burial; condition (e) compares the bundle actually left; canonical = maximal-certified, minimality docketed; register decrufted current-only; two new permanent regressions (nine total) | **fresh audit #5: pending** | ## 12. Appendix — HH step-indexed trace diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index 954713c..b96db40 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -389,7 +389,7 @@ substrate's obstruction and the fork reopens. | Item | Status | |---|---| -| Kernel | **v1.11** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates whose spectator transition is now implemented literally (audit #3's fatal finding: v1.10 computed the P/Q split and discarded it, erasing every retained spectator bit-free). Audit #2's fatal witness `W` HEALED at {1̂: 1} — the v1.10 "staged uncomputation inexpressible" registration retracted, the language expressed it all along; `B` healed since v1.10. All twenty certificates frozen as exact dicts (most boundaries pop nothing; q family/B/W pop exactly the interfering inner-coin instances); nine-invariant WF (W9 = live-ticket key uniqueness); physics table passes on all twenty. **PASS re-claim gated on fresh audit #4** | +| Kernel | **v1.12** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation (audit #4's countermodel pair: retained-Q frames and burials each stay the sole record). `W` healed at {1̂: 1} (audits 3+4 confirmed, refire amplitudes verified zero per-step); eighteen exact dict certificates + two canonical Nones; canonical = maximal-certified, minimality docketed; nine-invariant WF (W8 extended to bitfree ∩ burial; W9 live-ticket uniqueness); nine permanent regressions; physics table passes on all twenty. **PASS re-claim gated on fresh audit #5** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §11.7, §12.2, §13.3): the v1.5 fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is pop-err reachability + the RS-function property, strictly beyond Gram (negative control caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and as of v1.8 **self-validating**: the fixpoint is admitted only if its certified graph passes full semantic coverage, else None | From 110682b84ad07c7fe87dbf38aac022e46254da8d Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 17:21:58 -0400 Subject: [PATCH 036/107] =?UTF-8?q?qalc:=20kernel=20v1.13=20=E2=80=94=20co?= =?UTF-8?q?mplete=20KD=20subtraction;=20phase-3=20greedy=20rescue;=20palph?= =?UTF-8?q?a=20certified?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fresh audit #5 confirmed the W healing, all physics, and the regression battery (proven genuine against an emulated old arm; a burial-suffix lemma over 13,693 edges; within-group subtraction divergence proven impossible) while demanding two corrections: the v1.12 subtraction missed live tickets riding in the surviving tape tail/log (popped frame + riding ticket -> KD beside a live ticket, W8 in both targets), and 'maximal-certified' was measurably false — discover_total(palpha) discarded a whole map for one bad boundary while clean sub-certificates existed. v1.13: the complete subtraction (dk spares Q frames, burials, and T/log tickets — only representation-free keys are recorded dead); phase-3 greedy rescue re-admits a failing map under the validated-greedy discipline instead of discarding (palpha certifies: three boundaries, poppable key excluded to spectator, guard-silent, basis 474->275, marginal unchanged); maximality retracted to 'deterministic validation-adjudicated greedy'; version strings unified into the register; tenth permanent regression; version and pointer cruft fixed. Predictions written first; prediction 3 wrong in detail (joint rescue succeeded where greedy singles were predicted) and registered. PASS re-claim gated on fresh audit #6. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 31 ++++-- docs/ledger/2026-08.md | 47 +++++++++ docs/quantum-algebraic/kernel.md | 159 +++++++++++++++++++------------ docs/quantum-algebraic/token.md | 2 +- 4 files changed, 167 insertions(+), 72 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index d047213..513a3a9 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -420,7 +420,7 @@ consistency) and a fresh-context feasibility review (thread promising-with-hard-open-problems, converging with the sketch on every load-bearing point; its checklist and exclusions are folded in. -**The kernel is at v1.12** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.13** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and git). The last two audit rounds resolved the `W` saga: audit #3 found the v1.10 fire arm computed the instance-directed `P`/`Q` @@ -445,19 +445,34 @@ deterministic MAXIMAL-certified fixpoint, not minimal (measured: single-boundary ∅-pop certificates reach B and W's physics); minimal canonical certificates are docketed. Nothing reachable moved: all frozen certificates, marginals, and basis counts are -bit-identical under the fix; nine permanent regressions; the -register is decrufted current-only again. Physics table passes on -all twenty with `W = {halt1: 1}`; all four prior audit kits rerun -clean. +bit-identical under the fix; the register is decrufted +current-only. Audit #5 then confirmed the healing and all physics +again while completing the picture twice over: the subtraction +also had to spare live tickets riding in the surviving tape +tail/log (a popped frame's replay-re-emitted ticket stays the +answerable representation — v1.13's completed rule names only +keys with no surviving bit-carrying representation anywhere in +the target), and "maximal-certified" was measurably false — +`discover_total(palpha)` discarded a whole map for one bad +boundary while clean sub-certificates existed. v1.13's phase-3 +GREEDY RESCUE re-admits a failing map's boundaries under the +validated-greedy discipline instead of discarding: `palpha` now +certifies (three boundaries, its one poppable key excluded to +spectator, guard-silent, basis 474→275, marginal unchanged), the +claim language is "deterministic validation-adjudicated greedy — +neither maximal nor minimal", and the version now lives in the +register alone. Ten permanent regressions; nineteen frozen dicts ++ dupcall's canonical None; physics table passes on all twenty +with `W = {halt1: 1}`; all five prior audit kits rerun clean. The open docket, in order: -1. **fresh-context independent audit #5 of the v1.12 h-fragment +1. **fresh-context independent audit #6 of the v1.13 h-fragment claim** (next action; verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 - is its newly checkable ticket-dimension face), and minimal - canonical certificates; + is its newly checkable ticket-dimension face), and + minimal/maximal canonical certificates; 2. the readback controller (full-NF halt sectors; the kernel's root classifier is its 1-bit case) and the `t` gate's `ℤ[ω]` scalars — with time-in-the-core added to the transparency theorem diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 55d7f1f..eeaed9c 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2747,3 +2747,50 @@ single-boundary facts and docket minimality; the fragment, count, and conservation numbers stand bare. Registered, ledgered, committed; fresh audit #5 launched — the PASS re-claim stays gated on it. + +## 2026-08-09 — qALC kernel v1.13: the subtraction completed, and palpha comes in from the cold + +Fresh audit #5 (independent instance, sol tier, the v1.12 pack) +returned FAIL with the loop's now-familiar split: everything +load-bearing CONFIRMED — the W healing re-verified per-step, all +twenty physics rows, the nine regressions proven genuine by +emulating the old arm (both new ones fail under it), the +burial-suffix lemma (incoming ks an exact suffix of the target's +across 13,693 suite edges), and a tidy proof sketch that +within-group subtraction divergence is impossible (condition (b) +plus the group key fix every subtraction input) — while two +corrections were demanded. First, the v1.12 subtraction was +incomplete: it spared retained-Q frames and burials but not live +tickets riding in the surviving tape tail or log, so popping a +frame whose replay-re-emitted ticket survives in T left KD(key) +beside a live ticket — W8 in both targets, from a W9-clean, +expressly legitimate replay source. Second, "maximal-certified" +was measurably false on shipped palpha: phase 1 accumulated one +bad pop-boundary and phase 3 discarded the WHOLE map to None, +while clean sub-certificates existed all along. Plus version +cruft the v1.12 decruft missed (title line, two module +docstrings, an (a)-(e) that omitted (f), a pointer to a +nonexistent §15, wf.py's pre-W9 contract). + +v1.13, predictions written first: the COMPLETE subtraction — dk = +(α(l) ∪ keys(P)) − keys(Q) − burial-keys(ks) − α-keys(T) − +α-keys(log), i.e. the bundle names only keys with no surviving +bit-carrying representation anywhere in the target — and the +phase-3 GREEDY RESCUE: a failing map is re-admitted under the +validated-greedy discipline (joint-first with per-key exclusion +refinement, then sorted singles) instead of being discarded. +Outcome: the countermodel heals (no KD, ticket survives, targets +WF-clean — the tenth permanent regression), the 18 prior dicts +are untouched bit-for-bit, and palpha gains its first canonical +certificate — and here the prediction was wrong in an +instructive direction, registered as such: I guessed the +2-boundary greedy-singles outcome, but the joint rescue with +full-key exclusion succeeded, so all THREE boundaries certify +with the poppable key excluded to spectator. Guard-silent, basis +474→275, marginal {1/4, 3/4} unchanged — verified before +freezing. The claim language drops maximality entirely: +deterministic, validation-adjudicated greedy, with the measured +smaller-certificate facts registered beside it. Version strings +now live in the register alone. Full battery green; all five +prior kits rerun clean; register, STATUS, token.md updated; +fresh audit #6 launched — the PASS re-claim stays gated on it. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 6f39d41..53ea5b4 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ -# qALC three-program kernel — current register (v1.11) +# qALC three-program kernel — current register -**Status: v1.12.** The kernel is a scratch superposition evolver +**Status: v1.13.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -12,11 +12,11 @@ run success ("amplitudes decide whether a run succeeds, never whether the machine is an isometry") — a nine-invariant well-formedness subtype, a typed h-only fragment judgment with a syntactic language boundary, a written-first per-program physics -table, and every failure mode typed — never silent. Five -fresh-context audits and three working reviews have shaped it; +table, and every failure mode typed — never silent. Shaped by a +fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #5**, whose +The standing PASS re-claim is **gated on fresh audit #6**, whose verdict will be registered here. This file is the current contract and register only. The @@ -142,14 +142,18 @@ arrive/fire tape = P_b · μ_g · T, P_0 = l· P_1 = •·l· any P frame with bit ≠ b → pop-err erase (l, P); rs' = Q; leave ('KD', keys) — one tagged bundle naming every key that died with NO surviving - bit-carrying representation: - keys = (α-keys(l) ∪ keys(P)) \ keys(Q) \ burial-keys(ks) + bit-carrying representation ANYWHERE in the target: + keys = (α-keys(l) ∪ keys(P)) + \ keys(Q) \ burial-keys(ks) + \ α-keys(T) \ α-keys(log) a cargo ticket whose frame is retained in Q stays answerable - through the frame (the decode arm's frame-skip, lifted); - a key buried in a retained-whole K(l′) record keeps the - burial as its bit-carrying dead record (refire consults - burials via the dead-key set). An empty bundle is omitted. - [sound under fibre conditions (a)–(f), §5] + through the frame (the decode arm's frame-skip, lifted); a + popped frame whose replay-re-emitted ticket rides in the + surviving tape tail T or the log stays answerable through + that ticket; a key buried in a retained-whole K(l′) record + keeps the burial as its bit-carrying dead record (refire + consults burials via the dead-key set). An empty bundle is + omitted. [sound under fibre conditions (a)–(f), §5] else, l = α_g(i, b) with bit = slot (DECODE): retain ('K', g, i) — bit-free, branch-equal — UNLESS a same-key frame exists (the ticket was replay-re-emitted; @@ -276,22 +280,31 @@ machine is an isometry"): erased selection re-sought later reaches `refire`, loud, and the trial is dropped). Every acceptance requires the full validation to stay clean. Deterministic and bounded. -3. **Final validation** of the frozen certificate; None unless - `machine_coverage` holds — the conservative, sound fallback. - A None result IS the fallback (the plain reading); its coverage - verdict is `validate(term, None)`, which runs the same - reachable-WF sweep with an empty certified domain (W7 and - disjointness vacuous, the WF check itself never skipped). - -The canonical certificate is deterministic (measured seed- and -order-independent) and **maximal-certified, not minimal**: the -greedy admission certifies every boundary that stays clean, so -smaller clean certificates with identical physics exist (measured: -`W` reaches `{halt1: 1}` with the single ∅-pop boundary -`ffbbafffa`, basis 734 vs the canonical 498; `B` likewise with -`ffbbfffa` alone). No parsimony or necessity is claimed for the -frozen maps beyond determinism and validated cleanliness; minimal -canonical certificates are docketed future work. +3. **Final validation with GREEDY RESCUE**: the assembled map is + validated; on failure it is NOT discarded whole — the + validated-greedy discipline re-runs from scratch over its + positions (joint-first with per-key exclusion refinement, then + sorted singles), so one bad phase-1 boundary cannot veto the + clean rest (`palpha`'s certificate exists exactly this way: + its one poppable key is excluded to spectator and all three + boundaries certify cargo-only). None only when nothing admits + — the conservative, sound fallback. A None result IS the + fallback (the plain reading); its coverage verdict is + `validate(term, None)`, which runs the same reachable-WF sweep + with an empty certified domain (W7 and disjointness vacuous, + the WF check itself never skipped). + +The canonical certificate is **deterministic** (measured seed- and +order-independent) and **validation-adjudicated greedy — neither +maximal nor minimal is claimed**. Smaller clean certificates with +identical physics exist (measured: `W` reaches `{halt1: 1}` with +the single ∅-pop boundary `ffbbafffa`, basis 734 vs the canonical +498; `B` likewise with `ffbbfffa` alone), and the greedy order can +leave admissible boundaries unexplored. What IS claimed: every +admitted boundary was validated clean at admission, the map is a +deterministic function of the program, and the frozen values +reproduce bit-for-bit. Minimal (and maximal) canonical +certificates are docketed future work. **Validation** (`validate`) splits per the working-review verdict: the STRUCTURAL side — totality, Gram orthonormality on the @@ -322,15 +335,17 @@ semantically load-bearing for HNH (certified `{halt0: 1}` = the physics vs plain `{1/2, 1/2}`); `B` and `W`'s coherence-restoring certificates are admitted by the hybrid (structural `refire` at amplitude exactly zero — verified per-step, all refire sources at -exact amplitude 0 — canonical `{halt1: 1}` for both). Eighteen of +exact amplitude 0 — canonical `{halt1: 1}` for both). Nineteen of the twenty programs freeze exact canonical dicts reproduced -bit-for-bit by `discover_total`; `palpha` and `dupcall` canonically -return None (validation rejects their exploratory fixpoints — the -refusal working as designed) and run the plain reading. In the -frozen maps most certified boundaries pop nothing (cargo-only -certification, every frame retained); the q family, `B`, and `W` -pop inner-coin instances. No identity between the legacy -pop-everything reading and the canonical dicts is claimed. +bit-for-bit by `discover_total`; `dupcall` canonically returns +None (its plain run carries typed err mass, so no certificate can +reach `machine_coverage` — the refusal working as designed) and +runs the plain reading. In the frozen maps most certified +boundaries pop nothing (cargo-only certification, every frame +retained); the q family, `B`, and `W` pop inner-coin instances; +`palpha` certifies via the greedy rescue, guard-silent, basis +474 → 275 with its marginal unchanged. No identity between the +legacy pop-everything reading and the canonical dicts is claimed. ## 6. The invariant catalog (WF, the well-formed subtype) @@ -540,8 +555,9 @@ written-first table (hand-derived circuit readings, several independently confirmed by the audits). A user cannot tell from `machine_coverage` alone whether a program's canonical placement reaches its circuit ideal — that adjudication lives in the -physics table. Nor is the canonical certificate minimal (§5): it -is the deterministic maximal-certified fixpoint, nothing more. +physics table. Nor is the canonical certificate minimal or +maximal (§5): it is the deterministic validation-adjudicated +greedy fixpoint, nothing more. **The instance-alias gap.** No injectivity theorem for logged-position keys is claimed. Every detectable manifestation @@ -584,7 +600,7 @@ Twenty-program suite (twelve sectors + the audit witnesses | weave | 290 | ½ / ½, sup 4 | interleaving stressor | | hweave | 225 | ½ / ½, sup 4 | coherence across an interleaving | | qq | 2,192 | ½ / ½, sup 8 | Q in Q, double-crossed re-seeks | -| palpha | 474 | ¼ / ¾, sup 3 | audit-2 witness: cert refused, physics via fallback | +| palpha | 275 | ¼ / ¾, sup 3 | audit-2 witness; certified via the greedy rescue (one poppable key excluded to spectator), guard-silent, marginal unchanged from plain (474-state) reading | | dupcall | 632 | typed err ½ + ¼/¼ | untyped; refire positive control | | B | 186 | 1̂: 1 | audit-2 decomposition witness, healed (structural refire at amplitude 0) | | W | 498 | 1̂: 1 | audit-2 fatal witness, healed (inner boundary pops the inner coin's two instances; outer frames retained spectators; structural refire at amplitude 0, verified per-step) | @@ -593,33 +609,42 @@ All twenty: zero stuck / non-unit / non-orthogonal columns; guards silent except `dupcall` (expected: `alien-ticket`) and `B`/`W` (expected: structural `refire` at amplitude exactly zero — the hybrid's core case). The written-first physics table passes on all -twenty. `discover_total` == frozen CERTS on all 20: eighteen exact -canonical dicts compared bit-for-bit; `palpha`/`dupcall` -canonically None (validation rejects, plain-reading fallback); +twenty. `discover_total` == frozen CERTS on all 20: nineteen exact +canonical dicts compared bit-for-bit; `dupcall` canonically None +(plain run carries typed err mass; plain-reading fallback); `h(Ω)` → None. Negative controls: pstar × wrong certificate reaches `pop-err`; dupcall × v1.7-era certificate reaches `refire`, all-err. WF/W7/W8/W9 sweeps + mechanized disjointness: -zero violations; **nine permanent regressions** (the v1.6 pair; +zero violations; **ten permanent regressions** (the v1.6 pair; extra-frame collision, W7-excluded with disjoint targets; doctored bundle divergence; K+frame alias; retained-Q disjointness — spectator-bit columns share zero targets; duplicate-ticket W9; retained-Q KD — a cargo key with a retained frame leaves an EMPTY bundle, targets WF-clean; bitfree-burial — -a buried key stays the sole bit-carrying record, no KD beside -it). Conservation: exhaustive ≤ size 11, 14,452 surfacings at -≤10 / 55,727 at ≤11, zero failures. Polarity/terminal -chains/gauge: zero violations, orbit exact. All four prior -audits' independent reproducers rerun clean or typed (audit #1's -fuzz 250/250; audit #2's kit clean on every lifecycle, its -term-evaluator mismatches adjudicated as that evaluator's -non-normalization; audit #3's spectator columns share zero -targets; audit #4's countermodel pair healed per the predictions, -its W-healing verification — per-step zero refire amplitude, 46 -generated programs identical across old/new arms, 1,146-program -W9 fuzz clean — carried forward). Basis counts vs v1.2 reference: -`negative` 103→83, `selector` 173→106, `pstar` 458→242 — -v1.7-era, real, owned; marginals and supports never moved. All -measurements seconds-scale on the M5 Max. +a buried key stays the sole bit-carrying record, no KD beside it; +popped-frame + surviving ticket — the T-riding ticket stays the +answerable representation, no KD, targets WF-clean). Conservation: +exhaustive ≤ size 11, 14,452 surfacings at ≤10 / 55,727 at ≤11, +zero failures. Polarity/terminal chains/gauge: zero violations, +orbit exact. All five prior audits' independent reproducers rerun +clean or typed (audit #1's fuzz 250/250; audit #2's kit clean on +every lifecycle, its term-evaluator mismatches adjudicated as +that evaluator's non-normalization; audit #3's spectator columns +share zero targets; audit #4's countermodel pair healed; audit +#5's popped-frame countermodel healed). Standing audit-confirmed +lemmas carried forward: refire amplitudes of `B`/`W` verified +zero per-step; 46 generated programs identical across the +v1.11/v1.12 arms and zero transition differences over 54 +reachable certified arrivals; 1,146-program W9 fuzz clean; +burials never consumed (incoming ks an exact suffix of the +target's across 13,693 suite edges); within a retained group, +divergent subtraction results are impossible (condition (b) plus +the group key fix every subtraction input); the two v1.12 +regressions fail under an emulated v1.11 arm (genuine, not +vacuous). Basis counts vs v1.2 reference: `negative` 103→83, +`selector` 173→106, `pstar` 458→242 — v1.7-era, real, owned; +marginals and supports never moved. All measurements +seconds-scale on the M5 Max. ## 11. Chronicle @@ -640,10 +665,17 @@ bundle recorded bit-free death for keys with surviving bit-carrying representations (retained-Q frame and burial countermodels, both W8 hazards); the parsimony claim refuted (single-boundary ∅-pop W certificate reaches the physics); -W-healing and all physics CONFIRMED. Working reviews: v1.8 design -(two structural holes), v1.10 design fork (the hybrid verdict: -amplitudes decide success, never isometry; no bare-term ideal -oracle). +W-healing and all physics CONFIRMED. Audit #5 (v1.12): FAIL — the +subtraction missed live tickets surviving in the tape tail/log +(popped-frame + riding-ticket W8 countermodel); "maximal- +certified" refuted on shipped `palpha` (phase 3 discarded a whole +map containing one bad boundary while clean sub-certificates +existed); version-string cruft; W-healing, physics, regressions +(verified genuine against the old arm), burial-suffix lemma, and +subtracted-bundle safety all CONFIRMED. Working reviews: v1.8 +design (two structural holes), v1.10 design fork (the hybrid +verdict: amplitudes decide success, never isometry; no bare-term +ideal oracle). | version | one line | verdict that shaped it | |---|---|---| @@ -657,7 +689,8 @@ oracle). | v1.9 | KD bundles + condition (e); key-alias guard + W8; real disjointness checker; syntactic fragment boundary; docs current-only | **fresh audit #2: FAIL** (the `W` fatal witness — clean validation, wrong physics via a zero-amplitude structural veto on `B`-class certificates; W8 preservation refuted; (e) over-rejection; checker totality) | | v1.10 | the hybrid pipeline (structural isometry mandatory; dynamic cleanliness decides success); instance-directed erasure with validation-adjudicated spectator admission; deep W3 + the key-state algebra; machine_coverage rename + the physics table; `B` healed, `W` registered placement-open | **fresh audit #3: FAIL** (the fire arm computed P/Q and discarded it — retained spectators erased bit-free; retained-Q isometry countermodel; W's "limitation" was this defect and heals under the literal rule; validate(None) gap; duplicate-ticket W8 row; six honesty defects) | | v1.11 | the P/Q spectator transition implemented literally (KD from P, rs′ = Q); certificates re-discovered and frozen as exact dicts; `W` HEALED at {halt1: 1}, the staged-uncomputation retraction; W9 + the algebra's duplicate-ticket row; validate(None) runs the real sweep; two new permanent regressions; honesty corrections | **fresh audit #4: FAIL** (KD bundle bit-free-records keys with surviving bit-carrying representations — retained-Q frame + burial countermodels; parsimony refuted; W healing + physics CONFIRMED) | -| v1.12 | the KD subtraction (bundle names only representation-free keys; decode's record-skip lifted to burials); W8 extended to bitfree ∩ burial; condition (e) compares the bundle actually left; canonical = maximal-certified, minimality docketed; register decrufted current-only; two new permanent regressions (nine total) | **fresh audit #5: pending** | +| v1.12 | the KD subtraction (Q frames + burials); W8 extended to bitfree ∩ burial; condition (e) compares the bundle actually left; register decrufted current-only; two new permanent regressions (nine total) | **fresh audit #5: FAIL** (subtraction missed T/log-surviving tickets; "maximal-certified" false on palpha; version cruft; healing + physics + regressions CONFIRMED) | +| v1.13 | the COMPLETE subtraction (bundle names only keys with no surviving bit-carrying representation anywhere in the target — Q frames, burials, T/log tickets); phase-3 GREEDY RESCUE (a failing map is re-admitted greedily, not discarded — palpha certifies, guard-silent, marginal unchanged); "maximal" retracted to validation-adjudicated greedy; version strings unified (the register alone carries the version); tenth regression | **fresh audit #6: pending** | ## 12. Appendix — HH step-indexed trace diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index b96db40..e5d325a 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -389,7 +389,7 @@ substrate's obstruction and the fork reopens. | Item | Status | |---|---| -| Kernel | **v1.12** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation (audit #4's countermodel pair: retained-Q frames and burials each stay the sole record). `W` healed at {1̂: 1} (audits 3+4 confirmed, refire amplitudes verified zero per-step); eighteen exact dict certificates + two canonical Nones; canonical = maximal-certified, minimality docketed; nine-invariant WF (W8 extended to bitfree ∩ burial; W9 live-ticket uniqueness); nine permanent regressions; physics table passes on all twenty. **PASS re-claim gated on fresh audit #5** | +| Kernel | **v1.13** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — audits #4/#5's countermodels each healed with the survivor as sole record). `W` healed at {1̂: 1} (audits 3–5 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue certifies `palpha` (guard-silent, marginal unchanged); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; nine-invariant WF; ten permanent regressions; physics table passes on all twenty. **PASS re-claim gated on fresh audit #6** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §11.7, §12.2, §13.3): the v1.5 fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is pop-err reachability + the RS-function property, strictly beyond Gram (negative control caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and as of v1.8 **self-validating**: the fixpoint is admitted only if its certified graph passes full semantic coverage, else None | From e3628b7817ef8c2a251f473cf3a645f2a6f29a11 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 17:47:59 -0400 Subject: [PATCH 037/107] =?UTF-8?q?qalc:=20v1.14=20=E2=80=94=20regression?= =?UTF-8?q?=20ten=20gates;=20rescue=20pool=20completed;=20claims=20rescope?= =?UTF-8?q?d?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #6 (fresh instance): FAIL with ZERO machine countermodels — the completed subtraction CONFIRMED-SOUND by exhaustive storage enumeration, palpha + W hand-confirmed, 18 graphs transition-identical. The four findings were all scaffolding: regression ten computed but non-gating (runnable countermodel, reproduced); the rescue's None sentence outran its position pool; a moved-graphs claim scoped too wide; version cruft. v1.14, predictions-first (all HELD byte-for-byte, the loop's first perfect round): all ten regressions gate the sweep aggregate (the emulated-arm probe flips cert_sweep to FAIL); the phase-3 rescue pool spans phase-1 positions plus every phase-2 candidate (pre-fix diagnostic: behavior-identical on the whole suite — the completion makes the None sentence exact); claims rescoped; stale version text purged. Register §5/§9/§10/ §11, STATUS, token.md, ledger updated. Fresh audit #7 launched; the PASS re-claim stays gated on it. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 73 ++++++++++----------------- docs/ledger/2026-08.md | 48 ++++++++++++++++++ docs/quantum-algebraic/kernel.md | 87 +++++++++++++++++++++----------- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 134 insertions(+), 76 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 513a3a9..4c39497 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -420,55 +420,38 @@ consistency) and a fresh-context feasibility review (thread promising-with-hard-open-problems, converging with the sketch on every load-bearing point; its checklist and exclusions are folded in. -**The kernel is at v1.13** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.14** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` -and git). The last two audit rounds resolved the `W` saga: audit -#3 found the v1.10 fire arm computed the instance-directed `P`/`Q` -spectator split and discarded it — so v1.10's registered "W -placement limitation" (staged uncomputation inexpressible) had -measured that defect, not the certificate language — and v1.11 -wired the split through literally, healing audit #2's fatal -witness at its hand ideal `{halt1: 1}` (the retraction is -registered; the wrongly-ledgered consult prediction is corrected -in provenance). Audit #4 then CONFIRMED the healing (refire -amplitudes verified zero per-step; four independent physics -recomputations; 46 generated programs identical across arms) while -countermodeling the KD bundle's bookkeeping: bit-free death was -recorded for keys whose bit-carrying representation survived the -fire (a retained-Q frame; a retained-whole burial) — both W8 -hazards in the target. v1.12 subtracts: the bundle names only -representation-free keys, the decode arm's record-skip lifts to -burials, W8 extends to bitfree ∩ burial, condition (e) compares -the bundle actually left. Audit #4 also refuted the v1.11 -parsimony language — the canonical certificate is the -deterministic MAXIMAL-certified fixpoint, not minimal (measured: -single-boundary ∅-pop certificates reach B and W's physics); -minimal canonical certificates are docketed. Nothing reachable -moved: all frozen certificates, marginals, and basis counts are -bit-identical under the fix; the register is decrufted -current-only. Audit #5 then confirmed the healing and all physics -again while completing the picture twice over: the subtraction -also had to spare live tickets riding in the surviving tape -tail/log (a popped frame's replay-re-emitted ticket stays the -answerable representation — v1.13's completed rule names only -keys with no surviving bit-carrying representation anywhere in -the target), and "maximal-certified" was measurably false — -`discover_total(palpha)` discarded a whole map for one bad -boundary while clean sub-certificates existed. v1.13's phase-3 -GREEDY RESCUE re-admits a failing map's boundaries under the -validated-greedy discipline instead of discarding: `palpha` now -certifies (three boundaries, its one poppable key excluded to -spectator, guard-silent, basis 474→275, marginal unchanged), the -claim language is "deterministic validation-adjudicated greedy — -neither maximal nor minimal", and the version now lives in the -register alone. Ten permanent regressions; nineteen frozen dicts -+ dupcall's canonical None; physics table passes on all twenty -with `W = {halt1: 1}`; all five prior audit kits rerun clean. +and the register's §11 chronicle). The audit loop's state after +six fresh-context rounds: the machine core has not moved since the +v1.11 spectator-transition fix; audit #2's fatal witness `W` is +healed at its hand ideal `{halt1: 1}` and has been independently +re-confirmed three times (refire amplitudes verified zero +per-step); the KD subtraction is COMPLETE — the bundle names only +keys with no surviving bit-carrying representation anywhere in the +target (Q frames, burials, T/log-riding tickets) — and audit #6 +CONFIRMED it sound by exhaustively enumerating post-fire +bit-carrying storage, with `palpha`'s certificate and marginal +verified against the hand calculation. Audit #6's FAIL was the +first with zero machine countermodels: regression ten was computed +but not gating (runnable countermodel — fixed, all ten now gate +the sweep aggregate, measured to flip under an emulated old arm), +the rescue's "None only when nothing admits" outran its position +pool (fixed — the pool now spans phase-1 positions plus every +phase-2 candidate, measured behavior-identical on the whole suite, +so the sentence is exact), a moved-graphs claim was scoped too +wide, and version cruft lingered (purged; the register alone +carries the version). Nineteen frozen dict certificates + +dupcall's canonical None; canonical = deterministic +validation-adjudicated greedy, neither maximal nor minimal; +physics table passes on all twenty; all six prior audit kits rerun +byte-identical or correctly flipped; every v1.14 prediction held +byte-for-byte (provenance in the scratchpad prediction files). The open docket, in order: -1. **fresh-context independent audit #6 of the v1.13 h-fragment - claim** (next action; verdict to be registered in `kernel.md` +1. **fresh-context independent audit #7 of the v1.14 h-fragment + claim** (running; verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 is its newly checkable ticket-dimension face), and diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index eeaed9c..7baadf0 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2794,3 +2794,51 @@ smaller-certificate facts registered beside it. Version strings now live in the register alone. Full battery green; all five prior kits rerun clean; register, STATUS, token.md updated; fresh audit #6 launched — the PASS re-claim stays gated on it. + +## 2026-08-09 — qALC kernel v1.14: the loop reaches my own scaffolding + +Fresh audit #6 (independent instance, sol tier, the v1.13 pack) +returned FAIL — and for the first time in six rounds, with ZERO +machine countermodels. The completed subtraction was +CONFIRMED-SOUND by exhaustively enumerating post-fire bit-carrying +storage (retained Q frames; live tape/log tickets including LP +slice cargo; burial tickets — P and l erased, vb None, ANS not +instance-keyed, K/KD bit-free); palpha's certificate and {1/4, +3/4} marginal were verified against the hand calculation; W was +re-confirmed at {1̂: 1} with all four refire sources at exact +amplitude zero; the 18 prior graphs showed zero transition diffs +against an emulated v1.12 arm; rescue determinism held under +reversed traversal and six hash seeds. What failed was my +scaffolding and claim language, all four findings reproduced +before registering: (1) the tenth regression computed its verdict +flag but never fed it to the sweep's aggregate — a runnable +countermodel (the emulated old arm printed a failing regression +line under a passing total); (2) "None only when nothing admits" +outran the code — the phase-3 rescue pool was only the failing +map's own positions, so a phase-2 candidate rejected against a +dirty base could never be reconsidered (statement gap; the +auditor's 240-program search found no term exhibiting it); (3) +the pack's "nothing reachable moved" was literally false — palpha +deliberately moved 474→275; (4) residual version cruft (the +register's §9 claim title and audit-gate line, two module +identity docstrings, discover_total's pre-v1.13 pipeline +description). + +v1.14, predictions written first, a pre-fix diagnostic sharpening +them: replicating phase 1 and the phase-2 candidate computation +across all twenty programs showed NO phase-2 candidate is ever +rejected — the pool already equals the final domain everywhere — +so the pool completion was predicted behavior-identical. Outcome: +every prediction held BYTE-FOR-BYTE, the loop's first perfect +round — regression ten now gates (the emulated-arm probe flips +cert_sweep to FAIL, exactly as it must), the rescue pool spans +phase-1 positions plus every phase-2 candidate (making the None +sentence exact: greedy over the pool, not complete over its +subsets), suite/certify/wf/conservation outputs byte-identical to +the v1.13 captures, four prior kits byte-identical, audit #6's +kit clean with the flipped gate. Claim language rescoped (the +moved-graphs claim names the prior 18 + palpha at its certified +values); stale version text purged, including two +identity-position tags the audits never flagged. Register §5/§9/ +§10/§11, STATUS, token.md updated; fresh audit #7 launched — the +PASS re-claim stays gated on it. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 53ea5b4..f9e8efe 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC three-program kernel — current register -**Status: v1.13.** The kernel is a scratch superposition evolver +**Status: v1.14.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -16,7 +16,7 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #6**, whose +The standing PASS re-claim is **gated on fresh audit #7**, whose verdict will be registered here. This file is the current contract and register only. The @@ -134,7 +134,7 @@ arrive/fire tape = P_b · μ_g · T, P_0 = l· P_1 = •·l· → key-alias [deep bit coherence at the boundary: a fire must never erase or bury a disagreement] - CERTIFIED boundary (pos ∈ certificate, v1.10 INSTANCE-DIRECTED): + CERTIFIED boundary (pos ∈ certificate, INSTANCE-DIRECTED): the certificate names popkeys(pos); frames split into P = RS ∩ popkeys (erased) and Q = RS \ popkeys (retained SPECTATORS — which-path data of unrelated instances, e.g. @@ -282,13 +282,20 @@ machine is an isometry"): validation to stay clean. Deterministic and bounded. 3. **Final validation with GREEDY RESCUE**: the assembled map is validated; on failure it is NOT discarded whole — the - validated-greedy discipline re-runs from scratch over its - positions (joint-first with per-key exclusion refinement, then - sorted singles), so one bad phase-1 boundary cannot veto the - clean rest (`palpha`'s certificate exists exactly this way: - its one poppable key is excluded to spectator and all three - boundaries certify cargo-only). None only when nothing admits - — the conservative, sound fallback. A None result IS the + validated-greedy discipline re-runs from scratch over the FULL + candidate pool (phase-1 fixpoint positions plus every phase-2 + candidate, including candidates rejected against a dirty + phase-1 base), joint-first with per-key exclusion refinement, + then sorted singles, so one bad phase-1 boundary cannot veto + the clean rest (`palpha`'s certificate exists exactly this + way: its one poppable key is excluded to spectator and all + three boundaries certify cargo-only). None exactly when this + validated-greedy pass over the pool accepts nothing — greedy, + NOT complete over subsets of the pool — the conservative, + sound fallback. (Measured: on all twenty programs the pool + equals the final domain — no phase-2 candidate is ever + rejected — so the pool completion is behavior-identical on the + suite; it exists to make this sentence exact.) A None result IS the fallback (the plain reading); its coverage verdict is `validate(term, None)`, which runs the same reachable-WF sweep with an empty certified domain (W7 and disjointness vacuous, @@ -535,7 +542,7 @@ shell arguments — rejected. ## 9. The claim and the alias gap -**The v1.12 coverage claim.** Over programs that are (i) typable +**The coverage claim.** Over programs that are (i) typable h-only under the signature judgment (with the syntactic boundary: shell args exactly `Gate(h)` then `Gate(t)`, no gate literals in bodies, closed bodies) and (ii) whose canonical pipeline reports @@ -574,7 +581,7 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#5; the verdict will be registered here.** +#7; the verdict will be registered here.** ## 10. Verification state @@ -623,25 +630,36 @@ duplicate-ticket W9; retained-Q KD — a cargo key with a retained frame leaves an EMPTY bundle, targets WF-clean; bitfree-burial — a buried key stays the sole bit-carrying record, no KD beside it; popped-frame + surviving ticket — the T-riding ticket stays the -answerable representation, no KD, targets WF-clean). Conservation: +answerable representation, no KD, targets WF-clean). All ten GATE +the sweep's aggregate verdict — audit #6 caught the tenth +computed but non-gating (the emulated-old-arm probe now flips +`cert_sweep` to FAIL, measured). Conservation: exhaustive ≤ size 11, 14,452 surfacings at ≤10 / 55,727 at ≤11, zero failures. Polarity/terminal chains/gauge: zero violations, -orbit exact. All five prior audits' independent reproducers rerun +orbit exact. All six prior audits' independent reproducers rerun clean or typed (audit #1's fuzz 250/250; audit #2's kit clean on every lifecycle, its term-evaluator mismatches adjudicated as that evaluator's non-normalization; audit #3's spectator columns share zero targets; audit #4's countermodel pair healed; audit -#5's popped-frame countermodel healed). Standing audit-confirmed -lemmas carried forward: refire amplitudes of `B`/`W` verified -zero per-step; 46 generated programs identical across the -v1.11/v1.12 arms and zero transition differences over 54 -reachable certified arrivals; 1,146-program W9 fuzz clean; -burials never consumed (incoming ks an exact suffix of the -target's across 13,693 suite edges); within a retained group, -divergent subtraction results are impossible (condition (b) plus -the group key fix every subtraction input); the two v1.12 -regressions fail under an emulated v1.11 arm (genuine, not -vacuous). Basis counts vs v1.2 reference: `negative` 103→83, +#5's popped-frame countermodel healed; audit #6's gate probe +flips as it must). Standing audit-confirmed lemmas carried +forward: refire amplitudes of `B`/`W` verified zero per-step; 46 +generated programs identical across the v1.11/v1.12 arms and +zero transition differences over 54 reachable certified +arrivals; 1,146-program W9 fuzz clean; burials never consumed +(incoming ks an exact suffix of the target's across 13,693 suite +edges); within a retained group, divergent subtraction results +are impossible (condition (b) plus the group key fix every +subtraction input); the two v1.12 regressions fail under an +emulated v1.11 arm (genuine, not vacuous); the completed +subtraction CONFIRMED-SOUND by exhaustive enumeration of +post-fire bit-carrying storage (audit #6: retained Q frames, +tape/log tickets incl. LP slice cargo, burials — P and l erased, +vb None, ANS not instance-keyed, K/KD bit-free); `palpha` +CONFIRMED against the hand calculation; the 18 pre-v1.13 graphs +have zero transition diffs vs the emulated v1.12 arm; rescue +determinism held under reversed traversal and six hash seeds. +Basis counts vs v1.2 reference: `negative` 103→83, `selector` 173→106, `pstar` 458→242 — v1.7-era, real, owned; marginals and supports never moved. All measurements seconds-scale on the M5 Max. @@ -672,10 +690,18 @@ certified" refuted on shipped `palpha` (phase 3 discarded a whole map containing one bad boundary while clean sub-certificates existed); version-string cruft; W-healing, physics, regressions (verified genuine against the old arm), burial-suffix lemma, and -subtracted-bundle safety all CONFIRMED. Working reviews: v1.8 -design (two structural holes), v1.10 design fork (the hybrid -verdict: amplitudes decide success, never isometry; no bare-term -ideal oracle). +subtracted-bundle safety all CONFIRMED. Audit #6 (v1.13): FAIL — +the first round with ZERO machine countermodels: the completed +subtraction CONFIRMED-SOUND by exhaustive storage enumeration, +`palpha` and `W` confirmed by hand calculation; the failure was +scaffolding and language — regression ten computed but +non-gating (runnable countermodel), the rescue's "None only when +nothing admits" stronger than its position pool, "nothing +reachable moved" false as written (`palpha` deliberately moved), +residual version cruft. Working reviews: v1.8 design (two +structural holes), v1.10 design fork (the hybrid verdict: +amplitudes decide success, never isometry; no bare-term ideal +oracle). | version | one line | verdict that shaped it | |---|---|---| @@ -690,7 +716,8 @@ ideal oracle). | v1.10 | the hybrid pipeline (structural isometry mandatory; dynamic cleanliness decides success); instance-directed erasure with validation-adjudicated spectator admission; deep W3 + the key-state algebra; machine_coverage rename + the physics table; `B` healed, `W` registered placement-open | **fresh audit #3: FAIL** (the fire arm computed P/Q and discarded it — retained spectators erased bit-free; retained-Q isometry countermodel; W's "limitation" was this defect and heals under the literal rule; validate(None) gap; duplicate-ticket W8 row; six honesty defects) | | v1.11 | the P/Q spectator transition implemented literally (KD from P, rs′ = Q); certificates re-discovered and frozen as exact dicts; `W` HEALED at {halt1: 1}, the staged-uncomputation retraction; W9 + the algebra's duplicate-ticket row; validate(None) runs the real sweep; two new permanent regressions; honesty corrections | **fresh audit #4: FAIL** (KD bundle bit-free-records keys with surviving bit-carrying representations — retained-Q frame + burial countermodels; parsimony refuted; W healing + physics CONFIRMED) | | v1.12 | the KD subtraction (Q frames + burials); W8 extended to bitfree ∩ burial; condition (e) compares the bundle actually left; register decrufted current-only; two new permanent regressions (nine total) | **fresh audit #5: FAIL** (subtraction missed T/log-surviving tickets; "maximal-certified" false on palpha; version cruft; healing + physics + regressions CONFIRMED) | -| v1.13 | the COMPLETE subtraction (bundle names only keys with no surviving bit-carrying representation anywhere in the target — Q frames, burials, T/log tickets); phase-3 GREEDY RESCUE (a failing map is re-admitted greedily, not discarded — palpha certifies, guard-silent, marginal unchanged); "maximal" retracted to validation-adjudicated greedy; version strings unified (the register alone carries the version); tenth regression | **fresh audit #6: pending** | +| v1.13 | the COMPLETE subtraction (bundle names only keys with no surviving bit-carrying representation anywhere in the target — Q frames, burials, T/log tickets); phase-3 GREEDY RESCUE (a failing map is re-admitted greedily, not discarded — palpha certifies, guard-silent, marginal unchanged); "maximal" retracted to validation-adjudicated greedy; version strings unified (the register alone carries the version); tenth regression | **fresh audit #6: FAIL** (zero machine countermodels — subtraction CONFIRMED-SOUND by exhaustive storage enumeration, palpha + W hand-confirmed, 18 graphs zero diffs; regression ten non-gating; rescue claim stronger than its pool; "nothing reachable moved" false as written; version cruft) | +| v1.14 | regression ten GATES the aggregate; rescue pool completed to phase-1 ∪ all phase-2 candidates (measured behavior-identical on the suite — the completion makes the None sentence exact); claim language restricted (moved-graphs claim scoped to the prior 18 + palpha at its certified values); stale version/audit text purged; every prediction of the round held byte-for-byte | **fresh audit #7: pending** | ## 12. Appendix — HH step-indexed trace diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index e5d325a..c112f2e 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -389,7 +389,7 @@ substrate's obstruction and the fork reopens. | Item | Status | |---|---| -| Kernel | **v1.13** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — audits #4/#5's countermodels each healed with the survivor as sole record). `W` healed at {1̂: 1} (audits 3–5 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue certifies `palpha` (guard-silent, marginal unchanged); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; nine-invariant WF; ten permanent regressions; physics table passes on all twenty. **PASS re-claim gated on fresh audit #6** | +| Kernel | **v1.14** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audit #6's exhaustive storage enumeration). `W` healed at {1̂: 1} (audits 3–6 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; nine-invariant WF; ten permanent regressions, all gating. **PASS re-claim gated on fresh audit #7** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §11.7, §12.2, §13.3): the v1.5 fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is pop-err reachability + the RS-function property, strictly beyond Gram (negative control caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and as of v1.8 **self-validating**: the fixpoint is admitted only if its certified graph passes full semantic coverage, else None | From 4bb15fc01ca54e73fac33eb46908ad271b256ded Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 18:16:08 -0400 Subject: [PATCH 038/107] =?UTF-8?q?qalc:=20v1.15=20=E2=80=94=20non-vacuous?= =?UTF-8?q?=20coverage;=20exit-code=20verdict;=20the=20None=20sentence=20e?= =?UTF-8?q?xact?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #7 (fresh instance): FAIL, the second consecutive round with zero machine countermodels — the subtraction CONFIRMED a third time over an extended storage matrix, palpha + W hand-recomputed, the full-pool rescue construction verified. Findings (all reproduced): the None sentence omitted cap exits; validate() silently ignored unreachable certificate entries (vacuously satisfiable); the v1.6 regression pair gated nothing mechanical; 'byte-identical' false vs conservation's wall-clock suffix; two stale register phrases. v1.15, predictions-first (all HELD with exactly the declared deltas): NON-VACUITY joins structural validation (vacuous_positions; machine_coverage refuses unreachable entries; canonical maps never vacuous by settle()'s guarantee); eleventh permanent regression, gated; the module verdict is the exit code (forcing any single regression false exits nonzero, measured); the canonical-None sentence exact in three disjuncts — the auditor's own two-disjunct suggestion was incomplete, the empty admission is the third; title de-cruffed; output-identity claims scoped to deterministic fields. Register, STATUS, token.md, ledger updated. Fresh audit #8 launched; the PASS re-claim stays gated on it. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 52 ++++++++-------- docs/ledger/2026-08.md | 53 ++++++++++++++++ docs/quantum-algebraic/kernel.md | 104 ++++++++++++++++++++++--------- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 153 insertions(+), 58 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 4c39497..8d42dc7 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -420,37 +420,37 @@ consistency) and a fresh-context feasibility review (thread promising-with-hard-open-problems, converging with the sketch on every load-bearing point; its checklist and exclusions are folded in. -**The kernel is at v1.14** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.15** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after -six fresh-context rounds: the machine core has not moved since the -v1.11 spectator-transition fix; audit #2's fatal witness `W` is -healed at its hand ideal `{halt1: 1}` and has been independently -re-confirmed three times (refire amplitudes verified zero -per-step); the KD subtraction is COMPLETE — the bundle names only -keys with no surviving bit-carrying representation anywhere in the -target (Q frames, burials, T/log-riding tickets) — and audit #6 -CONFIRMED it sound by exhaustively enumerating post-fire -bit-carrying storage, with `palpha`'s certificate and marginal -verified against the hand calculation. Audit #6's FAIL was the -first with zero machine countermodels: regression ten was computed -but not gating (runnable countermodel — fixed, all ten now gate -the sweep aggregate, measured to flip under an emulated old arm), -the rescue's "None only when nothing admits" outran its position -pool (fixed — the pool now spans phase-1 positions plus every -phase-2 candidate, measured behavior-identical on the whole suite, -so the sentence is exact), a moved-graphs claim was scoped too -wide, and version cruft lingered (purged; the register alone -carries the version). Nineteen frozen dict certificates + -dupcall's canonical None; canonical = deterministic -validation-adjudicated greedy, neither maximal nor minimal; -physics table passes on all twenty; all six prior audit kits rerun -byte-identical or correctly flipped; every v1.14 prediction held -byte-for-byte (provenance in the scratchpad prediction files). +seven fresh-context rounds: the machine core has not moved since +the v1.11 spectator-transition fix, and the last TWO rounds found +zero machine countermodels — audits #6 and #7 together confirmed +the completed KD subtraction sound (exhaustive post-fire storage +enumeration, then an extended matrix: nested slice-cargo tickets, +tickets inside unrelated burials, ANS, frozen instance names), +hand-recomputed `palpha` ({1/4, 3/4}) and `W` ({halt1: 1}, refire +amplitudes exactly zero per-step), and verified the rescue's +full-pool construction and determinism. What the rounds still +found was claim-language and scaffolding, each fixed the same +day: all eleven permanent regressions now gate mechanically (the +module verdict is the exit code — forcing any single regression +false exits nonzero, measured); `validate()` gained NON-VACUITY +(a certificate entry at an unreachable position fails +`machine_coverage` instead of being silently ignored — canonical +maps are never vacuous by construction); the canonical-None +sentence is exact in three disjuncts (cap/nonconvergence exit, +empty admission, pool pass accepting nothing); output-identity +claims are scoped to deterministic fields. Nineteen frozen dict +certificates + dupcall's canonical None; canonical = +deterministic validation-adjudicated greedy, neither maximal nor +minimal; physics table passes on all twenty; all seven prior +audit kits rerun with exactly the declared deltas; every v1.15 +prediction held (provenance in the scratchpad prediction files). The open docket, in order: -1. **fresh-context independent audit #7 of the v1.14 h-fragment +1. **fresh-context independent audit #8 of the v1.15 h-fragment claim** (running; verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 7baadf0..785f5b8 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2842,3 +2842,56 @@ values); stale version text purged, including two identity-position tags the audits never flagged. Register §5/§9/ §10/§11, STATUS, token.md updated; fresh audit #7 launched — the PASS re-claim stays gated on it. + +## 2026-08-09 — qALC kernel v1.15: non-vacuous coverage, and the exit code becomes the verdict + +Fresh audit #7 (independent instance, sol tier, the v1.14 pack) +returned FAIL — the second consecutive round with zero machine +countermodels. It confirmed the completed subtraction a third +time over an extended matrix of its own construction (recursively +slice-nested tape/log tickets, tickets inside unrelated K +burials, ANS carrying no instance, frozen instance names not +traversed, vb None at every fire target), hand-recomputed palpha +and W, and verified the v1.14 full-pool construction correct +(candidates captured pre-mutation, deterministic under six hash +seeds and reversed traversal). Its four findings, all reproduced +via its kit before registering: the None sentence omitted cap +exits (state_cap=20 on HH returns None from phase 1 before any +pool pass exists); validate() silently ignored certificate +entries at unreachable positions, so "validation-clean" was +vacuously satisfiable (HH's canonical map plus a spurious +unreachable entry reported machine_coverage=True); only eight of +the ten regressions gated cert_sweep — the v1.6 collision pair +bound nothing mechanical; and "byte-identical" was literally +false against conservation.py's wall-clock suffix — a claim I +had written without full-diffing that one file, which is +precisely the sin this loop exists to catch. Plus two register +phrases: the pool-equals-domain parenthetical was false for +dupcall (my own diagnostic had printed the exception and I wrote +the sentence wrong anyway), and the H1 title still said +"three-program kernel" over a twenty-program suite. + +v1.15, predictions written first: NON-VACUITY joins the +structural side of validation — a new vacuous_positions field +counts certificate entries with no boundary arrival and +machine_coverage requires zero (a pure strengthening: settle() +rejects any trial whose position leaves the arrivals, so +canonical maps are never vacuous); an eleventh permanent +regression pins it (HH canonical + unreachable position must be +refused while the canonical map passes); the module verdict is +now the EXIT CODE — wf.py exits nonzero unless all three sweeps +pass, so any single regression failure fails something a script +can see (measured: forcing the v1.6 pair false exits 1, forcing +a cert_sweep flag false exits 1); the None sentence gained its +exact three disjuncts — and the auditor's two-disjunct +suggestion was itself incomplete, an empty admission (zero +structurally admissible boundaries) also returns None without +reaching phase 3, registered exactly; the title is now "qALC +kernel — current register"; output-identity claims are scoped to +deterministic fields. Every prediction held with exactly the +declared deltas: the 19 dicts and dupcall's None unchanged, the +auditor's vacuity probe flips to refused, suite/polarity/ +typecheck byte-identical, certify and the kits differing only by +the declared field, conservation only by its timing suffix. +Register, STATUS, token.md updated; fresh audit #8 launched — +the PASS re-claim stays gated on it. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index f9e8efe..7f8f8f5 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ -# qALC three-program kernel — current register +# qALC kernel — current register -**Status: v1.14.** The kernel is a scratch superposition evolver +**Status: v1.15.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -16,7 +16,7 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #7**, whose +The standing PASS re-claim is **gated on fresh audit #8**, whose verdict will be registered here. This file is the current contract and register only. The @@ -289,13 +289,19 @@ machine is an isometry"): then sorted singles, so one bad phase-1 boundary cannot veto the clean rest (`palpha`'s certificate exists exactly this way: its one poppable key is excluded to spectator and all - three boundaries certify cargo-only). None exactly when this - validated-greedy pass over the pool accepts nothing — greedy, - NOT complete over subsets of the pool — the conservative, - sound fallback. (Measured: on all twenty programs the pool - equals the final domain — no phase-2 candidate is ever - rejected — so the pool completion is behavior-identical on the - suite; it exists to make this sentence exact.) A None result IS the + three boundaries certify cargo-only). None arises in exactly + three ways: a cap or nonconvergence exit in phases 1–2 (the + conservative fallback, before any pool pass exists); an empty + admission (no position ever structurally admissible — the + empty map IS the plain reading); or this validated-greedy + pass over the pool accepting nothing — greedy, NOT complete + over subsets of the pool. (Measured: on all nineteen + certificate-bearing programs the pool equals the final + domain, and no phase-2 candidate is ever rejected anywhere; + `dupcall`'s three-position pool is correctly discarded whole + by validation — its plain run carries typed err mass. The + pool completion is behavior-identical on the suite; it exists + to make this sentence exact.) A None result IS the fallback (the plain reading); its coverage verdict is `validate(term, None)`, which runs the same reachable-WF sweep with an empty certified domain (W7 and disjointness vacuous, @@ -316,7 +322,11 @@ certificates are docketed future work. **Validation** (`validate`) splits per the working-review verdict: the STRUCTURAL side — totality, Gram orthonormality on the structural reachable basis, unconditional transparency, reachable -⊆ WF∧W7∧W8∧W9, mechanized disjointness — is mandatory and +⊆ WF∧W7∧W8∧W9, mechanized disjointness, and NON-VACUITY (audit +#7: a certified position with no boundary arrival is never +consulted, so `machine_coverage` refuses any map containing one; +canonical maps are never vacuous — `settle()` rejects any trial +whose position leaves the arrivals) — is mandatory and isometry-bearing (orbit-norm preservation alone is NOT isometry: `T|0⟩ = T|1⟩ = |1⟩` holds norm 1 forever from `|0⟩` while collapsing columns). The DYNAMIC side — exact evolution of the @@ -581,7 +591,7 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#7; the verdict will be registered here.** +#8; the verdict will be registered here.** ## 10. Verification state @@ -622,7 +632,7 @@ canonical dicts compared bit-for-bit; `dupcall` canonically None `h(Ω)` → None. Negative controls: pstar × wrong certificate reaches `pop-err`; dupcall × v1.7-era certificate reaches `refire`, all-err. WF/W7/W8/W9 sweeps + mechanized disjointness: -zero violations; **ten permanent regressions** (the v1.6 pair; +zero violations; **eleven permanent regressions** (the v1.6 pair; extra-frame collision, W7-excluded with disjoint targets; doctored bundle divergence; K+frame alias; retained-Q disjointness — spectator-bit columns share zero targets; @@ -630,19 +640,34 @@ duplicate-ticket W9; retained-Q KD — a cargo key with a retained frame leaves an EMPTY bundle, targets WF-clean; bitfree-burial — a buried key stays the sole bit-carrying record, no KD beside it; popped-frame + surviving ticket — the T-riding ticket stays the -answerable representation, no KD, targets WF-clean). All ten GATE -the sweep's aggregate verdict — audit #6 caught the tenth -computed but non-gating (the emulated-old-arm probe now flips -`cert_sweep` to FAIL, measured). Conservation: +answerable representation, no KD, targets WF-clean; +vacuous-position — a certificate entry at an unreachable +position must fail `machine_coverage` while the canonical map +passes). The gating structure, stated exactly (audits #6 and #7 +each caught a computed-but-non-gating verdict): the v1.6 pair +gates `collisions_under_wf()`; the other nine gate +`cert_sweep()`'s return; the module `__main__` conjoins all +three sweeps in its printed total AND ITS EXIT CODE, so any +single regression failure exits nonzero (measured: forcing the +pair false → exit 1; forcing a cert_sweep flag false → exit 1; +the emulated-old-arm probe flips `cert_sweep` to FAIL). +Conservation: exhaustive ≤ size 11, 14,452 surfacings at ≤10 / 55,727 at ≤11, zero failures. Polarity/terminal chains/gauge: zero violations, -orbit exact. All six prior audits' independent reproducers rerun -clean or typed (audit #1's fuzz 250/250; audit #2's kit clean on -every lifecycle, its term-evaluator mismatches adjudicated as -that evaluator's non-normalization; audit #3's spectator columns -share zero targets; audit #4's countermodel pair healed; audit -#5's popped-frame countermodel healed; audit #6's gate probe -flips as it must). Standing audit-confirmed lemmas carried +orbit exact. All seven prior audits' independent reproducers +rerun clean or typed (audit #1's fuzz 250/250; audit #2's kit +clean on every lifecycle, its term-evaluator mismatches +adjudicated as that evaluator's non-normalization; audit #3's +spectator columns share zero targets; audit #4's countermodel +pair healed; audit #5's popped-frame countermodel healed; audit +#6's gate probe flips as it must; audit #7's vacuity probe now +refused, its cap counterexample matching the three-way None +sentence). Output identity across code changes is claimed for +DETERMINISTIC fields only: `conservation.py` prints a wall-clock +suffix that varies run to run (audit #7 caught "byte-identical" +overclaiming this), and adding a declared validation field +changes every printed validation dict by exactly that field. +Standing audit-confirmed lemmas carried forward: refire amplitudes of `B`/`W` verified zero per-step; 46 generated programs identical across the v1.11/v1.12 arms and zero transition differences over 54 reachable certified @@ -658,8 +683,14 @@ tape/log tickets incl. LP slice cargo, burials — P and l erased, vb None, ANS not instance-keyed, K/KD bit-free); `palpha` CONFIRMED against the hand calculation; the 18 pre-v1.13 graphs have zero transition diffs vs the emulated v1.12 arm; rescue -determinism held under reversed traversal and six hash seeds. -Basis counts vs v1.2 reference: `negative` 103→83, +determinism held under reversed traversal and six hash seeds; +the subtraction re-confirmed over audit #7's extended matrix +(recursively slice-nested tape/log tickets, tickets inside +unrelated `K` burials, ANS carrying no instance, frozen instance +names not traversed, `vb` None at every fire target); the +full-pool construction verified correct (candidates captured +before phase-2 mutation, phase-1 entries persistent, sorted +order). Basis counts vs v1.2 reference: `negative` 103→83, `selector` 173→106, `pstar` 458→242 — v1.7-era, real, owned; marginals and supports never moved. All measurements seconds-scale on the M5 Max. @@ -698,10 +729,20 @@ scaffolding and language — regression ten computed but non-gating (runnable countermodel), the rescue's "None only when nothing admits" stronger than its position pool, "nothing reachable moved" false as written (`palpha` deliberately moved), -residual version cruft. Working reviews: v1.8 design (two -structural holes), v1.10 design fork (the hybrid verdict: -amplitudes decide success, never isometry; no bare-term ideal -oracle). +residual version cruft. Audit #7 (v1.14): FAIL — zero machine +countermodels again (the subtraction CONFIRMED a third time over +an extended storage matrix; Pα and W hand-recomputed; the +full-pool construction verified correct): the None sentence +omitted cap exits (`state_cap=20` returns None from phase 1); +`validate()` accepted certificate entries at unreachable +positions (vacuously); only eight of ten regressions gated +`cert_sweep` (the v1.6 pair bound nothing mechanical); +"byte-identical" was false against `conservation.py`'s timing +suffix; two register phrases stale (the pool-equals-domain +parenthetical vs `dupcall`; the "three-program" title). Working +reviews: v1.8 design (two structural holes), v1.10 design fork +(the hybrid verdict: amplitudes decide success, never isometry; +no bare-term ideal oracle). | version | one line | verdict that shaped it | |---|---|---| @@ -717,7 +758,8 @@ oracle). | v1.11 | the P/Q spectator transition implemented literally (KD from P, rs′ = Q); certificates re-discovered and frozen as exact dicts; `W` HEALED at {halt1: 1}, the staged-uncomputation retraction; W9 + the algebra's duplicate-ticket row; validate(None) runs the real sweep; two new permanent regressions; honesty corrections | **fresh audit #4: FAIL** (KD bundle bit-free-records keys with surviving bit-carrying representations — retained-Q frame + burial countermodels; parsimony refuted; W healing + physics CONFIRMED) | | v1.12 | the KD subtraction (Q frames + burials); W8 extended to bitfree ∩ burial; condition (e) compares the bundle actually left; register decrufted current-only; two new permanent regressions (nine total) | **fresh audit #5: FAIL** (subtraction missed T/log-surviving tickets; "maximal-certified" false on palpha; version cruft; healing + physics + regressions CONFIRMED) | | v1.13 | the COMPLETE subtraction (bundle names only keys with no surviving bit-carrying representation anywhere in the target — Q frames, burials, T/log tickets); phase-3 GREEDY RESCUE (a failing map is re-admitted greedily, not discarded — palpha certifies, guard-silent, marginal unchanged); "maximal" retracted to validation-adjudicated greedy; version strings unified (the register alone carries the version); tenth regression | **fresh audit #6: FAIL** (zero machine countermodels — subtraction CONFIRMED-SOUND by exhaustive storage enumeration, palpha + W hand-confirmed, 18 graphs zero diffs; regression ten non-gating; rescue claim stronger than its pool; "nothing reachable moved" false as written; version cruft) | -| v1.14 | regression ten GATES the aggregate; rescue pool completed to phase-1 ∪ all phase-2 candidates (measured behavior-identical on the suite — the completion makes the None sentence exact); claim language restricted (moved-graphs claim scoped to the prior 18 + palpha at its certified values); stale version/audit text purged; every prediction of the round held byte-for-byte | **fresh audit #7: pending** | +| v1.14 | regression ten GATES the aggregate; rescue pool completed to phase-1 ∪ all phase-2 candidates (measured behavior-identical on the suite — the completion makes the None sentence exact); claim language restricted (moved-graphs claim scoped to the prior 18 + palpha at its certified values); stale version/audit text purged; every prediction of the round held byte-for-byte | **fresh audit #7: FAIL** (zero machine countermodels again — subtraction confirmed third time over an extended matrix, Pα + W hand-recomputed, pool construction verified; None sentence omitted cap exits; validate() vacuously satisfiable at unreachable positions; v1.6 pair non-gating; "byte-identical" false vs the conservation timing suffix; two stale register phrases) | +| v1.15 | NON-VACUITY joins the structural side (`vacuous_positions`, machine_coverage refuses unreachable entries — canonical maps never vacuous by settle()'s guarantee); the None sentence exact in three disjuncts (cap/nonconvergence; empty admission; pool pass accepting nothing); eleventh regression (vacuous-position) gated; the module verdict is the EXIT CODE (any single regression failure exits nonzero, measured); title de-cruffed to "qALC kernel"; output-identity claims scoped to deterministic fields; every prediction held with exactly the declared deltas | **fresh audit #8: pending** | ## 12. Appendix — HH step-indexed trace diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index c112f2e..98e96a7 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -389,7 +389,7 @@ substrate's obstruction and the fork reopens. | Item | Status | |---|---| -| Kernel | **v1.14** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audit #6's exhaustive storage enumeration). `W` healed at {1̂: 1} (audits 3–6 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; nine-invariant WF; ten permanent regressions, all gating. **PASS re-claim gated on fresh audit #7** | +| Kernel | **v1.15** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6 and #7, exhaustive storage enumeration then an extended matrix). `W` healed at {1̂: 1} (audits 3–7 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage (unreachable certificate entries refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; nine-invariant WF; eleven permanent regressions, all gating the module exit code. **PASS re-claim gated on fresh audit #8** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §11.7, §12.2, §13.3): the v1.5 fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is pop-err reachability + the RS-function property, strictly beyond Gram (negative control caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and as of v1.8 **self-validating**: the fixpoint is admitted only if its certified graph passes full semantic coverage, else None | From 037133741eba87ce1ddc5add9592ad9d83c84340 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 18:30:38 -0400 Subject: [PATCH 039/107] =?UTF-8?q?docs:=20decruft=20pass=20=E2=80=94=20cu?= =?UTF-8?q?rrent-only=20across=20README,=20AGENTS,=20STATUS,=20token,=20cl?= =?UTF-8?q?assical?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit README: four certificate classes (PDR), 305 kills, post-trim Ω upper endpoint, qALC third-pillar paragraph. AGENTS: qALC is the third pillar, kernel.md added to the map, gate state current (scratch kernel + register + audit loop; §9 no-code tripwire unchanged), then-4,235 frontier disambiguated, threadless-audit convention noted. STATUS: qALC lead reflects the verified scratch kernel; sketch-era narration folded. token.md: Status no longer 'pre-kernel'; §4's kernel-gate conditional recorded as met and exceeded; obligations rows repointed from dead register sections (§11.7/§13/§14) to the current-only map (§4/§5/§7); regressions row covers the twenty-program suite. classical: verify_pdr joins the checker list; specification status counts four classes; 305 in architecture. Co-Authored-By: Claude Fable 5 --- AGENTS.md | 26 ++++++++------ README.md | 13 ++++--- docs/STATUS.md | 37 ++++++++------------ docs/classical/architecture.md | 5 +-- docs/classical/certificates/specification.md | 7 ++-- docs/quantum-algebraic/token.md | 29 +++++++++------ 6 files changed, 65 insertions(+), 52 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index bb981e9..12f0245 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -66,19 +66,21 @@ The library is three layers — `blc` substrate, symmetric `classical` and `quantum` pillars, `lab` behind its own feature — and one binary, `blam`, whose subcommands live in `src/cli/`. Lab-gated subcommands are recognised without the feature and say how to get themselves; do not "fix" that by -deleting the arm. A fourth pillar, `quantum-algebraic` (qALC: quantum +deleting the arm. A third pillar, `quantum-algebraic` (qALC: quantum *control*, storeless, runtime states in ℓ² over token configurations), -exists as a ratified contract plus an active machine design, no code — -`docs/quantum-algebraic/architecture.md` is the contract (IAM-lineage -token transport: the invocation term is read-only and values reach the -`h`/`t` gates by token routing, never by copying), `token.md` beside it -the active design (exact λIAM substrate, δ-gadget sketch, obligations -register), and `machine.md` the record of the two failed +exists as design documents plus an out-of-tree scratch kernel, no code +in the tree — `docs/quantum-algebraic/architecture.md` is the contract +(IAM-lineage token transport: the invocation term is read-only and +values reach the `h`/`t` gates by token routing, never by copying), +`token.md` beside it the active design (exact λIAM substrate, kernel +gate, obligations register), `kernel.md` the current-only register of +the scratch kernel that implements the gate (the register alone +carries the version; its state is machine-verified and held in a +fresh-context adversarial audit loop — round history in the ledger and +its §11 chronicle), and `machine.md` the record of the two failed rewriting-machine drafts — read-only history, do not build on it. **No qALC code may land** until the contract's §9 gates pass; the -concrete first gate is `token.md` §4's three-program kernel (full -transition table, range disjointness, step-indexed HH / H–NOT–H / -negative-witness traces, column-Gram enumeration). qALC work must +scratch kernel stays outside the tree until then, and qALC work must leave classical and qBLC rows bit-identical. `classical::ladder` owns the halting ladder, and every classical driver @@ -192,7 +194,7 @@ ambient load (the measurements and the scheduler A/B are in STATUS). steps / 100k nodes / 4096 lemma steps, measured kill-equivalent to the battery's 2000/200k (`::THOROUGH`). A complete four-rung frontier sweep (v1 + HTR + selector + PDR) measured 981.3 s wall / 6,630 s user at - `--threads 8` on the M5 Max over the 4,235-term frontier + `--threads 8` on the M5 Max over the then-4,235-term frontier (2026-08-08, the sweep that discovered the eight PDR kills) — 1.84 core-hours, well under the pre-measurement four-core-hour estimate, wall tail-bound as predicted. @@ -240,4 +242,6 @@ bisimulation), `qblc-omega-witnesses` (dyadicity hunt and phase-2 design), `qalc-architecture` (qALC design contract adversarial review, ratification, and amendments), and `qalc-token-machine` (qALC token machine feasibility and kernel review). +The kernel audit rounds deliberately run threadless — a fresh context +per round is the point — labeled `qalc-vNNN-fresh-audit`. Send raw evidence—encodings, diffs, measured bits—not summaries. diff --git a/README.md b/README.md index 7066721..6fd5bff 100644 --- a/README.md +++ b/README.md @@ -99,7 +99,7 @@ assert_eq!((nf.0.as_str(), steps), ("0010", 2)); Around the core: `classical::oracle` (Tromp's syntactic divergence prefilter), `classical::escalation` (redex-history loop detection plus a semantic self-feedback divergence certificate), `classical::certificate` -(trusted checkers for three machine-checkable divergence-certificate +(trusted checkers for four machine-checkable divergence-certificate classes), and `blc::enumerate` (parallel closed-term enumeration, `u64`-packed). `classical::ladder` is the one cheapest-verdict-first halting pipeline over all of them — pre-scan, oracle, two machine rungs, @@ -225,7 +225,7 @@ regeneration, Ω/K regeneration, certificate re-certification). `uni.rs` parity harness in `contrib/ait-uni/`. - The certificate soundness battery is a crate unit test rather than an integration test, so plain `cargo test` streams every provable halter - ≤28 bits through all three trusted checkers and asserts nothing fires. + ≤28 bits through all four trusted checkers and asserts nothing fires. - Halt counts are invariant under every engine change in the repo's history — CI diffs a census spot-check against the canonical table on every push. @@ -234,7 +234,7 @@ regeneration, Ω/K regeneration, certificate re-certification). `--all-features`, default features, and `--no-default-features` — so the lab targets, the no-lab dispatcher arms, and the im-rc-only library are each exercised. -- Every one of the 297 certificate kills is an individually +- Every one of the 305 certificate kills is an individually kernel-checked `¬HasNormalForm` theorem in Lean 4 (zero sorries, no mathlib), pinned to its wire bits by a kernel-checked encoding. @@ -245,7 +245,7 @@ census of all 526,039,969 closed terms of 4–41 bits (~16.5 min on an M5 Max) giving the first BBλ(41) bound (≥ 1,074,266,118 bits) and a BBλ(32) settled modulo the certificate layer (its one remaining unknown is a kernel-checked certified diverger); Ω restricted to ≤41 -bits exactly bracketed in [0.124105086764, 0.124105092919]; the +bits exactly bracketed in [0.124105086764, 0.124105092895]; the 170-bit self-interpreter certified locally optimal; and on the quantum side the first computed operator census of quantum-preparing programs (to our knowledge) — @@ -264,6 +264,11 @@ architecture is split into and [quantum](https://github.com/a9lim/blam/blob/main/docs/quantum/architecture.md) pillars; proof plans and research notes are grouped beneath those domains. +A third pillar, **qALC** (quantum *control*: storeless, runtime states in +ℓ² over token configurations), exists as a +[ratified design contract](https://github.com/a9lim/blam/blob/main/docs/quantum-algebraic/architecture.md) +with a machine-verified kernel register — design documents only; no qALC +code lands until the contract's gates pass. Canonical evidence lives in [data/](https://github.com/a9lim/blam/tree/main/data), the Lean formalization in [lean/](https://github.com/a9lim/blam/tree/main/lean), and the chronological diff --git a/docs/STATUS.md b/docs/STATUS.md index 8d42dc7..660f0bc 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -397,28 +397,21 @@ the whole-live-store operator census. ## Quantum-algebraic state (qALC) -A third pillar exists as a design contract only: -`quantum-algebraic/architecture.md` (quantum control, storeless — runtime -states in ℓ² over machine configurations, `h`/`t` constants at invocation, -fate softened to a real halting mass `μ_p` with `Ω_qALC = Σ 2^(−|p|) μ_p`), -with the active machine design in `quantum-algebraic/token.md` and the -failed rewriting drafts (v0/v1) preserved in -`quantum-algebraic/machine.md`. No engine, no data; -`data/quantum-algebraic/` is reserved. **The contract is frozen and -amended**: four review rounds concluded in a sign-off at `27f2c4b`, and -the token-machine amendment — route (b) after v1's no-cloning killshot -— was ratified through thread `qalc-architecture` and applied -(2026-08-09; history in `ledger/2026-08.md`). The machine is now -IAM-lineage token transport: term read-only, bideterministic substrate -(exact λIAM table pinned in `token.md` §2), values transported to δs -by routing, never copied. - -The v2 design sketch is drafted (`token.md` §3: probe protocol, -δ blocks on arrival states, balanced virtual answers, no-store -consistency) and a fresh-context feasibility review (thread -`qalc-token-machine`) independently graded the route -promising-with-hard-open-problems, converging with the sketch on every -load-bearing point; its checklist and exclusions are folded in. +The third pillar: a ratified design contract plus a machine-verified +scratch kernel, no code in the tree. +`quantum-algebraic/architecture.md` is the contract (quantum control, +storeless — runtime states in ℓ² over machine configurations, `h`/`t` +constants at invocation, fate softened to a real halting mass `μ_p` +with `Ω_qALC = Σ 2^(−|p|) μ_p`), frozen and amended: four review +rounds concluded in a sign-off at `27f2c4b`, and the token-machine +amendment — route (b) after v1's no-cloning killshot — was ratified +through thread `qalc-architecture` and applied (2026-08-09). The +machine is IAM-lineage token transport: term read-only, +bideterministic substrate (exact λIAM table pinned in `token.md` §2), +values transported to δs by routing, never copied. The active design +and obligations register are `quantum-algebraic/token.md`; the failed +rewriting drafts (v0/v1) are preserved read-only in +`quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. **The kernel is at v1.15** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` diff --git a/docs/classical/architecture.md b/docs/classical/architecture.md index 1e28103..3ab53b6 100644 --- a/docs/classical/architecture.md +++ b/docs/classical/architecture.md @@ -161,7 +161,8 @@ accounting so repeated checks stay O(1) without changing meter charges. `src/classical/certificate/` is the trusted checker layer. `mod.rs` holds the pattern-term representation and the trusted checkers `verify`, `verify_htr`, -and `verify_selector` for Ratchet, HeadTowerRatchet, and SelectorRatchet. +`verify_selector`, and `verify_pdr` for Ratchet, HeadTowerRatchet, +SelectorRatchet, and PassengerDiagonalRatchet. `search_impl.rs` is untrusted discovery — public as `classical::certificate::search` only under the `lab` feature, compiled for tests otherwise — and `battery.rs` is the in-crate soundness battery, which @@ -361,7 +362,7 @@ all closed terms through 18 bits plus targeted deep vectors, and the two-phase scheduler is pinned against an unsplit one-pass sweep, size by size, through 28 bits. The certificate soundness battery passes 196,848 provable halters through the exact discovery ladder and requires zero certificate fires. All -297 canonical kills are additionally kernel-checked in Lean with wire-identity +305 canonical kills are additionally kernel-checked in Lean with wire-identity theorems. Independent Python tools remain deliberately separate where shared diff --git a/docs/classical/certificates/specification.md b/docs/classical/certificates/specification.md index d007c0a..518da95 100644 --- a/docs/classical/certificates/specification.md +++ b/docs/classical/certificates/specification.md @@ -1,11 +1,12 @@ # Ratchet certificates: mechanical divergence proofs for growing-context loops -Status: three classes live in `src/classical/certificate/` — trusted +Status: four classes live in `src/classical/certificate/` — trusted checkers in `mod.rs`, untrusted discovery in `search_impl.rs` (public as `classical::certificate::search` behind the `lab` feature, driven by `blam cert search`): -v1–v1.2 (§3), `HeadTowerRatchet` (§5), and `SelectorRatchet` (§6). -Section 8 specifies the planned v4 classes. All checkers are trusted and +v1–v1.2 (§3), `HeadTowerRatchet` (§5), `SelectorRatchet` (§6), and +`PassengerDiagonalRatchet` (§8.1, implemented 2026-08-08). +Section 8's remaining entries specify planned classes. All checkers are trusted and discovery is untrusted; every implemented assembly theorem is additionally **machine-checked in Lean** (`lean/Blc/{Ratchet,HeadTower,Selector,Rigid}.lean` — the last is the diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index 98e96a7..55a5ed0 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -1,7 +1,10 @@ # qALC machine — token-transport design -**Status: active design, pre-kernel; the sketch (§3) is hand-derived -and unverified.** The qALC machine is IAM-lineage token transport +**Status: active design; the §4 kernel gate is implemented as an +out-of-tree scratch kernel, registered current-only in `kernel.md` +and held in a fresh-context adversarial audit loop. No qALC code +lands until architecture §9's gates pass.** The qALC machine is +IAM-lineage token transport (architecture §8): the invocation term is immutable and read-only, the runtime basis is token configurations, and gate arguments reach δs by routing, never by copying. The rationale: the Interaction Abstract @@ -382,24 +385,30 @@ h (NOT′ (h 0̂)) — the coherence bar and a column-Gram enumeration over the small reachable graph, showing `NOT′` returns a boolean-independent spectator while the non-injective -map does not. If the kernel works, the route is genuinely promising; -if HH needs special-case stack erasure or H–NOT–H leaves distinct -log/tape states, the route has only relocated the rewriting -substrate's obstruction and the fork reopens. +map does not. The bar was: if HH needs special-case stack erasure or +H–NOT–H leaves distinct log/tape states, the route has only relocated +the rewriting substrate's obstruction and the fork reopens. **The bar +is met and exceeded** — the scratch kernel earns HH's mass-1 +cancellation through certified erasure and decode (no special cases), +runs H–NOT–H to its coherence ideal, keeps the negative witness +unmerged, and extends the Gram enumeration to a twenty-program suite +with a written-first physics table; the fork stays closed. The +verified state, claims, and audit history live in `kernel.md` (the +register alone carries the version). | Item | Status | |---|---| | Kernel | **v1.15** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6 and #7, exhaustive storage enumeration then an extended matrix). `W` healed at {1̂: 1} (audits 3–7 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage (unreachable certificate entries refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; nine-invariant WF; eleven permanent regressions, all gating the module exit code. **PASS re-claim gated on fresh audit #8** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | -| Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §11.7, §12.2, §13.3): the v1.5 fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is pop-err reachability + the RS-function property, strictly beyond Gram (negative control caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and as of v1.8 **self-validating**: the fixpoint is admitted only if its certified graph passes full semantic coverage, else None | -| Instance identity | **ratified and discharged, interleaving included** (`kernel.md` §13.4, §14): lp-at-log-head structural for signature-abstracted programs; equal-lps-same-copy backed by the `(g,i)`-aliasing regression, the `dup` witness, and now the `frame-conflict` typed guard; the interleaved re-seek has semantics via the replay record — `Q`, `weave`, `hweave`, and `qq` all total, clean, and physical; v1.8 dissolves the audit's injectivity gap (aliasing manifestations are typed or value-correct — `frame-conflict`, `alien-ticket`, `refire`; lp uniqueness downgrades to a completeness conjecture) | -| Time register | **the coloring AND the conservation law are theorems** (`kernel.md` §11.1–11.2, §13.1): closed-form φ, uniform flip, certified-erasure defect `1 − w(erased lp)`; branch-offset formula verified; mark-free fire-free readback conserves `w ≡ slot` (proved: attribution ledger + coloring), so geometric selection of classical data decoheres intrinsically and every escape route is a named mechanism (interior-fire charge, VB pattern birth, mark capture) | +| Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §5): the fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is the hybrid validation — structural admission/isometry plus exact-amplitude dynamic cleanliness plus non-vacuity, strictly beyond Gram (negative controls caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and **self-validating**: every admitted map passes full semantic coverage, else None | +| Instance identity | **ratified and discharged, interleaving included** (`kernel.md` §4, §9): lp-at-log-head structural for signature-abstracted programs; equal-lps-same-copy backed by the `(g,i)`-aliasing regression, the `dup` witness, and the `frame-conflict` typed guard; the interleaved re-seek has semantics via the replay record — `Q`, `weave`, `hweave`, and `qq` all total, clean, and physical; the injectivity gap is dissolved into the registered alias-gap conditional (aliasing manifestations are typed or value-correct — `frame-conflict`, `alien-ticket`, `key-alias`, `refire`; W9 bounds live tickets; lp uniqueness stands as a completeness conjecture) | +| Time register | **the coloring AND the conservation law are theorems** (`kernel.md` §7.1–7.3): closed-form φ, uniform flip, certified-erasure defect `1 − w(erased lp)`; branch-offset formula verified; mark-free fire-free readback conserves `w ≡ slot` (proved: attribution ledger + coloring), so geometric selection of classical data decoheres intrinsically and every escape route is a named mechanism (interior-fire charge, VB pattern birth, mark capture) | | L1 arrival-residue determinacy | kernel-verified at `fire`; general proof open | | L2 pop timing / coherence return | confirmed for NOT′ (kernel); selector measured decoherent; mechanism understood via pattern-vs-step | | `call`/`recall`/`replay` structural domain disjointness | guards structural in v1.3 (instance + rs checks, buried-frame typed); formal table presentation still owed | | Probe-exit classification totality | open (kernel error rules are catch-alls) | | Readback controller | undesigned; kernel's root classifier is its 1-bit case | | `μ_p`/`Ω_qALC` on the token clock | pending readback design | -| Mandatory regressions | `p★`, 3-coin, `q`, `q′`, `q2`, `dup` — all total, Gram-clean, marginals correct; `q`-family certified runs halt frame-free with arrival telemetry 35/7/3 as the time-register record | +| Mandatory regressions | the twenty-program suite (twelve sectors, the audit witnesses, the interleaving stressors) — all total, Gram-clean, physics table passing; eleven permanent regressions gate the sweep's exit code; `q`-family certified runs halt frame-free with arrival telemetry 35/7/3 as the time-register record | | Bideterminism of §2 | verified vs arXiv:2002.05649 | From 48c4210c3bee2f2b40631a944924d89b01c9852b Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 18:38:44 -0400 Subject: [PATCH 040/107] =?UTF-8?q?qalc:=20v1.16=20=E2=80=94=20key-level?= =?UTF-8?q?=20non-vacuity;=20the=20admission=20claim=20stated=20honestly?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #8 (fresh instance): FAIL, third consecutive round with zero machine countermodels — the three-way None sentence CONFIRMED return-by-return, all eleven gates forced individually, the subtraction's fourth confirmation (24-combination cross), palpha + W hand-recomputed. The genuine finding: non-vacuity was position-level only — a ghost popkey at HH's frameless canonical boundary validated clean while constraining nothing (reproduced sharper than the audit stated), and the never-vacuous proof cited settle() for phase-1-only maps that never call it. v1.16, predictions-first (all HELD with exactly the declared deltas): vacuous_keys joins validate() — every popkey must occur in an arrival frame at its certified position; machine_coverage requires zero at both levels; the two-case proof corrected (phase-1 maps take keys from the converged arrivals, everything else via settle). Twelfth permanent regression (ghost-key), gated. The admission claim now says exactly what the code does; the physics preamble names its machine-measured row; inventory and contract docstrings corrected. Register, STATUS, token.md, ledger updated. Fresh audit #9 launched; the PASS re-claim stays gated on it. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 27 +++++++----- docs/ledger/2026-08.md | 52 ++++++++++++++++++++++ docs/quantum-algebraic/kernel.md | 76 +++++++++++++++++++++----------- docs/quantum-algebraic/token.md | 4 +- 4 files changed, 119 insertions(+), 40 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 660f0bc..3ff698d 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,37 +413,40 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.15** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.16** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after -seven fresh-context rounds: the machine core has not moved since -the v1.11 spectator-transition fix, and the last TWO rounds found -zero machine countermodels — audits #6 and #7 together confirmed +eight fresh-context rounds: the machine core has not moved since +the v1.11 spectator-transition fix, and the last THREE rounds +found zero machine countermodels — audits #6 through #8 confirmed the completed KD subtraction sound (exhaustive post-fire storage enumeration, then an extended matrix: nested slice-cargo tickets, tickets inside unrelated burials, ANS, frozen instance names), hand-recomputed `palpha` ({1/4, 3/4}) and `W` ({halt1: 1}, refire -amplitudes exactly zero per-step), and verified the rescue's -full-pool construction and determinism. What the rounds still +amplitudes exactly zero per-step), verified the rescue's +full-pool construction and determinism, traced the three-way +canonical-None sentence return-by-return, and forced every +regression gate individually. What the rounds still found was claim-language and scaffolding, each fixed the same -day: all eleven permanent regressions now gate mechanically (the +day: all twelve permanent regressions now gate mechanically (the module verdict is the exit code — forcing any single regression false exits nonzero, measured); `validate()` gained NON-VACUITY -(a certificate entry at an unreachable position fails +at both levels (an entry at an unreachable position and a ghost +popkey occurring in no arrival frame each fail `machine_coverage` instead of being silently ignored — canonical -maps are never vacuous by construction); the canonical-None +maps carry zero by the corrected two-case proof); the canonical-None sentence is exact in three disjuncts (cap/nonconvergence exit, empty admission, pool pass accepting nothing); output-identity claims are scoped to deterministic fields. Nineteen frozen dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor -minimal; physics table passes on all twenty; all seven prior -audit kits rerun with exactly the declared deltas; every v1.15 +minimal; physics table passes on all twenty; all prior audit +kits rerun with exactly the declared deltas; every v1.16 prediction held (provenance in the scratchpad prediction files). The open docket, in order: -1. **fresh-context independent audit #8 of the v1.15 h-fragment +1. **fresh-context independent audit #9 of the v1.16 h-fragment claim** (running; verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 785f5b8..85e329e 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2895,3 +2895,55 @@ typecheck byte-identical, certify and the kits differing only by the declared field, conservation only by its timing suffix. Register, STATUS, token.md updated; fresh audit #8 launched — the PASS re-claim stays gated on it. + +## 2026-08-09 — qALC kernel v1.16: ghost keys refused, and the docs come along + +(Also this date: the repo-wide docs decruft pass a9 asked for — +README gains the qALC third-pillar paragraph and loses the stale +three-class/297-kill/old-Ω numbers; AGENTS.md's qALC paragraph +catches up with the kernel's existence; token.md drops +"pre-kernel", records the §4 gate as met and exceeded, and has its +obligations rows repointed off dead register sections; classical +architecture/specification pick up verify_pdr and the four-class +count. Committed separately as 0371337.) + +Fresh audit #8 (independent instance, sol tier, the v1.15 pack) +returned FAIL — the THIRD consecutive round with zero machine +countermodels, and the first in which every mechanism the previous +round added was itself confirmed: the three-way None sentence +traced return-by-return (the two trailing defensive re-validations +adjudicated unreachable-failure by determinism), all eleven +regression gates forced individually to exit 1, the subtraction +confirmed a fourth time by a 24-combination cross, palpha and W +hand-recomputed again. The genuine finding: non-vacuity was +position-level only. Reproduced sharper than stated — HH's +canonical boundary is cargo-only, carrying NO arrival frames, so +ANY popkey there is a ghost: adding a genuinely reachable instance +key to the popkeys validated clean while constraining nothing. And +the register's never-vacuous proof cited settle() for maps that +never call it (HH's certificate is its phase-1 fixpoint). The +honesty findings: an "exactly two deltas" count that was four, the +"validated clean at admission" phrasing overstating structural +phase 1, a physics preamble omitting that dupcall's row is +machine-measured, an inventory listing 18 of 20 programs, and +stale WF∧W7∧W8 contracts in three docstrings. + +v1.16, predictions written first: KEY-level non-vacuity joins +validate() — every popkey must occur in some arrival frame at its +certified position, counted in vacuous_keys, machine_coverage +requires zero — with the corrected two-case never-vacuous proof +(phase-1 maps take positions AND keys from the converged arrivals; +every other acceptance passes through settle, which recomputes +popkeys from the arrivals it enforces); the twelfth permanent +regression pins the ghost-key refusal; the admission claim now +says exactly what happens (phase-2/rescue acceptances validate at +acceptance, phase 1 admits structurally, and nothing is ever +returned without the assembled map passing full validation); the +preamble names its three provenance categories; the docstrings +match the code. Every prediction held with exactly the declared +deltas — canonical maps all carry vacuous_keys 0, the ghost probe +flips to refused, the exploratory-rejection rows still fail by +their documented dynamic reasons (the new check did not intersect +their path), suite/polarity/typecheck byte-identical, forced-false +drives exit 1. Register, STATUS, token.md updated; fresh audit #9 +launched — the PASS re-claim stays gated on it. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 7f8f8f5..92f6ff0 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.15.** The kernel is a scratch superposition evolver +**Status: v1.16.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -16,7 +16,7 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #8**, whose +The standing PASS re-claim is **gated on fresh audit #9**, whose verdict will be registered here. This file is the current contract and register only. The @@ -313,20 +313,29 @@ maximal nor minimal is claimed**. Smaller clean certificates with identical physics exist (measured: `W` reaches `{halt1: 1}` with the single ∅-pop boundary `ffbbafffa`, basis 734 vs the canonical 498; `B` likewise with `ffbbfffa` alone), and the greedy order can -leave admissible boundaries unexplored. What IS claimed: every -admitted boundary was validated clean at admission, the map is a -deterministic function of the program, and the frozen values -reproduce bit-for-bit. Minimal (and maximal) canonical +leave admissible boundaries unexplored. What IS claimed (audit +#8 caught the earlier at-admission phrasing overstating phase 1, +which admits structurally): every phase-2 and rescue acceptance +passed full validation at acceptance, NO certificate is ever +returned without the assembled map passing full validation, the +map is a deterministic function of the program, and the frozen +values reproduce bit-for-bit. Minimal (and maximal) canonical certificates are docketed future work. **Validation** (`validate`) splits per the working-review verdict: the STRUCTURAL side — totality, Gram orthonormality on the structural reachable basis, unconditional transparency, reachable -⊆ WF∧W7∧W8∧W9, mechanized disjointness, and NON-VACUITY (audit -#7: a certified position with no boundary arrival is never -consulted, so `machine_coverage` refuses any map containing one; -canonical maps are never vacuous — `settle()` rejects any trial -whose position leaves the arrivals) — is mandatory and +⊆ WF∧W7∧W8∧W9, mechanized disjointness, and NON-VACUITY at both +levels (audits #7 and #8: a certified position with no boundary +arrival is never consulted, and a popkey occurring in no arrival +frame at its position can never pop anything — either entry +constrains nothing, and `machine_coverage` refuses maps +containing one. Canonical maps are never vacuous, by the two +paths into a frozen map: a phase-1 fixpoint map takes its +positions and keys directly from the converged arrivals, and +every other acceptance goes through `settle()`, which rejects +trials whose positions leave the arrivals and recomputes popkeys +from them) — is mandatory and isometry-bearing (orbit-norm preservation alone is NOT isometry: `T|0⟩ = T|1⟩ = |1⟩` holds norm 1 forever from `|0⟩` while collapsing columns). The DYNAMIC side — exact evolution of the @@ -341,7 +350,10 @@ semantics — no such total reference exists for bare λ-terms (the eliminator's physical reading — wire, measurement, garbage, promised uncomputation — is absent from the syntax); per-program physics expectations live in the suite's written-first table, each -marked hand-derived or audit-confirmed. What certification proves +marked hand-derived (audit-confirmed where noted) or — `dupcall` +only — machine-measured: no circuit reading exists for the untyped +refusal row, so it pins the measurement, not an ideal. What +certification proves is: **every admitted erasure has a checked reversible decoding from the retained coordinate and spectator state, and the resulting columns remain orthonormal** — not that the certificate @@ -569,7 +581,8 @@ semantics — no total reference exists for bare λ-terms; which eliminations are wires is the compilation theorem's question. Physics agreement is claimed program-by-program in the suite's written-first table (hand-derived circuit readings, several -independently confirmed by the audits). A user cannot tell from +independently confirmed by the audits; `dupcall`'s refusal row is +machine-measured, the one non-hand entry). A user cannot tell from `machine_coverage` alone whether a program's canonical placement reaches its circuit ideal — that adjudication lives in the physics table. Nor is the canonical certificate minimal or @@ -591,7 +604,7 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#8; the verdict will be registered here.** +#9; the verdict will be registered here.** ## 10. Verification state @@ -632,7 +645,7 @@ canonical dicts compared bit-for-bit; `dupcall` canonically None `h(Ω)` → None. Negative controls: pstar × wrong certificate reaches `pop-err`; dupcall × v1.7-era certificate reaches `refire`, all-err. WF/W7/W8/W9 sweeps + mechanized disjointness: -zero violations; **eleven permanent regressions** (the v1.6 pair; +zero violations; **twelve permanent regressions** (the v1.6 pair; extra-frame collision, W7-excluded with disjoint targets; doctored bundle divergence; K+frame alias; retained-Q disjointness — spectator-bit columns share zero targets; @@ -643,18 +656,22 @@ popped-frame + surviving ticket — the T-riding ticket stays the answerable representation, no KD, targets WF-clean; vacuous-position — a certificate entry at an unreachable position must fail `machine_coverage` while the canonical map -passes). The gating structure, stated exactly (audits #6 and #7 -each caught a computed-but-non-gating verdict): the v1.6 pair -gates `collisions_under_wf()`; the other nine gate +passes; ghost-key — an inert popkey occurring in no arrival +frame at its certified position must fail `machine_coverage`, +key-level non-vacuity). The gating structure, stated exactly +(audits #6 and #7 each caught a computed-but-non-gating +verdict; audit #8 forced all eleven then-regressions +individually and confirmed each drives exit 1): the v1.6 pair +gates `collisions_under_wf()`; the other ten gate `cert_sweep()`'s return; the module `__main__` conjoins all three sweeps in its printed total AND ITS EXIT CODE, so any single regression failure exits nonzero (measured: forcing the -pair false → exit 1; forcing a cert_sweep flag false → exit 1; +pair false → exit 1; forcing cert_sweep flags false → exit 1; the emulated-old-arm probe flips `cert_sweep` to FAIL). Conservation: exhaustive ≤ size 11, 14,452 surfacings at ≤10 / 55,727 at ≤11, zero failures. Polarity/terminal chains/gauge: zero violations, -orbit exact. All seven prior audits' independent reproducers +orbit exact. All eight prior audits' independent reproducers rerun clean or typed (audit #1's fuzz 250/250; audit #2's kit clean on every lifecycle, its term-evaluator mismatches adjudicated as that evaluator's non-normalization; audit #3's @@ -662,7 +679,8 @@ spectator columns share zero targets; audit #4's countermodel pair healed; audit #5's popped-frame countermodel healed; audit #6's gate probe flips as it must; audit #7's vacuity probe now refused, its cap counterexample matching the three-way None -sentence). Output identity across code changes is claimed for +sentence; audit #8's ghost-key probe now refused at the key +level). Output identity across code changes is claimed for DETERMINISTIC fields only: `conservation.py` prints a wall-clock suffix that varies run to run (audit #7 caught "byte-identical" overclaiming this), and adding a declared validation field @@ -687,10 +705,15 @@ determinism held under reversed traversal and six hash seeds; the subtraction re-confirmed over audit #7's extended matrix (recursively slice-nested tape/log tickets, tickets inside unrelated `K` burials, ANS carrying no instance, frozen instance -names not traversed, `vb` None at every fire target); the -full-pool construction verified correct (candidates captured -before phase-2 mutation, phase-1 entries persistent, sorted -order). Basis counts vs v1.2 reference: `negative` 103→83, +names not traversed, `vb` None at every fire target) and a +fourth time by audit #8's 24-combination cross of every death +mode against every retained compartment; the full-pool +construction verified correct (candidates captured before +phase-2 mutation, phase-1 entries persistent, sorted order); the +three-way None sentence traced return-by-return and CONFIRMED +(audit #8 — the two trailing defensive re-validations are +unreachable-failure by determinism of validate); all eleven +then-regression gates individually forced (audit #8). Basis counts vs v1.2 reference: `negative` 103→83, `selector` 173→106, `pstar` 458→242 — v1.7-era, real, owned; marginals and supports never moved. All measurements seconds-scale on the M5 Max. @@ -759,7 +782,8 @@ no bare-term ideal oracle). | v1.12 | the KD subtraction (Q frames + burials); W8 extended to bitfree ∩ burial; condition (e) compares the bundle actually left; register decrufted current-only; two new permanent regressions (nine total) | **fresh audit #5: FAIL** (subtraction missed T/log-surviving tickets; "maximal-certified" false on palpha; version cruft; healing + physics + regressions CONFIRMED) | | v1.13 | the COMPLETE subtraction (bundle names only keys with no surviving bit-carrying representation anywhere in the target — Q frames, burials, T/log tickets); phase-3 GREEDY RESCUE (a failing map is re-admitted greedily, not discarded — palpha certifies, guard-silent, marginal unchanged); "maximal" retracted to validation-adjudicated greedy; version strings unified (the register alone carries the version); tenth regression | **fresh audit #6: FAIL** (zero machine countermodels — subtraction CONFIRMED-SOUND by exhaustive storage enumeration, palpha + W hand-confirmed, 18 graphs zero diffs; regression ten non-gating; rescue claim stronger than its pool; "nothing reachable moved" false as written; version cruft) | | v1.14 | regression ten GATES the aggregate; rescue pool completed to phase-1 ∪ all phase-2 candidates (measured behavior-identical on the suite — the completion makes the None sentence exact); claim language restricted (moved-graphs claim scoped to the prior 18 + palpha at its certified values); stale version/audit text purged; every prediction of the round held byte-for-byte | **fresh audit #7: FAIL** (zero machine countermodels again — subtraction confirmed third time over an extended matrix, Pα + W hand-recomputed, pool construction verified; None sentence omitted cap exits; validate() vacuously satisfiable at unreachable positions; v1.6 pair non-gating; "byte-identical" false vs the conservation timing suffix; two stale register phrases) | -| v1.15 | NON-VACUITY joins the structural side (`vacuous_positions`, machine_coverage refuses unreachable entries — canonical maps never vacuous by settle()'s guarantee); the None sentence exact in three disjuncts (cap/nonconvergence; empty admission; pool pass accepting nothing); eleventh regression (vacuous-position) gated; the module verdict is the EXIT CODE (any single regression failure exits nonzero, measured); title de-cruffed to "qALC kernel"; output-identity claims scoped to deterministic fields; every prediction held with exactly the declared deltas | **fresh audit #8: pending** | +| v1.15 | NON-VACUITY joins the structural side (`vacuous_positions`, machine_coverage refuses unreachable entries — canonical maps never vacuous by settle()'s guarantee); the None sentence exact in three disjuncts (cap/nonconvergence; empty admission; pool pass accepting nothing); eleventh regression (vacuous-position) gated; the module verdict is the EXIT CODE (any single regression failure exits nonzero, measured); title de-cruffed to "qALC kernel"; output-identity claims scoped to deterministic fields; every prediction held with exactly the declared deltas | **fresh audit #8: FAIL** (zero machine countermodels, third straight — None sentence and all eleven gates CONFIRMED, subtraction fourth confirmation, Pα + W hand-recomputed; non-vacuity position-level only: ghost popkeys validate clean; settle() proof wrong for phase-1-only maps; four honesty findings) | +| v1.16 | KEY-level non-vacuity (`vacuous_keys`: every popkey must occur in an arrival frame at its position; ghost popkeys refused; canonical maps carry zero by the corrected two-case proof — phase-1 maps take keys from the converged arrivals, all other acceptances via settle()); twelfth regression (ghost-key), gated; the admission claim stated honestly (phase-2/rescue validate at acceptance, phase 1 is structural, nothing returns unvalidated); physics-table preamble names the machine-measured row; inventory and contract docstrings corrected; every prediction held with exactly the declared deltas | **fresh audit #9: pending** | ## 12. Appendix — HH step-indexed trace diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index 55a5ed0..1176f08 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -398,7 +398,7 @@ register alone carries the version). | Item | Status | |---|---| -| Kernel | **v1.15** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6 and #7, exhaustive storage enumeration then an extended matrix). `W` healed at {1̂: 1} (audits 3–7 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage (unreachable certificate entries refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; nine-invariant WF; eleven permanent regressions, all gating the module exit code. **PASS re-claim gated on fresh audit #8** | +| Kernel | **v1.16** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#8: exhaustive storage enumeration, an extended matrix, a 24-combination cross). `W` healed at {1̂: 1} (audits 3–8 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; nine-invariant WF; twelve permanent regressions, all gating the module exit code. **PASS re-claim gated on fresh audit #9** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §5): the fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is the hybrid validation — structural admission/isometry plus exact-amplitude dynamic cleanliness plus non-vacuity, strictly beyond Gram (negative controls caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and **self-validating**: every admitted map passes full semantic coverage, else None | @@ -410,5 +410,5 @@ register alone carries the version). | Probe-exit classification totality | open (kernel error rules are catch-alls) | | Readback controller | undesigned; kernel's root classifier is its 1-bit case | | `μ_p`/`Ω_qALC` on the token clock | pending readback design | -| Mandatory regressions | the twenty-program suite (twelve sectors, the audit witnesses, the interleaving stressors) — all total, Gram-clean, physics table passing; eleven permanent regressions gate the sweep's exit code; `q`-family certified runs halt frame-free with arrival telemetry 35/7/3 as the time-register record | +| Mandatory regressions | the twenty-program suite (twelve sectors, the audit witnesses, the interleaving stressors) — all total, Gram-clean, physics table passing; twelve permanent regressions gate the sweep's exit code; `q`-family certified runs halt frame-free with arrival telemetry 35/7/3 as the time-register record | | Bideterminism of §2 | verified vs arXiv:2002.05649 | From 41df238cfd5707763c734409ec0683136899cafe Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 19:01:02 -0400 Subject: [PATCH 041/107] =?UTF-8?q?qalc:=20v1.17=20=E2=80=94=20=C2=A77.1?= =?UTF-8?q?=20states=20the=20theorem=20its=20checker=20enforces;=20KD=20jo?= =?UTF-8?q?ins=20the=20gauge=20sweep?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #9 (fresh instance): FAIL, fourth consecutive round with zero machine countermodels — and the first where every mechanical charge returned CONFIRMED-SOUND (subtraction fifth confirmation, two-level non-vacuity sharp, rescue determinism, all twelve gates forced, palpha + W by hand, delta enumeration exact). The sole finding was §7.1, the register's v1.6-era prose: the displayed coloring formula omitted Σw(KS) (six reachable witness edges); 'every fire has defect 1−w(l)' conflated conservative fire (ordinary flip) with certified erasure; the 256-assignment gauge sweep asserted KD's zero weight rather than enumerating it. The checker was honest the whole time — the shipped polarity output already printed the separating witnesses. v1.17, predictions-first (all HELD): §7.1 restated to exactly the mechanized theorem (formula + weight table + flip statement with the pinned-gauge caveat and parametrized form); the gauge sweep enumerates nine mark weights — 4/512, same orbit, KD pinned 0 by measurement; the ghost regression prints its count. phi(), w(), and every certificate untouched; only the gauge and ghost lines move in any output. Register, STATUS, token.md, ledger updated. Fresh audit #10 launched; the PASS re-claim stays gated on it. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 21 +++++++++----- docs/ledger/2026-08.md | 44 ++++++++++++++++++++++++++++ docs/quantum-algebraic/kernel.md | 50 +++++++++++++++++++++----------- docs/quantum-algebraic/token.md | 4 +-- 4 files changed, 93 insertions(+), 26 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 3ff698d..23b52c8 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,12 +413,12 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.16** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.17** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after -eight fresh-context rounds: the machine core has not moved since -the v1.11 spectator-transition fix, and the last THREE rounds -found zero machine countermodels — audits #6 through #8 confirmed +nine fresh-context rounds: the machine core has not moved since +the v1.11 spectator-transition fix, and the last FOUR rounds +found zero machine countermodels — audits #6 through #9 confirmed the completed KD subtraction sound (exhaustive post-fire storage enumeration, then an extended matrix: nested slice-cargo tickets, tickets inside unrelated burials, ANS, frozen instance names), @@ -426,7 +426,14 @@ hand-recomputed `palpha` ({1/4, 3/4}) and `W` ({halt1: 1}, refire amplitudes exactly zero per-step), verified the rescue's full-pool construction and determinism, traced the three-way canonical-None sentence return-by-return, and forced every -regression gate individually. What the rounds still +regression gate individually. Audit #9's sole finding was the +register's OLDEST prose: §7.1 misstated the mechanized coloring +theorem (the formula omitted the KS weight term its checker +carries; the flip theorem conflated conservative fire with +certified erasure; the gauge sweep asserted rather than +enumerated the KD weight) — restated in v1.17 to exactly the +theorem polarity.py enforces, with the sweep extended to 4/512 +and KD pinned zero by measurement rather than assertion. What the rounds still found was claim-language and scaffolding, each fixed the same day: all twelve permanent regressions now gate mechanically (the module verdict is the exit code — forcing any single regression @@ -441,12 +448,12 @@ claims are scoped to deterministic fields. Nineteen frozen dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; physics table passes on all twenty; all prior audit -kits rerun with exactly the declared deltas; every v1.16 +kits rerun with exactly the declared deltas; every v1.17 prediction held (provenance in the scratchpad prediction files). The open docket, in order: -1. **fresh-context independent audit #9 of the v1.16 h-fragment +1. **fresh-context independent audit #10 of the v1.17 h-fragment claim** (running; verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 85e329e..4dfd296 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2947,3 +2947,47 @@ their documented dynamic reasons (the new check did not intersect their path), suite/polarity/typecheck byte-identical, forced-false drives exit 1. Register, STATUS, token.md updated; fresh audit #9 launched — the PASS re-claim stays gated on it. + +## 2026-08-09 — qALC kernel v1.17: the coloring theorem says what its checker checks + +Fresh audit #9 (independent instance, sol tier, the v1.16 pack) +returned FAIL — the FOURTH consecutive round with zero machine +countermodels, and the first in which every mechanical charge came +back CONFIRMED-SOUND: the subtraction's fifth confirmation (33 +W1–W9-clean combinations), two-level non-vacuity sharp on both +probes (with twelve canonical maps verified phase-1-only against +their own recomputed arrivals), rescue determinism under reversed +traversals, all twelve regression gates individually forced, +palpha and W by hand, and v1.16's exact delta enumeration verified +to the field. The one genuine finding was the register's oldest +prose — §7.1, written at v1.6, never before audited this hard: +the displayed φ formula omitted the Σw(KS) term its own +executable carries (six reachable witness edges across Ccoll and +dupcall where the displayed formula predicts delta 0 and the +mechanized theorem requires 1); the flip theorem said every fire +has defect 1−w(l) when the checker reserves that for CERTIFIED +erasure and expects conservative retain-whole fire to flip +ordinarily (Ccoll's two conservative fires, w(l)=1 with delta 1, +were sitting in the shipped polarity output as "w=1:d=1 ×2" the +whole time — the checker was honest, the prose was not); and the +"256 assignments" gauge sweep never enumerated KD as a mark +weight. Plus one wording nit: the ghost probe's nonzero +vacuous_keys appeared in no saved output. + +v1.17, predictions written first: §7.1 restated to exactly the +theorem polarity.py enforces — the formula gains Σw(KS) with +w(K₂(l)) = w(l) and w(K₃) = w(KD) = 0; uniform flip on every +Run→Run rule INCLUDING conservative fire, certified erasure the +sole exception at 1 − w(l) in the pinned gauge (parametrized form +named); Ccoll's separating witnesses registered. The gauge sweep +extends to nine parameters: 4/512, the same four-element orbit, +every survivor pinning KD at 0 — enumerated now, not asserted. +The ghost regression prints its count. phi(), w(), and every +certificate untouched; suite/certify/typecheck byte-identical, +polarity moves only in the gauge line, wf only in the ghost line, +all six kits byte-identical. One process note kept for +provenance: the first edit pass on polarity.py silently no-opped +two replacements and the sweep's own MISMATCH print caught it on +the first measured run, before anything was registered. Register, +STATUS, token.md updated; fresh audit #10 launched — the PASS +re-claim stays gated on it. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 92f6ff0..2e68678 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.16.** The kernel is a scratch superposition evolver +**Status: v1.17.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -16,7 +16,7 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #9**, whose +The standing PASS re-claim is **gated on fresh audit #10**, whose verdict will be registered here. This file is the current contract and register only. The @@ -430,21 +430,32 @@ the machine's unitarity claims quantify over the subtype: ### 7.1 The coloring (closed form + uniform flip) ```text -φ(s) = depth(pos) + [d = ↑] + Σ w(tape) + Σ w(log) + Σ w(RS) + k_VB (mod 2) +φ(s) = depth(pos) + [d = ↑] + Σ w(tape) + Σ w(log) + Σ w(RS) + + Σ w(KS) + k_VB (mod 2) w(•) = w(γ) = w(μ) = w(α) = w(ρ) = w(R) = 0; w(A) = 1 w(l) for l = (occ, slice) = (depth(occ) − depth(binder)) + Σ w(slice) +w(K₂(l)) = w(l) — a retained-whole spectator record carries its + lp's weight; w(K₃) = w(KD) = 0 ``` -**Theorem (uniform flip).** Every Run→Run rule flips φ EXCEPT -`fire`, whose defect is exactly `1 − w(l)` for the erased/decoded -arrival lp. Proof is per-row algebra; the load-bearing case is -`var`/`bt2` (the teleport's distance is absorbed by the lp carrying -it as weight). Mechanically verified on every reachable Run→Run -edge of the battery, zero violations; every fire edge's measured -defect equals `1 − w(l)`. The weight assignment is **gauge-pinned**: -of all 256 assignments over the mark alphabet, exactly the -4-element orbit generated by two symmetries survives, and the orbit -fixes every deployed consequence. +**Theorem (uniform flip).** Every Run→Run rule flips φ — +INCLUDING the conservative retain-whole fire — EXCEPT +CERTIFIED-erasure fire, whose delta in the pinned gauge is +exactly `1 − w(l)` for the erased arrival lp (the sweep's +parametrized form is `1 − w(l) − F·w(R)` with `F` the popped +frame count; `w(R) = 0` in the pinned gauge). Proof is per-row +algebra; the load-bearing case is `var`/`bt2` (the teleport's +distance is absorbed by the lp carrying it as weight). +Mechanically verified on every reachable Run→Run edge of the +battery, zero violations. The separating witnesses the previous +phrasing got wrong (audit #9): `Ccoll`'s two reachable +conservative fires have `w(l) = 1` and delta 1 — an ordinary +flip, not a `1 − w(l)` defect — and the Σ w(KS) term decides six +reachable edges (two in `Ccoll`, four in `dupcall`). The weight +assignment is **gauge-pinned**: of all 512 assignments over the +mark alphabet INCLUDING the KD weight, exactly the 4-element +orbit generated by two symmetries survives — every survivor +fixes KD at 0 — and the orbit fixes every deployed consequence. ### 7.2 The branch-offset law @@ -604,7 +615,7 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#9; the verdict will be registered here.** +#10; the verdict will be registered here.** ## 10. Verification state @@ -671,7 +682,9 @@ the emulated-old-arm probe flips `cert_sweep` to FAIL). Conservation: exhaustive ≤ size 11, 14,452 surfacings at ≤10 / 55,727 at ≤11, zero failures. Polarity/terminal chains/gauge: zero violations, -orbit exact. All eight prior audits' independent reproducers +orbit exact — 4/512 with the KD weight enumerated (audit #9 +caught the 8-parameter sweep asserting KD's zero rather than +enumerating it), every survivor fixing KD at 0. All nine prior audits' independent reproducers rerun clean or typed (audit #1's fuzz 250/250; audit #2's kit clean on every lifecycle, its term-evaluator mismatches adjudicated as that evaluator's non-normalization; audit #3's @@ -680,7 +693,9 @@ pair healed; audit #5's popped-frame countermodel healed; audit #6's gate probe flips as it must; audit #7's vacuity probe now refused, its cap counterexample matching the three-way None sentence; audit #8's ghost-key probe now refused at the key -level). Output identity across code changes is claimed for +level; audit #9's COLORING probe stands as evidence of the +pre-v1.17 §7.1 phrasing — its six witness edges are decided +correctly by the mechanized theorem, which §7.1 now states). Output identity across code changes is claimed for DETERMINISTIC fields only: `conservation.py` prints a wall-clock suffix that varies run to run (audit #7 caught "byte-identical" overclaiming this), and adding a declared validation field @@ -783,7 +798,8 @@ no bare-term ideal oracle). | v1.13 | the COMPLETE subtraction (bundle names only keys with no surviving bit-carrying representation anywhere in the target — Q frames, burials, T/log tickets); phase-3 GREEDY RESCUE (a failing map is re-admitted greedily, not discarded — palpha certifies, guard-silent, marginal unchanged); "maximal" retracted to validation-adjudicated greedy; version strings unified (the register alone carries the version); tenth regression | **fresh audit #6: FAIL** (zero machine countermodels — subtraction CONFIRMED-SOUND by exhaustive storage enumeration, palpha + W hand-confirmed, 18 graphs zero diffs; regression ten non-gating; rescue claim stronger than its pool; "nothing reachable moved" false as written; version cruft) | | v1.14 | regression ten GATES the aggregate; rescue pool completed to phase-1 ∪ all phase-2 candidates (measured behavior-identical on the suite — the completion makes the None sentence exact); claim language restricted (moved-graphs claim scoped to the prior 18 + palpha at its certified values); stale version/audit text purged; every prediction of the round held byte-for-byte | **fresh audit #7: FAIL** (zero machine countermodels again — subtraction confirmed third time over an extended matrix, Pα + W hand-recomputed, pool construction verified; None sentence omitted cap exits; validate() vacuously satisfiable at unreachable positions; v1.6 pair non-gating; "byte-identical" false vs the conservation timing suffix; two stale register phrases) | | v1.15 | NON-VACUITY joins the structural side (`vacuous_positions`, machine_coverage refuses unreachable entries — canonical maps never vacuous by settle()'s guarantee); the None sentence exact in three disjuncts (cap/nonconvergence; empty admission; pool pass accepting nothing); eleventh regression (vacuous-position) gated; the module verdict is the EXIT CODE (any single regression failure exits nonzero, measured); title de-cruffed to "qALC kernel"; output-identity claims scoped to deterministic fields; every prediction held with exactly the declared deltas | **fresh audit #8: FAIL** (zero machine countermodels, third straight — None sentence and all eleven gates CONFIRMED, subtraction fourth confirmation, Pα + W hand-recomputed; non-vacuity position-level only: ghost popkeys validate clean; settle() proof wrong for phase-1-only maps; four honesty findings) | -| v1.16 | KEY-level non-vacuity (`vacuous_keys`: every popkey must occur in an arrival frame at its position; ghost popkeys refused; canonical maps carry zero by the corrected two-case proof — phase-1 maps take keys from the converged arrivals, all other acceptances via settle()); twelfth regression (ghost-key), gated; the admission claim stated honestly (phase-2/rescue validate at acceptance, phase 1 is structural, nothing returns unvalidated); physics-table preamble names the machine-measured row; inventory and contract docstrings corrected; every prediction held with exactly the declared deltas | **fresh audit #9: pending** | +| v1.16 | KEY-level non-vacuity (`vacuous_keys`: every popkey must occur in an arrival frame at its position; ghost popkeys refused; canonical maps carry zero by the corrected two-case proof — phase-1 maps take keys from the converged arrivals, all other acceptances via settle()); twelfth regression (ghost-key), gated; the admission claim stated honestly (phase-2/rescue validate at acceptance, phase 1 is structural, nothing returns unvalidated); physics-table preamble names the machine-measured row; inventory and contract docstrings corrected; every prediction held with exactly the declared deltas | **fresh audit #9: FAIL** (zero machine countermodels, fourth straight — every mechanical charge CONFIRMED incl. all twelve gates and both non-vacuity levels; §7.1 misstated the mechanized coloring theorem: formula omitted Σw(KS), defect sentence conflated conservative fire with certified erasure, gauge sweep asserted rather than enumerated KD) | +| v1.17 | §7.1 restated to the theorem the checker enforces (φ gains Σw(KS) with w(K₂(l)) = w(l), w(K₃) = w(KD) = 0; uniform flip INCLUDING conservative fire, certified erasure the sole exception at 1 − w(l) pinned-gauge, parametrized form named; Ccoll's separating witnesses registered); the gauge sweep enumerates KD — 4/512, orbit unchanged, KD pinned 0 by measurement; the ghost regression prints its nonzero count; phi(), w(), and every certificate untouched | **fresh audit #10: pending** | ## 12. Appendix — HH step-indexed trace diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index 1176f08..3bf2cb0 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -398,12 +398,12 @@ register alone carries the version). | Item | Status | |---|---| -| Kernel | **v1.16** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#8: exhaustive storage enumeration, an extended matrix, a 24-combination cross). `W` healed at {1̂: 1} (audits 3–8 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; nine-invariant WF; twelve permanent regressions, all gating the module exit code. **PASS re-claim gated on fresh audit #9** | +| Kernel | **v1.17** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–9 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; nine-invariant WF; twelve permanent regressions, all gating the module exit code. **PASS re-claim gated on fresh audit #10** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §5): the fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is the hybrid validation — structural admission/isometry plus exact-amplitude dynamic cleanliness plus non-vacuity, strictly beyond Gram (negative controls caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and **self-validating**: every admitted map passes full semantic coverage, else None | | Instance identity | **ratified and discharged, interleaving included** (`kernel.md` §4, §9): lp-at-log-head structural for signature-abstracted programs; equal-lps-same-copy backed by the `(g,i)`-aliasing regression, the `dup` witness, and the `frame-conflict` typed guard; the interleaved re-seek has semantics via the replay record — `Q`, `weave`, `hweave`, and `qq` all total, clean, and physical; the injectivity gap is dissolved into the registered alias-gap conditional (aliasing manifestations are typed or value-correct — `frame-conflict`, `alien-ticket`, `key-alias`, `refire`; W9 bounds live tickets; lp uniqueness stands as a completeness conjecture) | -| Time register | **the coloring AND the conservation law are theorems** (`kernel.md` §7.1–7.3): closed-form φ, uniform flip, certified-erasure defect `1 − w(erased lp)`; branch-offset formula verified; mark-free fire-free readback conserves `w ≡ slot` (proved: attribution ledger + coloring), so geometric selection of classical data decoheres intrinsically and every escape route is a named mechanism (interior-fire charge, VB pattern birth, mark capture) | +| Time register | **the coloring AND the conservation law are theorems** (`kernel.md` §7.1–7.3; §7.1 restated at v1.17 to the exact mechanized form — Σw(KS) in the formula, conservative fire flips ordinarily, gauge orbit 4/512 with KD enumerated): closed-form φ, uniform flip, certified-erasure defect `1 − w(erased lp)`; branch-offset formula verified; mark-free fire-free readback conserves `w ≡ slot` (proved: attribution ledger + coloring), so geometric selection of classical data decoheres intrinsically and every escape route is a named mechanism (interior-fire charge, VB pattern birth, mark capture) | | L1 arrival-residue determinacy | kernel-verified at `fire`; general proof open | | L2 pop timing / coherence return | confirmed for NOT′ (kernel); selector measured decoherent; mechanism understood via pattern-vs-step | | `call`/`recall`/`replay` structural domain disjointness | guards structural in v1.3 (instance + rs checks, buried-frame typed); formal table presentation still owed | From bd887cce23035234b8ddce32f2f9b82188a0046b Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 19:23:51 -0400 Subject: [PATCH 042/107] =?UTF-8?q?qalc:=20v1.18=20=E2=80=94=20the=20check?= =?UTF-8?q?er=20catches=20up=20to=20the=20register=20(popped-F);=20instrum?= =?UTF-8?q?ents=20gain=20verdicts?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #10 (fresh instance): FAIL, fifth consecutive clean-machine round — §7.2 and §7.3 CONFIRMED at symbol level (conservation additionally surviving an independent 131k-surfacing mid-run check), the displayed §7.1 formula verified against the executable on every reachable state. The finding inverted the loop's pattern for the first time: the register was RIGHT and the checker WRONG — §7.1 defines the certified-fire F as popped frames; the gauge sweep recorded total source frames including retained spectators (38 reachable witnesses, orbit-masked by w(R)=0). Plus instrument prose and print-only verdicts. v1.18, predictions-first (all HELD), entirely checker-side: collect() records the popped count (§7.1 unchanged); popped-F sweep 4/512, identical orbit; polarity docstring/comments state the current theorem and true HH/HNH weights; conservation pointers fixed; both instruments exit nonzero on any gated failure, branch-offset rows gating (forced-false measured exit 1 each); pack labels version-neutral. Every theorem in the register has now been audited symbol-by-symbol. Register, STATUS, token.md, ledger updated. Fresh audit #11 launched; the PASS re-claim stays gated on it. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 21 +++++++++----- docs/ledger/2026-08.md | 47 ++++++++++++++++++++++++++++++++ docs/quantum-algebraic/kernel.md | 20 ++++++++++---- docs/quantum-algebraic/token.md | 4 +-- 4 files changed, 77 insertions(+), 15 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 23b52c8..1c7447a 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,12 +413,12 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.17** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.18** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after -nine fresh-context rounds: the machine core has not moved since -the v1.11 spectator-transition fix, and the last FOUR rounds -found zero machine countermodels — audits #6 through #9 confirmed +ten fresh-context rounds: the machine core has not moved since +the v1.11 spectator-transition fix, and the last FIVE rounds +found zero machine countermodels — audits #6 through #10 confirmed the completed KD subtraction sound (exhaustive post-fire storage enumeration, then an extended matrix: nested slice-cargo tickets, tickets inside unrelated burials, ANS, frozen instance names), @@ -433,7 +433,14 @@ carries; the flip theorem conflated conservative fire with certified erasure; the gauge sweep asserted rather than enumerated the KD weight) — restated in v1.17 to exactly the theorem polarity.py enforces, with the sweep extended to 4/512 -and KD pinned zero by measurement rather than assertion. What the rounds still +and KD pinned zero by measurement rather than assertion. Audit +#10 then confirmed §7.2 and §7.3 at symbol level (conservation +additionally surviving an independent 131k-surfacing mid-run +check) and inverted the loop's pattern once: the register was +right and the checker wrong (the sweep recorded total frames +where §7.1 says popped — corrected checker-side in v1.18, same +orbit), so every theorem in the register has now been audited +symbol-by-symbol; the instruments all carry exit-code verdicts. What the rounds still found was claim-language and scaffolding, each fixed the same day: all twelve permanent regressions now gate mechanically (the module verdict is the exit code — forcing any single regression @@ -448,12 +455,12 @@ claims are scoped to deterministic fields. Nineteen frozen dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; physics table passes on all twenty; all prior audit -kits rerun with exactly the declared deltas; every v1.17 +kits rerun with exactly the declared deltas; every v1.18 prediction held (provenance in the scratchpad prediction files). The open docket, in order: -1. **fresh-context independent audit #10 of the v1.17 h-fragment +1. **fresh-context independent audit #11 of the v1.18 h-fragment claim** (running; verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 4dfd296..2767fe1 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -2991,3 +2991,50 @@ two replacements and the sweep's own MISMATCH print caught it on the first measured run, before anything was registered. Register, STATUS, token.md updated; fresh audit #10 launched — the PASS re-claim stays gated on it. + +## 2026-08-09 — qALC kernel v1.18: the checker catches up to the register + +Fresh audit #10 (independent instance, sol tier, the v1.17 pack) +returned FAIL — the FIFTH consecutive round with zero machine +countermodels. §7.2 and §7.3, the last register prose never put +under a hostile symbol-level lens, both survived: the branch- +offset law on 44 interior-fire-free fire pairs, and conservation +on the registered exhaustive sweep PLUS an independent check the +auditor built from 56,642 genuine mid-run configurations — +131,335 intermediate surfacings, 9,283 with nonempty L₀, zero +violations of Lemma A, Lemma B, or the theorem. The displayed +§7.1 formula was verified against the executable on every +reachable state. And then the loop's pattern inverted for the +first time: the finding was that the REGISTER was right and the +CHECKER was wrong. §7.1 defines the certified-fire F as the +POPPED frame count; the gauge sweep's collect() recorded the +source's total frame count — popped plus retained Q spectators — +with a sharp witness at canonical pstar's ffbba boundary (zero +popped, one retained) and 38 reachable certified edges across +seven programs. Numerically masked, since every surviving gauge +pins w(R)=0 and both variants return the identical four +assignments — but "branch for branch" exactness was false, on +the checker's side of the ledger. Plus instrument prose (the +polarity docstring still pre-v1.17; an HH/HNH comment claiming +weight-zero alpha arrivals where HNH's are weight-one lps; two +stale Sec-11.1 pointers; pack labels reading "under v1.15") and +a flag that polarity and conservation carry print-only verdicts +— the same class wf.py was twice FAILed for. + +v1.18, predictions written first, all checker-side (§7.1's text +stands unchanged): collect() records F as the popped count; +polarity's docstring/comments state the current theorem and the +true HH/HNH weights (0/0 and 1/1 — equal per program, which is +all the law needs); conservation's pointers repointed; both +instruments gain exit-code verdicts, with the branch-offset rows +gating polarity's (end-to-end forced-false measured exit 1 for +gauge, offset, and conservation violations); pack labels made +version-neutral. Every prediction held: popped-F sweep 4/512 +same orbit, per-program lines byte-identical, all seven kits +byte-identical, and the v117 kit's still-reported 38 mismatches +resolved on inspection as a version-independent fact about the +two definitions differing on spectator-retaining edges — exactly +why the recording had to pick the register's. Every theorem in +the register has now been audited symbol-by-symbol. Register, +STATUS, token.md updated; fresh audit #11 launched — the PASS +re-claim stays gated on it. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 2e68678..11e49bb 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.17.** The kernel is a scratch superposition evolver +**Status: v1.18.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -16,7 +16,7 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #10**, whose +The standing PASS re-claim is **gated on fresh audit #11**, whose verdict will be registered here. This file is the current contract and register only. The @@ -615,7 +615,7 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#10; the verdict will be registered here.** +#11; the verdict will be registered here.** ## 10. Verification state @@ -684,7 +684,7 @@ exhaustive ≤ size 11, 14,452 surfacings at ≤10 / 55,727 at ≤11, zero failures. Polarity/terminal chains/gauge: zero violations, orbit exact — 4/512 with the KD weight enumerated (audit #9 caught the 8-parameter sweep asserting KD's zero rather than -enumerating it), every survivor fixing KD at 0. All nine prior audits' independent reproducers +enumerating it), every survivor fixing KD at 0. All ten prior audits' independent reproducers rerun clean or typed (audit #1's fuzz 250/250; audit #2's kit clean on every lifecycle, its term-evaluator mismatches adjudicated as that evaluator's non-normalization; audit #3's @@ -695,7 +695,14 @@ refused, its cap counterexample matching the three-way None sentence; audit #8's ghost-key probe now refused at the key level; audit #9's COLORING probe stands as evidence of the pre-v1.17 §7.1 phrasing — its six witness edges are decided -correctly by the mechanized theorem, which §7.1 now states). Output identity across code changes is claimed for +correctly by the mechanized theorem, which §7.1 now states; +audit #10's F-parity probe stands as evidence that popped and +total frame counts differ on 38 spectator-retaining edges — +the recording now takes the register's popped count). The +polarity and conservation instruments carry exit-code verdicts +(audit #10 flagged their print-only totals; forced-false on any +gated component measured exit 1), and the §7.2 branch-offset +rows gate the polarity verdict. Output identity across code changes is claimed for DETERMINISTIC fields only: `conservation.py` prints a wall-clock suffix that varies run to run (audit #7 caught "byte-identical" overclaiming this), and adding a declared validation field @@ -799,7 +806,8 @@ no bare-term ideal oracle). | v1.14 | regression ten GATES the aggregate; rescue pool completed to phase-1 ∪ all phase-2 candidates (measured behavior-identical on the suite — the completion makes the None sentence exact); claim language restricted (moved-graphs claim scoped to the prior 18 + palpha at its certified values); stale version/audit text purged; every prediction of the round held byte-for-byte | **fresh audit #7: FAIL** (zero machine countermodels again — subtraction confirmed third time over an extended matrix, Pα + W hand-recomputed, pool construction verified; None sentence omitted cap exits; validate() vacuously satisfiable at unreachable positions; v1.6 pair non-gating; "byte-identical" false vs the conservation timing suffix; two stale register phrases) | | v1.15 | NON-VACUITY joins the structural side (`vacuous_positions`, machine_coverage refuses unreachable entries — canonical maps never vacuous by settle()'s guarantee); the None sentence exact in three disjuncts (cap/nonconvergence; empty admission; pool pass accepting nothing); eleventh regression (vacuous-position) gated; the module verdict is the EXIT CODE (any single regression failure exits nonzero, measured); title de-cruffed to "qALC kernel"; output-identity claims scoped to deterministic fields; every prediction held with exactly the declared deltas | **fresh audit #8: FAIL** (zero machine countermodels, third straight — None sentence and all eleven gates CONFIRMED, subtraction fourth confirmation, Pα + W hand-recomputed; non-vacuity position-level only: ghost popkeys validate clean; settle() proof wrong for phase-1-only maps; four honesty findings) | | v1.16 | KEY-level non-vacuity (`vacuous_keys`: every popkey must occur in an arrival frame at its position; ghost popkeys refused; canonical maps carry zero by the corrected two-case proof — phase-1 maps take keys from the converged arrivals, all other acceptances via settle()); twelfth regression (ghost-key), gated; the admission claim stated honestly (phase-2/rescue validate at acceptance, phase 1 is structural, nothing returns unvalidated); physics-table preamble names the machine-measured row; inventory and contract docstrings corrected; every prediction held with exactly the declared deltas | **fresh audit #9: FAIL** (zero machine countermodels, fourth straight — every mechanical charge CONFIRMED incl. all twelve gates and both non-vacuity levels; §7.1 misstated the mechanized coloring theorem: formula omitted Σw(KS), defect sentence conflated conservative fire with certified erasure, gauge sweep asserted rather than enumerated KD) | -| v1.17 | §7.1 restated to the theorem the checker enforces (φ gains Σw(KS) with w(K₂(l)) = w(l), w(K₃) = w(KD) = 0; uniform flip INCLUDING conservative fire, certified erasure the sole exception at 1 − w(l) pinned-gauge, parametrized form named; Ccoll's separating witnesses registered); the gauge sweep enumerates KD — 4/512, orbit unchanged, KD pinned 0 by measurement; the ghost regression prints its nonzero count; phi(), w(), and every certificate untouched | **fresh audit #10: pending** | +| v1.17 | §7.1 restated to the theorem the checker enforces (φ gains Σw(KS) with w(K₂(l)) = w(l), w(K₃) = w(KD) = 0; uniform flip INCLUDING conservative fire, certified erasure the sole exception at 1 − w(l) pinned-gauge, parametrized form named; Ccoll's separating witnesses registered); the gauge sweep enumerates KD — 4/512, orbit unchanged, KD pinned 0 by measurement; the ghost regression prints its nonzero count; phi(), w(), and every certificate untouched | **fresh audit #10: FAIL** (fifth straight clean-machine round; §7.2 + §7.3 CONFIRMED symbol-level incl. a 131k-surfacing independent conservation check; the inversion: the register was right, the checker wrong — F recorded total frames, not popped; instrument prose + print-only verdicts) | +| v1.18 | the checker catches up to the register: collect() records F as the POPPED count ((len(src.rs) − len(tgt.rs)) mod 2 — §7.1's text stands unchanged); polarity and conservation gain exit-code verdicts (branch-offset rows gating; forced-false measured exit 1); instrument docstrings/comments/pointers corrected (the HH/HNH weight comment now states 0/0 and 1/1); pack labels version-neutral; popped-F sweep 4/512, same orbit; every prediction held with the v117-kit caveat resolved on inspection | **fresh audit #11: pending** | ## 12. Appendix — HH step-indexed trace diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index 3bf2cb0..6ef9eeb 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -398,12 +398,12 @@ register alone carries the version). | Item | Status | |---|---| -| Kernel | **v1.17** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–9 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; nine-invariant WF; twelve permanent regressions, all gating the module exit code. **PASS re-claim gated on fresh audit #10** | +| Kernel | **v1.18** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–10 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; nine-invariant WF; twelve permanent regressions, all gating the module exit code. **PASS re-claim gated on fresh audit #11** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §5): the fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is the hybrid validation — structural admission/isometry plus exact-amplitude dynamic cleanliness plus non-vacuity, strictly beyond Gram (negative controls caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and **self-validating**: every admitted map passes full semantic coverage, else None | | Instance identity | **ratified and discharged, interleaving included** (`kernel.md` §4, §9): lp-at-log-head structural for signature-abstracted programs; equal-lps-same-copy backed by the `(g,i)`-aliasing regression, the `dup` witness, and the `frame-conflict` typed guard; the interleaved re-seek has semantics via the replay record — `Q`, `weave`, `hweave`, and `qq` all total, clean, and physical; the injectivity gap is dissolved into the registered alias-gap conditional (aliasing manifestations are typed or value-correct — `frame-conflict`, `alien-ticket`, `key-alias`, `refire`; W9 bounds live tickets; lp uniqueness stands as a completeness conjecture) | -| Time register | **the coloring AND the conservation law are theorems** (`kernel.md` §7.1–7.3; §7.1 restated at v1.17 to the exact mechanized form — Σw(KS) in the formula, conservative fire flips ordinarily, gauge orbit 4/512 with KD enumerated): closed-form φ, uniform flip, certified-erasure defect `1 − w(erased lp)`; branch-offset formula verified; mark-free fire-free readback conserves `w ≡ slot` (proved: attribution ledger + coloring), so geometric selection of classical data decoheres intrinsically and every escape route is a named mechanism (interior-fire charge, VB pattern birth, mark capture) | +| Time register | **the coloring AND the conservation law are theorems** (`kernel.md` §7.1–7.3; §7.1 restated at v1.17 to the exact mechanized form — Σw(KS) in the formula, conservative fire flips ordinarily, gauge orbit 4/512 with KD enumerated; §7.2/§7.3 audit-confirmed symbol-level, conservation incl. a 131k mid-run surfacing check): closed-form φ, uniform flip, certified-erasure defect `1 − w(erased lp)`; branch-offset formula verified; mark-free fire-free readback conserves `w ≡ slot` (proved: attribution ledger + coloring), so geometric selection of classical data decoheres intrinsically and every escape route is a named mechanism (interior-fire charge, VB pattern birth, mark capture) | | L1 arrival-residue determinacy | kernel-verified at `fire`; general proof open | | L2 pop timing / coherence return | confirmed for NOT′ (kernel); selector measured decoherent; mechanism understood via pattern-vs-step | | `call`/`recall`/`replay` structural domain disjointness | guards structural in v1.3 (instance + rs checks, buried-frame typed); formal table presentation still owed | From 71bc2da0b1eef8d714f40c6e0214f56e512e34cc Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 19:49:27 -0400 Subject: [PATCH 043/107] =?UTF-8?q?qalc:=20v1.19=20=E2=80=94=20deep=20W4;?= =?UTF-8?q?=20all=20six=20instruments=20gate;=20full=20decruft?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #11 (fresh instance): FAIL — the F correction CONFIRMED on 116 certified-fire edges and the machine core clean again; the finding was the last known checker gap: W4 read only top-level tape where the register forbids ANY same-instance ticket in a VB-active state. The auditor's slice-suspended countermodel passed wf() and produced a two-live-ticket W9 target in one vvar step (subtype not preserved; reachable nowhere in 1,250 searched graphs). Also: 'all four instruments gate' overcounted, three stale doc lines. v1.19, predictions-first (all HELD), with a9's decruft directive folded in: W4 searches live alpha keys deeply through tape and log slice cargo (the exact required repair); thirteenth gated regression + stripped no-over-tightening control; suite/certify/ typecheck join the exit-code verdicts (typecheck gains its printed fragment total, 17/20) — forced-false measured exit 1 on every gated component of every instrument; kernel.py doc lines fixed; two invalid docstring escapes fixed (one long-standing); stale-phrase sweep over all eight modules empty. Machine, certificates, graphs untouched. Register, STATUS, token.md, ledger updated. Fresh audit #12 launched; the PASS re-claim stays gated on it. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 18 ++++++++---- docs/ledger/2026-08.md | 43 ++++++++++++++++++++++++++++ docs/quantum-algebraic/kernel.md | 48 +++++++++++++++++++++----------- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 89 insertions(+), 22 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 1c7447a..9139c56 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,10 +413,10 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.18** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.19** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after -ten fresh-context rounds: the machine core has not moved since +eleven fresh-context rounds: the machine core has not moved since the v1.11 spectator-transition fix, and the last FIVE rounds found zero machine countermodels — audits #6 through #10 confirmed the completed KD subtraction sound (exhaustive post-fire storage @@ -440,7 +440,15 @@ check) and inverted the loop's pattern once: the register was right and the checker wrong (the sweep recorded total frames where §7.1 says popped — corrected checker-side in v1.18, same orbit), so every theorem in the register has now been audited -symbol-by-symbol; the instruments all carry exit-code verdicts. What the rounds still +symbol-by-symbol. Audit #11 confirmed the F correction on 116 +edges and found the last checker gap: W4 read only top-level +tape where the register says any same-instance ticket — v1.19 +makes it deep (the auditor's slice-suspended countermodel, +reachable nowhere in 1,250 searched graphs, is now flagged at +its source and frozen as the thirteenth gated regression), and +ALL SIX instruments now carry exit-code verdicts (suite, +certify, and typecheck joined; forced-false measured exit 1 on +every gated component). What the rounds still found was claim-language and scaffolding, each fixed the same day: all twelve permanent regressions now gate mechanically (the module verdict is the exit code — forcing any single regression @@ -455,12 +463,12 @@ claims are scoped to deterministic fields. Nineteen frozen dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; physics table passes on all twenty; all prior audit -kits rerun with exactly the declared deltas; every v1.18 +kits rerun with exactly the declared deltas; every v1.19 prediction held (provenance in the scratchpad prediction files). The open docket, in order: -1. **fresh-context independent audit #11 of the v1.18 h-fragment +1. **fresh-context independent audit #12 of the v1.19 h-fragment claim** (running; verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 2767fe1..ce3538f 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -3038,3 +3038,46 @@ why the recording had to pick the register's. Every theorem in the register has now been audited symbol-by-symbol. Register, STATUS, token.md updated; fresh audit #11 launched — the PASS re-claim stays gated on it. + +## 2026-08-09 — qALC kernel v1.19: W4 goes deep, every instrument gates, and the surface gets its full polish + +Fresh audit #11 (independent instance, sol tier, the v1.18 pack) +returned FAIL. The v1.18 F correction was CONFIRMED sharp — 116 +reachable certified-fire edges, target rs exactly Q, the length +difference exactly |P|, zero recording mismatches — and the +machine core re-confirmed once more. The finding, the first with +teeth since audit #8, was again a CHECKER gap: the register's W4 +forbids any same-instance ticket in a VB-active state, and wf.py +checked only top-level tape entries. The auditor's countermodel +(reproduced): a structurally valid HH VB(k=2) state with the +instance's ticket suspended in a logged position's slice cargo +passes wf() clean; the one legal vvar step re-emits the ticket +beside the virtual boolean's fresh interrogation — two live +same-key tickets, a W9 target from a WF source, the subtype not +preserved. Reachable nowhere: the twenty programs, 1,000 +generated graphs, and 250 candidates carry no instance of the +pattern. Also: "all four instruments gate" overcounted (suite +and certify exited 0 on forced FAIL prints; typecheck had +neither a gate nor a total), and three stale doc lines. + +v1.19, predictions written first, with a9's directive folded in +(a full decruft so the next adversarial run is as authoritative +as possible): W4's ticket clause searches live alpha keys deeply +through tape AND log slice cargo — the auditor's exact required +repair — with the countermodel frozen as the THIRTEENTH gated +regression beside a stripped control proving the deep check does +not over-tighten (and the full WF sweep confirming zero +reachable states excluded); ALL SIX instruments now carry +exit-code verdicts (typecheck gained its printed fragment total: +17/20 typable-h-only, every escape rejected), with forced-false +measured exit 1 end-to-end on every gated component; the +kernel.py cert-map and rs-set doc lines fixed; a stale-phrase +sweep over all eight modules came back empty. Two escape-sequence +warts surfaced and died in passing — one I introduced and caught +via the capture diff, one long-standing in conservation.py's +docstring that the recompile exposed. Every prediction held; the +v118 kit's suite-forcing probe was adjudicated a no-op (it +targets a line the gate refactor renamed — the end-to-end forced +tests are the valid evidence, declared in the pack). Register, +STATUS, token.md updated; fresh audit #12 launched — the PASS +re-claim stays gated on it. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 11e49bb..cd23277 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.18.** The kernel is a scratch superposition evolver +**Status: v1.19.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -16,7 +16,7 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #11**, whose +The standing PASS re-claim is **gated on fresh audit #12**, whose verdict will be registered here. This file is the current contract and register only. The @@ -389,9 +389,15 @@ the machine's unitarity claims quantify over the subtype: across ALL bit-carrying representations — frames, top-level and slice-suspended tickets on tape and log, and tickets buried in retained-whole `K(l)` records. -- **W4** (first-interrogation exclusivity): a VB-active state at - instance `i` holds no `i`-frame and no `i`-ticket (the guard - chain forces this). +- **W4** (first-interrogation exclusivity, DEEP as of v1.19): a + VB-active state at instance `i` holds no `i`-frame and no live + `i`-ticket anywhere on tape or log, deep through slice cargo. + The guard chain forces this on reachable states; the deep + clause additionally excludes the unreachable slice-suspended + configuration whose `vvar` step would re-emit a second live + same-key ticket (audit #11's subtype-preservation + countermodel — found reachable NOWHERE in the twenty programs, + 1,000 generated graphs, or 250 candidates). - **W5** (probe pairing): deep-counted γ (through lp slices and retained `K(l)` records; instance KEYS are frozen names, never counted) = #μ(tape) + #A(tape) — every in-flight probe's γ is @@ -615,7 +621,7 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#11; the verdict will be registered here.** +#12; the verdict will be registered here.** ## 10. Verification state @@ -656,7 +662,7 @@ canonical dicts compared bit-for-bit; `dupcall` canonically None `h(Ω)` → None. Negative controls: pstar × wrong certificate reaches `pop-err`; dupcall × v1.7-era certificate reaches `refire`, all-err. WF/W7/W8/W9 sweeps + mechanized disjointness: -zero violations; **twelve permanent regressions** (the v1.6 pair; +zero violations; **thirteen permanent regressions** (the v1.6 pair; extra-frame collision, W7-excluded with disjoint targets; doctored bundle divergence; K+frame alias; retained-Q disjointness — spectator-bit columns share zero targets; @@ -669,11 +675,13 @@ vacuous-position — a certificate entry at an unreachable position must fail `machine_coverage` while the canonical map passes; ghost-key — an inert popkey occurring in no arrival frame at its certified position must fail `machine_coverage`, -key-level non-vacuity). The gating structure, stated exactly +key-level non-vacuity; deep-W4 — a slice-suspended +same-instance ticket in a VB-active state must be flagged while +the stripped control stays clean). The gating structure, stated exactly (audits #6 and #7 each caught a computed-but-non-gating verdict; audit #8 forced all eleven then-regressions individually and confirmed each drives exit 1): the v1.6 pair -gates `collisions_under_wf()`; the other ten gate +gates `collisions_under_wf()`; the other eleven gate `cert_sweep()`'s return; the module `__main__` conjoins all three sweeps in its printed total AND ITS EXIT CODE, so any single regression failure exits nonzero (measured: forcing the @@ -684,7 +692,7 @@ exhaustive ≤ size 11, 14,452 surfacings at ≤10 / 55,727 at ≤11, zero failures. Polarity/terminal chains/gauge: zero violations, orbit exact — 4/512 with the KD weight enumerated (audit #9 caught the 8-parameter sweep asserting KD's zero rather than -enumerating it), every survivor fixing KD at 0. All ten prior audits' independent reproducers +enumerating it), every survivor fixing KD at 0. All eleven prior audits' independent reproducers rerun clean or typed (audit #1's fuzz 250/250; audit #2's kit clean on every lifecycle, its term-evaluator mismatches adjudicated as that evaluator's non-normalization; audit #3's @@ -698,11 +706,18 @@ pre-v1.17 §7.1 phrasing — its six witness edges are decided correctly by the mechanized theorem, which §7.1 now states; audit #10's F-parity probe stands as evidence that popped and total frame counts differ on 38 spectator-retaining edges — -the recording now takes the register's popped count). The -polarity and conservation instruments carry exit-code verdicts -(audit #10 flagged their print-only totals; forced-false on any -gated component measured exit 1), and the §7.2 branch-offset -rows gate the polarity verdict. Output identity across code changes is claimed for +the recording now takes the register's popped count; audit +#11's deep-W4 countermodel now flagged at its source). ALL SIX +instruments carry exit-code verdicts — wf, polarity, +conservation (audit #10 flagged their print-only totals), and +as of v1.19 suite, certify, and typecheck too (audit #11 +flagged those; typecheck also gained its printed fragment +total, 17/20 typable-h-only + every escape rejected); +forced-false on any gated component of any instrument measured +exit 1, and the §7.2 branch-offset rows gate the polarity +verdict. The F recording was confirmed by audit #11 on 116 +certified-fire edges (target.rs exactly Q; len difference +exactly |P|; zero recording mismatches). Output identity across code changes is claimed for DETERMINISTIC fields only: `conservation.py` prints a wall-clock suffix that varies run to run (audit #7 caught "byte-identical" overclaiming this), and adding a declared validation field @@ -807,7 +822,8 @@ no bare-term ideal oracle). | v1.15 | NON-VACUITY joins the structural side (`vacuous_positions`, machine_coverage refuses unreachable entries — canonical maps never vacuous by settle()'s guarantee); the None sentence exact in three disjuncts (cap/nonconvergence; empty admission; pool pass accepting nothing); eleventh regression (vacuous-position) gated; the module verdict is the EXIT CODE (any single regression failure exits nonzero, measured); title de-cruffed to "qALC kernel"; output-identity claims scoped to deterministic fields; every prediction held with exactly the declared deltas | **fresh audit #8: FAIL** (zero machine countermodels, third straight — None sentence and all eleven gates CONFIRMED, subtraction fourth confirmation, Pα + W hand-recomputed; non-vacuity position-level only: ghost popkeys validate clean; settle() proof wrong for phase-1-only maps; four honesty findings) | | v1.16 | KEY-level non-vacuity (`vacuous_keys`: every popkey must occur in an arrival frame at its position; ghost popkeys refused; canonical maps carry zero by the corrected two-case proof — phase-1 maps take keys from the converged arrivals, all other acceptances via settle()); twelfth regression (ghost-key), gated; the admission claim stated honestly (phase-2/rescue validate at acceptance, phase 1 is structural, nothing returns unvalidated); physics-table preamble names the machine-measured row; inventory and contract docstrings corrected; every prediction held with exactly the declared deltas | **fresh audit #9: FAIL** (zero machine countermodels, fourth straight — every mechanical charge CONFIRMED incl. all twelve gates and both non-vacuity levels; §7.1 misstated the mechanized coloring theorem: formula omitted Σw(KS), defect sentence conflated conservative fire with certified erasure, gauge sweep asserted rather than enumerated KD) | | v1.17 | §7.1 restated to the theorem the checker enforces (φ gains Σw(KS) with w(K₂(l)) = w(l), w(K₃) = w(KD) = 0; uniform flip INCLUDING conservative fire, certified erasure the sole exception at 1 − w(l) pinned-gauge, parametrized form named; Ccoll's separating witnesses registered); the gauge sweep enumerates KD — 4/512, orbit unchanged, KD pinned 0 by measurement; the ghost regression prints its nonzero count; phi(), w(), and every certificate untouched | **fresh audit #10: FAIL** (fifth straight clean-machine round; §7.2 + §7.3 CONFIRMED symbol-level incl. a 131k-surfacing independent conservation check; the inversion: the register was right, the checker wrong — F recorded total frames, not popped; instrument prose + print-only verdicts) | -| v1.18 | the checker catches up to the register: collect() records F as the POPPED count ((len(src.rs) − len(tgt.rs)) mod 2 — §7.1's text stands unchanged); polarity and conservation gain exit-code verdicts (branch-offset rows gating; forced-false measured exit 1); instrument docstrings/comments/pointers corrected (the HH/HNH weight comment now states 0/0 and 1/1); pack labels version-neutral; popped-F sweep 4/512, same orbit; every prediction held with the v117-kit caveat resolved on inspection | **fresh audit #11: pending** | +| v1.18 | the checker catches up to the register: collect() records F as the POPPED count ((len(src.rs) − len(tgt.rs)) mod 2 — §7.1's text stands unchanged); polarity and conservation gain exit-code verdicts (branch-offset rows gating; forced-false measured exit 1); instrument docstrings/comments/pointers corrected (the HH/HNH weight comment now states 0/0 and 1/1); pack labels version-neutral; popped-F sweep 4/512, same orbit; every prediction held with the v117-kit caveat resolved on inspection | **fresh audit #11: FAIL** (F correction CONFIRMED on 116 edges; machine clean; W4 under-implemented — slice-suspended ticket passes the top-level check, subtype not preserved by vvar; "all four instruments gate" overcounted; three stale doc lines) | +| v1.19 | W4 goes DEEP (live same-instance tickets through tape/log slice cargo; the unreachable countermodel excluded from the subtype; stripped control proves no over-tightening); thirteenth gated regression; ALL SIX instruments carry exit-code verdicts (typecheck gains its printed fragment total); kernel.py cert/rs doc lines and two invalid docstring escapes fixed (one long-standing, surfaced by recompile); full decruft sweep per a9's directive; every prediction held, the v118 kit's no-op suite probe adjudicated | **fresh audit #12: pending** | ## 12. Appendix — HH step-indexed trace diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index 6ef9eeb..64d338f 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -398,7 +398,7 @@ register alone carries the version). | Item | Status | |---|---| -| Kernel | **v1.18** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–10 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; nine-invariant WF; twelve permanent regressions, all gating the module exit code. **PASS re-claim gated on fresh audit #11** | +| Kernel | **v1.19** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; nine-invariant WF; thirteen permanent regressions, all gating; all six instruments carry exit-code verdicts. **PASS re-claim gated on fresh audit #12** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §5): the fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is the hybrid validation — structural admission/isometry plus exact-amplitude dynamic cleanliness plus non-vacuity, strictly beyond Gram (negative controls caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and **self-validating**: every admitted map passes full semantic coverage, else None | From bae18f15089bc935ee9a22701573fc2a6ff9ebc1 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 20:26:03 -0400 Subject: [PATCH 044/107] =?UTF-8?q?qalc:=20kernel=20v1.20=20=E2=80=94=20W4?= =?UTF-8?q?=20closed=20by=20enumeration;=20anshead=20species=20typed?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #12 (FAIL) reached a kernel arm for the first time since v1.11: the anshead species check was an untyped assert that never consulted the leaf (matched foreign markers silently accepted). v1.20 types it (species-ans, leaf = gamma = answer), bit-identical on every covered output. W4 gains W4-storage and W4-burial, closing vvar preservation by the four-class enumeration (agreeing burial admissible, its target measured WF; entry-vs-region closure stated honestly). Regressions fourteen and fifteen gated; GUARD_RULES extended; section 3 gains the species-ans, rootval, and verr rows; fifteen regressions registered; zero storage/burial exclusions on the audit's own 300-program corpus. Fresh audit #13 launched; the PASS re-claim stays gated on it. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 39 ++++++++--- docs/ledger/2026-08.md | 54 +++++++++++++++ docs/quantum-algebraic/kernel.md | 112 +++++++++++++++++++++++-------- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 169 insertions(+), 38 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 9139c56..ed16e22 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,12 +413,16 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.19** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.20** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after -eleven fresh-context rounds: the machine core has not moved since -the v1.11 spectator-transition fix, and the last FIVE rounds -found zero machine countermodels — audits #6 through #10 confirmed +twelve fresh-context rounds: ONE kernel arm has moved since the +v1.11 spectator-transition fix — audit #12 found the anshead +species check was an untyped ASSERT that never consulted the +leaf (matched foreign markers were silently accepted), and v1.20 +types it (`species-ans`, leaf = γ = A agreement) with every +covered output measured bit-identical across the change. Audits +#6 through #10 confirmed the completed KD subtraction sound (exhaustive post-fire storage enumeration, then an extended matrix: nested slice-cargo tickets, tickets inside unrelated burials, ANS, frozen instance names), @@ -448,9 +452,23 @@ reachable nowhere in 1,250 searched graphs, is now flagged at its source and frozen as the thirteenth gated regression), and ALL SIX instruments now carry exit-code verdicts (suite, certify, and typecheck joined; forced-false measured exit 1 on -every gated component). What the rounds still +every gated component). Audit #12 then delivered the loop's +first kernel-arm finding since v1.11 (the anshead assert above) +plus the last two W4 leak classes — same-key bit-free storage +and conflicting-bit burials, both vvar-unreachable but +subtype-breaking — while CONFIRMING the gating independently +(fourteen forced components, all thirteen then-flags), the +machine diff-clean against the v1.18 snapshot, `token.md` §2 +against the classical substrate row-for-row (2,622 terms, +47,420 lockstep steps, zero mismatches), and deep-W4's zero +over-tightening on 218,546 generated states. v1.20 closes W4 +BY ENUMERATION — the four representation classes exhaust what +the vvar-emitted ticket can collide with — freezes both new +countermodels as regressions fourteen and fifteen (gated, +forced-false measured exit 1), and adds the missing §3 rows +(species-ans, rootval, verr). What the rounds still found was claim-language and scaffolding, each fixed the same -day: all twelve permanent regressions now gate mechanically (the +day: all fifteen permanent regressions now gate mechanically (the module verdict is the exit code — forcing any single regression false exits nonzero, measured); `validate()` gained NON-VACUITY at both levels (an entry at an unreachable position and a ghost @@ -463,13 +481,14 @@ claims are scoped to deterministic fields. Nineteen frozen dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; physics table passes on all twenty; all prior audit -kits rerun with exactly the declared deltas; every v1.19 -prediction held (provenance in the scratchpad prediction files). +kits rerun with exactly the declared deltas; every v1.20 +prediction held (one wrong detail registered; provenance in the +scratchpad prediction files). The open docket, in order: -1. **fresh-context independent audit #12 of the v1.19 h-fragment - claim** (running; verdict to be registered in `kernel.md` +1. **fresh-context independent audit #13 of the v1.20 h-fragment + claim** (verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 is its newly checkable ticket-dimension face), and diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index ce3538f..6c755ad 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -3081,3 +3081,57 @@ targets a line the gate refactor renamed — the end-to-end forced tests are the valid evidence, declared in the pack). Register, STATUS, token.md updated; fresh audit #12 launched — the PASS re-claim stays gated on it. + +## 2026-08-09 — qALC kernel v1.20: audit #12 reaches the machine; W4 closes by enumeration; the anshead assert becomes a typed guard + +Fresh audit #12 (independent instance, sol tier, the v1.19 pack) +returned FAIL — and for the first time since v1.11, a finding +touched a kernel arm. The anshead species check was an ASSERT: +γ_h·A_t at an h leaf crashed untyped (AssertionError), and — +worse — the arm never consulted the LEAF, so matched foreign +markers γ_t·A_t at an h leaf were SILENTLY accepted into +VB(t,…), contradicting §3's "every detectable misuse is typed." +The retrace arm transports the mismatch and crashed one step +later. Alongside it, the two remaining W4 leak classes: same-key +BIT-FREE storage in a VB-active state (vvar target violates W8) +and a same-key burial with a CONFLICTING bit (target violates +W3) — both refire-unreachable, both subtype-breaking, the same +raw-forward-invariance standard audit #11 set. Plus: §3's table +omitted the reachable rootval rows (dup reaches two) and the +answer-species behavior; C2's "exactly" missed the SyntaxWarning +REMOVAL in the conservation capture; a hardcoded pack label +still said "twelve regressions"; Run.ks's docstring named only +one of its three record classes. The audit also CONFIRMED, +independently: all fourteen instrument-component forcings and +all thirteen regression gates drive exit 1; the machine +diff-clean against the v1.18 snapshot; token.md §2 against +lam_iam.py row-for-row (2,622 closed terms, 7,866 runs, 47,420 +lockstep steps, all eight rules, zero mismatches); deep-W4's +zero reachable over-tightening on 300 generated programs / +218,546 states; the F recording on the same 116 edges. + +v1.20, predictions written first, all findings reproduced via +the auditor's kit before anything moved: W4 is CLOSED BY +ENUMERATION rather than patched — the emitted ticket α_g(i,b′) +can only violate W3/W8/W9 in a vvar target, and each violating +partner class is now excluded at the source (frames, live +tickets, bit-free storage, conflicting burials; an AGREEING +burial is admissible and its target measures WF — the built-in +no-over-tightening control), with entry-vs-region closure stated +honestly in §6 (anshead entry is lifecycle-guarded, raw-entry +closure deliberately not claimed). The anshead assert became the +typed guard `species-ans` (leaf = γ = A, else typed error) — the +ONE kernel-arm change since v1.11, with suite, certify, +typecheck, and polarity outputs byte-identical and conservation +identical modulo its timing suffix: the guard is invisible on +every covered graph. Regressions FOURTEEN (the five-case +storage/burial table) and FIFTEEN (the four-case species set, +retrace chain included) joined cert_sweep, forced-false measured +exit 1 each; GUARD_RULES gained species-ans (print-neutral, an +unexpected fire now gates); §3 gained the species-ans, rootval, +and verr rows; the storage/burial fuzz over the auditor's own +corpus (same generator, seed, caps) measured ZERO hits. Every +prediction held, one wrong detail registered (wf prints no count +line — the fifteen-count lives in the kit inventory and the +register). Register, STATUS, token.md updated; fresh audit #13 +launched — the PASS re-claim stays gated on it. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index cd23277..9a114ee 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.19.** The kernel is a scratch superposition evolver +**Status: v1.20.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -16,8 +16,13 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #12**, whose -verdict will be registered here. +The standing PASS re-claim is **gated on fresh audit #13**, whose +verdict will be registered here. One kernel arm has moved since +v1.11: audit #12 found the anshead species check was an ASSERT +(untyped crash) that never consulted the leaf; v1.20 types it +(`species-ans`, leaf = γ = A). Every covered graph, certificate, +marginal, and physics row measured bit-identical across the +change. This file is the current contract and register only. The round-by-round history — countermodels, corrections, verdicts — @@ -169,8 +174,20 @@ arrive/fire tape = P_b · μ_g · T, P_0 = l· P_1 = •·l· retrace (pos, ↑, γ_g·L, A_g(b′)·T) → (parent+'f', ↓, L, γ_g·A_g(b′)·T) [bt1's action on the γ head] -anshead (g, ↓, L, γ_g·A_g(b′)·T) → (g, VB(g, b′, 0), L, T) +anshead (g, ↓, L, γ·A·T): leaf, γ, and A gate kinds must all + agree — the answer arriving at a leaf is that leaf's + own gate's answer — else → species-ans [v1.20, + audit #12: this was an ASSERT (untyped crash on γ/A + disagreement) that never consulted the LEAF — matched + foreign markers γ_t·A_t at an h leaf were silently + accepted into VB(t,…)] + (g, ↓, L, γ_g·A_g(b′)·T) → (g, VB(g, b′, 0), L, T) vb2 (g, VB(g,b′,k<2), L, •·T) → (g, VB(g,b′,k+1), L, T) +rootval (g, VB(g,b′,k<2), L, ρ·T) → RunDone(b̂′, res) + [the partially-applied answer boolean IS the output; + REACHABLE — dup reaches two such states] +verr (g, VB(g,b′,k<2), L, μ·T) → RunDone(err, res) + [a probed bare boolean value — typed] vvar (g, VB(g,b′,2), L, T) → (g, ↑, L, •^(b′+1)·α_g(i,b′)·T) one bullet pays the gate application, the rest encode the slot; the ticket carries the instance. @@ -185,10 +202,10 @@ errors VB with a non-• non-classifier tape top; ↓-stuck on ``` The guard family — `no-instance`, `alien-ticket`, `frame-conflict`, -`recall-err`, `replay-err`, `pop-err`, `species-mu`, `refire`, -`key-alias` — is the machine's whole answer to aliasing and misuse: -**every detectable manifestation is a typed error, never a silent -reinterpretation.** +`recall-err`, `replay-err`, `pop-err`, `species-mu`, `species-ans`, +`refire`, `key-alias` — is the machine's whole answer to aliasing +and misuse: **every detectable manifestation is a typed error, +never a silent reinterpretation.** ## 4. Instance identity and the selection lifecycle @@ -389,15 +406,29 @@ the machine's unitarity claims quantify over the subtype: across ALL bit-carrying representations — frames, top-level and slice-suspended tickets on tape and log, and tickets buried in retained-whole `K(l)` records. -- **W4** (first-interrogation exclusivity, DEEP as of v1.19): a - VB-active state at instance `i` holds no `i`-frame and no live - `i`-ticket anywhere on tape or log, deep through slice cargo. - The guard chain forces this on reachable states; the deep - clause additionally excludes the unreachable slice-suspended - configuration whose `vvar` step would re-emit a second live - same-key ticket (audit #11's subtype-preservation - countermodel — found reachable NOWHERE in the twenty programs, - 1,000 generated graphs, or 250 candidates). +- **W4** (first-interrogation exclusivity, CLOSED as of v1.20): a + VB-active state at instance `i` holds NO other representation + of its key in ANY of the four classes — no `i`-frame in RS + (`W4-frame`), no live `i`-ticket anywhere on tape or log deep + through slice cargo (`W4-ticket`, audit #11's countermodel), + no same-key bit-free storage (`W4-storage`, audit #12), and no + same-key burial with a CONFLICTING bit (`W4-burial`, audit + #12); an AGREEING burial is admissible — its `vvar` target is + WF. The four exclusions close `vvar` preservation **by + enumeration**: the emitted ticket `α_g(i,b′)` can only violate + W3, W8, or W9 in the target, and each violating partner class + is excluded at the source (frame or conflicting ticket/burial + → W3; bit-free record → W8; second live ticket → W9); `vb2` + preserves the region trivially (KS untouched). ENTRY into the + VB region (`anshead`) is guarded on reachable states by the + lifecycle — no representation of a key exists before its first + `vvar`, and re-interrogation of a dead key is refire-typed — + and raw-entry closure is deliberately NOT claimed: W4 encodes + a reachability fact (first interrogation), strictly stronger + than raw-state closure at the region's entry. Zero states of + the twenty programs excluded; zero W4-storage/W4-burial hits + over 218,546 states of 300 generated programs (the audit-#12 + corpus). - **W5** (probe pairing): deep-counted γ (through lp slices and retained `K(l)` records; instance KEYS are frozen names, never counted) = #μ(tape) + #A(tape) — every in-flight probe's γ is @@ -621,7 +652,7 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#12; the verdict will be registered here.** +#13; the verdict will be registered here.** ## 10. Verification state @@ -662,7 +693,7 @@ canonical dicts compared bit-for-bit; `dupcall` canonically None `h(Ω)` → None. Negative controls: pstar × wrong certificate reaches `pop-err`; dupcall × v1.7-era certificate reaches `refire`, all-err. WF/W7/W8/W9 sweeps + mechanized disjointness: -zero violations; **thirteen permanent regressions** (the v1.6 pair; +zero violations; **fifteen permanent regressions** (the v1.6 pair; extra-frame collision, W7-excluded with disjoint targets; doctored bundle divergence; K+frame alias; retained-Q disjointness — spectator-bit columns share zero targets; @@ -677,16 +708,29 @@ passes; ghost-key — an inert popkey occurring in no arrival frame at its certified position must fail `machine_coverage`, key-level non-vacuity; deep-W4 — a slice-suspended same-instance ticket in a VB-active state must be flagged while -the stripped control stays clean). The gating structure, stated exactly +the stripped control stays clean; W4 storage/burial — same-key +bit-free K/KD storage and a conflicting-bit burial in a +VB-active state must be flagged (`W4-storage`/`W4-burial`) +while the clean and AGREEING-burial sources stay WF and the +agreeing burial's vvar target measures WF, the built-in +no-over-tightening control; answer-species — mismatched and +matched-foreign γ/A markers at a leaf must be typed +`species-ans`, the matched-own anshead intact, and the retrace +chain typed one step after `bt1g` with no crash anywhere). The +gating structure, stated exactly (audits #6 and #7 each caught a computed-but-non-gating verdict; audit #8 forced all eleven then-regressions -individually and confirmed each drives exit 1): the v1.6 pair -gates `collisions_under_wf()`; the other eleven gate +individually and confirmed each drives exit 1; audit #12 +independently forced all thirteen then-flags plus every +instrument component — fourteen forcings — each to exit 1): +the v1.6 pair +gates `collisions_under_wf()`; the other thirteen gate `cert_sweep()`'s return; the module `__main__` conjoins all three sweeps in its printed total AND ITS EXIT CODE, so any single regression failure exits nonzero (measured: forcing the -pair false → exit 1; forcing cert_sweep flags false → exit 1; -the emulated-old-arm probe flips `cert_sweep` to FAIL). +pair false → exit 1; forcing cert_sweep flags false → exit 1, +including both v1.20 flags; the emulated-old-arm probe flips +`cert_sweep` to FAIL). Conservation: exhaustive ≤ size 11, 14,452 surfacings at ≤10 / 55,727 at ≤11, zero failures. Polarity/terminal chains/gauge: zero violations, @@ -707,7 +751,10 @@ correctly by the mechanized theorem, which §7.1 now states; audit #10's F-parity probe stands as evidence that popped and total frame counts differ on 38 spectator-retaining edges — the recording now takes the register's popped count; audit -#11's deep-W4 countermodel now flagged at its source). ALL SIX +#11's deep-W4 countermodel now flagged at its source; audit +#12's storage/burial sources now flagged `W4-storage`/ +`W4-burial` and its answer-species cases typed `species-ans` +with no exception anywhere on its kit rerun). ALL SIX instruments carry exit-code verdicts — wf, polarity, conservation (audit #10 flagged their print-only totals), and as of v1.19 suite, certify, and typecheck too (audit #11 @@ -750,7 +797,17 @@ phase-2 mutation, phase-1 entries persistent, sorted order); the three-way None sentence traced return-by-return and CONFIRMED (audit #8 — the two trailing defensive re-validations are unreachable-failure by determinism of validate); all eleven -then-regression gates individually forced (audit #8). Basis counts vs v1.2 reference: `negative` 103→83, +then-regression gates individually forced (audit #8); the +F recording re-confirmed by audit #12 on the same 116 +certified-fire edges with zero split or collect() mismatches; +`token.md` §2 vs the classical substrate confirmed row-for-row +by audit #12's independent lockstep — 2,622 closed terms, 7,866 +runs, 47,420 steps, all eight rules exercised, zero mismatches; +the deep-W4 clause confirmed with zero reachable +over-tightening on audit #12's 300-generated-program corpus +(206 typable h-only, 363 graphs, 218,546 states), the same +corpus that measures zero `W4-storage`/`W4-burial` hits under +v1.20. Basis counts vs v1.2 reference: `negative` 103→83, `selector` 173→106, `pstar` 458→242 — v1.7-era, real, owned; marginals and supports never moved. All measurements seconds-scale on the M5 Max. @@ -823,7 +880,8 @@ no bare-term ideal oracle). | v1.16 | KEY-level non-vacuity (`vacuous_keys`: every popkey must occur in an arrival frame at its position; ghost popkeys refused; canonical maps carry zero by the corrected two-case proof — phase-1 maps take keys from the converged arrivals, all other acceptances via settle()); twelfth regression (ghost-key), gated; the admission claim stated honestly (phase-2/rescue validate at acceptance, phase 1 is structural, nothing returns unvalidated); physics-table preamble names the machine-measured row; inventory and contract docstrings corrected; every prediction held with exactly the declared deltas | **fresh audit #9: FAIL** (zero machine countermodels, fourth straight — every mechanical charge CONFIRMED incl. all twelve gates and both non-vacuity levels; §7.1 misstated the mechanized coloring theorem: formula omitted Σw(KS), defect sentence conflated conservative fire with certified erasure, gauge sweep asserted rather than enumerated KD) | | v1.17 | §7.1 restated to the theorem the checker enforces (φ gains Σw(KS) with w(K₂(l)) = w(l), w(K₃) = w(KD) = 0; uniform flip INCLUDING conservative fire, certified erasure the sole exception at 1 − w(l) pinned-gauge, parametrized form named; Ccoll's separating witnesses registered); the gauge sweep enumerates KD — 4/512, orbit unchanged, KD pinned 0 by measurement; the ghost regression prints its nonzero count; phi(), w(), and every certificate untouched | **fresh audit #10: FAIL** (fifth straight clean-machine round; §7.2 + §7.3 CONFIRMED symbol-level incl. a 131k-surfacing independent conservation check; the inversion: the register was right, the checker wrong — F recorded total frames, not popped; instrument prose + print-only verdicts) | | v1.18 | the checker catches up to the register: collect() records F as the POPPED count ((len(src.rs) − len(tgt.rs)) mod 2 — §7.1's text stands unchanged); polarity and conservation gain exit-code verdicts (branch-offset rows gating; forced-false measured exit 1); instrument docstrings/comments/pointers corrected (the HH/HNH weight comment now states 0/0 and 1/1); pack labels version-neutral; popped-F sweep 4/512, same orbit; every prediction held with the v117-kit caveat resolved on inspection | **fresh audit #11: FAIL** (F correction CONFIRMED on 116 edges; machine clean; W4 under-implemented — slice-suspended ticket passes the top-level check, subtype not preserved by vvar; "all four instruments gate" overcounted; three stale doc lines) | -| v1.19 | W4 goes DEEP (live same-instance tickets through tape/log slice cargo; the unreachable countermodel excluded from the subtype; stripped control proves no over-tightening); thirteenth gated regression; ALL SIX instruments carry exit-code verdicts (typecheck gains its printed fragment total); kernel.py cert/rs doc lines and two invalid docstring escapes fixed (one long-standing, surfaced by recompile); full decruft sweep per a9's directive; every prediction held, the v118 kit's no-op suite probe adjudicated | **fresh audit #12: pending** | +| v1.19 | W4 goes DEEP (live same-instance tickets through tape/log slice cargo; the unreachable countermodel excluded from the subtype; stripped control proves no over-tightening); thirteenth gated regression; ALL SIX instruments carry exit-code verdicts (typecheck gains its printed fragment total); kernel.py cert/rs doc lines and two invalid docstring escapes fixed (one long-standing, surfaced by recompile); full decruft sweep per a9's directive; every prediction held, the v118 kit's no-op suite probe adjudicated | **fresh audit #12: FAIL** (first kernel-arm finding since v1.11 — the anshead species check was an untyped ASSERT and never consulted the leaf, silently accepting matched foreign markers; W4 still leaked on same-key bit-free storage (→W8 target) and conflicting burials (→W3 target); reachable rootval rows and answer-species behavior absent from §3's table; C2's "exactly" missed the SyntaxWarning removal; stale "twelve regressions" pack label; Run.ks docstring incomplete. CONFIRMED: C4 by fully independent forcing of fourteen components, all thirteen gates, machine diff-clean vs the v1.18 snapshot, token.md §2 lockstep 2,622 terms/47,420 steps zero mismatches, deep-W4 zero over-tightening on 218,546 generated states, F on 116 edges) | +| v1.20 | W4 CLOSED by enumeration (`W4-storage` + `W4-burial` join frame/ticket; the four classes exhaust what the vvar-emitted ticket can collide with; agreeing burial admissible, its target measured WF; entry-vs-region closure stated honestly); `species-ans` types the anshead species check — leaf = γ = A — the ONE kernel-arm change since v1.11, bit-identical on every covered output; regressions fourteen (five-case storage/burial table) and fifteen (four-case species incl. the retrace chain) gated; §3 gains the species-ans, rootval, and verr rows; GUARD_RULES, guard docstrings, Run.ks docstring corrected; pack WF label count-neutral; zero storage/burial hits on the audit's own 300-program corpus; every prediction held (one wrong detail registered: wf prints no count line) | **fresh audit #13: pending** | ## 12. Appendix — HH step-indexed trace diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index 64d338f..c351d1b 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -398,7 +398,7 @@ register alone carries the version). | Item | Status | |---|---| -| Kernel | **v1.19** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; nine-invariant WF; thirteen permanent regressions, all gating; all six instruments carry exit-code verdicts. **PASS re-claim gated on fresh audit #12** | +| Kernel | **v1.20** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; nine-invariant WF with W4 closed by enumeration (the four representation classes exhaust vvar's collision surface); the anshead species check typed (`species-ans`, leaf = γ = A — the one kernel-arm change since v1.11, bit-identical on every covered output); fifteen permanent regressions, all gating; all six instruments carry exit-code verdicts. **PASS re-claim gated on fresh audit #13** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §5): the fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is the hybrid validation — structural admission/isometry plus exact-amplitude dynamic cleanliness plus non-vacuity, strictly beyond Gram (negative controls caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and **self-validating**: every admitted map passes full semantic coverage, else None | From 962a62efb7687be1af3d42c0ef615d8c5c7d090c Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 21:00:10 -0400 Subject: [PATCH 045/107] =?UTF-8?q?qalc:=20kernel=20v1.21=20=E2=80=94=20W0?= =?UTF-8?q?=20token=20grammar;=20stall=20class=20typed;=20provenance=20cor?= =?UTF-8?q?rected?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #13 (FAIL) confirmed the v1.20 W4 closure SOUND by its own nine-row enumeration and the gating 15/15, then found the answer-bit domain nowhere enforced (ANS('h',2) was WF and flowed to an out-of-alphabet halt2; malformed tuples crashed untyped; a gamma/answer pair meeting a binder stalled silently) — and that 'one kernel-arm change since v1.11' was false by literal diff (v1.12/v1.13 moved the fire arm's KD subtraction). v1.21: W0 joins the subtype (token grammar — bits {0,1}, gates {h,t}, exact arities, deep through cargo; VB phase in domain); anshead hardens to arity + domain; species-binder/species-leaf/ species-transport close the untyped-stall class (classical finals deliberately kept); regression sixteen gated; provenance restated exactly (two waves since v1.11); counts count-neutral; zero W0 hits on the 218,546-state corpus. Fresh audit #14 launched; the PASS re-claim stays gated on it. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 51 ++++++++----- docs/ledger/2026-08.md | 53 +++++++++++++ docs/quantum-algebraic/kernel.md | 123 +++++++++++++++++++++++-------- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 178 insertions(+), 51 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index ed16e22..2d8ca67 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,15 +413,21 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.20** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.21** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after -twelve fresh-context rounds: ONE kernel arm has moved since the -v1.11 spectator-transition fix — audit #12 found the anshead +thirteen fresh-context rounds. Kernel-arm provenance, stated +exactly (audit #13 refuted the loop's "unmoved since v1.11" +slogan by literal diff): two audit-driven waves since v1.11 — +the v1.12/v1.13 fire-arm KD-subtraction completion (audits +#4/#5, measured no-op on the then-covered graphs) and the +v1.20/v1.21 leaf-guard wave (audit #12 found the anshead species check was an untyped ASSERT that never consulted the -leaf (matched foreign markers were silently accepted), and v1.20 -types it (`species-ans`, leaf = γ = A agreement) with every -covered output measured bit-identical across the change. Audits +leaf; audit #13 found the answer-bit domain nowhere enforced — +ANS('h',2) flowed to an out-of-alphabet halt2 — plus untyped +crash/stall surfaces; v1.21 adds the W0 token-grammar invariant, +hardens anshead to arity + domain, and types the three stall +surfaces, all measured bit-identical on covered outputs). Audits #6 through #10 confirmed the completed KD subtraction sound (exhaustive post-fire storage enumeration, then an extended matrix: nested slice-cargo tickets, @@ -452,8 +458,7 @@ reachable nowhere in 1,250 searched graphs, is now flagged at its source and frozen as the thirteenth gated regression), and ALL SIX instruments now carry exit-code verdicts (suite, certify, and typecheck joined; forced-false measured exit 1 on -every gated component). Audit #12 then delivered the loop's -first kernel-arm finding since v1.11 (the anshead assert above) +every gated component). Audit #12 delivered the anshead finding plus the last two W4 leak classes — same-key bit-free storage and conflicting-bit burials, both vvar-unreachable but subtype-breaking — while CONFIRMING the gating independently @@ -461,14 +466,23 @@ subtype-breaking — while CONFIRMING the gating independently machine diff-clean against the v1.18 snapshot, `token.md` §2 against the classical substrate row-for-row (2,622 terms, 47,420 lockstep steps, zero mismatches), and deep-W4's zero -over-tightening on 218,546 generated states. v1.20 closes W4 +over-tightening on 218,546 generated states. v1.20 closed W4 BY ENUMERATION — the four representation classes exhaust what -the vvar-emitted ticket can collide with — freezes both new -countermodels as regressions fourteen and fifteen (gated, -forced-false measured exit 1), and adds the missing §3 rows -(species-ans, rootval, verr). What the rounds still +the vvar-emitted ticket can collide with — and audit #13 +CONFIRMED that closure SOUND with its own nine-row enumeration +(agreeing-burial admission verified non-leaking through +recall/replay/decode and full injected cones) while confirming +gating 15/15 and the certificate/polarity/conservation +excavations clean at symbol level. v1.21 answers audit #13's +findings: the W0 grammar invariant (bits {0,1}, gates {h,t}, +exact arities, deep through cargo; VB phase in domain) grounds +§1's output alphabet, anshead types malformed and out-of-range +answers instead of crashing, the untyped-stall class closes +with three typed guards, and regression sixteen gates it all +(zero W0 hits on the same 218,546-state corpus). What the +rounds still found was claim-language and scaffolding, each fixed the same -day: all fifteen permanent regressions now gate mechanically (the +day: all sixteen permanent regressions now gate mechanically (the module verdict is the exit code — forcing any single regression false exits nonzero, measured); `validate()` gained NON-VACUITY at both levels (an entry at an unreachable position and a ghost @@ -481,13 +495,14 @@ claims are scoped to deterministic fields. Nineteen frozen dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; physics table passes on all twenty; all prior audit -kits rerun with exactly the declared deltas; every v1.20 -prediction held (one wrong detail registered; provenance in the -scratchpad prediction files). +kits rerun with exactly the declared deltas (one adjudicated: +the v114 kit's placeholder-key probe is outside the token +language, W0 working as specified); every v1.21 prediction held +(provenance in the scratchpad prediction files). The open docket, in order: -1. **fresh-context independent audit #13 of the v1.20 h-fragment +1. **fresh-context independent audit #14 of the v1.21 h-fragment claim** (verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 6c755ad..2556352 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -3135,3 +3135,56 @@ prediction held, one wrong detail registered (wf prints no count line — the fifteen-count lives in the kit inventory and the register). Register, STATUS, token.md updated; fresh audit #13 launched — the PASS re-claim stays gated on it. + +## 2026-08-09 — qALC kernel v1.21: the W4 closure survives its hostile check; the token grammar becomes W0; a slogan dies by literal diff + +Fresh audit #13 (independent instance, sol tier, the v1.20 pack) +returned FAIL — with the round's centerpiece CONFIRMED: the W4 +closure was verified SOUND by the auditor's own nine-row +source/target enumeration, the agreeing-burial admission proven +non-leaking through direct recall/replay/decode probes and full +injected cones (43/43/13/13 states, zero violations), the +raw-entry caveat verified as honestly disclosed, and the gating +confirmed 15/15 with independently re-derived forcings. The +certificate rescue, polarity, and conservation excavations all +came back clean at symbol level. + +The findings: the answer-bit DOMAIN was nowhere stated or +enforced — ANS('h', 2) was WF, anshead accepted it, and rootval +produced `halt2`, an out-of-alphabet terminal contradicting §1 +(bits -1 and 7 likewise); malformed tuples ('A','h') and +('A','h',0,'junk') satisfied is_ans and CRASHED untyped +(ValueError); a WF non-gate lambda at γ_h·A_h(0)·ρ had no +successor — a silent stall. And the honesty catch of the loop so +far: "one kernel-arm change since v1.11" was FALSE by literal +diff — the v1.12/v1.13 rounds changed the fire arm's KD +subtraction, exactly as the chronicle's own rows document. The +loop's favorite slogan had outlived its truth by nine versions. +Plus: "All eleven prior audits" (twelve), "the eleven cert_sweep +flags" (thirteen), and C2's "seven kits" (eight). + +v1.21, predictions written first, all findings reproduced before +anything moved: W0 joins the subtype — the state/token grammar +(bits in {0,1}, gates in {h,t}, exact arities, instance keys +lp-shaped, VB phase in domain, deep through slice and burial +cargo), with position-appropriateness explicitly left to the +other invariants. The hardened anshead types malformed and +out-of-range answers (species-ans, never ValueError, never +halt2); the untyped-stall class closes with three typed guards +(species-binder for gate tokens meeting a binder, species-leaf +for classifier-less arrivals at the gate leaf, +species-transport for unmatched transport heads) — with the +classical substrate's own finals (foreign-lp, empty tape) +deliberately left as finals, since typing them would diverge +from λIAM. Regression sixteen gates the full countermodel set +plus no-over-typing controls. Kernel-arm provenance is restated +exactly everywhere: two waves since v1.11, each measured +no-op/bit-identical on covered outputs. One kit delta +adjudicated: the v114 kit's 'nested-ticket-in-other-K' probe +used placeholder storage keys ("x", "y") outside the machine's +language — W0 flags them, its subtraction columns unchanged, +kept as evidence like the v116 kit's frozen formula. Zero W0 +hits on the 218,546-state corpus; every prediction held; all +counts in standing prose now count-neutral. Register, STATUS, +token.md updated; fresh audit #14 launched — the PASS re-claim +stays gated on it. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 9a114ee..f7d810b 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.20.** The kernel is a scratch superposition evolver +**Status: v1.21.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -9,20 +9,26 @@ ticket/frame/record machinery for re-interrogation, hybrid canonical pipeline — structural admission and structural isometry mandatory, exact-amplitude dynamic cleanliness deciding run success ("amplitudes decide whether a run succeeds, never -whether the machine is an isometry") — a nine-invariant -well-formedness subtype, a typed h-only fragment judgment with a +whether the machine is an isometry") — a ten-invariant +well-formedness subtype (the W0 token grammar plus W1-W9), a +typed h-only fragment judgment with a syntactic language boundary, a written-first per-program physics table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #13**, whose -verdict will be registered here. One kernel arm has moved since -v1.11: audit #12 found the anshead species check was an ASSERT -(untyped crash) that never consulted the leaf; v1.20 types it -(`species-ans`, leaf = γ = A). Every covered graph, certificate, -marginal, and physics row measured bit-identical across the -change. +The standing PASS re-claim is **gated on fresh audit #14**, whose +verdict will be registered here. Kernel-arm provenance, stated +exactly (audit #13 refuted the earlier "one arm since v1.11" +slogan by literal diff — the truth is two audit-driven waves): +the v1.12/v1.13 fire-arm KD-subtraction completion (audits +#4/#5; measured no-op on the then-covered graphs), and the +v1.20/v1.21 leaf-guard wave (audits #12/#13: the anshead species +ASSERT became the typed `species-ans` with exact arities and the +answer bit in {0,1}, and the three untyped-stall surfaces became +`species-binder`/`species-leaf`/`species-transport`). Every +covered graph, certificate, marginal, and physics row measured +bit-identical across the v1.20/v1.21 wave. This file is the current contract and register only. The round-by-round history — countermodels, corrections, verdicts — @@ -72,7 +78,13 @@ tape/log entries: • | logged position l | γ_g | μ_g | A_g(b′) `γ_g` (gate boundary marker), `μ_g` (probe frame), `A_g(b′)` (fired answer token), `α_g(i, b′)` (answer ticket, instance-tagged), `ρ` -(root frame). **Instance** `i` = the invoking occurrence's logged +(root frame). **Token domains (v1.21, audit #13's finding — +enforced by W0)**: every bit `b′ ∈ {0, 1}`, every gate kind +`g ∈ {h, t}`, exact tuple arities, instance keys lp-shaped, the +VB phase `k ∈ {0, 1, 2}` — deep through slice and burial cargo. +Out-of-domain tokens are outside the state language entirely +(before v1.21, `A_h(2)` was WF and flowed to an out-of-alphabet +`halt2`). **Instance** `i` = the invoking occurrence's logged position — always at log head when the token stands at the gate leaf (arg-entry is structurally forced); a logged position names a dynamic subterm copy (λIAM lineage). The classical transport rules @@ -175,12 +187,17 @@ retrace (pos, ↑, γ_g·L, A_g(b′)·T) → (parent+'f', ↓, L, γ_g·A_g(b′)·T) [bt1's action on the γ head] anshead (g, ↓, L, γ·A·T): leaf, γ, and A gate kinds must all - agree — the answer arriving at a leaf is that leaf's - own gate's answer — else → species-ans [v1.20, - audit #12: this was an ASSERT (untyped crash on γ/A - disagreement) that never consulted the LEAF — matched - foreign markers γ_t·A_t at an h leaf were silently - accepted into VB(t,…)] + agree, tuple arities exact, answer bit ∈ {0, 1} — + the answer arriving at a leaf is that leaf's own + gate's answer — else → species-ans [v1.20/v1.21, + audits #12/#13: this was an ASSERT (untyped crash on + γ/A disagreement) that never consulted the LEAF — + matched foreign markers γ_t·A_t at an h leaf were + silently accepted into VB(t,…) — followed by an + unpack that crashed on malformed tuples while an + out-of-range bit flowed to an out-of-alphabet halt] + A second γ/A pair deeper in the tail is accepted + here and typed `stuck-vb` one step later. (g, ↓, L, γ_g·A_g(b′)·T) → (g, VB(g, b′, 0), L, T) vb2 (g, VB(g,b′,k<2), L, •·T) → (g, VB(g,b′,k+1), L, T) rootval (g, VB(g,b′,k<2), L, ρ·T) → RunDone(b̂′, res) @@ -197,13 +214,20 @@ root (root, ↑, ε, P_b·ρ) → RunDone(b̂, res) other ρ arrivals → RunDone(err, res) halt/ticks RunDone → Halt(nf, res, 0) → tick → … errors VB with a non-• non-classifier tape top; ↓-stuck on - μ/ρ; neutral constants under μ/ρ — all typed, complete - residue. + μ/ρ; neutral constants under μ/ρ; and the v1.21 + stall closures (audit #13): γ/A/α meeting a binder + → species-binder (foreign-lp and empty-tape finals + stay classical finals — typing them would diverge + from the λIAM substrate); A/α/l meeting the gate + leaf without its classifier shape → species-leaf; + μ/ρ/A unmatched at an f-transport position → + species-transport — all typed, complete residue. ``` The guard family — `no-instance`, `alien-ticket`, `frame-conflict`, `recall-err`, `replay-err`, `pop-err`, `species-mu`, `species-ans`, -`refire`, `key-alias` — is the machine's whole answer to aliasing +`species-binder`, `species-leaf`, `species-transport`, `refire`, +`key-alias` — is the machine's whole answer to aliasing and misuse: **every detectable manifestation is a typed error, never a silent reinterpretation.** @@ -398,6 +422,16 @@ legacy pop-everything reading and the canonical dicts is claimed. For Run states; reachable ⊆ WF is machine-checked per program, and the machine's unitarity claims quantify over the subtype: +- **W0** (state/token grammar, v1.21 — audit #13): every token is + a well-formed instance of some production with in-domain fields + (bits `{0,1}`, gates `{h,t}`, exact arities), deep through + slice and burial cargo; frames, storage records, and the VB + phase likewise. Position-appropriateness is the other + invariants' job — W0 never asks where a token sits, only + whether it is a token. Grounds §1's output alphabet: `rootval` + from a WF VB state can only produce `halt0`/`halt1`. Zero + reachable fires on the twenty programs and the 218,546-state + generated corpus. - **W1** (log discipline): `|log| = level(pos)`. - **W2** (record uniqueness + canonicity): at most one frame per `(g, i)` in RS; RS canonically sorted (state identity is @@ -652,7 +686,7 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#13; the verdict will be registered here.** +#14; the verdict will be registered here.** ## 10. Verification state @@ -693,7 +727,7 @@ canonical dicts compared bit-for-bit; `dupcall` canonically None `h(Ω)` → None. Negative controls: pstar × wrong certificate reaches `pop-err`; dupcall × v1.7-era certificate reaches `refire`, all-err. WF/W7/W8/W9 sweeps + mechanized disjointness: -zero violations; **fifteen permanent regressions** (the v1.6 pair; +zero violations; **sixteen permanent regressions** (the v1.6 pair; extra-frame collision, W7-excluded with disjoint targets; doctored bundle divergence; K+frame alias; retained-Q disjointness — spectator-bit columns share zero targets; @@ -716,27 +750,34 @@ agreeing burial's vvar target measures WF, the built-in no-over-tightening control; answer-species — mismatched and matched-foreign γ/A markers at a leaf must be typed `species-ans`, the matched-own anshead intact, and the retrace -chain typed one step after `bt1g` with no crash anywhere). The +chain typed one step after `bt1g` with no crash anywhere; +grammar/stall — W0 flags and species-ans types all five bad +answers (bits 2/-1/7 and both malformed arities), the VB-domain +violation is W0-flagged, the three stall arms fire exactly on +their cases, and the classical final plus the deeper-pair chain +stay untouched). The gating structure, stated exactly (audits #6 and #7 each caught a computed-but-non-gating verdict; audit #8 forced all eleven then-regressions individually and confirmed each drives exit 1; audit #12 independently forced all thirteen then-flags plus every -instrument component — fourteen forcings — each to exit 1): +instrument component — fourteen forcings — each to exit 1; +audit #13 confirmed the fifteen-gate structure 15/15 with fully +independent re-derived forcings): the v1.6 pair -gates `collisions_under_wf()`; the other thirteen gate +gates `collisions_under_wf()`; the other fourteen gate `cert_sweep()`'s return; the module `__main__` conjoins all three sweeps in its printed total AND ITS EXIT CODE, so any single regression failure exits nonzero (measured: forcing the pair false → exit 1; forcing cert_sweep flags false → exit 1, -including both v1.20 flags; the emulated-old-arm probe flips -`cert_sweep` to FAIL). +including the v1.20 and v1.21 flags; the emulated-old-arm probe +flips `cert_sweep` to FAIL). Conservation: exhaustive ≤ size 11, 14,452 surfacings at ≤10 / 55,727 at ≤11, zero failures. Polarity/terminal chains/gauge: zero violations, orbit exact — 4/512 with the KD weight enumerated (audit #9 caught the 8-parameter sweep asserting KD's zero rather than -enumerating it), every survivor fixing KD at 0. All eleven prior audits' independent reproducers +enumerating it), every survivor fixing KD at 0. All prior audits' independent reproducers rerun clean or typed (audit #1's fuzz 250/250; audit #2's kit clean on every lifecycle, its term-evaluator mismatches adjudicated as that evaluator's non-normalization; audit #3's @@ -754,7 +795,14 @@ the recording now takes the register's popped count; audit #11's deep-W4 countermodel now flagged at its source; audit #12's storage/burial sources now flagged `W4-storage`/ `W4-burial` and its answer-species cases typed `species-ans` -with no exception anywhere on its kit rerun). ALL SIX +with no exception anywhere on its kit rerun; audit #13's +grammar countermodels W0-flagged and species-ans-typed, its +stall states typed by the three new guards; the v114 kit's +`nested-ticket-in-other-K` probe now W0-flags — ADJUDICATED: +that probe's placeholder storage keys ("x", "y") are outside +the machine's gate/instance language, its subtraction columns +unchanged — the same evidence class as the v116 kit's frozen +formula). ALL SIX instruments carry exit-code verdicts — wf, polarity, conservation (audit #10 flagged their print-only totals), and as of v1.19 suite, certify, and typecheck too (audit #11 @@ -807,7 +855,17 @@ the deep-W4 clause confirmed with zero reachable over-tightening on audit #12's 300-generated-program corpus (206 typable h-only, 363 graphs, 218,546 states), the same corpus that measures zero `W4-storage`/`W4-burial` hits under -v1.20. Basis counts vs v1.2 reference: `negative` 103→83, +v1.20 and zero W0 hits under v1.21; the v1.20 W4 closure +CONFIRMED-SOUND by audit #13's own nine-row source/target +enumeration, with the agreeing-burial admission verified +non-leaking through direct recall/replay/decode probes and +full injected cones (43/43/13/13 states, zero violations, zero +guards) and the raw-entry caveat verified as honestly +disclosed; audit #13's excavations of the certificate rescue +(reversed traversal), polarity (13,520 states, 116 fires, +gauge 4/512), and conservation (131,335 intermediate-start +surfacings) all clean at symbol level; reachable anshead edges +verified species-exact across 13,504 states / 242 edges. Basis counts vs v1.2 reference: `negative` 103→83, `selector` 173→106, `pstar` 458→242 — v1.7-era, real, owned; marginals and supports never moved. All measurements seconds-scale on the M5 Max. @@ -880,8 +938,9 @@ no bare-term ideal oracle). | v1.16 | KEY-level non-vacuity (`vacuous_keys`: every popkey must occur in an arrival frame at its position; ghost popkeys refused; canonical maps carry zero by the corrected two-case proof — phase-1 maps take keys from the converged arrivals, all other acceptances via settle()); twelfth regression (ghost-key), gated; the admission claim stated honestly (phase-2/rescue validate at acceptance, phase 1 is structural, nothing returns unvalidated); physics-table preamble names the machine-measured row; inventory and contract docstrings corrected; every prediction held with exactly the declared deltas | **fresh audit #9: FAIL** (zero machine countermodels, fourth straight — every mechanical charge CONFIRMED incl. all twelve gates and both non-vacuity levels; §7.1 misstated the mechanized coloring theorem: formula omitted Σw(KS), defect sentence conflated conservative fire with certified erasure, gauge sweep asserted rather than enumerated KD) | | v1.17 | §7.1 restated to the theorem the checker enforces (φ gains Σw(KS) with w(K₂(l)) = w(l), w(K₃) = w(KD) = 0; uniform flip INCLUDING conservative fire, certified erasure the sole exception at 1 − w(l) pinned-gauge, parametrized form named; Ccoll's separating witnesses registered); the gauge sweep enumerates KD — 4/512, orbit unchanged, KD pinned 0 by measurement; the ghost regression prints its nonzero count; phi(), w(), and every certificate untouched | **fresh audit #10: FAIL** (fifth straight clean-machine round; §7.2 + §7.3 CONFIRMED symbol-level incl. a 131k-surfacing independent conservation check; the inversion: the register was right, the checker wrong — F recorded total frames, not popped; instrument prose + print-only verdicts) | | v1.18 | the checker catches up to the register: collect() records F as the POPPED count ((len(src.rs) − len(tgt.rs)) mod 2 — §7.1's text stands unchanged); polarity and conservation gain exit-code verdicts (branch-offset rows gating; forced-false measured exit 1); instrument docstrings/comments/pointers corrected (the HH/HNH weight comment now states 0/0 and 1/1); pack labels version-neutral; popped-F sweep 4/512, same orbit; every prediction held with the v117-kit caveat resolved on inspection | **fresh audit #11: FAIL** (F correction CONFIRMED on 116 edges; machine clean; W4 under-implemented — slice-suspended ticket passes the top-level check, subtype not preserved by vvar; "all four instruments gate" overcounted; three stale doc lines) | -| v1.19 | W4 goes DEEP (live same-instance tickets through tape/log slice cargo; the unreachable countermodel excluded from the subtype; stripped control proves no over-tightening); thirteenth gated regression; ALL SIX instruments carry exit-code verdicts (typecheck gains its printed fragment total); kernel.py cert/rs doc lines and two invalid docstring escapes fixed (one long-standing, surfaced by recompile); full decruft sweep per a9's directive; every prediction held, the v118 kit's no-op suite probe adjudicated | **fresh audit #12: FAIL** (first kernel-arm finding since v1.11 — the anshead species check was an untyped ASSERT and never consulted the leaf, silently accepting matched foreign markers; W4 still leaked on same-key bit-free storage (→W8 target) and conflicting burials (→W3 target); reachable rootval rows and answer-species behavior absent from §3's table; C2's "exactly" missed the SyntaxWarning removal; stale "twelve regressions" pack label; Run.ks docstring incomplete. CONFIRMED: C4 by fully independent forcing of fourteen components, all thirteen gates, machine diff-clean vs the v1.18 snapshot, token.md §2 lockstep 2,622 terms/47,420 steps zero mismatches, deep-W4 zero over-tightening on 218,546 generated states, F on 116 edges) | -| v1.20 | W4 CLOSED by enumeration (`W4-storage` + `W4-burial` join frame/ticket; the four classes exhaust what the vvar-emitted ticket can collide with; agreeing burial admissible, its target measured WF; entry-vs-region closure stated honestly); `species-ans` types the anshead species check — leaf = γ = A — the ONE kernel-arm change since v1.11, bit-identical on every covered output; regressions fourteen (five-case storage/burial table) and fifteen (four-case species incl. the retrace chain) gated; §3 gains the species-ans, rootval, and verr rows; GUARD_RULES, guard docstrings, Run.ks docstring corrected; pack WF label count-neutral; zero storage/burial hits on the audit's own 300-program corpus; every prediction held (one wrong detail registered: wf prints no count line) | **fresh audit #13: pending** | +| v1.19 | W4 goes DEEP (live same-instance tickets through tape/log slice cargo; the unreachable countermodel excluded from the subtype; stripped control proves no over-tightening); thirteenth gated regression; ALL SIX instruments carry exit-code verdicts (typecheck gains its printed fragment total); kernel.py cert/rs doc lines and two invalid docstring escapes fixed (one long-standing, surfaced by recompile); full decruft sweep per a9's directive; every prediction held, the v118 kit's no-op suite probe adjudicated | **fresh audit #12: FAIL** (first audit-found kernel-arm defect since audit #5's fire-arm countermodel — the anshead species check was an untyped ASSERT and never consulted the leaf, silently accepting matched foreign markers; W4 still leaked on same-key bit-free storage (→W8 target) and conflicting burials (→W3 target); reachable rootval rows and answer-species behavior absent from §3's table; C2's "exactly" missed the SyntaxWarning removal; stale "twelve regressions" pack label; Run.ks docstring incomplete. CONFIRMED: C4 by fully independent forcing of fourteen components, all thirteen gates, machine diff-clean vs the v1.18 snapshot, token.md §2 lockstep 2,622 terms/47,420 steps zero mismatches, deep-W4 zero over-tightening on 218,546 generated states, F on 116 edges) | +| v1.20 | W4 CLOSED by enumeration (`W4-storage` + `W4-burial` join frame/ticket; the four classes exhaust what the vvar-emitted ticket can collide with; agreeing burial admissible, its target measured WF; entry-vs-region closure stated honestly); `species-ans` types the anshead species check — leaf = γ = A — the ONE kernel-arm change since v1.11, bit-identical on every covered output; regressions fourteen (five-case storage/burial table) and fifteen (four-case species incl. the retrace chain) gated; §3 gains the species-ans, rootval, and verr rows; GUARD_RULES, guard docstrings, Run.ks docstring corrected; pack WF label count-neutral; zero storage/burial hits on the audit's own 300-program corpus; every prediction held (one wrong detail registered: wf prints no count line) | **fresh audit #13: FAIL** (the W4 closure CONFIRMED-SOUND by the auditor's own nine-row enumeration, agreeing-burial verified non-leaking, gating 15/15, cert/polarity/conservation excavations clean; the findings: the answer-bit DOMAIN was nowhere stated or enforced — ANS('h',2) was WF and flowed through anshead to an out-of-alphabet halt2, malformed tuples satisfied is_ans and crashed untyped, a γ/A pair meeting a binder stalled silently; and the honesty catch that "one kernel-arm change since v1.11" was FALSE — v1.12/v1.13 changed the fire arm's KD subtraction, as this chronicle's own rows document; plus two stale counts and C2's "seven kits" for eight) | +| v1.21 | W0 joins the subtype (state/token grammar: bits {0,1}, gates {h,t}, exact arities, deep through slice/burial cargo, VB phase in domain — position-appropriateness stays the other invariants' job); anshead hardens to arity + domain (species-ans, never ValueError, never halt2); the untyped-stall class closes with three typed guards (species-binder, species-leaf, species-transport; foreign-lp and empty-tape finals stay classical finals by design); regression sixteen gated; kernel-arm provenance restated exactly (two waves since v1.11: v1.12/v1.13 KD subtraction, v1.20/v1.21 leaf guards — each measured no-op/bit-identical on covered outputs); counts go count-neutral in the standing prose; the v114 kit's placeholder-key probe adjudicated (out-of-language tokens, W0 working as specified); zero W0 hits on the 218,546-state corpus; every prediction held | **fresh audit #14: pending** | ## 12. Appendix — HH step-indexed trace diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index c351d1b..da22476 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -398,7 +398,7 @@ register alone carries the version). | Item | Status | |---|---| -| Kernel | **v1.20** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; nine-invariant WF with W4 closed by enumeration (the four representation classes exhaust vvar's collision surface); the anshead species check typed (`species-ans`, leaf = γ = A — the one kernel-arm change since v1.11, bit-identical on every covered output); fifteen permanent regressions, all gating; all six instruments carry exit-code verdicts. **PASS re-claim gated on fresh audit #13** | +| Kernel | **v1.21** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (the W0 token grammar — bits {0,1}, gates {h,t}, exact arities, deep through cargo — plus W1-W9, with W4 closed by enumeration: the four representation classes exhaust vvar's collision surface, CONFIRMED-SOUND by audit #13); the leaf guards typed (`species-ans` with arity + bit domain, `species-binder`/`species-leaf`/`species-transport` closing the untyped-stall class — the v1.20/v1.21 wave, bit-identical on every covered output; kernel arms moved twice since v1.11: v1.12/v1.13 KD subtraction and this wave); sixteen permanent regressions, all gating; all six instruments carry exit-code verdicts. **PASS re-claim gated on fresh audit #14** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §5): the fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is the hybrid validation — structural admission/isometry plus exact-amplitude dynamic cleanliness plus non-vacuity, strictly beyond Gram (negative controls caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and **self-validating**: every admitted map passes full semantic coverage, else None | From 9a2c9a760b74f403e08a00face0b0cb87cab844c Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 21:32:22 -0400 Subject: [PATCH 046/107] =?UTF-8?q?qalc:=20kernel=20v1.22=20=E2=80=94=20W0?= =?UTF-8?q?=20is=20the=20full=20state=20language;=20exact-int=20bits;=20pr?= =?UTF-8?q?ovenance=20summaries=20abolished?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #14 (FAIL) confirmed gating 16/16, section 8, the section-12 trace, and the classical-final exemptions — then broke W0's edges: Python equality admitted 1.0/True as bits (rootval string-formats, minting halt1.0/haltTrue terminal kinds from WF states); K(l) cargo and instance fields were unchecked; the state coordinates were unchecked entirely (silent stalls and raw AttributeErrors inside WF); and the corrected provenance summary was still incomplete. v1.22: W0 becomes the full state language (exact-int bits with bool refused, recursive lp productions whose occurrences resolve to Vars, arrival-lp K(l) cargo, coordinates in language, VB phase in domain); anshead's bit check exact-int (the one arm change, bit-identical on covered outputs); regression seventeen gated; provenance summaries abolished in favor of the chronicle's per-version rows; the v1.12 fixture's App-naming carrier lp corrected; six kits' out-of-language fixture lps and the audit-#14 kit's crash-by-construction adjudicated; zero W0 hits on the 218,546-state corpus. Fresh audit #15 launched; the PASS re-claim stays gated on it. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 83 +++++++++++--------- docs/ledger/2026-08.md | 59 ++++++++++++++ docs/quantum-algebraic/kernel.md | 131 +++++++++++++++++++++---------- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 195 insertions(+), 80 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 2d8ca67..a740144 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,21 +413,27 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.21** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.22** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after -thirteen fresh-context rounds. Kernel-arm provenance, stated -exactly (audit #13 refuted the loop's "unmoved since v1.11" -slogan by literal diff): two audit-driven waves since v1.11 — -the v1.12/v1.13 fire-arm KD-subtraction completion (audits -#4/#5, measured no-op on the then-covered graphs) and the -v1.20/v1.21 leaf-guard wave (audit #12 found the anshead -species check was an untyped ASSERT that never consulted the -leaf; audit #13 found the answer-bit domain nowhere enforced — -ANS('h',2) flowed to an out-of-alphabet halt2 — plus untyped -crash/stall surfaces; v1.21 adds the W0 token-grammar invariant, -hardens anshead to arity + domain, and types the three stall -surfaces, all measured bit-identical on covered outputs). Audits +fourteen fresh-context rounds. Kernel-arm provenance summaries +have been refuted by literal diff twice (audit #13 killed +"unmoved since v1.11"; audit #14 showed the corrected summary +still incomplete), so the register now names arms per version +only and defers history to the chronicle rows. The recent arc: +audit #12 found the anshead species check was an untyped ASSERT +that never consulted the leaf; audit #13 found the answer-bit +domain nowhere enforced (ANS('h',2) flowed to an +out-of-alphabet halt2) plus untyped crash/stall surfaces; audit +#14 found W0's equality-based bit check admitted 1.0/True +(minting halt1.0/haltTrue terminal kinds), unchecked instance +productions, and unchecked state coordinates (silent stalls and +AttributeErrors inside WF). v1.20 through v1.22 answered: typed +species guards at the leaf, binder, and transport arms; W0 +grown into the FULL state language (exact-int bits, recursive +lp productions with occurrences resolving to Vars, arrival-lp +K(l) cargo, coordinates in language, VB phase in domain); every +change measured bit-identical on covered outputs. Audits #6 through #10 confirmed the completed KD subtraction sound (exhaustive post-fire storage enumeration, then an extended matrix: nested slice-cargo tickets, @@ -458,31 +464,32 @@ reachable nowhere in 1,250 searched graphs, is now flagged at its source and frozen as the thirteenth gated regression), and ALL SIX instruments now carry exit-code verdicts (suite, certify, and typecheck joined; forced-false measured exit 1 on -every gated component). Audit #12 delivered the anshead finding -plus the last two W4 leak classes — same-key bit-free storage -and conflicting-bit burials, both vvar-unreachable but -subtype-breaking — while CONFIRMING the gating independently -(fourteen forced components, all thirteen then-flags), the -machine diff-clean against the v1.18 snapshot, `token.md` §2 -against the classical substrate row-for-row (2,622 terms, -47,420 lockstep steps, zero mismatches), and deep-W4's zero -over-tightening on 218,546 generated states. v1.20 closed W4 -BY ENUMERATION — the four representation classes exhaust what -the vvar-emitted ticket can collide with — and audit #13 -CONFIRMED that closure SOUND with its own nine-row enumeration +every gated component). Audit #12 also delivered the last two +W4 leak classes while CONFIRMING the gating independently, the +machine diff-clean against the v1.18 snapshot, and `token.md` +§2 against the classical substrate row-for-row (2,622 terms, +47,420 lockstep steps, zero mismatches). v1.20 closed W4 BY +ENUMERATION — the four representation classes exhaust what the +vvar-emitted ticket can collide with — and audit #13 CONFIRMED +that closure SOUND with its own nine-row enumeration (agreeing-burial admission verified non-leaking through recall/replay/decode and full injected cones) while confirming gating 15/15 and the certificate/polarity/conservation -excavations clean at symbol level. v1.21 answers audit #13's -findings: the W0 grammar invariant (bits {0,1}, gates {h,t}, -exact arities, deep through cargo; VB phase in domain) grounds -§1's output alphabet, anshead types malformed and out-of-range -answers instead of crashing, the untyped-stall class closes -with three typed guards, and regression sixteen gates it all -(zero W0 hits on the same 218,546-state corpus). What the +excavations clean at symbol level. Audit #14 then confirmed +gating 16/16, §8 against typecheck sentence-by-sentence, §12's +trace anchors by fresh replay, and the classical-final +exemptions against lam_iam — while breaking W0's edges as +above. v1.22 grew W0 to the full language, went exact-int at +the one kernel arm that reads a bit (anshead), and gated it as +regression seventeen (ten countermodels + intact controls; +zero W0 hits on the same 218,546-state corpus; the six kits +whose hand-built helper lps name non-Var positions adjudicated +as out-of-language fixtures, failure counters all still zero; +the audit-#14 kit crashes by construction on the healed +machine, which is itself the healing evidence). What the rounds still found was claim-language and scaffolding, each fixed the same -day: all sixteen permanent regressions now gate mechanically (the +day: all seventeen permanent regressions now gate mechanically (the module verdict is the exit code — forcing any single regression false exits nonzero, measured); `validate()` gained NON-VACUITY at both levels (an entry at an unreachable position and a ghost @@ -495,14 +502,14 @@ claims are scoped to deterministic fields. Nineteen frozen dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; physics table passes on all twenty; all prior audit -kits rerun with exactly the declared deltas (one adjudicated: -the v114 kit's placeholder-key probe is outside the token -language, W0 working as specified); every v1.21 prediction held -(provenance in the scratchpad prediction files). +kits rerun with every delta adjudicated (out-of-language +fixture lps; the healed-countermodel crash); every v1.22 +prediction held in substance with the kit-delta count wrong and +registered (provenance in the scratchpad prediction files). The open docket, in order: -1. **fresh-context independent audit #14 of the v1.21 h-fragment +1. **fresh-context independent audit #15 of the v1.22 h-fragment claim** (verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 2556352..952daf3 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -3188,3 +3188,62 @@ hits on the 218,546-state corpus; every prediction held; all counts in standing prose now count-neutral. Register, STATUS, token.md updated; fresh audit #14 launched — the PASS re-claim stays gated on it. + +## 2026-08-09 — qALC kernel v1.22: W0 grows into the full state language; Python equality loses an argument; provenance summaries are abolished + +Fresh audit #14 (independent instance, sol tier, the v1.21 pack) +returned FAIL — confirming C5 sixteen-for-sixteen with fully +independent forcings, §8 against typecheck sentence by sentence, +§12's HH trace at every load-bearing anchor by fresh replay, +gram()/run_dyn() as exactly what §10 claims they measure, the +classical-final exemptions as REAL against lam_iam, and the +v114 placeholder-key adjudication in both directions. + +The findings were the language's edges. W0's bit check used +`in (0, 1)` — Python equality — so 1.0, 0.0, True, and False +were all in-domain: ANS('h', 1.0) was WF, anshead accepted it, +and rootval STRING-FORMATS the bit, minting the out-of-alphabet +terminal kinds halt1.0 and haltTrue from well-formed states. (My +own v1.21 prediction file had blessed the bool tolerance as +deliberate "since bools are ints" — the auditor showed exactly +why that reasoning fails at the terminal formatter.) W0 also +never checked retained-whole K(l) cargo (('K', BULLET) passed), +never recursed into ticket/frame/storage instance fields, and +never looked at the state coordinates at all: d='X' and alien +paths were WF and silently stalled; off-tree paths and lp +occurrences naming non-Var positions were WF and crashed raw in +subterm/binder_path. The register's "position-appropriateness is +the other invariants' job" was refuted to its face — no other +invariant does any of that. And the corrected two-wave +provenance summary was STILL incomplete: v1.11→v1.12 also +changed the ordinary alpha-decode arm (burial suppresses the +bit-free record) — a change the summary folded into "KD +subtraction" — and "leaf-guard wave" mislabeled v1.21's binder +and transport arms. Summaries of arm history are now abolished: +the register names arms per version only and defers everything +older to the chronicle rows. + +v1.22, predictions written first, all countermodels reproduced +via the auditor's own kit: W0 becomes the FULL state language — +exact-int bits everywhere a bit lives (type(b) is int; bool is +a subclass and is refused), lp productions recursive wherever +they appear with path components in {f,a,b} and every +occurrence resolving to a Var of the term (the machine only +mints lps at Var positions), arrival-lp K(l) cargo, coordinates +d/path in language, VB phase exact-int. The one kernel-arm +change: anshead's bit check goes exact-int. Regression +seventeen gates the ten countermodels plus intact controls +(exact ints; the kit-exact foreign-lp classical final). The +sweep and the 218,546-state corpus: zero W0 hits. Three +adjudications, all registered: the v1.12 bitfree-burial +REGRESSION FIXTURE itself carried an App-naming carrier lp — +corrected to a Var-naming one, countermodel essence untouched; +six kits' hand-built helper lps are the same out-of-language +class (wf-display columns move, every failure counter stays 0, +all exit 0); and the audit-#14 kit CRASHES by construction on +the healed machine — its probe dereferences a countermodel +target that is now a typed error, which is the healing made +visible. Every prediction held in substance; the kit-delta +count was wrong and is registered as such. Register, STATUS, +token.md updated; fresh audit #15 launched — the PASS re-claim +stays gated on it. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index f7d810b..35528c3 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.21.** The kernel is a scratch superposition evolver +**Status: v1.22.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -17,18 +17,20 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #14**, whose -verdict will be registered here. Kernel-arm provenance, stated -exactly (audit #13 refuted the earlier "one arm since v1.11" -slogan by literal diff — the truth is two audit-driven waves): -the v1.12/v1.13 fire-arm KD-subtraction completion (audits -#4/#5; measured no-op on the then-covered graphs), and the -v1.20/v1.21 leaf-guard wave (audits #12/#13: the anshead species -ASSERT became the typed `species-ans` with exact arities and the -answer bit in {0,1}, and the three untyped-stall surfaces became -`species-binder`/`species-leaf`/`species-transport`). Every -covered graph, certificate, marginal, and physics row measured -bit-identical across the v1.20/v1.21 wave. +The standing PASS re-claim is **gated on fresh audit #15**, whose +verdict will be registered here. Kernel-arm provenance is the +chronicle's per-row "what changed" column — summaries of it have +been refuted twice by literal diff (audit #13 killed "unmoved +since v1.11"; audit #14 showed the corrected two-wave summary +still omitted v1.12's ordinary-decode burial-suppression change +and mislabeled v1.21's binder/transport arms as "leaf" guards) — +so this register now names arms exactly and only per version: +v1.22 changes ONE arm relative to v1.21 (anshead's answer-bit +check goes exact-int: `type(b) is int`, refusing bool/float +aliases that Python equality admitted), and every covered graph, +certificate, marginal, and physics row measured bit-identical +across it. For anything older, read §11's rows; do not trust a +summary, including this file's former ones. This file is the current contract and register only. The round-by-round history — countermodels, corrections, verdicts — @@ -78,13 +80,24 @@ tape/log entries: • | logged position l | γ_g | μ_g | A_g(b′) `γ_g` (gate boundary marker), `μ_g` (probe frame), `A_g(b′)` (fired answer token), `α_g(i, b′)` (answer ticket, instance-tagged), `ρ` -(root frame). **Token domains (v1.21, audit #13's finding — -enforced by W0)**: every bit `b′ ∈ {0, 1}`, every gate kind -`g ∈ {h, t}`, exact tuple arities, instance keys lp-shaped, the -VB phase `k ∈ {0, 1, 2}` — deep through slice and burial cargo. -Out-of-domain tokens are outside the state language entirely -(before v1.21, `A_h(2)` was WF and flowed to an out-of-alphabet -`halt2`). **Instance** `i` = the invoking occurrence's logged +(root frame). **The state language (v1.21/v1.22, audits +#13/#14 — enforced by W0)**: every bit is an EXACT int in +`{0, 1}` (bool is a Python subclass of int and is refused — +`rootval` string-formats the bit, so `1.0`/`True` would mint +out-of-alphabet terminal kinds `halt1.0`/`haltTrue`); every gate +kind in `{h, t}`; exact tuple arities; lp productions recursive +wherever they appear (slices, ticket/frame instances, K/KD +keys), with path components in `{f, a, b}` and every occurrence +resolving to a `Var` of the term (the machine only mints lps at +Var positions); retained-whole `K(l)` cargo is an ARRIVAL lp +(`L` or `AL`); the state coordinates in language (`d ∈ {↓, ↑}`, +`pos` resolving in the term); the VB phase exact-int with +`k ∈ {0, 1, 2}`. Machine-PHASE placement of well-formed tokens +is the other invariants' job — W0 is the language, not the +protocol. Before v1.21, `A_h(2)` was WF and flowed to +`halt2`; before v1.22, `A_h(True)` still was, and off-language +coordinates stalled silently or crashed inside WF. +**Instance** `i` = the invoking occurrence's logged position — always at log head when the token stands at the gate leaf (arg-entry is structurally forced); a logged position names a dynamic subterm copy (λIAM lineage). The classical transport rules @@ -422,16 +435,21 @@ legacy pop-everything reading and the canonical dicts is claimed. For Run states; reachable ⊆ WF is machine-checked per program, and the machine's unitarity claims quantify over the subtype: -- **W0** (state/token grammar, v1.21 — audit #13): every token is - a well-formed instance of some production with in-domain fields - (bits `{0,1}`, gates `{h,t}`, exact arities), deep through - slice and burial cargo; frames, storage records, and the VB - phase likewise. Position-appropriateness is the other - invariants' job — W0 never asks where a token sits, only - whether it is a token. Grounds §1's output alphabet: `rootval` - from a WF VB state can only produce `halt0`/`halt1`. Zero - reachable fires on the twenty programs and the 218,546-state - generated corpus. +- **W0** (state grammar — v1.21 tokens, v1.22 the FULL language + after audit #14's countermodels): the state language of §2, + mechanized — exact-int bits (bool refused), gates in `{h,t}`, + exact arities, lp productions recursive with every occurrence + resolving to a Var of the term, arrival-lp `K(l)` cargo, + coordinates `d`/`pos` in language, VB phase exact-int in + domain. Machine-phase PLACEMENT of well-formed tokens is the + other invariants' job — W0 is the language, not the protocol. + Grounds §1's output alphabet (`rootval` from a WF VB state can + only produce `halt0`/`halt1` — as exact ints) and closes audit + #14's stall/crash class: off-language coordinates and + semantically invalid lps are outside WF, so no WF state stalls + silently or crashes in `subterm`/`binder_path`. Zero reachable + fires on the twenty programs and the 218,546-state generated + corpus. - **W1** (log discipline): `|log| = level(pos)`. - **W2** (record uniqueness + canonicity): at most one frame per `(g, i)` in RS; RS canonically sorted (state identity is @@ -686,7 +704,7 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#14; the verdict will be registered here.** +#15; the verdict will be registered here.** ## 10. Verification state @@ -727,7 +745,7 @@ canonical dicts compared bit-for-bit; `dupcall` canonically None `h(Ω)` → None. Negative controls: pstar × wrong certificate reaches `pop-err`; dupcall × v1.7-era certificate reaches `refire`, all-err. WF/W7/W8/W9 sweeps + mechanized disjointness: -zero violations; **sixteen permanent regressions** (the v1.6 pair; +zero violations; **seventeen permanent regressions** (the v1.6 pair; extra-frame collision, W7-excluded with disjoint targets; doctored bundle divergence; K+frame alias; retained-Q disjointness — spectator-bit columns share zero targets; @@ -755,23 +773,31 @@ grammar/stall — W0 flags and species-ans types all five bad answers (bits 2/-1/7 and both malformed arities), the VB-domain violation is W0-flagged, the three stall arms fire exactly on their cases, and the classical final plus the deeper-pair chain -stay untouched). The +stay untouched; state-language — the numeric/bool aliases are +W0-flagged AND species-ans-typed (no halt1.0/haltTrue from any +WF state), the malformed productions (bullet/answer K(l) cargo, +shallow ticket instances, non-lp frame/K/KD instances) and the +coordinate violations (alien d, alien path component, off-tree +path, non-Var lp occurrence) all W0-flagged, with the exact-int +bits and the kit-exact foreign-lp classical final as intact +controls). The gating structure, stated exactly (audits #6 and #7 each caught a computed-but-non-gating verdict; audit #8 forced all eleven then-regressions individually and confirmed each drives exit 1; audit #12 independently forced all thirteen then-flags plus every instrument component — fourteen forcings — each to exit 1; -audit #13 confirmed the fifteen-gate structure 15/15 with fully -independent re-derived forcings): +audit #13 confirmed the fifteen-gate structure 15/15; audit +#14 confirmed sixteen-for-sixteen with independent forcings +including ok_gr): the v1.6 pair -gates `collisions_under_wf()`; the other fourteen gate +gates `collisions_under_wf()`; the other fifteen gate `cert_sweep()`'s return; the module `__main__` conjoins all three sweeps in its printed total AND ITS EXIT CODE, so any single regression failure exits nonzero (measured: forcing the pair false → exit 1; forcing cert_sweep flags false → exit 1, -including the v1.20 and v1.21 flags; the emulated-old-arm probe -flips `cert_sweep` to FAIL). +including the v1.20, v1.21, and v1.22 flags; the +emulated-old-arm probe flips `cert_sweep` to FAIL). Conservation: exhaustive ≤ size 11, 14,452 surfacings at ≤10 / 55,727 at ≤11, zero failures. Polarity/terminal chains/gauge: zero violations, @@ -802,7 +828,21 @@ stall states typed by the three new guards; the v114 kit's that probe's placeholder storage keys ("x", "y") are outside the machine's gate/instance language, its subtraction columns unchanged — the same evidence class as the v116 kit's frozen -formula). ALL SIX +formula; audit #14's ten countermodels all W0-flagged and, for +the numeric aliases, species-ans-typed. Two v1.22 kit-delta +classes ADJUDICATED: (a) hand-built matrix states in six kits +(v113/v114/v116/v117/v118/v119) carry helper lps whose +occurrences name non-Var positions — outside the lp language +the machine actually mints, audit #14's own binder_path-crash +class — so their wf-display columns move while every failure +counter stays 0, every gate field True, all exits 0; the one +such fixture in wf.py's OWN v1.12 regression was corrected to +a Var-naming carrier, countermodel essence untouched; (b) the +v121 kit CRASHES by construction under v1.22 — its numeric +probe dereferences the Run fields of a countermodel target +that is now a species-ans RunDone; its completed first section +shows all six production countermodels W0-flagged, and +regression seventeen carries the gated form). ALL SIX instruments carry exit-code verdicts — wf, polarity, conservation (audit #10 flagged their print-only totals), and as of v1.19 suite, certify, and typecheck too (audit #11 @@ -865,7 +905,15 @@ disclosed; audit #13's excavations of the certificate rescue (reversed traversal), polarity (13,520 states, 116 fires, gauge 4/512), and conservation (131,335 intermediate-start surfacings) all clean at symbol level; reachable anshead edges -verified species-exact across 13,504 states / 242 edges. Basis counts vs v1.2 reference: `negative` 103→83, +verified species-exact across 13,504 states / 242 edges; +audit #14 confirmed §8 against typecheck.py sentence by +sentence (17/20, exactly q/dup/dupcall rejected, every escape), +§12's HH trace at every load-bearing anchor by fresh replay, +gram()/run_dyn() as exactly what §10's numbers claim +(amplitude-blind canonical BFS; exact-amplitude evolution with +zero-amplitude pruning), the classical-final exemptions REAL +against lam_iam.step_classical, and the v114 placeholder-key +adjudication in both directions. Basis counts vs v1.2 reference: `negative` 103→83, `selector` 173→106, `pstar` 458→242 — v1.7-era, real, owned; marginals and supports never moved. All measurements seconds-scale on the M5 Max. @@ -940,7 +988,8 @@ no bare-term ideal oracle). | v1.18 | the checker catches up to the register: collect() records F as the POPPED count ((len(src.rs) − len(tgt.rs)) mod 2 — §7.1's text stands unchanged); polarity and conservation gain exit-code verdicts (branch-offset rows gating; forced-false measured exit 1); instrument docstrings/comments/pointers corrected (the HH/HNH weight comment now states 0/0 and 1/1); pack labels version-neutral; popped-F sweep 4/512, same orbit; every prediction held with the v117-kit caveat resolved on inspection | **fresh audit #11: FAIL** (F correction CONFIRMED on 116 edges; machine clean; W4 under-implemented — slice-suspended ticket passes the top-level check, subtype not preserved by vvar; "all four instruments gate" overcounted; three stale doc lines) | | v1.19 | W4 goes DEEP (live same-instance tickets through tape/log slice cargo; the unreachable countermodel excluded from the subtype; stripped control proves no over-tightening); thirteenth gated regression; ALL SIX instruments carry exit-code verdicts (typecheck gains its printed fragment total); kernel.py cert/rs doc lines and two invalid docstring escapes fixed (one long-standing, surfaced by recompile); full decruft sweep per a9's directive; every prediction held, the v118 kit's no-op suite probe adjudicated | **fresh audit #12: FAIL** (first audit-found kernel-arm defect since audit #5's fire-arm countermodel — the anshead species check was an untyped ASSERT and never consulted the leaf, silently accepting matched foreign markers; W4 still leaked on same-key bit-free storage (→W8 target) and conflicting burials (→W3 target); reachable rootval rows and answer-species behavior absent from §3's table; C2's "exactly" missed the SyntaxWarning removal; stale "twelve regressions" pack label; Run.ks docstring incomplete. CONFIRMED: C4 by fully independent forcing of fourteen components, all thirteen gates, machine diff-clean vs the v1.18 snapshot, token.md §2 lockstep 2,622 terms/47,420 steps zero mismatches, deep-W4 zero over-tightening on 218,546 generated states, F on 116 edges) | | v1.20 | W4 CLOSED by enumeration (`W4-storage` + `W4-burial` join frame/ticket; the four classes exhaust what the vvar-emitted ticket can collide with; agreeing burial admissible, its target measured WF; entry-vs-region closure stated honestly); `species-ans` types the anshead species check — leaf = γ = A — the ONE kernel-arm change since v1.11, bit-identical on every covered output; regressions fourteen (five-case storage/burial table) and fifteen (four-case species incl. the retrace chain) gated; §3 gains the species-ans, rootval, and verr rows; GUARD_RULES, guard docstrings, Run.ks docstring corrected; pack WF label count-neutral; zero storage/burial hits on the audit's own 300-program corpus; every prediction held (one wrong detail registered: wf prints no count line) | **fresh audit #13: FAIL** (the W4 closure CONFIRMED-SOUND by the auditor's own nine-row enumeration, agreeing-burial verified non-leaking, gating 15/15, cert/polarity/conservation excavations clean; the findings: the answer-bit DOMAIN was nowhere stated or enforced — ANS('h',2) was WF and flowed through anshead to an out-of-alphabet halt2, malformed tuples satisfied is_ans and crashed untyped, a γ/A pair meeting a binder stalled silently; and the honesty catch that "one kernel-arm change since v1.11" was FALSE — v1.12/v1.13 changed the fire arm's KD subtraction, as this chronicle's own rows document; plus two stale counts and C2's "seven kits" for eight) | -| v1.21 | W0 joins the subtype (state/token grammar: bits {0,1}, gates {h,t}, exact arities, deep through slice/burial cargo, VB phase in domain — position-appropriateness stays the other invariants' job); anshead hardens to arity + domain (species-ans, never ValueError, never halt2); the untyped-stall class closes with three typed guards (species-binder, species-leaf, species-transport; foreign-lp and empty-tape finals stay classical finals by design); regression sixteen gated; kernel-arm provenance restated exactly (two waves since v1.11: v1.12/v1.13 KD subtraction, v1.20/v1.21 leaf guards — each measured no-op/bit-identical on covered outputs); counts go count-neutral in the standing prose; the v114 kit's placeholder-key probe adjudicated (out-of-language tokens, W0 working as specified); zero W0 hits on the 218,546-state corpus; every prediction held | **fresh audit #14: pending** | +| v1.21 | W0 joins the subtype (state/token grammar: bits {0,1}, gates {h,t}, exact arities, deep through slice/burial cargo, VB phase in domain — position-appropriateness stays the other invariants' job); anshead hardens to arity + domain (species-ans, never ValueError, never halt2); the untyped-stall class closes with three typed guards (species-binder, species-leaf, species-transport; foreign-lp and empty-tape finals stay classical finals by design); regression sixteen gated; kernel-arm provenance restated exactly (two waves since v1.11: v1.12/v1.13 KD subtraction, v1.20/v1.21 leaf guards — each measured no-op/bit-identical on covered outputs); counts go count-neutral in the standing prose; the v114 kit's placeholder-key probe adjudicated (out-of-language tokens, W0 working as specified); zero W0 hits on the 218,546-state corpus; every prediction held | **fresh audit #14: FAIL** (C5 CONFIRMED 16/16 with independent forcings; §8, §12's trace anchors, gram/run_dyn, the classical-final exemptions, and the v114 adjudication all CONFIRMED. The findings: W0's bit check used Python equality — 1.0/True/0.0/False are ==-equal to bits, so ANS('h',1.0) was WF and rootval string-formatted it into the out-of-alphabet terminal KINDS halt1.0/haltTrue; W0 never checked K(l) cargo shape, ticket/frame/storage instance fields recursively, or the state coordinates at all — d='X' and alien paths were WF and silently stalled, off-tree paths and non-Var lp occurrences were WF and crashed in subterm/binder_path; the "position-appropriateness is the other invariants' job" sentence was refuted (no other invariant does d/path/lp validity); C2 missed the diag capture's own label delta; and the corrected two-wave provenance summary was STILL incomplete — v1.12 also changed the ordinary decode arm, and "leaf-guard wave" mislabeled the binder/transport arms) | +| v1.22 | W0 becomes the FULL state language: exact-int bits (bool refused — the terminal-kind minting), recursive lp productions with occurrences resolving to Vars of the term, arrival-lp K(l) cargo, coordinates d/path in language, VB phase exact-int; anshead's bit check exact-int (the one arm change, bit-identical on covered outputs); regression seventeen (state-language: ten countermodels + exact-int and kit-exact foreign-lp controls) gated; provenance summaries abolished — the register names arms per version only and defers history to these rows; the wf.py v1.12 fixture's App-naming carrier lp corrected (countermodel essence untouched); six kits' helper-lp wf-columns and the v121 kit's crash-by-construction adjudicated; stale W1-W9 phrases updated; zero W0 hits on the corpus; every prediction held in substance with the kit-delta count wrong and registered | **fresh audit #15: pending** | ## 12. Appendix — HH step-indexed trace diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index da22476..f67e771 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -398,7 +398,7 @@ register alone carries the version). | Item | Status | |---|---| -| Kernel | **v1.21** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (the W0 token grammar — bits {0,1}, gates {h,t}, exact arities, deep through cargo — plus W1-W9, with W4 closed by enumeration: the four representation classes exhaust vvar's collision surface, CONFIRMED-SOUND by audit #13); the leaf guards typed (`species-ans` with arity + bit domain, `species-binder`/`species-leaf`/`species-transport` closing the untyped-stall class — the v1.20/v1.21 wave, bit-identical on every covered output; kernel arms moved twice since v1.11: v1.12/v1.13 KD subtraction and this wave); sixteen permanent regressions, all gating; all six instruments carry exit-code verdicts. **PASS re-claim gated on fresh audit #14** | +| Kernel | **v1.22** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (W0 = the FULL state language as of v1.22 — exact-int bits with bool refused, recursive lp productions whose occurrences resolve to Vars of the term, arrival-lp K(l) cargo, coordinates in language, VB phase in domain — plus W1-W9, with W4 closed by enumeration, CONFIRMED-SOUND by audit #13); the species guards typed at the leaf, binder, and transport arms (bit-identical on every covered output; kernel-arm history lives in the register's §11 rows — summaries of it were twice refuted by literal diff and are abolished); seventeen permanent regressions, all gating; all six instruments carry exit-code verdicts. **PASS re-claim gated on fresh audit #15** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §5): the fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is the hybrid validation — structural admission/isometry plus exact-amplitude dynamic cleanliness plus non-vacuity, strictly beyond Gram (negative controls caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and **self-validating**: every admitted map passes full semantic coverage, else None | From 3cfd7097a03d92860270d8ea08159567e89f55ee Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 22:09:28 -0400 Subject: [PATCH 047/107] =?UTF-8?q?qalc:=20kernel=20v1.23=20=E2=80=94=20al?= =?UTF-8?q?ways-emit=20KD=20bundles;=20typed=20t=20fence;=20sorted=20W0=20?= =?UTF-8?q?language?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #15 (FAIL) confirmed the v1.22 deltas and forcings, then found the first raw-subtype unitarity break since audit #3: omitting empty KD bundles made storage histories non-prefix-free (a fresh decode and a carried-in record collided on identical targets at norm 2), a BULLET in the log passed every invariant and collided via bt1, the lambda-IAM slice equation was unchecked, open terms crashed binder_path inside WF, and the t boundary raised from WF states. v1.23: the certified fire emits its bundle unconditionally — ('KD', ()) when empty — restoring prefix-freeness (section 7.4 restated); t-unimplemented typed scope fence; W0 gains the log sort, the slice equation with a bound-finding binder walk, and the closed-term conjunct; regressions eighteen and nineteen gated. The written-first hinge prediction held: suite, certify, typecheck, polarity byte-identical across a change touching 39 of 58 reachable certified fires — no reachable interference crosses fire histories. Three regression mechanizations updated and two fixture lps corrected, all disclosed, theorems unchanged. Fresh audit #16 launched; the PASS re-claim stays gated on it. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 42 ++++++---- docs/ledger/2026-08.md | 51 ++++++++++++ docs/quantum-algebraic/kernel.md | 128 +++++++++++++++++++++++-------- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 176 insertions(+), 47 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index a740144..0da1ae8 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,10 +413,10 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.22** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.23** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after -fourteen fresh-context rounds. Kernel-arm provenance summaries +fifteen fresh-context rounds. Kernel-arm provenance summaries have been refuted by literal diff twice (audit #13 killed "unmoved since v1.11"; audit #14 showed the corrected summary still incomplete), so the register now names arms per version @@ -479,17 +479,26 @@ excavations clean at symbol level. Audit #14 then confirmed gating 16/16, §8 against typecheck sentence-by-sentence, §12's trace anchors by fresh replay, and the classical-final exemptions against lam_iam — while breaking W0's edges as -above. v1.22 grew W0 to the full language, went exact-int at -the one kernel arm that reads a bit (anshead), and gated it as -regression seventeen (ten countermodels + intact controls; -zero W0 hits on the same 218,546-state corpus; the six kits -whose hand-built helper lps name non-Var positions adjudicated -as out-of-language fixtures, failure counters all still zero; -the audit-#14 kit crashes by construction on the healed -machine, which is itself the healing evidence). What the +above; v1.22 grew W0 to the full language and went exact-int at +the one kernel arm that reads a bit. Audit #15 then delivered +the loop's first raw-subtype UNITARITY break since audit #3: +the certified fire omitted empty KD bundles, so storage +histories were not prefix-free — a fresh decode and a +carried-in record collided on identical targets at norm 2 — +and W0 still admitted a BULLET in the log (another norm-2 +collision via bt1), left the lambda-IAM slice equation +unchecked, and accepted open terms; the t boundary crashed +from WF states. v1.23 answered with the always-emit bundle +discipline (§7.4 restated to strip-the-head injectivity), the +typed t fence, and the sorted language (log alphabet, slice +equation, closed terms) — and the round's written-first HINGE +prediction held: suite, certify, typecheck, and polarity +byte-identical, because no reachable interference crosses fire +histories; the machine change is invisible on every covered +output while closing the raw-subtype collision. What the rounds still found was claim-language and scaffolding, each fixed the same -day: all seventeen permanent regressions now gate mechanically (the +day: all nineteen permanent regressions now gate mechanically (the module verdict is the exit code — forcing any single regression false exits nonzero, measured); `validate()` gained NON-VACUITY at both levels (an entry at an unreachable position and a ghost @@ -502,14 +511,15 @@ claims are scoped to deterministic fields. Nineteen frozen dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; physics table passes on all twenty; all prior audit -kits rerun with every delta adjudicated (out-of-language -fixture lps; the healed-countermodel crash); every v1.22 -prediction held in substance with the kit-delta count wrong and -registered (provenance in the scratchpad prediction files). +kits rerun with every delta adjudicated (ks-display relabels +under always-emit; matrix-coverage shrink under the tightened +language; the healed-countermodel crash); every v1.23 +prediction held including the hinge (provenance in the +scratchpad prediction files). The open docket, in order: -1. **fresh-context independent audit #15 of the v1.22 h-fragment +1. **fresh-context independent audit #16 of the v1.23 h-fragment claim** (verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 952daf3..4b91f16 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -3247,3 +3247,54 @@ visible. Every prediction held in substance; the kit-delta count was wrong and is registered as such. Register, STATUS, token.md updated; fresh audit #15 launched — the PASS re-claim stays gated on it. + +## 2026-08-09 — qALC kernel v1.23: the empty bundle learns to exist; the first unitarity break since audit #3, healed with the physics untouched + +Fresh audit #15 (independent instance, sol tier, the v1.22 pack) +returned FAIL — confirming C1/C2/C4/C5 (the one-condition diff, +the exact delta set with the crash scoped, all seventeen +forcings, and the exact-int repair itself sound against +Fraction(1), int-subclass, and -0.0 probes) and then delivering +the loop's first raw-subtype UNITARITY countermodel since audit +#3's fatal witness: §7.4's incoming-KS disjointness was FALSE. +The certified fire omitted empty KD bundles, so storage +histories were not prefix-free — a fresh certified decode +(cargo ticket, empty incoming storage) and a carried-in record +(ordinary cargo, KD({k}) incoming) produced IDENTICAL targets: +column inner product 1, and (A+B)/sqrt2 reached norm 2 in one +step. Alongside it: W0 admitted a BULLET in the log, which bt1 +happily transported into a b1-collision (norm 2 again, at the +phase level); the lambda-IAM logged-position equation +len(slice) = level(occ) - level(binder) was unchecked (a bad +slice stepped from WF to a W1-invalid target); open terms' +current positions crashed binder_path from inside WF; and the t +boundary raised NotImplementedError on WF states. + +v1.23, predictions written first with the round's hinge stated +as its own falsifiable claim: the certified fire now emits its +bundle UNCONDITIONALLY — an empty bundle is ('KD', ()) — so +target storage is always new-bundle - incoming and the incoming +tail strips off (§7.4 restated to that injectivity). A +pre-fix diagnostic measured the blast radius: 39 of 58 +reachable certified fires had empty bundles, so this was a real +machine change touching most certified graphs. THE HINGE HELD: +suite, certify, typecheck, and polarity byte-identical — every +basis count, marginal, support, physics row, and frozen +certificate — because the empty bundle feeds no guard and no +reachable interference crosses fire histories. The t boundary +became the typed scope fence t-unimplemented. W0 gained the log +SORT (lp-like entries only), the slice equation with a +bound-finding binder walk, and the closed-term conjunct. +Regressions eighteen and nineteen gate it all. Disclosed +mechanization updates, all with theorems unchanged: three +v1.12/v1.13-era regressions now assert the present-but-empty +bundle instead of bundle absence; the v1.11 tcargo pair and the +deep-W4 stripped control got equation-valid carrier lps. Ten +kits' ks-display relabels and the v116/v117 matrices' coverage +shrink (33 hand-built cases, 6 surviving the tightened +language) adjudicated — the subtraction code those matrices +verified is diff-identical since v1.13. The audit-#15 kit's own +KD collision now measures disjoint targets and a clean norm. +Zero W0 hits on the 218,546-state corpus. Register, STATUS, +token.md updated; fresh audit #16 launched — the PASS re-claim +stays gated on it. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 35528c3..991e2d1 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.22.** The kernel is a scratch superposition evolver +**Status: v1.23.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -17,7 +17,7 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #15**, whose +The standing PASS re-claim is **gated on fresh audit #16**, whose verdict will be registered here. Kernel-arm provenance is the chronicle's per-row "what changed" column — summaries of it have been refuted twice by literal diff (audit #13 killed "unmoved @@ -25,12 +25,19 @@ since v1.11"; audit #14 showed the corrected two-wave summary still omitted v1.12's ordinary-decode burial-suppression change and mislabeled v1.21's binder/transport arms as "leaf" guards) — so this register now names arms exactly and only per version: -v1.22 changes ONE arm relative to v1.21 (anshead's answer-bit -check goes exact-int: `type(b) is int`, refusing bool/float -aliases that Python equality admitted), and every covered graph, -certificate, marginal, and physics row measured bit-identical -across it. For anything older, read §11's rows; do not trust a -summary, including this file's former ones. +v1.23 changes TWO arms relative to v1.22: the certified fire +emits its KD bundle UNCONDITIONALLY (an empty bundle is +`('KD', ())` — audit #15 showed the omission made storage +histories non-prefix-free, colliding a fresh decode with a +carried-in record on identical targets at norm 2), and the `t` +boundary is a typed scope fence (`t-unimplemented`) instead of a +raise. Suite, certify, typecheck, and polarity outputs measured +BYTE-IDENTICAL across the change — every basis count, marginal, +support, physics row, and frozen certificate — because the +empty bundle feeds no guard and no reachable interference +crosses fire histories (the round's written-first hinge +prediction, which held). For anything older, read §11's rows; do +not trust a summary, including this file's former ones. This file is the current contract and register only. The round-by-round history — countermodels, corrections, verdicts — @@ -68,7 +75,10 @@ RS ::= canonically sorted set of replay RECORDS R_g(i, b′) push is idempotent, replay reads it wherever it sits KS ::= stack of decode records — inert dead storage: ('K', g, i) one decoded ticket (fire's α-decode) - ('KD', {keys}) certified erasure's tagged bundle + ('KD', {keys}) certified erasure's tagged bundle — + emitted on EVERY certified fire, + empty if no key died bare (v1.23: + prefix-freeness of storage histories) ('K', l) a retained-whole which-path spectator RunDone ::= RunDone(nf, residue) nf ∈ {0̂, 1̂, I, err} Halt ::= Halt(nf, residue, tick) @@ -171,7 +181,12 @@ arrive/fire tape = P_b · μ_g · T, P_0 = l· P_1 = •·l· an outer coin's frame around an inner interference) any P frame with bit ≠ b → pop-err erase (l, P); rs' = Q; leave ('KD', keys) — one tagged - bundle naming every key that died with NO surviving + bundle, emitted on EVERY certified fire (v1.23, audit + #15: an omitted empty bundle made storage histories + non-prefix-free — a fresh decode and a carried-in record + collided on identical targets, norm 2; target storage is + always new-bundle · incoming, so incoming KS strips off), + naming every key that died with NO surviving bit-carrying representation ANYWHERE in the target: keys = (α-keys(l) ∪ keys(P)) \ keys(Q) \ burial-keys(ks) @@ -183,7 +198,8 @@ arrive/fire tape = P_b · μ_g · T, P_0 = l· P_1 = •·l· that ticket; a key buried in a retained-whole K(l′) record keeps the burial as its bit-carrying dead record (refire consults burials via the dead-key set). An empty bundle is - omitted. [sound under fibre conditions (a)–(f), §5] + EMITTED, never omitted. [sound under fibre conditions + (a)–(f) plus the always-emit discipline, §5/§7.4] else, l = α_g(i, b) with bit = slot (DECODE): retain ('K', g, i) — bit-free, branch-equal — UNLESS a same-key frame exists (the ticket was replay-re-emitted; @@ -194,7 +210,11 @@ arrive/fire tape = P_b · μ_g · T, P_0 = l· P_1 = •·l· else (RETAIN-WHOLE): keep ('K', l) — same-slot arrivals with different which-path data stay orthogonal then fire: targets (pos, ↑, γ_g·L, A_g(b′)·T′), amplitudes the - Q_g row for input b; Q_h = H. Other shapes → species. + Q_g row for input b; Q_h = H. g = t → t-unimplemented, a + typed SCOPE FENCE (v1.23, audit #15: h-only is a claim about + programs, and the machine must be total on WF — the raise + crashed from WF states; Q_t over ℤ[ω] stays deliberately + unexercised). Other shapes → species. retrace (pos, ↑, γ_g·L, A_g(b′)·T) → (parent+'f', ↓, L, γ_g·A_g(b′)·T) [bt1's action on the γ head] @@ -239,7 +259,8 @@ errors VB with a non-• non-classifier tape top; ↓-stuck on The guard family — `no-instance`, `alien-ticket`, `frame-conflict`, `recall-err`, `replay-err`, `pop-err`, `species-mu`, `species-ans`, -`species-binder`, `species-leaf`, `species-transport`, `refire`, +`species-binder`, `species-leaf`, `species-transport`, +`t-unimplemented`, `refire`, `key-alias` — is the machine's whole answer to aliasing and misuse: **every detectable manifestation is a typed error, never a silent reinterpretation.** @@ -435,14 +456,22 @@ legacy pop-everything reading and the canonical dicts is claimed. For Run states; reachable ⊆ WF is machine-checked per program, and the machine's unitarity claims quantify over the subtype: -- **W0** (state grammar — v1.21 tokens, v1.22 the FULL language - after audit #14's countermodels): the state language of §2, - mechanized — exact-int bits (bool refused), gates in `{h,t}`, - exact arities, lp productions recursive with every occurrence - resolving to a Var of the term, arrival-lp `K(l)` cargo, - coordinates `d`/`pos` in language, VB phase exact-int in - domain. Machine-phase PLACEMENT of well-formed tokens is the - other invariants' job — W0 is the language, not the protocol. +- **W0** (state grammar — v1.21 tokens, v1.22 the token + language, v1.23 the SORTED language after audit #15's + countermodels): the state language of §2, mechanized — + exact-int bits (bool refused), gates in `{h,t}`, exact + arities, lp productions recursive with every occurrence + resolving to a Var of the CLOSED term AND satisfying the λIAM + logged-position equation `len(slice) = level(occ) − + level(binder)` via a bound-finding binder walk, arrival-lp + `K(l)` cargo, coordinates `d`/`pos` in language, VB phase + exact-int in domain — and SORTED: the log's alphabet is + lp-like productions only (lp/γ/α — `arg` pushes lp-like heads + and `bt2` pushes slices; nothing else ever enters; a BULLET in + the log passed every invariant and `bt1` transported it into a + `b1` collision at norm 2). Machine-phase placement of + well-formed tokens within their sorts is the other invariants' + job — W0 is the language, not the protocol. Grounds §1's output alphabet (`rootval` from a WF VB state can only produce `halt0`/`halt1` — as exact ints) and closes audit #14's stall/crash class: off-language coordinates and @@ -603,7 +632,15 @@ For two certified-fire sources at one boundary: ```text different retained spectator (pos, log, T, incoming KS, retained Q) - ⇒ disjoint targets (targets embed all of it verbatim); + ⇒ disjoint targets. For pos/log/T/Q the targets embed the + coordinate verbatim. For incoming KS the embedding is + new-bundle · incoming with the bundle ALWAYS present + (v1.23): equal targets force equal bundle heads (branch- + equal by condition (e)) and hence equal incoming tails. + Audit #15's countermodel — a fresh decode (bundle {k}, + empty incoming) colliding with a carried-in record (empty + bundle omitted, incoming {k}) — is exactly what the + always-emit discipline forecloses; same spectator, same slot ⇒ the SAME source (W7: the fibre is a function; state identity); same spectator, opposite slots @@ -745,7 +782,7 @@ canonical dicts compared bit-for-bit; `dupcall` canonically None `h(Ω)` → None. Negative controls: pstar × wrong certificate reaches `pop-err`; dupcall × v1.7-era certificate reaches `refire`, all-err. WF/W7/W8/W9 sweeps + mechanized disjointness: -zero violations; **seventeen permanent regressions** (the v1.6 pair; +zero violations; **nineteen permanent regressions** (the v1.6 pair; extra-frame collision, W7-excluded with disjoint targets; doctored bundle divergence; K+frame alias; retained-Q disjointness — spectator-bit columns share zero targets; @@ -780,7 +817,12 @@ shallow ticket instances, non-lp frame/K/KD instances) and the coordinate violations (alien d, alien path component, off-tree path, non-Var lp occurrence) all W0-flagged, with the exact-int bits and the kit-exact foreign-lp classical final as intact -controls). The +controls; log-sort/slice-equation — bullet/answer/mu/rho log +entries W0-flagged, the slice-length violation and the +open-term state W0-flagged, an lp log entry intact; KS +prefix-freeness — audit #15's fresh-decode/carried-in pair +produces DISJOINT targets with the empty bundle explicit, and +the t boundary is typed with the h-fire control intact). The gating structure, stated exactly (audits #6 and #7 each caught a computed-but-non-gating verdict; audit #8 forced all eleven then-regressions @@ -789,15 +831,29 @@ independently forced all thirteen then-flags plus every instrument component — fourteen forcings — each to exit 1; audit #13 confirmed the fifteen-gate structure 15/15; audit #14 confirmed sixteen-for-sixteen with independent forcings -including ok_gr): +including ok_gr; audit #15 confirmed seventeen-for-seventeen): the v1.6 pair -gates `collisions_under_wf()`; the other fifteen gate +gates `collisions_under_wf()`; the other seventeen gate `cert_sweep()`'s return; the module `__main__` conjoins all three sweeps in its printed total AND ITS EXIT CODE, so any single regression failure exits nonzero (measured: forcing the pair false → exit 1; forcing cert_sweep flags false → exit 1, -including the v1.20, v1.21, and v1.22 flags; the -emulated-old-arm probe flips `cert_sweep` to FAIL). +including the v1.20 through v1.23 flags; the +emulated-old-arm probe flips `cert_sweep` to FAIL). Three +v1.12/v1.13-era regression mechanizations were updated in v1.23 +to the always-emit discipline (their targets now carry the +explicit empty bundle; the theorems they guard — no key with a +surviving representation enters the bundle — are unchanged and +still measured True), and two hand-built fixture lps (the v1.11 +tcargo pair and the deep-W4 stripped control) were corrected to +satisfy the lambda-IAM slice equation, countermodel essence +untouched in every case. Old kits' hand-built subtraction +MATRICES now exercise fewer cases under the tightened language +(the v116/v117 kits: 33 originally, 6 surviving) — their +historical confirmations stand as records of then-language +runs, and the subtraction code they verified is diff-identical +since v1.13 (the v1.23 arm change touches only the bundle's +EMISSION, not its computation). Conservation: exhaustive ≤ size 11, 14,452 surfacings at ≤10 / 55,727 at ≤11, zero failures. Polarity/terminal chains/gauge: zero violations, @@ -913,7 +969,14 @@ gram()/run_dyn() as exactly what §10's numbers claim (amplitude-blind canonical BFS; exact-amplitude evolution with zero-amplitude pruning), the classical-final exemptions REAL against lam_iam.step_classical, and the v114 placeholder-key -adjudication in both directions. Basis counts vs v1.2 reference: `negative` 103→83, +adjudication in both directions; audit #15 confirmed the +exact-int repair sound against Fraction(1), int-subclass, and +-0.0 probes, the v1.21→v1.22 one-condition diff, and all +seventeen then-forcings — and its two countermodel classes +(prefix-freeness, language sorting) are healed and gated as +regressions eighteen and nineteen, with the fresh-decode/ +carried-in pair measured disjoint and the 39 reachable +empty-bundle fires (of 58 certified) now emitting explicitly. Basis counts vs v1.2 reference: `negative` 103→83, `selector` 173→106, `pstar` 458→242 — v1.7-era, real, owned; marginals and supports never moved. All measurements seconds-scale on the M5 Max. @@ -989,10 +1052,15 @@ no bare-term ideal oracle). | v1.19 | W4 goes DEEP (live same-instance tickets through tape/log slice cargo; the unreachable countermodel excluded from the subtype; stripped control proves no over-tightening); thirteenth gated regression; ALL SIX instruments carry exit-code verdicts (typecheck gains its printed fragment total); kernel.py cert/rs doc lines and two invalid docstring escapes fixed (one long-standing, surfaced by recompile); full decruft sweep per a9's directive; every prediction held, the v118 kit's no-op suite probe adjudicated | **fresh audit #12: FAIL** (first audit-found kernel-arm defect since audit #5's fire-arm countermodel — the anshead species check was an untyped ASSERT and never consulted the leaf, silently accepting matched foreign markers; W4 still leaked on same-key bit-free storage (→W8 target) and conflicting burials (→W3 target); reachable rootval rows and answer-species behavior absent from §3's table; C2's "exactly" missed the SyntaxWarning removal; stale "twelve regressions" pack label; Run.ks docstring incomplete. CONFIRMED: C4 by fully independent forcing of fourteen components, all thirteen gates, machine diff-clean vs the v1.18 snapshot, token.md §2 lockstep 2,622 terms/47,420 steps zero mismatches, deep-W4 zero over-tightening on 218,546 generated states, F on 116 edges) | | v1.20 | W4 CLOSED by enumeration (`W4-storage` + `W4-burial` join frame/ticket; the four classes exhaust what the vvar-emitted ticket can collide with; agreeing burial admissible, its target measured WF; entry-vs-region closure stated honestly); `species-ans` types the anshead species check — leaf = γ = A — the ONE kernel-arm change since v1.11, bit-identical on every covered output; regressions fourteen (five-case storage/burial table) and fifteen (four-case species incl. the retrace chain) gated; §3 gains the species-ans, rootval, and verr rows; GUARD_RULES, guard docstrings, Run.ks docstring corrected; pack WF label count-neutral; zero storage/burial hits on the audit's own 300-program corpus; every prediction held (one wrong detail registered: wf prints no count line) | **fresh audit #13: FAIL** (the W4 closure CONFIRMED-SOUND by the auditor's own nine-row enumeration, agreeing-burial verified non-leaking, gating 15/15, cert/polarity/conservation excavations clean; the findings: the answer-bit DOMAIN was nowhere stated or enforced — ANS('h',2) was WF and flowed through anshead to an out-of-alphabet halt2, malformed tuples satisfied is_ans and crashed untyped, a γ/A pair meeting a binder stalled silently; and the honesty catch that "one kernel-arm change since v1.11" was FALSE — v1.12/v1.13 changed the fire arm's KD subtraction, as this chronicle's own rows document; plus two stale counts and C2's "seven kits" for eight) | | v1.21 | W0 joins the subtype (state/token grammar: bits {0,1}, gates {h,t}, exact arities, deep through slice/burial cargo, VB phase in domain — position-appropriateness stays the other invariants' job); anshead hardens to arity + domain (species-ans, never ValueError, never halt2); the untyped-stall class closes with three typed guards (species-binder, species-leaf, species-transport; foreign-lp and empty-tape finals stay classical finals by design); regression sixteen gated; kernel-arm provenance restated exactly (two waves since v1.11: v1.12/v1.13 KD subtraction, v1.20/v1.21 leaf guards — each measured no-op/bit-identical on covered outputs); counts go count-neutral in the standing prose; the v114 kit's placeholder-key probe adjudicated (out-of-language tokens, W0 working as specified); zero W0 hits on the 218,546-state corpus; every prediction held | **fresh audit #14: FAIL** (C5 CONFIRMED 16/16 with independent forcings; §8, §12's trace anchors, gram/run_dyn, the classical-final exemptions, and the v114 adjudication all CONFIRMED. The findings: W0's bit check used Python equality — 1.0/True/0.0/False are ==-equal to bits, so ANS('h',1.0) was WF and rootval string-formatted it into the out-of-alphabet terminal KINDS halt1.0/haltTrue; W0 never checked K(l) cargo shape, ticket/frame/storage instance fields recursively, or the state coordinates at all — d='X' and alien paths were WF and silently stalled, off-tree paths and non-Var lp occurrences were WF and crashed in subterm/binder_path; the "position-appropriateness is the other invariants' job" sentence was refuted (no other invariant does d/path/lp validity); C2 missed the diag capture's own label delta; and the corrected two-wave provenance summary was STILL incomplete — v1.12 also changed the ordinary decode arm, and "leaf-guard wave" mislabeled the binder/transport arms) | -| v1.22 | W0 becomes the FULL state language: exact-int bits (bool refused — the terminal-kind minting), recursive lp productions with occurrences resolving to Vars of the term, arrival-lp K(l) cargo, coordinates d/path in language, VB phase exact-int; anshead's bit check exact-int (the one arm change, bit-identical on covered outputs); regression seventeen (state-language: ten countermodels + exact-int and kit-exact foreign-lp controls) gated; provenance summaries abolished — the register names arms per version only and defers history to these rows; the wf.py v1.12 fixture's App-naming carrier lp corrected (countermodel essence untouched); six kits' helper-lp wf-columns and the v121 kit's crash-by-construction adjudicated; stale W1-W9 phrases updated; zero W0 hits on the corpus; every prediction held in substance with the kit-delta count wrong and registered | **fresh audit #15: pending** | +| v1.22 | W0 becomes the FULL state language: exact-int bits (bool refused — the terminal-kind minting), recursive lp productions with occurrences resolving to Vars of the term, arrival-lp K(l) cargo, coordinates d/path in language, VB phase exact-int; anshead's bit check exact-int (the one arm change, bit-identical on covered outputs); regression seventeen (state-language: ten countermodels + exact-int and kit-exact foreign-lp controls) gated; provenance summaries abolished — the register names arms per version only and defers history to these rows; the wf.py v1.12 fixture's App-naming carrier lp corrected (countermodel essence untouched); six kits' helper-lp wf-columns and the v121 kit's crash-by-construction adjudicated; stale W1-W9 phrases updated; zero W0 hits on the corpus; every prediction held in substance with the kit-delta count wrong and registered | **fresh audit #15: FAIL** (C1/C2/C4/C5 CONFIRMED — the v1.21→v1.22 diff exactly the exact-int condition, the delta set exact with the crash scoped, all seventeen forcings, the exact-bit repair itself sound against Fraction/int-subclass/-0.0 probes. The findings: THE FIRST RAW-SUBTYPE UNITARITY BREAK SINCE AUDIT #3 — §7.4's incoming-KS disjointness is false because the certified fire omitted empty KD bundles: a fresh decode and a carried-in record produced IDENTICAL targets, inner product 1, norm 2; W0 admitted BULLET in the log (bt1 transported it into a b1 collision, norm 2 again), never checked the lambda-IAM slice equation (a bad slice stepped to a W1-invalid target), and accepted open terms whose current position crashes binder_path; the t boundary raised NotImplementedError from WF states; "full state language" and the placement sentence refuted with them) | +| v1.23 | The certified fire emits its bundle UNCONDITIONALLY — ('KD', ()) when empty — restoring storage-history prefix-freeness (§7.4 restated to the strip-the-head injectivity); the t boundary becomes the typed scope fence t-unimplemented; W0 gains the log SORT (lp-like entries only), the lambda-IAM slice equation with a bound-finding binder walk, and the closed-term conjunct; regressions eighteen (log-sort/slice-equation) and nineteen (KS prefix-freeness + t fence) gated; three v1.12/v1.13-era regression mechanizations updated to the always-emit form and two fixture lps corrected to the slice equation (theorems and countermodel essences unchanged, all disclosed); THE HINGE PREDICTION, written first, HELD: suite, certify, typecheck, and polarity byte-identical — no reachable interference crosses fire histories, so the machine change is invisible on every covered output; ten kits' ks-display deltas and the matrix-coverage shrink adjudicated; zero W0 hits on the corpus | **fresh audit #16: pending** | ## 12. Appendix — HH step-indexed trace +(As of v1.23, every post-fire state additionally carries the +explicit `('KD', ())` bundle in KS — not displayed in these rows; +rules, tape shapes, and timings are unchanged.) + Notation: `b` = bullet, `L(path|n)` = logged position (slice length n), `gh/mh` = `γ_h`/`μ_h`, `Ahb′` = `A_h(b′)`, `ahb′` = `α_h(b′)`, `R` = ρ. Amplitude `m/r2^k` = `m·2^(−k/2)`. Term paths: wrapper diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index f67e771..b122448 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -398,7 +398,7 @@ register alone carries the version). | Item | Status | |---|---| -| Kernel | **v1.22** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (W0 = the FULL state language as of v1.22 — exact-int bits with bool refused, recursive lp productions whose occurrences resolve to Vars of the term, arrival-lp K(l) cargo, coordinates in language, VB phase in domain — plus W1-W9, with W4 closed by enumeration, CONFIRMED-SOUND by audit #13); the species guards typed at the leaf, binder, and transport arms (bit-identical on every covered output; kernel-arm history lives in the register's §11 rows — summaries of it were twice refuted by literal diff and are abolished); seventeen permanent regressions, all gating; all six instruments carry exit-code verdicts. **PASS re-claim gated on fresh audit #15** | +| Kernel | **v1.23** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (W0 = the SORTED state language as of v1.23 — exact-int bits, recursive lp productions satisfying the lambda-IAM slice equation with occurrences resolving to bound Vars of the closed term, the log's lp-like alphabet, arrival-lp K(l) cargo, coordinates in language — plus W1-W9, with W4 closed by enumeration and §7.4's storage prefix-freeness restored by the always-emit bundle discipline after audit #15's norm-2 countermodel, the first raw-subtype unitarity break since audit #3, healed with every covered output byte-identical); the species guards and the t scope fence typed; nineteen permanent regressions, all gating; all six instruments carry exit-code verdicts; kernel-arm history lives in the register's §11 rows. **PASS re-claim gated on fresh audit #16** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §5): the fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is the hybrid validation — structural admission/isometry plus exact-amplitude dynamic cleanliness plus non-vacuity, strictly beyond Gram (negative controls caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and **self-validating**: every admitted map passes full semantic coverage, else None | From 49e25caf7f2f2c0853aa5ebb3383f6e069951851 Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 22:52:16 -0400 Subject: [PATCH 048/107] =?UTF-8?q?qalc:=20kernel=20v1.24=20=E2=80=94=20ev?= =?UTF-8?q?ery=20fire=20appends=20exactly=20one=20arm-typed=20head;=20audi?= =?UTF-8?q?t=20#16=20registered?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #16 (cx-20260809-220901-b2f9) FAILED v1.23 with the audit-#15 sibling: the suppressed-decode arm appended zero storage heads, so a suppressed decode forged a retain-whole fire's history (norm 2, both suppression variants), plus W0's Var(0)/list-container holes and three stale lines. It also confirmed the v1.23 hinge independently (re-executed v1.22 sources; 5,760-state fire-history search; the stronger append-only form derived). v1.24: the KA history head — every fire arm appends exactly one arm-typed head (KD/K3/KA/K2), §7.4 restated to the all-arms discipline; the head carries its key (author two-key sibling, norm 2 pre-fix, dies with it); KA excluded from dead/bitfree sets by design. W0 gains exact-type purity (non-hashing pre-pass; hostile __hash__/__eq__ foreclosed) and 1-indexed closedness. Regressions 20/21 gated; 21/21 forced-exit-1; arm census 58/69/10/0 makes the hinge a reachability fact — four instruments byte-identical on first run. One wrong prediction registered (kit-delta clause missed the v113/v114 raw-fire displays). Fresh audit #17 launched; PASS re-claim gated on it. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 41 ++++-- docs/ledger/2026-08.md | 81 +++++++++++ docs/quantum-algebraic/kernel.md | 228 +++++++++++++++++++++++-------- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 285 insertions(+), 67 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 0da1ae8..212e707 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,10 +413,10 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.23** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.24** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after -fifteen fresh-context rounds. Kernel-arm provenance summaries +sixteen fresh-context rounds. Kernel-arm provenance summaries have been refuted by literal diff twice (audit #13 killed "unmoved since v1.11"; audit #14 showed the corrected summary still incomplete), so the register now names arms per version @@ -495,10 +495,33 @@ equation, closed terms) — and the round's written-first HINGE prediction held: suite, certify, typecheck, and polarity byte-identical, because no reachable interference crosses fire histories; the machine change is invisible on every covered -output while closing the raw-subtype collision. What the +output while closing the raw-subtype collision. Audit #16 +confirmed that hinge INDEPENDENTLY (re-executed the v1.22 +sources; searched 5,760 states plus 300 generated bodies for +mixed fire-count merges, found zero, and derived the stronger +form — append-only KS makes them impossible) and then forged +the SAME collision through the arms v1.23 didn't cover: the +suppressed-decode fire appends zero storage heads, so a +suppressed decode with incoming [K(l)] impersonates a +retain-whole fire with incoming [] — identical targets, norm 2, +both suppression variants; it also caught W0 accepting Var(0) +(the 1-indexed de Bruijn convention AGENTS.md warns about, +violated in our own checker) and list-typed containers. v1.24 +answered with the one-head-per-fire discipline — every fire arm +appends exactly one arm-typed storage head; the suppressed +arm's ('KA', g, i) carries its key because a two-key +double-suppression sibling (author-found during fix design, +measured norm 2 pre-fix) would survive a contentless marker — +and W0's exact-type purity (registers checked without hashing, +so hostile __hash__/__eq__ can neither crash nor poison the +checker) plus 1-indexed closedness. The hinge was cheaper this +round: the four instruments byte-identical because the +suppressed arm is REACHABLY DEAD CODE on the whole canonical +suite (arm census measured first: 58 certified / 69 +retain-whole / 10 decode-recorded / 0 suppressed). What the rounds still found was claim-language and scaffolding, each fixed the same -day: all nineteen permanent regressions now gate mechanically (the +day: all twenty-one permanent regressions now gate mechanically (the module verdict is the exit code — forcing any single regression false exits nonzero, measured); `validate()` gained NON-VACUITY at both levels (an entry at an unreachable position and a ghost @@ -512,14 +535,16 @@ certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; physics table passes on all twenty; all prior audit kits rerun with every delta adjudicated (ks-display relabels -under always-emit; matrix-coverage shrink under the tightened -language; the healed-countermodel crash); every v1.23 -prediction held including the hinge (provenance in the +under always-emit and now under the KA head; matrix-coverage +shrink under the tightened language; the healed-countermodel +crash); every v1.24 prediction held including the hinge, with +one registered wrong call — the kit-delta clause missed that +two kits build raw suppressed-decode fires (provenance in the scratchpad prediction files). The open docket, in order: -1. **fresh-context independent audit #16 of the v1.23 h-fragment +1. **fresh-context independent audit #17 of the v1.24 h-fragment claim** (verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 4b91f16..59589f6 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -3298,3 +3298,84 @@ KD collision now measures disjoint targets and a clean norm. Zero W0 hits on the 218,546-state corpus. Register, STATUS, token.md updated; fresh audit #16 launched — the PASS re-claim stays gated on it. + +## 2026-08-09 — qALC kernel v1.24: every fire learns to sign its work; the auditor forges the same collision through the other door + +Audit #16 (fresh instance, sol tier, threadless) FAILED v1.23 — +and first CONFIRMED the round it was auditing, independently and +at depth: it re-executed the v1.22 sources extracted from the +prior pack and reproduced the hinge's byte-identity itself; +tracked certified-fire counts across 5,760 states of all +nineteen certified graphs plus 300 generated bodies (zero +mixed-count merges); and derived the STRONGER form of the hinge +reason — KS is append-only and each certified fire adds exactly +one entry, so histories with different fire counts cannot merge +at all. It confirmed the certified arm's prefix-freeness +narrowly sound (nested bundles cannot defeat tuple-head/tail +injectivity), the binder equation against lam_iam.binder_path +on every reachable lp (100,763 occurrences, zero mismatches), +gating nineteen-for-nineteen plus fourteen instrument +components, and every disclosed v1.23 fixture update +theorem-preserving. + +Then the countermodel: the AUDIT-#15 SIBLING. v1.23 taught the +CERTIFIED fire to append exactly one storage head; the +suppressed-decode arm still appended ZERO — that is what the +suppression was. So a suppressed decode whose incoming KS +already reads [K(l)] and a retain-whole fire with incoming [] +produce IDENTICAL targets — inner product 1, norm 2 at step +one — through BOTH suppression variants (same-key frame, +agreeing burial), on the shipped HH program's own uncertified +boundary, W0-W9 and W7 clean. Explicitly not the registered +alias gap: ticket+frame and ticket+agreeing-burial are legal +lifecycle configurations. Alongside it, two W0 totality holes: +closed() accepted Var(0) — `i <= depth` under the 1-INDEXED de +Bruijn convention, the exact convention AGENTS.md warns bites +everyone, violated in our own checker (binder_path IndexError +one step inside WF) — and nothing sorted the CONTAINERS (a +list-valued tape passed WF; the fire's tuple concatenation +TypeError'd). Plus three stale lines, including §9's gate +sentence still naming audit #15. + +v1.24, predictions written first, arm census measured before +them: every fire arm now appends EXACTLY ONE arm-typed storage +head — KD certified, K3 decode-recorded, ('KA', g, i) +decode-suppressed, K2 retain-whole — restoring prefix-freeness +across ALL arms (§7.4 restated). The KA head CARRIES ITS KEY +because of an author-found sibling the auditor never built: two +different tickets both suppressing over a shared two-frame RS +also collide (measured norm 2 pre-fix); a contentless +"suppressed here" marker would kill the auditor's pairs and +leave that one alive. KA is history, not a dead record — +excluded from ks_dead_keys and ks_bitfree_keys by design, so +refire, key-alias, W8, and W4-storage stay blind and a +replay-re-emitted ticket still recalls and re-fires. W0 gained +exact-type PURITY (the five registers are exact tuples of exact +tuples/str/int, checked WITHOUT HASHING before any scan — +audit #15's binder_path lesson one level down: the lp cache and +key dicts hash state content, so a nested tuple-subclass with a +hostile __hash__ would have crashed the checker and a hostile +__eq__ could have poisoned it; impure states early-return W0) +and the 1-indexed closedness. The hinge was CHEAPER this round: +the arm census (58 certified / 69 retain-whole / 10 +decode-recorded / 0 suppressed reachable fires, the certified +count matching the auditor's independent 58) shows the +suppressed arm is reachably DEAD CODE on the whole canonical +suite, so byte-identity of suite/certify/typecheck/polarity +follows from reachability, not an interference argument — and +it held on the first run after the arm change. Regressions +twenty (fire prefix-freeness: the auditor's two pairs + the +author sibling + a recorded-arm control) and twenty-one (W0 +totality II: Var(0), list tape, hostile-hash subclass flagged +without a crash, tuple control WF) gate it all; +twenty-one-for-twenty-one under forcing, all six instruments +exit-code clean, zero corpus hits. One prediction WRONG and +registered: the kit-delta clause said no kit's ks display +would change — I grepped the instruments for suppressed-decode +mechanizations but not the KITS; the v113/v114 kits build raw +suppressed-decode fires and their displays gain the KA head +(semantic columns unchanged). The v121 kit's crash and the +v122 kit's healed readings byte-identical. Register (header, +§2, §3, §6, §7.4, §9, §10, §11, §12), STATUS, token.md +updated; fresh audit #17 launched — the PASS re-claim stays +gated on it. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 991e2d1..da94b98 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.23.** The kernel is a scratch superposition evolver +**Status: v1.24.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -17,7 +17,7 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #16**, whose +The standing PASS re-claim is **gated on fresh audit #17**, whose verdict will be registered here. Kernel-arm provenance is the chronicle's per-row "what changed" column — summaries of it have been refuted twice by literal diff (audit #13 killed "unmoved @@ -25,19 +25,30 @@ since v1.11"; audit #14 showed the corrected two-wave summary still omitted v1.12's ordinary-decode burial-suppression change and mislabeled v1.21's binder/transport arms as "leaf" guards) — so this register now names arms exactly and only per version: -v1.23 changes TWO arms relative to v1.22: the certified fire -emits its KD bundle UNCONDITIONALLY (an empty bundle is -`('KD', ())` — audit #15 showed the omission made storage -histories non-prefix-free, colliding a fresh decode with a -carried-in record on identical targets at norm 2), and the `t` -boundary is a typed scope fence (`t-unimplemented`) instead of a -raise. Suite, certify, typecheck, and polarity outputs measured -BYTE-IDENTICAL across the change — every basis count, marginal, -support, physics row, and frozen certificate — because the -empty bundle feeds no guard and no reachable interference -crosses fire histories (the round's written-first hinge -prediction, which held). For anything older, read §11's rows; do -not trust a summary, including this file's former ones. +v1.24 changes ONE arm relative to v1.23: the suppressed-decode +fire appends an inert arm-typed history head `('KA', g, i)` +instead of appending NOTHING — audit #16 showed the zero-append +let a suppressed decode (incoming KS already `[K(l)]`) +impersonate a retain-whole fire (incoming `[]`, prepending +`K(l)`) on identical targets at norm 2, through both the +same-key-frame and the agreeing-burial suppression variants. +Every fire arm now appends EXACTLY ONE arm-typed storage head +(§7.4). The head carries its key because two different tickets +both suppressing over a shared two-frame RS also collided (the +author sibling, measured at norm 2 pre-fix; a contentless marker +would have left it alive). KA is HISTORY, not a dead record: the +suppressed key's answerable representation survives in the +frame/burial, so `ks_dead_keys` and `ks_bitfree_keys` exclude it +by design — refire, key-alias, W8, and W4-storage stay blind, +and a replay-re-emitted ticket still recalls and re-fires. +Suite, certify, typecheck, and polarity outputs measured +BYTE-IDENTICAL across the change — this round not by an +interference argument but because the suppressed arm is +REACHABLY DEAD CODE on the whole canonical suite (arm census, +measured first: 58 certified / 69 retain-whole / 10 +decode-recorded / 0 suppressed reachable fires). For anything +older, read §11's rows; do not trust a summary, including this +file's former ones. This file is the current contract and register only. The round-by-round history — countermodels, corrections, verdicts — @@ -73,13 +84,22 @@ VB ::= ∅ | (g, b′, k) k ∈ {0,1,2} — virtual-boolean phase RS ::= canonically sorted set of replay RECORDS R_g(i, b′) — one per (gate, instance); transport-inert; recall's push is idempotent, replay reads it wherever it sits -KS ::= stack of decode records — inert dead storage: +KS ::= stack of storage heads — inert history; EVERY fire + appends EXACTLY ONE (v1.24: prefix-freeness across + all arms — incoming KS is the tail after stripping + one head): ('K', g, i) one decoded ticket (fire's α-decode) ('KD', {keys}) certified erasure's tagged bundle — emitted on EVERY certified fire, - empty if no key died bare (v1.23: - prefix-freeness of storage histories) + empty if no key died bare (v1.23) ('K', l) a retained-whole which-path spectator + ('KA', g, i) suppressed decode's history head — + NOT a dead record: the key's + answerable representation survives + in the frame/burial, so it is + excluded from ks_dead_keys and + ks_bitfree_keys (refire, key-alias, + W8, W4-storage stay blind) RunDone ::= RunDone(nf, residue) nf ∈ {0̂, 1̂, I, err} Halt ::= Halt(nf, residue, tick) residue = the COMPLETE pre-entry state (injectivity of terminals) @@ -90,23 +110,37 @@ tape/log entries: • | logged position l | γ_g | μ_g | A_g(b′) `γ_g` (gate boundary marker), `μ_g` (probe frame), `A_g(b′)` (fired answer token), `α_g(i, b′)` (answer ticket, instance-tagged), `ρ` -(root frame). **The state language (v1.21/v1.22, audits -#13/#14 — enforced by W0)**: every bit is an EXACT int in -`{0, 1}` (bool is a Python subclass of int and is refused — -`rootval` string-formats the bit, so `1.0`/`True` would mint -out-of-alphabet terminal kinds `halt1.0`/`haltTrue`); every gate -kind in `{h, t}`; exact tuple arities; lp productions recursive -wherever they appear (slices, ticket/frame instances, K/KD -keys), with path components in `{f, a, b}` and every occurrence -resolving to a `Var` of the term (the machine only mints lps at -Var positions); retained-whole `K(l)` cargo is an ARRIVAL lp -(`L` or `AL`); the state coordinates in language (`d ∈ {↓, ↑}`, -`pos` resolving in the term); the VB phase exact-int with -`k ∈ {0, 1, 2}`. Machine-PHASE placement of well-formed tokens -is the other invariants' job — W0 is the language, not the -protocol. Before v1.21, `A_h(2)` was WF and flowed to -`halt2`; before v1.22, `A_h(True)` still was, and off-language -coordinates stalled silently or crashed inside WF. +(root frame). **The state language (v1.21–v1.24, audits +#13–#16 — enforced by W0)**: exact-type PURITY first — the five +registers are exact tuples of exact tuples/str/int, checked +WITHOUT HASHING before any scan (a list-valued tape passed WF +and TypeError'd in the fire; a nested tuple-subclass with a +hostile `__hash__` would crash the checker's own caches, and a +hostile `__eq__` could poison them — impure states early-return +W0 and W1-W9 are not adjudicated over them); every bit an EXACT +int in `{0, 1}` (bool is a Python subclass of int and is +refused — `rootval` string-formats the bit, so `1.0`/`True` +would mint out-of-alphabet terminal kinds `halt1.0`/`haltTrue`); +every gate kind in `{h, t}`; exact tuple arities; lp productions +recursive wherever they appear (slices, ticket/frame instances, +K/KD/KA keys), with path components in `{f, a, b}` and every +occurrence resolving to a BOUND `Var` of the CLOSED term — +1-INDEXED, so `Var(0)` is no variable (audit #16: `i <= depth` +alone accepted it and `binder_path` IndexError'd one step +later — the exact convention the repo's own conventions doc +warns about) — satisfying the λIAM logged-position equation +`len(slice) = level(occ) − level(binder)`; the log a separate +SORT (lp-like entries only); retained-whole `K(l)` cargo an +ARRIVAL lp (`L` or `AL`); the state coordinates in language +(`d ∈ {↓, ↑}`, `pos` resolving in the term); the VB phase +exact-int with `k ∈ {0, 1, 2}`. Machine-PHASE placement of +well-formed tokens is the other invariants' job — W0 is the +language, not the protocol. Before v1.21, `A_h(2)` was WF and +flowed to `halt2`; before v1.22, `A_h(True)` still was, and +off-language coordinates stalled silently or crashed inside WF; +before v1.23, BULLET rode the log into a b1 collision; before +v1.24, `Var(0)` and list containers passed WF and crashed one +step later. **Instance** `i` = the invoking occurrence's logged position — always at log head when the token stands at the gate leaf (arg-entry is structurally forced); a logged position names a @@ -205,8 +239,17 @@ arrive/fire tape = P_b · μ_g · T, P_0 = l· P_1 = •·l· same-key frame exists (the ticket was replay-re-emitted; the frame remains the answerable representation) or a same-key burial exists (the buried ticket remains the - bit-carrying dead record); either way no record is - created: W8 exclusivity by construction + bit-carrying dead record); in the suppressed case no DEAD + RECORD is created (W8 exclusivity by construction) but + the arm still appends its one history head ('KA', g, i) — + v1.24, audit #16: appending nothing let a suppressed + decode impersonate a retain-whole fire on identical + targets (norm 2, both suppression variants), and the head + carries the KEY because two different tickets suppressing + over a shared two-frame RS collided too (the author + sibling). KA feeds no guard: ks_dead_keys and + ks_bitfree_keys exclude it, so a replay off the surviving + frame stays legal else (RETAIN-WHOLE): keep ('K', l) — same-slot arrivals with different which-path data stay orthogonal then fire: targets (pos, ↑, γ_g·L, A_g(b′)·T′), amplitudes the @@ -457,14 +500,20 @@ For Run states; reachable ⊆ WF is machine-checked per program, and the machine's unitarity claims quantify over the subtype: - **W0** (state grammar — v1.21 tokens, v1.22 the token - language, v1.23 the SORTED language after audit #15's - countermodels): the state language of §2, mechanized — - exact-int bits (bool refused), gates in `{h,t}`, exact - arities, lp productions recursive with every occurrence - resolving to a Var of the CLOSED term AND satisfying the λIAM - logged-position equation `len(slice) = level(occ) − - level(binder)` via a bound-finding binder walk, arrival-lp - `K(l)` cargo, coordinates `d`/`pos` in language, VB phase + language, v1.23 the SORTED language, v1.24 exact-type purity + after audits #14–#16's countermodels): the state language of + §2, mechanized — exact-type PURITY first (the five registers + are exact tuples of exact tuples/str/int, verified WITHOUT + HASHING before any scan; impure states early-return W0, so a + hostile `__hash__`/`__eq__` can neither crash nor poison the + checker's caches, and list containers no longer pass); exact- + int bits (bool refused), gates in `{h,t}`, exact arities, lp + productions recursive with every occurrence resolving to a + BOUND Var of the CLOSED term — 1-INDEXED: `Var(0)` refused — + AND satisfying the λIAM logged-position equation `len(slice) = + level(occ) − level(binder)` via a bound-finding binder walk, + arrival-lp `K(l)` cargo, the `('KA', g, i)` history-head + production, coordinates `d`/`pos` in language, VB phase exact-int in domain — and SORTED: the log's alphabet is lp-like productions only (lp/γ/α — `arg` pushes lp-like heads and `bt2` pushes slices; nothing else ever enters; a BULLET in @@ -628,6 +677,27 @@ ways as virtual ancestry predicts. ### 7.4 Range disjointness (on WF∧W7, corrected statement) +**Storage-history discipline (v1.24, all arms):** every fire arm +appends EXACTLY ONE storage head, and the head species names the +arm — `('KD', keys)` certified, `('K', g, i)` decode-recorded, +`('KA', g, i)` decode-suppressed, `('K', l)` retain-whole — so +incoming KS is always the tail after stripping one head, and the +head species can never be forged across arms: KD is confined to +certified positions (certification is a program-level property +of the position), the other three have pairwise-distinct +tags/arities, and suppressed-vs-recorded at one target is doubly +impossible (distinct tags, and the suppression condition is a +function of the target's RS and KS-tail). Within one arm the +head content plus the slot recovers the cargo key (certified: +the fibre condition; decode/suppressed: the head's key; +retain-whole: the head's lp). Audit #16's countermodels — a +suppressed decode impersonating a retain-whole fire through +either suppression variant, at norm 2 — and the author's two-key +double-suppression sibling are exactly what the +one-head-per-fire discipline forecloses; audit #15's +empty-bundle collision was the certified arm's instance of the +same defect. + For two certified-fire sources at one boundary: ```text @@ -741,7 +811,9 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#15; the verdict will be registered here.** +#17; the verdict will be registered here.** (Audit #16 caught +this very sentence still naming audit #15 — the §1 gate and this +one are now updated together.) ## 10. Verification state @@ -782,15 +854,17 @@ canonical dicts compared bit-for-bit; `dupcall` canonically None `h(Ω)` → None. Negative controls: pstar × wrong certificate reaches `pop-err`; dupcall × v1.7-era certificate reaches `refire`, all-err. WF/W7/W8/W9 sweeps + mechanized disjointness: -zero violations; **nineteen permanent regressions** (the v1.6 pair; +zero violations; **twenty-one permanent regressions** (the v1.6 pair; extra-frame collision, W7-excluded with disjoint targets; doctored bundle divergence; K+frame alias; retained-Q disjointness — spectator-bit columns share zero targets; duplicate-ticket W9; retained-Q KD — a cargo key with a retained frame leaves an EMPTY bundle, targets WF-clean; bitfree-burial — -a buried key stays the sole bit-carrying record, no KD beside it; -popped-frame + surviving ticket — the T-riding ticket stays the -answerable representation, no KD, targets WF-clean; +a buried key stays the sole bit-carrying record, the key OUT of +the (explicitly present, v1.23) bundle beside it; popped-frame + +surviving ticket — the T-riding ticket stays the answerable +representation, the key out of the explicit bundle, targets +WF-clean; vacuous-position — a certificate entry at an unreachable position must fail `machine_coverage` while the canonical map passes; ghost-key — an inert popkey occurring in no arrival @@ -822,7 +896,15 @@ entries W0-flagged, the slice-length violation and the open-term state W0-flagged, an lp log entry intact; KS prefix-freeness — audit #15's fresh-decode/carried-in pair produces DISJOINT targets with the empty bundle explicit, and -the t boundary is typed with the h-fire control intact). The +the t boundary is typed with the h-fire control intact; fire +prefix-freeness — audit #16's frame-skip and burial-skip pairs +AND the author two-key double-suppression pair each produce +disjoint targets with the `('KA', g, i)` head explicit in every +suppressed target, the decode-recorded arm an intact control; +W0 totality II — the `Var(0)` state and the list-tape state are +W0-flagged at source, a hostile-hash tuple-subclass is +W0-flagged WITHOUT crashing the checker, and the +tuple-everything control stays WF). The gating structure, stated exactly (audits #6 and #7 each caught a computed-but-non-gating verdict; audit #8 forced all eleven then-regressions @@ -831,14 +913,15 @@ independently forced all thirteen then-flags plus every instrument component — fourteen forcings — each to exit 1; audit #13 confirmed the fifteen-gate structure 15/15; audit #14 confirmed sixteen-for-sixteen with independent forcings -including ok_gr; audit #15 confirmed seventeen-for-seventeen): -the v1.6 pair -gates `collisions_under_wf()`; the other seventeen gate +including ok_gr; audit #15 confirmed seventeen-for-seventeen; +audit #16 confirmed nineteen-for-nineteen plus fourteen +instrument components, every mutation exit 1): the v1.6 pair +gates `collisions_under_wf()`; the other nineteen gate `cert_sweep()`'s return; the module `__main__` conjoins all three sweeps in its printed total AND ITS EXIT CODE, so any single regression failure exits nonzero (measured: forcing the pair false → exit 1; forcing cert_sweep flags false → exit 1, -including the v1.20 through v1.23 flags; the +including the v1.20 through v1.24 flags; the emulated-old-arm probe flips `cert_sweep` to FAIL). Three v1.12/v1.13-era regression mechanizations were updated in v1.23 to the always-emit discipline (their targets now carry the @@ -976,7 +1059,32 @@ seventeen then-forcings — and its two countermodel classes (prefix-freeness, language sorting) are healed and gated as regressions eighteen and nineteen, with the fresh-decode/ carried-in pair measured disjoint and the 39 reachable -empty-bundle fires (of 58 certified) now emitting explicitly. Basis counts vs v1.2 reference: `negative` 103→83, +empty-bundle fires (of 58 certified) now emitting explicitly; +audit #16 confirmed the v1.23 hinge INDEPENDENTLY (re-executed +the extracted v1.22 sources: four instruments byte-identical; +tracked certified-fire counts over 5,760 states of all 19 +certified graphs plus 300 generated bodies — zero mixed-count +merges — and derived the stronger v1.23 form: KS is +append-only and each certified fire adds exactly one entry, so +different-fire-count histories cannot merge), the certified-arm +prefix-freeness narrowly sound (tuple-head/tail injectivity +undefeatable by nested bundles or keys), the binder equation +against `lam_iam.binder_path` on every reachable lp (14,136 +states, 100,763 occurrences, 166 program/lp pairs, zero +mismatches), the blast radius independently reproduced (39 +empty of 58), and the disclosed v1.23 mechanization/fixture +updates theorem-preserving — and its two countermodel classes +(cross-arm fire-history forgery, W0 totality holes) are healed +and gated as regressions twenty and twenty-one, with the +suppressed arm's reachable-dead-code status measured by the +arm census (0 suppressed fires among 137 reachable). The v1.24 +kit deltas, adjudicated: the v113/v114 kits' raw +suppressed-decode fire displays gain the KA head (ks-display +relabels; every semantic column — surviving/bitfree/overlap, +marginals, W results — unchanged); the v118/v119 kits' +changed-source line counts grow with the diff (their +capture-identity verdicts unchanged); the v121 kit's crash +byte-identical; all other kits byte-identical. Basis counts vs v1.2 reference: `negative` 103→83, `selector` 173→106, `pstar` 458→242 — v1.7-era, real, owned; marginals and supports never moved. All measurements seconds-scale on the M5 Max. @@ -1053,13 +1161,17 @@ no bare-term ideal oracle). | v1.20 | W4 CLOSED by enumeration (`W4-storage` + `W4-burial` join frame/ticket; the four classes exhaust what the vvar-emitted ticket can collide with; agreeing burial admissible, its target measured WF; entry-vs-region closure stated honestly); `species-ans` types the anshead species check — leaf = γ = A — the ONE kernel-arm change since v1.11, bit-identical on every covered output; regressions fourteen (five-case storage/burial table) and fifteen (four-case species incl. the retrace chain) gated; §3 gains the species-ans, rootval, and verr rows; GUARD_RULES, guard docstrings, Run.ks docstring corrected; pack WF label count-neutral; zero storage/burial hits on the audit's own 300-program corpus; every prediction held (one wrong detail registered: wf prints no count line) | **fresh audit #13: FAIL** (the W4 closure CONFIRMED-SOUND by the auditor's own nine-row enumeration, agreeing-burial verified non-leaking, gating 15/15, cert/polarity/conservation excavations clean; the findings: the answer-bit DOMAIN was nowhere stated or enforced — ANS('h',2) was WF and flowed through anshead to an out-of-alphabet halt2, malformed tuples satisfied is_ans and crashed untyped, a γ/A pair meeting a binder stalled silently; and the honesty catch that "one kernel-arm change since v1.11" was FALSE — v1.12/v1.13 changed the fire arm's KD subtraction, as this chronicle's own rows document; plus two stale counts and C2's "seven kits" for eight) | | v1.21 | W0 joins the subtype (state/token grammar: bits {0,1}, gates {h,t}, exact arities, deep through slice/burial cargo, VB phase in domain — position-appropriateness stays the other invariants' job); anshead hardens to arity + domain (species-ans, never ValueError, never halt2); the untyped-stall class closes with three typed guards (species-binder, species-leaf, species-transport; foreign-lp and empty-tape finals stay classical finals by design); regression sixteen gated; kernel-arm provenance restated exactly (two waves since v1.11: v1.12/v1.13 KD subtraction, v1.20/v1.21 leaf guards — each measured no-op/bit-identical on covered outputs); counts go count-neutral in the standing prose; the v114 kit's placeholder-key probe adjudicated (out-of-language tokens, W0 working as specified); zero W0 hits on the 218,546-state corpus; every prediction held | **fresh audit #14: FAIL** (C5 CONFIRMED 16/16 with independent forcings; §8, §12's trace anchors, gram/run_dyn, the classical-final exemptions, and the v114 adjudication all CONFIRMED. The findings: W0's bit check used Python equality — 1.0/True/0.0/False are ==-equal to bits, so ANS('h',1.0) was WF and rootval string-formatted it into the out-of-alphabet terminal KINDS halt1.0/haltTrue; W0 never checked K(l) cargo shape, ticket/frame/storage instance fields recursively, or the state coordinates at all — d='X' and alien paths were WF and silently stalled, off-tree paths and non-Var lp occurrences were WF and crashed in subterm/binder_path; the "position-appropriateness is the other invariants' job" sentence was refuted (no other invariant does d/path/lp validity); C2 missed the diag capture's own label delta; and the corrected two-wave provenance summary was STILL incomplete — v1.12 also changed the ordinary decode arm, and "leaf-guard wave" mislabeled the binder/transport arms) | | v1.22 | W0 becomes the FULL state language: exact-int bits (bool refused — the terminal-kind minting), recursive lp productions with occurrences resolving to Vars of the term, arrival-lp K(l) cargo, coordinates d/path in language, VB phase exact-int; anshead's bit check exact-int (the one arm change, bit-identical on covered outputs); regression seventeen (state-language: ten countermodels + exact-int and kit-exact foreign-lp controls) gated; provenance summaries abolished — the register names arms per version only and defers history to these rows; the wf.py v1.12 fixture's App-naming carrier lp corrected (countermodel essence untouched); six kits' helper-lp wf-columns and the v121 kit's crash-by-construction adjudicated; stale W1-W9 phrases updated; zero W0 hits on the corpus; every prediction held in substance with the kit-delta count wrong and registered | **fresh audit #15: FAIL** (C1/C2/C4/C5 CONFIRMED — the v1.21→v1.22 diff exactly the exact-int condition, the delta set exact with the crash scoped, all seventeen forcings, the exact-bit repair itself sound against Fraction/int-subclass/-0.0 probes. The findings: THE FIRST RAW-SUBTYPE UNITARITY BREAK SINCE AUDIT #3 — §7.4's incoming-KS disjointness is false because the certified fire omitted empty KD bundles: a fresh decode and a carried-in record produced IDENTICAL targets, inner product 1, norm 2; W0 admitted BULLET in the log (bt1 transported it into a b1 collision, norm 2 again), never checked the lambda-IAM slice equation (a bad slice stepped to a W1-invalid target), and accepted open terms whose current position crashes binder_path; the t boundary raised NotImplementedError from WF states; "full state language" and the placement sentence refuted with them) | -| v1.23 | The certified fire emits its bundle UNCONDITIONALLY — ('KD', ()) when empty — restoring storage-history prefix-freeness (§7.4 restated to the strip-the-head injectivity); the t boundary becomes the typed scope fence t-unimplemented; W0 gains the log SORT (lp-like entries only), the lambda-IAM slice equation with a bound-finding binder walk, and the closed-term conjunct; regressions eighteen (log-sort/slice-equation) and nineteen (KS prefix-freeness + t fence) gated; three v1.12/v1.13-era regression mechanizations updated to the always-emit form and two fixture lps corrected to the slice equation (theorems and countermodel essences unchanged, all disclosed); THE HINGE PREDICTION, written first, HELD: suite, certify, typecheck, and polarity byte-identical — no reachable interference crosses fire histories, so the machine change is invisible on every covered output; ten kits' ks-display deltas and the matrix-coverage shrink adjudicated; zero W0 hits on the corpus | **fresh audit #16: pending** | +| v1.23 | The certified fire emits its bundle UNCONDITIONALLY — ('KD', ()) when empty — restoring storage-history prefix-freeness (§7.4 restated to the strip-the-head injectivity); the t boundary becomes the typed scope fence t-unimplemented; W0 gains the log SORT (lp-like entries only), the lambda-IAM slice equation with a bound-finding binder walk, and the closed-term conjunct; regressions eighteen (log-sort/slice-equation) and nineteen (KS prefix-freeness + t fence) gated; three v1.12/v1.13-era regression mechanizations updated to the always-emit form and two fixture lps corrected to the slice equation (theorems and countermodel essences unchanged, all disclosed); THE HINGE PREDICTION, written first, HELD: suite, certify, typecheck, and polarity byte-identical — no reachable interference crosses fire histories, so the machine change is invisible on every covered output; ten kits' ks-display deltas and the matrix-coverage shrink adjudicated; zero W0 hits on the corpus | **fresh audit #16: FAIL** (C1 CONFIRMED independently — the two-arm diff exact, four instruments byte-identical against the re-executed v1.22 sources, the hinge reason verified by a 5,760-state fire-history search plus 300 generated bodies with zero mixed-count merges, and the stronger v1.23 form derived: append-only KS makes different-fire-count merges impossible; C2 CONFIRMED narrowly for certified fires — nested bundles cannot defeat tuple-head injectivity; C4/C5 CONFIRMED — nineteen forcings + fourteen instrument components all exit 1, zero reachable W0 fires, the corpus rerun independently; the binder equation confirmed on 100,763 reachable lp occurrences with zero binder_path mismatches. The findings: THE AUDIT-#15 SIBLING — the suppressed-decode arm appends ZERO storage heads, so a suppressed decode with incoming [K(l)] and a retain-whole fire with incoming [] produce IDENTICAL targets, norm 2, through BOTH the same-key-frame and agreeing-burial variants — legal lifecycle configurations, not the alias gap; W0 accepted Var(0) (`i <= depth` under the 1-INDEXED convention — binder_path IndexError one step inside WF) and never sorted the CONTAINERS (a list tape passed WF, the fire TypeError'd); three stale register/docstring lines, including the §9 gate sentence still naming audit #15) | +| v1.24 | The suppressed-decode fire appends the inert arm-typed history head ('KA', g, i) — EVERY fire arm now appends exactly one head, §7.4 restated to the all-arms one-head discipline; the head carries its key because the author two-key double-suppression sibling (both tickets suppressing over a shared two-frame RS) also collided at norm 2 pre-fix, and a contentless marker would have left it alive; KA excluded from ks_dead_keys/ks_bitfree_keys by design (refire/key-alias/W8/W4-storage blind; replays off the surviving frame stay legal); W0 gains exact-type PURITY (registers exact tuples of exact tuples/str/int, checked without hashing before any scan — hostile __hash__/__eq__ can neither crash nor poison the checker; list containers refused) and the 1-indexed closedness (Var(0) refused); regressions twenty (fire prefix-freeness, three pairs + recorded-arm control) and twenty-one (W0 totality II incl. the hostile-hash probe) gated; the three stale lines fixed; THE HINGE, cheaper this round: suite/certify/typecheck/polarity byte-identical because the suppressed arm is REACHABLY DEAD CODE on the whole canonical suite (arm census measured first: 58 certified / 69 retain-whole / 10 decode-recorded / 0 suppressed); v113/v114 kit ks-displays gain the KA head (relabels, semantic columns unchanged — a kit-delta class my predictions MISSED and registered as the round's wrong call); zero W0/W4 hits on the corpus | **fresh audit #17: pending** | ## 12. Appendix — HH step-indexed trace (As of v1.23, every post-fire state additionally carries the explicit `('KD', ())` bundle in KS — not displayed in these rows; -rules, tape shapes, and timings are unchanged.) +rules, tape shapes, and timings are unchanged. The v1.24 KA head +appears in NO row of this trace or any reachable state of the +canonical suite — the suppressed-decode arm is reachably dead +code there; only raw-state fixtures and kit probes mint it.) Notation: `b` = bullet, `L(path|n)` = logged position (slice length n), `gh/mh` = `γ_h`/`μ_h`, `Ahb′` = `A_h(b′)`, `ahb′` = `α_h(b′)`, diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index b122448..6e32b22 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -398,7 +398,7 @@ register alone carries the version). | Item | Status | |---|---| -| Kernel | **v1.23** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (W0 = the SORTED state language as of v1.23 — exact-int bits, recursive lp productions satisfying the lambda-IAM slice equation with occurrences resolving to bound Vars of the closed term, the log's lp-like alphabet, arrival-lp K(l) cargo, coordinates in language — plus W1-W9, with W4 closed by enumeration and §7.4's storage prefix-freeness restored by the always-emit bundle discipline after audit #15's norm-2 countermodel, the first raw-subtype unitarity break since audit #3, healed with every covered output byte-identical); the species guards and the t scope fence typed; nineteen permanent regressions, all gating; all six instruments carry exit-code verdicts; kernel-arm history lives in the register's §11 rows. **PASS re-claim gated on fresh audit #16** | +| Kernel | **v1.24** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (W0 = the SORTED state language with exact-type PURITY as of v1.24 — registers exact tuples of exact tuples/str/int checked without hashing, exact-int bits, recursive lp productions satisfying the lambda-IAM slice equation with occurrences resolving to bound Vars (1-indexed; Var(0) refused) of the closed term, the log's lp-like alphabet, arrival-lp K(l) cargo, the KA production, coordinates in language — plus W1-W9, with W4 closed by enumeration and §7.4's storage prefix-freeness now the ALL-ARMS one-head-per-fire discipline: audit #15's empty-bundle collision and audit #16's suppressed-decode/retain-whole forgery were the certified and uncertified instances of the same defect — every fire arm appends exactly one arm-typed head (KD / K3 / KA / K2), each healed with every covered output byte-identical); the species guards and the t scope fence typed; twenty-one permanent regressions, all gating; all six instruments carry exit-code verdicts; kernel-arm history lives in the register's §11 rows. **PASS re-claim gated on fresh audit #17** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §5): the fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is the hybrid validation — structural admission/isometry plus exact-amplitude dynamic cleanliness plus non-vacuity, strictly beyond Gram (negative controls caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and **self-validating**: every admitted map passes full semantic coverage, else None | From b661ba2db4cce11a38bccc24a9cec58fde6a404d Mon Sep 17 00:00:00 2001 From: a9lim Date: Sun, 9 Aug 2026 23:32:14 -0400 Subject: [PATCH 049/107] =?UTF-8?q?qalc:=20kernel=20v1.25=20=E2=80=94=20wf?= =?UTF-8?q?()=20total=20by=20the=20W0=20gate;=20alien-gate;=20ten-mark=20g?= =?UTF-8?q?auge;=20audit=20#17=20registered?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #17 (cx-20260809-225138-ea2a) CONFIRMED the v1.24 KA repair outright — no remaining storage-history collision; census extended to the corpus (367/465/222/0); C1 at the AST level — and FAILED the round on three verification-layer defects: wf() crashed on exact-pure malformed tuples one layer past the purity pass; a WF-clean foreign-gate ticket was silently decoded (the decode row's subscript, dropped by the implementation); the gauge sweep omitted the KA mark, unconstrainable by reachable edges. v1.25: the W0 gate makes wf() total (W1-W9 adjudicated only over the language's carrier; no-over-collapse control gated); the alien-gate guard types foreign-gate tickets at both polarities (fifteenth guard; reachably unmintable — suite/certify/typecheck byte-identical); polarity sweeps ten marks over 1024 assignments printing both readings — 8/1024 reachable-only KA-free, 4/1024 with the disclosed raw suppressed edge, w(KA)=0 pinned, verdict gating on both. Regressions 22/23; 23/23 forced-exit-1. My pre-fix parity hand-derivation lost to the measurement and is registered as this round's wrong call. Fresh audit #18 launched; PASS re-claim gated on it. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 36 +++++-- docs/ledger/2026-08.md | 66 ++++++++++++ docs/quantum-algebraic/kernel.md | 166 ++++++++++++++++++++++--------- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 211 insertions(+), 59 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 212e707..463c3d8 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,10 +413,10 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.24** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.25** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after -sixteen fresh-context rounds. Kernel-arm provenance summaries +seventeen fresh-context rounds. Kernel-arm provenance summaries have been refuted by literal diff twice (audit #13 killed "unmoved since v1.11"; audit #14 showed the corrected summary still incomplete), so the register now names arms per version @@ -518,10 +518,25 @@ checker) plus 1-indexed closedness. The hinge was cheaper this round: the four instruments byte-identical because the suppressed arm is REACHABLY DEAD CODE on the whole canonical suite (arm census measured first: 58 certified / 69 -retain-whole / 10 decode-recorded / 0 suppressed). What the +retain-whole / 10 decode-recorded / 0 suppressed). Audit #17 +then CONFIRMED the KA repair outright — no remaining +storage-history collision, the census independently matched +and extended to the corpus (367/465/222/0), C1 at the AST +level — and found three verification-layer defects: wf() was +not total (exact-pure malformed tuples W0-flagged, then +IndexError in the W1-W9 scans), a WF-clean foreign-gate ticket +was silently decoded (the register's decode-row subscript, +dropped by the implementation), and the gauge sweep omitted +the KA mark (unconstrainable by reachable edges). v1.25 +answered: the alien-gate guard (fifteenth in the family), the +W0 gate making wf() total (W1-W9 adjudicated only over the +language's carrier), and the ten-mark gauge sweep — 8/1024 +reachable-only with KA free, 4/1024 with one disclosed raw +suppressed-decode edge, every survivor pinning w(KA)=0 — with +suite/certify/typecheck byte-identical again. What the rounds still found was claim-language and scaffolding, each fixed the same -day: all twenty-one permanent regressions now gate mechanically (the +day: all twenty-three permanent regressions now gate mechanically (the module verdict is the exit code — forcing any single regression false exits nonzero, measured); `validate()` gained NON-VACUITY at both levels (an entry at an unreachable position and a ghost @@ -535,16 +550,17 @@ certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; physics table passes on all twenty; all prior audit kits rerun with every delta adjudicated (ks-display relabels -under always-emit and now under the KA head; matrix-coverage -shrink under the tightened language; the healed-countermodel -crash); every v1.24 prediction held including the hinge, with -one registered wrong call — the kit-delta clause missed that -two kits build raw suppressed-decode fires (provenance in the +under always-emit and the KA head; the W0-gate display +collapses; matrix-coverage shrink under the tightened language; +the healed-countermodel crash); every v1.25 prediction held, +with the round's registered wrong call being my own pre-fix +hand-derivation of the fire-edge parity — the mechanized sweep +adjudicated for the auditor's numbers (provenance in the scratchpad prediction files). The open docket, in order: -1. **fresh-context independent audit #17 of the v1.24 h-fragment +1. **fresh-context independent audit #18 of the v1.25 h-fragment claim** (verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 59589f6..0fefa46 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -3379,3 +3379,69 @@ v122 kit's healed readings byte-identical. Register (header, §2, §3, §6, §7.4, §9, §10, §11, §12), STATUS, token.md updated; fresh audit #17 launched — the PASS re-claim stays gated on it. + +## 2026-08-09 — qALC kernel v1.25: the machine holds for the first time in three rounds; the checker learns to stop reading garbage; the new mark joins the orbit + +Audit #17 (fresh instance, sol tier, threadless) FAILED v1.25's +predecessor — but the headline is what it did NOT break: the +v1.24 KA repair survived a maximally adversarial round +untouched. The auditor enumerated the four KS-writing arms from +source, verified every non-fire Run→Run path KS-preserving, +re-derived the three healed collision pairs with honest +STATE-SPACE inner products (all 0, clean evolutions — explicitly +routing around the positional kit helper), drove the KA +guard-exclusion lifecycle through replay/recall/refire/key-alias +and found it coherent, matched the arm census 58/69/10/0, and +extended it to the 218,546-state corpus: 367 certified / 465 +retain-whole / 222 decode-recorded / 0 suppressed. C1 confirmed +at the AST level; 21 regression forcings + 14 instrument +components all exit 1. + +The findings live in the layers AROUND the machine. (1) wf() was +not total: exact-pure malformed tuples — a bare ('AL',), a bare +('L',), an empty () frame — passed the v1.24 purity pass +(they're perfectly typed garbage), were correctly W0-flagged, +and then the W1-W9 deep scans indexed them: IndexError from +inside the checker. Purity fixed hashing-totality and missed +indexing-totality one clause later. (2) The decode arm dropped a +subscript: the register has always said l = alpha_g(i, b), the +code checked the bit and never the gate kind, so alpha_t at an h +boundary with a matching bit was WF-clean and silently DECODED +into ('K', 't', i) under an H row. Reachably unmintable (alpha_t +can only be minted behind the t-fire fence) but detectable and +untyped — against the register's own "every detectable misuse is +typed." (3) The gauge sweep never learned about KA: nine +parameters, 512 assignments, the new mark falling through +prof_entry at implicit weight zero — and since the suppressed +arm is reachably dead, reachable edges CANNOT constrain the new +mark's weight. The auditor ran the repaired experiment +themselves: 8/1024 reachable-only with KA free; 4/1024 with one +raw suppressed edge, every survivor pinning KA = 0. + +v1.25, predictions written first: the W0 GATE (out-of-language +states early-return ['W0']; W1-W9 are adjudicated only over the +language's carrier — recon found exactly two multi-flag W0 +results across all three sweeps, both asserted by membership, so +nothing broke); the alien-gate guard (fifteenth in the family, +both bit polarities; retain-whole never sees a foreign-gate +ticket); the TEN-mark gauge sweep printing both readings — +8/1024 reachable-only KA-free, then 4/1024 with the disclosed +raw suppressed-decode edge (wf.py regression twenty's frame-skip +fixture), verdict gating on both. My own pre-fix hand-derivation +of the fire-edge parity DISAGREED with the auditor's numbers; I +predicted deference to measurement with a halt branch, and the +measurement went the auditor's way — the mechanized sweep is the +theorem, my head-model was wrong, and the predictions file says +so. suite/certify/typecheck byte-identical; conservation +identical to the timing suffix; wf gained exactly its two new +regression lines (twenty-two: checker totality III with the +no-over-collapse control; twenty-three: alien-gate with the +same-gate control); twenty-three-for-twenty-three under forcing; +census and corpus unchanged. Kit deltas adjudicated: the W0-gate +display collapses on out-of-language fixtures (v113/v119/v122 — +the in-language W4 demonstrations still flag in wf.py's own +regression), and the v117/v118 orbit displays recompute at ten +marks and independently print the 8-entry KA-free reachable +orbit. Register (§1, §2 guards, §3, §6, §7.1, §9, §10, §11), +STATUS, token.md updated; fresh audit #18 launched — the PASS +re-claim stays gated on it. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index da94b98..b532012 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.24.** The kernel is a scratch superposition evolver +**Status: v1.25.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -17,7 +17,7 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #17**, whose +The standing PASS re-claim is **gated on fresh audit #18**, whose verdict will be registered here. Kernel-arm provenance is the chronicle's per-row "what changed" column — summaries of it have been refuted twice by literal diff (audit #13 killed "unmoved @@ -25,30 +25,31 @@ since v1.11"; audit #14 showed the corrected two-wave summary still omitted v1.12's ordinary-decode burial-suppression change and mislabeled v1.21's binder/transport arms as "leaf" guards) — so this register now names arms exactly and only per version: -v1.24 changes ONE arm relative to v1.23: the suppressed-decode -fire appends an inert arm-typed history head `('KA', g, i)` -instead of appending NOTHING — audit #16 showed the zero-append -let a suppressed decode (incoming KS already `[K(l)]`) -impersonate a retain-whole fire (incoming `[]`, prepending -`K(l)`) on identical targets at norm 2, through both the -same-key-frame and the agreeing-burial suppression variants. -Every fire arm now appends EXACTLY ONE arm-typed storage head -(§7.4). The head carries its key because two different tickets -both suppressing over a shared two-frame RS also collided (the -author sibling, measured at norm 2 pre-fix; a contentless marker -would have left it alive). KA is HISTORY, not a dead record: the -suppressed key's answerable representation survives in the -frame/burial, so `ks_dead_keys` and `ks_bitfree_keys` exclude it -by design — refire, key-alias, W8, and W4-storage stay blind, -and a replay-re-emitted ticket still recalls and re-fires. -Suite, certify, typecheck, and polarity outputs measured -BYTE-IDENTICAL across the change — this round not by an -interference argument but because the suppressed arm is -REACHABLY DEAD CODE on the whole canonical suite (arm census, -measured first: 58 certified / 69 retain-whole / 10 -decode-recorded / 0 suppressed reachable fires). For anything -older, read §11's rows; do not trust a summary, including this -file's former ones. +v1.25 adds ONE machine guard relative to v1.24, and no arm's +storage behavior moves: the fire boundary types foreign-gate +cargo tickets (`alien-gate` — audit #17 showed `α_t` at an `h` +boundary with a matching bit was WF-clean and silently DECODED +into a `('K','t',i)` record under an H row: the register's +decode row always said `l = α_g(i, b)` and the implementation +had dropped the subscript). Around the machine, two +verification-layer corrections from the same audit: `wf()` is +now TOTAL by the W0 GATE (exact-pure malformed tuples were +W0-flagged and then crashed the W1-W9 deep scans; W1-W9 are +adjudicated only over the language's carrier), and the KA mark +joined the gauge sweep (ten parameters, 1024 assignments — a +reachably-dead mark cannot be constrained by reachable edges, +so one disclosed raw suppressed-decode edge is the constraining +instrument: 8/1024 reachable-only with KA free, 4/1024 with the +edge, every survivor pinning w(KA) = 0). Audit #17 CONFIRMED +the v1.24 KA repair itself outright — no remaining +storage-history collision, state-space inner products +re-derived, the guard-exclusion lifecycle verified coherent, +and the arm census extended to the 218,546-state corpus +(367/465/222/0). Suite, certify, and typecheck measured +BYTE-IDENTICAL across v1.25; polarity's output changed in +exactly the declared gauge-sweep lines. For anything older, +read §11's rows; do not trust a summary, including this file's +former ones. This file is the current contract and register only. The round-by-round history — countermodels, corrections, verdicts — @@ -204,6 +205,17 @@ head):** ```text arrive/fire tape = P_b · μ_g · T, P_0 = l· P_1 = •·l· μ's gate kind ≠ γ's → species-mu + cargo is a ticket of a FOREIGN gate (α with kind ≠ γ's, either + bit polarity) → alien-gate [v1.25, audit #17: the + decode row's subscript is + load-bearing — α_t at an h + boundary with a matching bit was + silently decoded into ('K','t',i) + under an H row; reachably + unmintable (α_t's only mint site + is behind the t-fire fence) but + detectable, so typed; retain-whole + never sees a foreign-gate ticket] any (g, i) with two bits among cargo-nested α and RS frames → key-alias [deep bit coherence at the boundary: a fire must never @@ -300,10 +312,10 @@ errors VB with a non-• non-classifier tape top; ↓-stuck on species-transport — all typed, complete residue. ``` -The guard family — `no-instance`, `alien-ticket`, `frame-conflict`, -`recall-err`, `replay-err`, `pop-err`, `species-mu`, `species-ans`, -`species-binder`, `species-leaf`, `species-transport`, -`t-unimplemented`, `refire`, +The guard family — `no-instance`, `alien-ticket`, `alien-gate`, +`frame-conflict`, `recall-err`, `replay-err`, `pop-err`, +`species-mu`, `species-ans`, `species-binder`, `species-leaf`, +`species-transport`, `t-unimplemented`, `refire`, `key-alias` — is the machine's whole answer to aliasing and misuse: **every detectable manifestation is a typed error, never a silent reinterpretation.** @@ -525,7 +537,15 @@ the machine's unitarity claims quantify over the subtype: only produce `halt0`/`halt1` — as exact ints) and closes audit #14's stall/crash class: off-language coordinates and semantically invalid lps are outside WF, so no WF state stalls - silently or crashes in `subterm`/`binder_path`. Zero reachable + silently or crashes in `subterm`/`binder_path`. W0 is also a + GATE (v1.25, audit #17): when it flags, `wf()` returns + `['W0']` immediately — exact-pure malformed tuples (a bare + `('AL',)`, an empty `()` frame) were correctly W0-flagged and + then crashed the W1-W9 deep scans, so W1-W9 are adjudicated + only over the language's carrier, the same argument that + justifies the purity early-return; after a clean W0 every + token has exact shape and the scans index safely, making + `wf()` TOTAL. Zero reachable fires on the twenty programs and the 218,546-state generated corpus. - **W1** (log discipline): `|log| = level(pos)`. @@ -602,7 +622,8 @@ the machine's unitarity claims quantify over the subtype: w(•) = w(γ) = w(μ) = w(α) = w(ρ) = w(R) = 0; w(A) = 1 w(l) for l = (occ, slice) = (depth(occ) − depth(binder)) + Σ w(slice) w(K₂(l)) = w(l) — a retained-whole spectator record carries its - lp's weight; w(K₃) = w(KD) = 0 + lp's weight; w(K₃) = w(KD) = w(KA) = 0 + (KA joined the alphabet at v1.25, audit #17) ``` **Theorem (uniform flip).** Every Run→Run rule flips φ — @@ -619,10 +640,20 @@ phrasing got wrong (audit #9): `Ccoll`'s two reachable conservative fires have `w(l) = 1` and delta 1 — an ordinary flip, not a `1 − w(l)` defect — and the Σ w(KS) term decides six reachable edges (two in `Ccoll`, four in `dupcall`). The weight -assignment is **gauge-pinned**: of all 512 assignments over the -mark alphabet INCLUDING the KD weight, exactly the 4-element +assignment is **gauge-pinned**: of all 1024 assignments over the +mark alphabet INCLUDING the KD and KA weights (ten swept +parameters as of v1.25 — audit #17 caught the nine-parameter +sweep omitting the new mark entirely), exactly the 4-element orbit generated by two symmetries survives — every survivor -fixes KD at 0 — and the orbit fixes every deployed consequence. +fixes KD and KA at 0 — and the orbit fixes every deployed +consequence. The KA pinning requires a DISCLOSED instrument: KA +never occurs on a reachable edge (the suppressed arm is +reachably dead code), so the reachable sweep alone leaves it +free (8/1024, measured and printed); one raw suppressed-decode +fire (wf.py regression twenty's frame-skip fixture — WF, +uncertified, reachably unmintable) joins the edge set and pins +it (4/1024). Both readings print, and the verdict gates on +both. ### 7.2 The branch-offset law @@ -811,9 +842,9 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#17; the verdict will be registered here.** (Audit #16 caught -this very sentence still naming audit #15 — the §1 gate and this -one are now updated together.) +#18; the verdict will be registered here.** (Audit #16 caught +this very sentence still naming a stale round — the §1 gate and +this one are now updated together, every round.) ## 10. Verification state @@ -854,7 +885,7 @@ canonical dicts compared bit-for-bit; `dupcall` canonically None `h(Ω)` → None. Negative controls: pstar × wrong certificate reaches `pop-err`; dupcall × v1.7-era certificate reaches `refire`, all-err. WF/W7/W8/W9 sweeps + mechanized disjointness: -zero violations; **twenty-one permanent regressions** (the v1.6 pair; +zero violations; **twenty-three permanent regressions** (the v1.6 pair; extra-frame collision, W7-excluded with disjoint targets; doctored bundle divergence; K+frame alias; retained-Q disjointness — spectator-bit columns share zero targets; @@ -904,7 +935,13 @@ suppressed target, the decode-recorded arm an intact control; W0 totality II — the `Var(0)` state and the list-tape state are W0-flagged at source, a hostile-hash tuple-subclass is W0-flagged WITHOUT crashing the checker, and the -tuple-everything control stays WF). The +tuple-everything control stays WF; checker totality III — the +bare-`('AL',)`, bare-`('L',)`, and empty-frame states return +exactly `['W0']` with no exception, and an in-language +multi-violation control still lists its W1-W9 flags (the gate +must not over-collapse); alien-gate — foreign-gate tickets at +the fire boundary are WF and typed `alien-gate` at both bit +polarities, the same-gate decode control fires unchanged). The gating structure, stated exactly (audits #6 and #7 each caught a computed-but-non-gating verdict; audit #8 forced all eleven then-regressions @@ -915,13 +952,15 @@ audit #13 confirmed the fifteen-gate structure 15/15; audit #14 confirmed sixteen-for-sixteen with independent forcings including ok_gr; audit #15 confirmed seventeen-for-seventeen; audit #16 confirmed nineteen-for-nineteen plus fourteen -instrument components, every mutation exit 1): the v1.6 pair -gates `collisions_under_wf()`; the other nineteen gate +instrument components, every mutation exit 1; audit #17 +confirmed twenty-one-for-twenty-one plus the fourteen +components likewise): the v1.6 pair +gates `collisions_under_wf()`; the other twenty-one gate `cert_sweep()`'s return; the module `__main__` conjoins all three sweeps in its printed total AND ITS EXIT CODE, so any single regression failure exits nonzero (measured: forcing the pair false → exit 1; forcing cert_sweep flags false → exit 1, -including the v1.20 through v1.24 flags; the +including the v1.20 through v1.25 flags; the emulated-old-arm probe flips `cert_sweep` to FAIL). Three v1.12/v1.13-era regression mechanizations were updated in v1.23 to the always-emit discipline (their targets now carry the @@ -940,9 +979,12 @@ EMISSION, not its computation). Conservation: exhaustive ≤ size 11, 14,452 surfacings at ≤10 / 55,727 at ≤11, zero failures. Polarity/terminal chains/gauge: zero violations, -orbit exact — 4/512 with the KD weight enumerated (audit #9 -caught the 8-parameter sweep asserting KD's zero rather than -enumerating it), every survivor fixing KD at 0. All prior audits' independent reproducers +orbit exact — 4/1024 with the KD and KA weights enumerated +(audit #9 caught the 8-parameter sweep asserting KD's zero +rather than enumerating it; audit #17 caught the 9-parameter +sweep omitting KA entirely), every survivor fixing KD and KA at +0, the KA pinning via the disclosed raw suppressed edge with +the reachable-only 8/1024 reading printed beside it. All prior audits' independent reproducers rerun clean or typed (audit #1's fuzz 250/250; audit #2's kit clean on every lifecycle, its term-evaluator mismatches adjudicated as that evaluator's non-normalization; audit #3's @@ -1084,7 +1126,34 @@ relabels; every semantic column — surviving/bitfree/overlap, marginals, W results — unchanged); the v118/v119 kits' changed-source line counts grow with the diff (their capture-identity verdicts unchanged); the v121 kit's crash -byte-identical; all other kits byte-identical. Basis counts vs v1.2 reference: `negative` 103→83, +byte-identical; all other kits byte-identical. Audit #17 +confirmed the KA repair OUTRIGHT (no remaining storage-history +collision: the four KS-writing arms enumerated from source, +non-fire Run→Run paths verified KS-preserving, the three healed +pairs re-derived at state-space inner product 0 with clean +evolutions, KA's guard exclusions verified coherent through the +replay/recall/refire/key-alias lifecycle), extended the arm +census to the corpus (367 certified / 465 retain-whole / 222 +decode-recorded / 0 suppressed over 218,546 states), confirmed +C1 at the AST level (exactly one executable kernel change), and +independently validated the registered wrong prediction, the +KA display adjudication, and the positional-inner-product +caveat — its three countermodel classes (checker +non-totality on exact-pure malformed states, the cross-gate +silent decode, the KA-less gauge sweep) are healed and gated as +regressions twenty-two and twenty-three plus the ten-mark +sweep. The v1.25 kit deltas, adjudicated: kits displaying +multi-flag W0 lists on out-of-language fixtures collapse to +`['W0']` under the W0 gate (v113's emulation columns, v119's +W4_STORAGE fixture rows — those fixtures were already the +out-of-language helper-lp class, and the in-language W4 +demonstrations live in wf.py's own regression fourteen, still +flagging; v122's bt2-target row); the v117/v118 kits' orbit +displays recompute with the current ten-mark profiler and print +the 8-entry KA-free reachable orbit — independent confirmation +of the unconstrained-mark fact — with `orbits_equal` still +True; the v118/v119 line counts as always; the v121 crash and +the v123 kit byte-identical. Basis counts vs v1.2 reference: `negative` 103→83, `selector` 173→106, `pstar` 458→242 — v1.7-era, real, owned; marginals and supports never moved. All measurements seconds-scale on the M5 Max. @@ -1162,7 +1231,8 @@ no bare-term ideal oracle). | v1.21 | W0 joins the subtype (state/token grammar: bits {0,1}, gates {h,t}, exact arities, deep through slice/burial cargo, VB phase in domain — position-appropriateness stays the other invariants' job); anshead hardens to arity + domain (species-ans, never ValueError, never halt2); the untyped-stall class closes with three typed guards (species-binder, species-leaf, species-transport; foreign-lp and empty-tape finals stay classical finals by design); regression sixteen gated; kernel-arm provenance restated exactly (two waves since v1.11: v1.12/v1.13 KD subtraction, v1.20/v1.21 leaf guards — each measured no-op/bit-identical on covered outputs); counts go count-neutral in the standing prose; the v114 kit's placeholder-key probe adjudicated (out-of-language tokens, W0 working as specified); zero W0 hits on the 218,546-state corpus; every prediction held | **fresh audit #14: FAIL** (C5 CONFIRMED 16/16 with independent forcings; §8, §12's trace anchors, gram/run_dyn, the classical-final exemptions, and the v114 adjudication all CONFIRMED. The findings: W0's bit check used Python equality — 1.0/True/0.0/False are ==-equal to bits, so ANS('h',1.0) was WF and rootval string-formatted it into the out-of-alphabet terminal KINDS halt1.0/haltTrue; W0 never checked K(l) cargo shape, ticket/frame/storage instance fields recursively, or the state coordinates at all — d='X' and alien paths were WF and silently stalled, off-tree paths and non-Var lp occurrences were WF and crashed in subterm/binder_path; the "position-appropriateness is the other invariants' job" sentence was refuted (no other invariant does d/path/lp validity); C2 missed the diag capture's own label delta; and the corrected two-wave provenance summary was STILL incomplete — v1.12 also changed the ordinary decode arm, and "leaf-guard wave" mislabeled the binder/transport arms) | | v1.22 | W0 becomes the FULL state language: exact-int bits (bool refused — the terminal-kind minting), recursive lp productions with occurrences resolving to Vars of the term, arrival-lp K(l) cargo, coordinates d/path in language, VB phase exact-int; anshead's bit check exact-int (the one arm change, bit-identical on covered outputs); regression seventeen (state-language: ten countermodels + exact-int and kit-exact foreign-lp controls) gated; provenance summaries abolished — the register names arms per version only and defers history to these rows; the wf.py v1.12 fixture's App-naming carrier lp corrected (countermodel essence untouched); six kits' helper-lp wf-columns and the v121 kit's crash-by-construction adjudicated; stale W1-W9 phrases updated; zero W0 hits on the corpus; every prediction held in substance with the kit-delta count wrong and registered | **fresh audit #15: FAIL** (C1/C2/C4/C5 CONFIRMED — the v1.21→v1.22 diff exactly the exact-int condition, the delta set exact with the crash scoped, all seventeen forcings, the exact-bit repair itself sound against Fraction/int-subclass/-0.0 probes. The findings: THE FIRST RAW-SUBTYPE UNITARITY BREAK SINCE AUDIT #3 — §7.4's incoming-KS disjointness is false because the certified fire omitted empty KD bundles: a fresh decode and a carried-in record produced IDENTICAL targets, inner product 1, norm 2; W0 admitted BULLET in the log (bt1 transported it into a b1 collision, norm 2 again), never checked the lambda-IAM slice equation (a bad slice stepped to a W1-invalid target), and accepted open terms whose current position crashes binder_path; the t boundary raised NotImplementedError from WF states; "full state language" and the placement sentence refuted with them) | | v1.23 | The certified fire emits its bundle UNCONDITIONALLY — ('KD', ()) when empty — restoring storage-history prefix-freeness (§7.4 restated to the strip-the-head injectivity); the t boundary becomes the typed scope fence t-unimplemented; W0 gains the log SORT (lp-like entries only), the lambda-IAM slice equation with a bound-finding binder walk, and the closed-term conjunct; regressions eighteen (log-sort/slice-equation) and nineteen (KS prefix-freeness + t fence) gated; three v1.12/v1.13-era regression mechanizations updated to the always-emit form and two fixture lps corrected to the slice equation (theorems and countermodel essences unchanged, all disclosed); THE HINGE PREDICTION, written first, HELD: suite, certify, typecheck, and polarity byte-identical — no reachable interference crosses fire histories, so the machine change is invisible on every covered output; ten kits' ks-display deltas and the matrix-coverage shrink adjudicated; zero W0 hits on the corpus | **fresh audit #16: FAIL** (C1 CONFIRMED independently — the two-arm diff exact, four instruments byte-identical against the re-executed v1.22 sources, the hinge reason verified by a 5,760-state fire-history search plus 300 generated bodies with zero mixed-count merges, and the stronger v1.23 form derived: append-only KS makes different-fire-count merges impossible; C2 CONFIRMED narrowly for certified fires — nested bundles cannot defeat tuple-head injectivity; C4/C5 CONFIRMED — nineteen forcings + fourteen instrument components all exit 1, zero reachable W0 fires, the corpus rerun independently; the binder equation confirmed on 100,763 reachable lp occurrences with zero binder_path mismatches. The findings: THE AUDIT-#15 SIBLING — the suppressed-decode arm appends ZERO storage heads, so a suppressed decode with incoming [K(l)] and a retain-whole fire with incoming [] produce IDENTICAL targets, norm 2, through BOTH the same-key-frame and agreeing-burial variants — legal lifecycle configurations, not the alias gap; W0 accepted Var(0) (`i <= depth` under the 1-INDEXED convention — binder_path IndexError one step inside WF) and never sorted the CONTAINERS (a list tape passed WF, the fire TypeError'd); three stale register/docstring lines, including the §9 gate sentence still naming audit #15) | -| v1.24 | The suppressed-decode fire appends the inert arm-typed history head ('KA', g, i) — EVERY fire arm now appends exactly one head, §7.4 restated to the all-arms one-head discipline; the head carries its key because the author two-key double-suppression sibling (both tickets suppressing over a shared two-frame RS) also collided at norm 2 pre-fix, and a contentless marker would have left it alive; KA excluded from ks_dead_keys/ks_bitfree_keys by design (refire/key-alias/W8/W4-storage blind; replays off the surviving frame stay legal); W0 gains exact-type PURITY (registers exact tuples of exact tuples/str/int, checked without hashing before any scan — hostile __hash__/__eq__ can neither crash nor poison the checker; list containers refused) and the 1-indexed closedness (Var(0) refused); regressions twenty (fire prefix-freeness, three pairs + recorded-arm control) and twenty-one (W0 totality II incl. the hostile-hash probe) gated; the three stale lines fixed; THE HINGE, cheaper this round: suite/certify/typecheck/polarity byte-identical because the suppressed arm is REACHABLY DEAD CODE on the whole canonical suite (arm census measured first: 58 certified / 69 retain-whole / 10 decode-recorded / 0 suppressed); v113/v114 kit ks-displays gain the KA head (relabels, semantic columns unchanged — a kit-delta class my predictions MISSED and registered as the round's wrong call); zero W0/W4 hits on the corpus | **fresh audit #17: pending** | +| v1.24 | The suppressed-decode fire appends the inert arm-typed history head ('KA', g, i) — EVERY fire arm now appends exactly one head, §7.4 restated to the all-arms one-head discipline; the head carries its key because the author two-key double-suppression sibling (both tickets suppressing over a shared two-frame RS) also collided at norm 2 pre-fix, and a contentless marker would have left it alive; KA excluded from ks_dead_keys/ks_bitfree_keys by design (refire/key-alias/W8/W4-storage blind; replays off the surviving frame stay legal); W0 gains exact-type PURITY (registers exact tuples of exact tuples/str/int, checked without hashing before any scan — hostile __hash__/__eq__ can neither crash nor poison the checker; list containers refused) and the 1-indexed closedness (Var(0) refused); regressions twenty (fire prefix-freeness, three pairs + recorded-arm control) and twenty-one (W0 totality II incl. the hostile-hash probe) gated; the three stale lines fixed; THE HINGE, cheaper this round: suite/certify/typecheck/polarity byte-identical because the suppressed arm is REACHABLY DEAD CODE on the whole canonical suite (arm census measured first: 58 certified / 69 retain-whole / 10 decode-recorded / 0 suppressed); v113/v114 kit ks-displays gain the KA head (relabels, semantic columns unchanged — a kit-delta class my predictions MISSED and registered as the round's wrong call); zero W0/W4 hits on the corpus | **fresh audit #17: FAIL** (the KA repair itself CONFIRMED-SOUND — no remaining storage-history collision; the four KS-writing arms enumerated from source, non-fire paths KS-preserving, the three healed pairs re-derived at state-space inner product 0, the guard-exclusion lifecycle verified coherent — and the reachability hinge confirmed with an independent census matching 58/69/10/0 and EXTENDED to the corpus, 367/465/222/0; C1 confirmed at the AST level; C4/C5 confirmed, 21 forcings + 14 components all exit 1. The findings: wf() NOT TOTAL over exact-pure malformed states — bare ('AL',)/('L',) tape tokens and an empty () frame pass purity, get W0-flagged, then IndexError the W1-W9 deep scans; a WF-clean FOREIGN-GATE ticket silently decoded — α_t at an h boundary with matching bit fires and records ('K','t',i) under an H row, the register's decode subscript dropped by the implementation; the gauge sweep OMITS KA — nine parameters, KA implicitly weight 0 and unconstrainable by reachable edges (the auditor's own repaired sweep: 8/1024 reachable-only KA-free, 4/1024 with a raw suppressed edge, KA pinned 0); plus the stale "inert dead storage" docstring phrase) | +| v1.25 | ONE machine guard added, no arm's storage behavior moves: alien-gate types foreign-gate cargo tickets at the fire boundary at both bit polarities (the decode row's subscript restored to the implementation; reachably unmintable — α_t's only mint site is behind the t-fire fence — so suite/certify/typecheck byte-identical, measured); wf() made TOTAL by the W0 GATE (out-of-language states early-return ['W0']; W1-W9 adjudicated only over the language's carrier; the in-language multi-flag control proves no over-collapse); the gauge sweep goes TEN-mark — 8/1024 reachable-only with KA free (printed), 4/1024 with the disclosed raw suppressed-decode edge, every survivor pinning w(KA)=0, verdict gating on both readings; §7.1 restated; regressions twenty-two (checker totality III) and twenty-three (alien-gate) gated, twenty-three-for-twenty-three under forcing; the "inert dead storage" phrase corrected; my pre-fix hand-derivation of the fire-edge parity DISAGREED with the auditor's sweep numbers and the measurement adjudicated for the auditor (registered — the mechanized sweep is the theorem, not my head-model); kit deltas: the W0-gate display collapses on out-of-language fixtures and the ten-mark orbit displays (independent confirmation of the unconstrained-mark fact), v121 crash and v123 kit byte-identical | **fresh audit #18: pending** | ## 12. Appendix — HH step-indexed trace diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index 6e32b22..fd2cb68 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -398,7 +398,7 @@ register alone carries the version). | Item | Status | |---|---| -| Kernel | **v1.24** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (W0 = the SORTED state language with exact-type PURITY as of v1.24 — registers exact tuples of exact tuples/str/int checked without hashing, exact-int bits, recursive lp productions satisfying the lambda-IAM slice equation with occurrences resolving to bound Vars (1-indexed; Var(0) refused) of the closed term, the log's lp-like alphabet, arrival-lp K(l) cargo, the KA production, coordinates in language — plus W1-W9, with W4 closed by enumeration and §7.4's storage prefix-freeness now the ALL-ARMS one-head-per-fire discipline: audit #15's empty-bundle collision and audit #16's suppressed-decode/retain-whole forgery were the certified and uncertified instances of the same defect — every fire arm appends exactly one arm-typed head (KD / K3 / KA / K2), each healed with every covered output byte-identical); the species guards and the t scope fence typed; twenty-one permanent regressions, all gating; all six instruments carry exit-code verdicts; kernel-arm history lives in the register's §11 rows. **PASS re-claim gated on fresh audit #17** | +| Kernel | **v1.25** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (W0 = the SORTED state language with exact-type PURITY as of v1.24 — registers exact tuples of exact tuples/str/int checked without hashing, exact-int bits, recursive lp productions satisfying the lambda-IAM slice equation with occurrences resolving to bound Vars (1-indexed; Var(0) refused) of the closed term, the log's lp-like alphabet, arrival-lp K(l) cargo, the KA production, coordinates in language — plus W1-W9, with W4 closed by enumeration and §7.4's storage prefix-freeness now the ALL-ARMS one-head-per-fire discipline: audit #15's empty-bundle collision and audit #16's suppressed-decode/retain-whole forgery were the certified and uncertified instances of the same defect — every fire arm appends exactly one arm-typed head (KD / K3 / KA / K2), each healed with every covered output byte-identical); wf() TOTAL via the W0 gate (v1.25 — W1-W9 adjudicated only over the language's carrier); the species guards, the alien-gate foreign-ticket guard, and the t scope fence typed (fifteen guards); the ten-mark gauge sweep pins w(KA)=0 via the disclosed raw suppressed edge (4/1024, with the 8/1024 reachable-only reading printed beside it); twenty-three permanent regressions, all gating; all six instruments carry exit-code verdicts; kernel-arm history lives in the register's §11 rows. **PASS re-claim gated on fresh audit #18** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §5): the fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is the hybrid validation — structural admission/isometry plus exact-amplitude dynamic cleanliness plus non-vacuity, strictly beyond Gram (negative controls caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and **self-validating**: every admitted map passes full semantic coverage, else None | From 2fe949996cb5aa3789cee6701305e1bd1620ca5f Mon Sep 17 00:00:00 2001 From: a9lim Date: Mon, 10 Aug 2026 00:05:17 -0400 Subject: [PATCH 050/107] =?UTF-8?q?qalc:=20kernel=20v1.26=20=E2=80=94=20ev?= =?UTF-8?q?ery=20wf=20traversal=20iterative;=20totality=20scoped=20to=20th?= =?UTF-8?q?e=20host-identity=20boundary;=20audit=20#18=20registered?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #18 (cx-20260809-233143-22da) confirmed the v1.25 machine outright — alien-gate on a strictly larger surface (nested/frame/ burial foreign representations all carried, never reinterpreted), the gauge pinning proved arm-intrinsic by an independent GF(2) solver, C1 by source reconstruction — and refuted checker totality at layer four: an exact-pure empty tuple in the log crashed wf() upstream of the W0 gate (is_gam indexed e[0] bare), and 1,500-deep structures blew recursive pure()/closed(). v1.26 — no arm, no guard: emptiness conjuncts on the four predicates; every wf traversal iterative and pre-gate hash-free (closure-sweep token grammar with an id-keyed per-call memo); kernel's deep helpers iterative with identical outputs; the totality claim scoped to where it lives — total rejection on the raw-object layer, the host-identity boundary past the gate, shared with the machine's own superposition layer. Regression 24; 24/24 forced-exit-1; four instruments byte-identical; one equivalence bug caught during implementation before measurement (the AL-instance kind requirement, registered). Audit #18's harness joins the kit set and reruns healed. Fresh audit #19 launched; PASS re-claim gated on it. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 37 +++++++--- docs/ledger/2026-08.md | 70 ++++++++++++++++++ docs/quantum-algebraic/kernel.md | 121 ++++++++++++++++++++++--------- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 182 insertions(+), 48 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 463c3d8..bda8bc7 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,10 +413,10 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.25** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.26** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after -seventeen fresh-context rounds. Kernel-arm provenance summaries +eighteen fresh-context rounds. Kernel-arm provenance summaries have been refuted by literal diff twice (audit #13 killed "unmoved since v1.11"; audit #14 showed the corrected summary still incomplete), so the register now names arms per version @@ -533,10 +533,24 @@ W0 gate making wf() total (W1-W9 adjudicated only over the language's carrier), and the ten-mark gauge sweep — 8/1024 reachable-only with KA free, 4/1024 with one disclosed raw suppressed-decode edge, every survivor pinning w(KA)=0 — with -suite/certify/typecheck byte-identical again. What the -rounds still +suite/certify/typecheck byte-identical again. Audit #18 +confirmed all of that (alien-gate on its full surface; the +gauge pinning proved arm-intrinsic by an independent GF(2) +solver) and broke checker totality at layer FOUR: an exact-pure +empty tuple in the log crashed wf() upstream of the W0 gate +through a bare-indexing token predicate, and 1,500-deep +recursion blew pure() and closed(). v1.26 is the helper-level +totality round — no arm, no guard: emptiness conjuncts on the +four predicates, every wf traversal iterative and pre-gate +hash-free (the token grammar as a closure sweep), and the +totality claim scoped to where it lives — total rejection on +the raw-object layer, with the W1-W9 scans and the machine's +superposition layer sharing the HOST-IDENTITY BOUNDARY (a +state the host cannot hash can never enter a superposition). +Suite/certify/typecheck/polarity byte-identical once more. What +the rounds still found was claim-language and scaffolding, each fixed the same -day: all twenty-three permanent regressions now gate mechanically (the +day: all twenty-four permanent regressions now gate mechanically (the module verdict is the exit code — forcing any single regression false exits nonzero, measured); `validate()` gained NON-VACUITY at both levels (an entry at an unreachable position and a ghost @@ -552,15 +566,16 @@ minimal; physics table passes on all twenty; all prior audit kits rerun with every delta adjudicated (ks-display relabels under always-emit and the KA head; the W0-gate display collapses; matrix-coverage shrink under the tightened language; -the healed-countermodel crash); every v1.25 prediction held, -with the round's registered wrong call being my own pre-fix -hand-derivation of the fire-edge parity — the mechanized sweep -adjudicated for the auditor's numbers (provenance in the -scratchpad prediction files). +the healed-countermodel crash); every v1.26 prediction held, +with one equivalence bug caught during implementation before +any measurement — the closure sweep's first draft would have +weakened the AL-instance kind requirement, restored and +registered beside v1.25's wrong-algebra call (provenance in +the scratchpad prediction files). The open docket, in order: -1. **fresh-context independent audit #18 of the v1.25 h-fragment +1. **fresh-context independent audit #19 of the v1.26 h-fragment claim** (verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 0fefa46..4ac2b4a 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -3445,3 +3445,73 @@ marks and independently print the 8-entry KA-free reachable orbit. Register (§1, §2 guards, §3, §6, §7.1, §9, §10, §11), STATUS, token.md updated; fresh audit #18 launched — the PASS re-claim stays gated on it. + +## 2026-08-10 — qALC kernel v1.26: the last recursion dies; totality finds its true boundary + +Audit #18 (fresh instance, sol tier, threadless) FAILED v1.25 on +exactly one refuted claim while confirming every other: C1 by +source reconstruction, the alien-gate repair on a STRICTLY +LARGER surface than the round claimed (top-level foreign +tickets typed at both polarities plain and certified; nested +foreign tickets, foreign frames, and foreign burials all +verified CARRIED — explicitly tagged in cargo, KD keys, +spectators, and history, never reinterpreted), and the gauge +claim UPGRADED in confirmation: an independent ten-mark +profiler and GF(2) solver showed every possible +suppressed-decode edge satisfies w(M)+w(A)+w(AL)+w(KA) ≡ 1, so +the reachable orbit forces w(KA) = 0 universally — the pinning +is a property of the arm, not of my chosen instrument edge. It +also forced the two polarity readings separately and REMOVED +the raw instrument (exit 1 — the both-readings gate is real). + +The refutation: checker totality, LAYER FOUR. An exact-pure +EMPTY TUPLE in the log crashed wf() UPSTREAM of the W0 gate — +purity accepts (), w0log calls kernel.is_gam, and is_gam +indexed e[0] bare (is_lp always had the emptiness guard; its +four siblings never got it). The gate only protected states +whose W0 clauses could already be computed safely. Beside it, +two RecursionError classes: a 1,500-deep exact tuple blew +recursive pure(), a 1,500-lambda closed term blew recursive +closed(). The staircase so far: binder_path (audit #15), +hashing (v1.24's own design), indexing (audit #17), emptiness +and recursion (audit #18) — each round one layer below the +previous fix, all inside the same claim. + +v1.26, predictions written first — NO arm, NO guard, the +helper-level totality round: the four predicates gain the +emptiness conjunct (identical on every non-empty tuple); every +traversal wf() performs before and during W0 becomes ITERATIVE +and pre-gate HASH-FREE — explicit-stack pure and closed, the +token grammar as a CLOSURE SWEEP (a token is valid iff every +node of its closure satisfies its local predicate — exactly the +recursive definition, iteratively — with an id-keyed per-call +memo), iterative deep scans, and kernel's +alpha_keys_live/alpha_bits_deep iterative too (they serve the +fire arm's deep-W3 guard; identical outputs). The totality +claim is finally scoped to where it lives: total rejection on +the raw-object layer — any finite object graph either passes W0 +or returns exactly ['W0'], no crash — and past the gate the +HOST-IDENTITY BOUNDARY, shared with the machine's own +superposition layer: a state whose components the host cannot +hash can never enter an evolve dict at all, so neither the +scans nor the machine claim states past it. The cap placed at +state identity, not an arbitrary depth number — the honest +version of the auditor's disclosure option. + +One equivalence bug caught DURING implementation, before any +measurement: the closure sweep's first draft pushed the AL +instance untyped, which would have accepted an AL whose +instance is a bullet — the recursive form required an lp. The +kind requirement restored; registered in the predictions file +because it is exactly the silent-weakening class the risk +section named. Measurements: suite, certify, typecheck, +polarity ALL byte-identical; conservation timing-suffix only; +wf exactly one new line; the four empty-register states, the +deep tuple, and the deep term all heal (['W0'], ['W0'], full +pass); corpus zero hits; census unchanged; regression +twenty-four gated, twenty-four-for-twenty-four under forcing; +the auditor's own harness joins the kit set and reruns healed +on every row; pack captions made count-neutral per their own +standing convention (audit #18 caught the v125 caption still +saying twenty-one). Register, STATUS, token.md updated; fresh +audit #19 launched — the PASS re-claim stays gated on it. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index b532012..a707ad7 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.25.** The kernel is a scratch superposition evolver +**Status: v1.26.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -17,7 +17,7 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #18**, whose +The standing PASS re-claim is **gated on fresh audit #19**, whose verdict will be registered here. Kernel-arm provenance is the chronicle's per-row "what changed" column — summaries of it have been refuted twice by literal diff (audit #13 killed "unmoved @@ -25,31 +25,34 @@ since v1.11"; audit #14 showed the corrected two-wave summary still omitted v1.12's ordinary-decode burial-suppression change and mislabeled v1.21's binder/transport arms as "leaf" guards) — so this register now names arms exactly and only per version: -v1.25 adds ONE machine guard relative to v1.24, and no arm's -storage behavior moves: the fire boundary types foreign-gate -cargo tickets (`alien-gate` — audit #17 showed `α_t` at an `h` -boundary with a matching bit was WF-clean and silently DECODED -into a `('K','t',i)` record under an H row: the register's -decode row always said `l = α_g(i, b)` and the implementation -had dropped the subscript). Around the machine, two -verification-layer corrections from the same audit: `wf()` is -now TOTAL by the W0 GATE (exact-pure malformed tuples were -W0-flagged and then crashed the W1-W9 deep scans; W1-W9 are -adjudicated only over the language's carrier), and the KA mark -joined the gauge sweep (ten parameters, 1024 assignments — a -reachably-dead mark cannot be constrained by reachable edges, -so one disclosed raw suppressed-decode edge is the constraining -instrument: 8/1024 reachable-only with KA free, 4/1024 with the -edge, every survivor pinning w(KA) = 0). Audit #17 CONFIRMED -the v1.24 KA repair itself outright — no remaining -storage-history collision, state-space inner products -re-derived, the guard-exclusion lifecycle verified coherent, -and the arm census extended to the 218,546-state corpus -(367/465/222/0). Suite, certify, and typecheck measured -BYTE-IDENTICAL across v1.25; polarity's output changed in -exactly the declared gauge-sweep lines. For anything older, -read §11's rows; do not trust a summary, including this file's -former ones. +v1.26 changes NO arm and NO guard — it is a helper-level +totality round. Audit #18 confirmed everything else (C1 by +source reconstruction; the alien-gate repair including nested +foreign tickets, foreign frames, and foreign burials — all +carried explicitly tagged, none reinterpreted; the gauge claim +UPGRADED: an independent GF(2) solver showed every possible +suppressed-decode edge satisfies w(M)+w(A)+w(AL)+w(KA) ≡ 1, so +the reachable orbit forces w(KA) = 0 universally — the pinning +is a property of the arm, not of the chosen instrument edge) +and broke checker totality at LAYER FOUR: an exact-pure EMPTY +TUPLE in the log crashed `wf()` upstream of the W0 gate +(`is_gam` indexed `e[0]` bare), and 1,500-deep recursion blew +`pure()` and `closed()`. v1.26: the four bare-indexing token +predicates gain the emptiness conjunct (identical on every +non-empty tuple); every traversal `wf()` performs before and +during W0 — purity, closedness, the token grammar (now a +closure sweep with an id-keyed per-call memo), and the deep +scans, plus the kernel's `alpha_keys_live`/`alpha_bits_deep` +that also serve the fire arm's deep-W3 guard — is ITERATIVE +and, pre-gate, HASH-FREE. The totality claim is scoped to +where it actually lives (§6): total rejection on the +raw-object layer; past the gate, the W1-W9 scans and the +machine's superposition layer share the HOST-IDENTITY +BOUNDARY — a state whose components the host cannot hash can +never enter a superposition at all. Suite, certify, typecheck, +and polarity measured BYTE-IDENTICAL across v1.26. For +anything older, read §11's rows; do not trust a summary, +including this file's former ones. This file is the current contract and register only. The round-by-round history — countermodels, corrections, verdicts — @@ -544,8 +547,26 @@ the machine's unitarity claims quantify over the subtype: then crashed the W1-W9 deep scans, so W1-W9 are adjudicated only over the language's carrier, the same argument that justifies the purity early-return; after a clean W0 every - token has exact shape and the scans index safely, making - `wf()` TOTAL. Zero reachable + token has exact shape and the scans index safely. TOTALITY, + scoped where it lives (v1.26, audit #18 — which found an + empty tuple in the LOG crashing upstream of the gate through + a bare-indexing token predicate, and 1,500-deep recursion + blowing `pure()`/`closed()`): every traversal `wf()` performs + before and during W0 is ITERATIVE and HASH-FREE (explicit + stacks; the token grammar a closure sweep — a token is valid + iff every node of its closure satisfies its local predicate, + which is the recursive definition, iteratively — with an + id-keyed per-call memo), so `wf()` rejects ANY finite object + graph without crashing and returns exactly `['W0']` for + everything out of language. Past the gate, the W1-W9 scans + key their dicts by in-language components, and the machine's + own superposition layer keys STATES by hash: both share the + HOST-IDENTITY BOUNDARY — a state whose components exceed the + host's structural hashing limits cannot enter any + superposition (evolve's dicts require the hash before wf ever + sees the state), so neither layer claims states past it; the + boundary is state identity, not an arbitrary depth cap. Zero + reachable fires on the twenty programs and the 218,546-state generated corpus. - **W1** (log discipline): `|log| = level(pos)`. @@ -885,7 +906,7 @@ canonical dicts compared bit-for-bit; `dupcall` canonically None `h(Ω)` → None. Negative controls: pstar × wrong certificate reaches `pop-err`; dupcall × v1.7-era certificate reaches `refire`, all-err. WF/W7/W8/W9 sweeps + mechanized disjointness: -zero violations; **twenty-three permanent regressions** (the v1.6 pair; +zero violations; **twenty-four permanent regressions** (the v1.6 pair; extra-frame collision, W7-excluded with disjoint targets; doctored bundle divergence; K+frame alias; retained-Q disjointness — spectator-bit columns share zero targets; @@ -941,7 +962,12 @@ exactly `['W0']` with no exception, and an in-language multi-violation control still lists its W1-W9 flags (the gate must not over-collapse); alien-gate — foreign-gate tickets at the fire boundary are WF and typed `alien-gate` at both bit -polarities, the same-gate decode control fires unchanged). The +polarities, the same-gate decode control fires unchanged; +totality IV — an exact-pure empty tuple in EACH of the four +registers returns exactly `['W0']` with no exception, a +1,500-deep exact tuple returns `['W0']`, and a 1,500-lambda +closed term's root state passes wf in full — the deep-term +no-over-rejection control). The gating structure, stated exactly (audits #6 and #7 each caught a computed-but-non-gating verdict; audit #8 forced all eleven then-regressions @@ -954,13 +980,16 @@ including ok_gr; audit #15 confirmed seventeen-for-seventeen; audit #16 confirmed nineteen-for-nineteen plus fourteen instrument components, every mutation exit 1; audit #17 confirmed twenty-one-for-twenty-one plus the fourteen -components likewise): the v1.6 pair -gates `collisions_under_wf()`; the other twenty-one gate +components likewise; audit #18 confirmed +twenty-three-for-twenty-three plus the fourteen components, +the two polarity readings forced separately, and the raw gauge +instrument REMOVED → exit 1): the v1.6 pair +gates `collisions_under_wf()`; the other twenty-two gate `cert_sweep()`'s return; the module `__main__` conjoins all three sweeps in its printed total AND ITS EXIT CODE, so any single regression failure exits nonzero (measured: forcing the pair false → exit 1; forcing cert_sweep flags false → exit 1, -including the v1.20 through v1.25 flags; the +including the v1.20 through v1.26 flags; the emulated-old-arm probe flips `cert_sweep` to FAIL). Three v1.12/v1.13-era regression mechanizations were updated in v1.23 to the always-emit discipline (their targets now carry the @@ -1153,7 +1182,26 @@ displays recompute with the current ten-mark profiler and print the 8-entry KA-free reachable orbit — independent confirmation of the unconstrained-mark fact — with `orbits_equal` still True; the v118/v119 line counts as always; the v121 crash and -the v123 kit byte-identical. Basis counts vs v1.2 reference: `negative` 103→83, +the v123 kit byte-identical. Audit #18 confirmed the alien-gate +repair on its full semantic surface (top-level foreign tickets +typed at both polarities, plain and certified; nested foreign +tickets, foreign frames, and foreign burials verified CARRIED — +explicitly tagged in lp cargo, KD keys, spectator frames, and +burial history, never reinterpreted — a strictly stronger +adjacent-representation check than the round claimed), upgraded +the gauge confirmation to the universal equation (every +suppressed-decode edge, frame or burial, either slot, forces +w(KA) = 0 given the reachable orbit — via an independent +profiler and GF(2) solver), and independently verified the two +polarity readings and the raw instrument's own gating; its +totality countermodels (the empty log tuple, the two +RecursionError classes) are healed and gated as regression +twenty-four, with every wf traversal now iterative and the +host-identity boundary registered in §6. Its harness +(audit_v125_fresh.py) joins the kit rerun set — its TOTALITY +rows now report the healed values, its ALIEN_GATE and GAUGE +tables reproduce, and its forcing inventory (its own 23-flag +snapshot) reports all exit 1. Basis counts vs v1.2 reference: `negative` 103→83, `selector` 173→106, `pstar` 458→242 — v1.7-era, real, owned; marginals and supports never moved. All measurements seconds-scale on the M5 Max. @@ -1232,7 +1280,8 @@ no bare-term ideal oracle). | v1.22 | W0 becomes the FULL state language: exact-int bits (bool refused — the terminal-kind minting), recursive lp productions with occurrences resolving to Vars of the term, arrival-lp K(l) cargo, coordinates d/path in language, VB phase exact-int; anshead's bit check exact-int (the one arm change, bit-identical on covered outputs); regression seventeen (state-language: ten countermodels + exact-int and kit-exact foreign-lp controls) gated; provenance summaries abolished — the register names arms per version only and defers history to these rows; the wf.py v1.12 fixture's App-naming carrier lp corrected (countermodel essence untouched); six kits' helper-lp wf-columns and the v121 kit's crash-by-construction adjudicated; stale W1-W9 phrases updated; zero W0 hits on the corpus; every prediction held in substance with the kit-delta count wrong and registered | **fresh audit #15: FAIL** (C1/C2/C4/C5 CONFIRMED — the v1.21→v1.22 diff exactly the exact-int condition, the delta set exact with the crash scoped, all seventeen forcings, the exact-bit repair itself sound against Fraction/int-subclass/-0.0 probes. The findings: THE FIRST RAW-SUBTYPE UNITARITY BREAK SINCE AUDIT #3 — §7.4's incoming-KS disjointness is false because the certified fire omitted empty KD bundles: a fresh decode and a carried-in record produced IDENTICAL targets, inner product 1, norm 2; W0 admitted BULLET in the log (bt1 transported it into a b1 collision, norm 2 again), never checked the lambda-IAM slice equation (a bad slice stepped to a W1-invalid target), and accepted open terms whose current position crashes binder_path; the t boundary raised NotImplementedError from WF states; "full state language" and the placement sentence refuted with them) | | v1.23 | The certified fire emits its bundle UNCONDITIONALLY — ('KD', ()) when empty — restoring storage-history prefix-freeness (§7.4 restated to the strip-the-head injectivity); the t boundary becomes the typed scope fence t-unimplemented; W0 gains the log SORT (lp-like entries only), the lambda-IAM slice equation with a bound-finding binder walk, and the closed-term conjunct; regressions eighteen (log-sort/slice-equation) and nineteen (KS prefix-freeness + t fence) gated; three v1.12/v1.13-era regression mechanizations updated to the always-emit form and two fixture lps corrected to the slice equation (theorems and countermodel essences unchanged, all disclosed); THE HINGE PREDICTION, written first, HELD: suite, certify, typecheck, and polarity byte-identical — no reachable interference crosses fire histories, so the machine change is invisible on every covered output; ten kits' ks-display deltas and the matrix-coverage shrink adjudicated; zero W0 hits on the corpus | **fresh audit #16: FAIL** (C1 CONFIRMED independently — the two-arm diff exact, four instruments byte-identical against the re-executed v1.22 sources, the hinge reason verified by a 5,760-state fire-history search plus 300 generated bodies with zero mixed-count merges, and the stronger v1.23 form derived: append-only KS makes different-fire-count merges impossible; C2 CONFIRMED narrowly for certified fires — nested bundles cannot defeat tuple-head injectivity; C4/C5 CONFIRMED — nineteen forcings + fourteen instrument components all exit 1, zero reachable W0 fires, the corpus rerun independently; the binder equation confirmed on 100,763 reachable lp occurrences with zero binder_path mismatches. The findings: THE AUDIT-#15 SIBLING — the suppressed-decode arm appends ZERO storage heads, so a suppressed decode with incoming [K(l)] and a retain-whole fire with incoming [] produce IDENTICAL targets, norm 2, through BOTH the same-key-frame and agreeing-burial variants — legal lifecycle configurations, not the alias gap; W0 accepted Var(0) (`i <= depth` under the 1-INDEXED convention — binder_path IndexError one step inside WF) and never sorted the CONTAINERS (a list tape passed WF, the fire TypeError'd); three stale register/docstring lines, including the §9 gate sentence still naming audit #15) | | v1.24 | The suppressed-decode fire appends the inert arm-typed history head ('KA', g, i) — EVERY fire arm now appends exactly one head, §7.4 restated to the all-arms one-head discipline; the head carries its key because the author two-key double-suppression sibling (both tickets suppressing over a shared two-frame RS) also collided at norm 2 pre-fix, and a contentless marker would have left it alive; KA excluded from ks_dead_keys/ks_bitfree_keys by design (refire/key-alias/W8/W4-storage blind; replays off the surviving frame stay legal); W0 gains exact-type PURITY (registers exact tuples of exact tuples/str/int, checked without hashing before any scan — hostile __hash__/__eq__ can neither crash nor poison the checker; list containers refused) and the 1-indexed closedness (Var(0) refused); regressions twenty (fire prefix-freeness, three pairs + recorded-arm control) and twenty-one (W0 totality II incl. the hostile-hash probe) gated; the three stale lines fixed; THE HINGE, cheaper this round: suite/certify/typecheck/polarity byte-identical because the suppressed arm is REACHABLY DEAD CODE on the whole canonical suite (arm census measured first: 58 certified / 69 retain-whole / 10 decode-recorded / 0 suppressed); v113/v114 kit ks-displays gain the KA head (relabels, semantic columns unchanged — a kit-delta class my predictions MISSED and registered as the round's wrong call); zero W0/W4 hits on the corpus | **fresh audit #17: FAIL** (the KA repair itself CONFIRMED-SOUND — no remaining storage-history collision; the four KS-writing arms enumerated from source, non-fire paths KS-preserving, the three healed pairs re-derived at state-space inner product 0, the guard-exclusion lifecycle verified coherent — and the reachability hinge confirmed with an independent census matching 58/69/10/0 and EXTENDED to the corpus, 367/465/222/0; C1 confirmed at the AST level; C4/C5 confirmed, 21 forcings + 14 components all exit 1. The findings: wf() NOT TOTAL over exact-pure malformed states — bare ('AL',)/('L',) tape tokens and an empty () frame pass purity, get W0-flagged, then IndexError the W1-W9 deep scans; a WF-clean FOREIGN-GATE ticket silently decoded — α_t at an h boundary with matching bit fires and records ('K','t',i) under an H row, the register's decode subscript dropped by the implementation; the gauge sweep OMITS KA — nine parameters, KA implicitly weight 0 and unconstrainable by reachable edges (the auditor's own repaired sweep: 8/1024 reachable-only KA-free, 4/1024 with a raw suppressed edge, KA pinned 0); plus the stale "inert dead storage" docstring phrase) | -| v1.25 | ONE machine guard added, no arm's storage behavior moves: alien-gate types foreign-gate cargo tickets at the fire boundary at both bit polarities (the decode row's subscript restored to the implementation; reachably unmintable — α_t's only mint site is behind the t-fire fence — so suite/certify/typecheck byte-identical, measured); wf() made TOTAL by the W0 GATE (out-of-language states early-return ['W0']; W1-W9 adjudicated only over the language's carrier; the in-language multi-flag control proves no over-collapse); the gauge sweep goes TEN-mark — 8/1024 reachable-only with KA free (printed), 4/1024 with the disclosed raw suppressed-decode edge, every survivor pinning w(KA)=0, verdict gating on both readings; §7.1 restated; regressions twenty-two (checker totality III) and twenty-three (alien-gate) gated, twenty-three-for-twenty-three under forcing; the "inert dead storage" phrase corrected; my pre-fix hand-derivation of the fire-edge parity DISAGREED with the auditor's sweep numbers and the measurement adjudicated for the auditor (registered — the mechanized sweep is the theorem, not my head-model); kit deltas: the W0-gate display collapses on out-of-language fixtures and the ten-mark orbit displays (independent confirmation of the unconstrained-mark fact), v121 crash and v123 kit byte-identical | **fresh audit #18: pending** | +| v1.25 | ONE machine guard added, no arm's storage behavior moves: alien-gate types foreign-gate cargo tickets at the fire boundary at both bit polarities (the decode row's subscript restored to the implementation; reachably unmintable — α_t's only mint site is behind the t-fire fence — so suite/certify/typecheck byte-identical, measured); wf() made TOTAL by the W0 GATE (out-of-language states early-return ['W0']; W1-W9 adjudicated only over the language's carrier; the in-language multi-flag control proves no over-collapse); the gauge sweep goes TEN-mark — 8/1024 reachable-only with KA free (printed), 4/1024 with the disclosed raw suppressed-decode edge, every survivor pinning w(KA)=0, verdict gating on both readings; §7.1 restated; regressions twenty-two (checker totality III) and twenty-three (alien-gate) gated, twenty-three-for-twenty-three under forcing; the "inert dead storage" phrase corrected; my pre-fix hand-derivation of the fire-edge parity DISAGREED with the auditor's sweep numbers and the measurement adjudicated for the auditor (registered — the mechanized sweep is the theorem, not my head-model); kit deltas: the W0-gate display collapses on out-of-language fixtures and the ten-mark orbit displays (independent confirmation of the unconstrained-mark fact), v121 crash and v123 kit byte-identical | **fresh audit #18: FAIL** (C1/C2/C4/C5 CONFIRMED — the delta exact by source reconstruction, 23 forcings + 14 components + both polarity readings + the raw instrument removed all exit 1, zero W0/alien-gate fires on an independently regenerated corpus; the alien-gate repair CONFIRMED on its full surface including nested/frame/burial foreign representations, all carried, never reinterpreted; the gauge claim UPGRADED — an independent GF(2) solver proved every possible suppressed-decode edge forces w(KA)=0 given the reachable orbit: the pinning is arm-intrinsic, not edge-dependent. The finding: C3's totality broken at LAYER FOUR — an exact-pure EMPTY TUPLE in the log crashes wf() UPSTREAM of the W0 gate (w0log → is_gam → bare e[0] IndexError; the gate only protected states whose W0 clauses already computed safely), plus two RecursionError classes (1,500-deep exact tuple in recursive pure(); 1,500-lambda term in recursive closed()); honesty: "wf() is total" false as written, the pack caption's stale regression count violating its own count-neutral convention, "one raw edge" vs one raw fire with two H successor edges) | +| v1.26 | NO arm, NO guard — the helper-level totality round: the four bare-indexing token predicates (is_gam/is_mu/is_ans/is_alpha) gain the emptiness conjunct is_lp always had; every wf traversal before and during W0 becomes ITERATIVE and pre-gate HASH-FREE (explicit-stack pure/closed; the token grammar as a CLOSURE SWEEP — valid iff every closure node satisfies its local predicate — with an id-keyed per-call memo; iterative deep scans; kernel's alpha_keys_live/alpha_bits_deep iterative too, serving the fire arm's deep-W3 guard identically); the totality claim SCOPED to where it lives — total rejection on the raw-object layer, and past the gate the HOST-IDENTITY BOUNDARY shared with the machine's own superposition layer (§6); regression twenty-four (empty tuple in each register → exactly ['W0']; 1,500-deep tuple → ['W0']; 1,500-lambda term passes in full) gated, twenty-four-for-twenty-four under forcing; one equivalence bug caught DURING implementation before any measurement (the sweep's first draft would have accepted an AL with a non-lp instance — the kind requirement restored, registered in the predictions file); pack captions made count-neutral per their own standing convention; suite/certify/typecheck/polarity byte-identical, conservation timing-suffix only, wf exactly one new line; the auditor's harness joins the kit set and reruns healed | **fresh audit #19: pending** | ## 12. Appendix — HH step-indexed trace diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index fd2cb68..e9e30d9 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -398,7 +398,7 @@ register alone carries the version). | Item | Status | |---|---| -| Kernel | **v1.25** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (W0 = the SORTED state language with exact-type PURITY as of v1.24 — registers exact tuples of exact tuples/str/int checked without hashing, exact-int bits, recursive lp productions satisfying the lambda-IAM slice equation with occurrences resolving to bound Vars (1-indexed; Var(0) refused) of the closed term, the log's lp-like alphabet, arrival-lp K(l) cargo, the KA production, coordinates in language — plus W1-W9, with W4 closed by enumeration and §7.4's storage prefix-freeness now the ALL-ARMS one-head-per-fire discipline: audit #15's empty-bundle collision and audit #16's suppressed-decode/retain-whole forgery were the certified and uncertified instances of the same defect — every fire arm appends exactly one arm-typed head (KD / K3 / KA / K2), each healed with every covered output byte-identical); wf() TOTAL via the W0 gate (v1.25 — W1-W9 adjudicated only over the language's carrier); the species guards, the alien-gate foreign-ticket guard, and the t scope fence typed (fifteen guards); the ten-mark gauge sweep pins w(KA)=0 via the disclosed raw suppressed edge (4/1024, with the 8/1024 reachable-only reading printed beside it); twenty-three permanent regressions, all gating; all six instruments carry exit-code verdicts; kernel-arm history lives in the register's §11 rows. **PASS re-claim gated on fresh audit #18** | +| Kernel | **v1.26** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (W0 = the SORTED state language with exact-type PURITY as of v1.24 — registers exact tuples of exact tuples/str/int checked without hashing, exact-int bits, recursive lp productions satisfying the lambda-IAM slice equation with occurrences resolving to bound Vars (1-indexed; Var(0) refused) of the closed term, the log's lp-like alphabet, arrival-lp K(l) cargo, the KA production, coordinates in language — plus W1-W9, with W4 closed by enumeration and §7.4's storage prefix-freeness now the ALL-ARMS one-head-per-fire discipline: audit #15's empty-bundle collision and audit #16's suppressed-decode/retain-whole forgery were the certified and uncertified instances of the same defect — every fire arm appends exactly one arm-typed head (KD / K3 / KA / K2), each healed with every covered output byte-identical); wf() total on the raw-object layer via the W0 gate with every traversal iterative and pre-gate hash-free (v1.26 — W1-W9 adjudicated only over the language's carrier; past the gate the host-identity boundary, shared with the machine's own superposition layer); the species guards, the alien-gate foreign-ticket guard, and the t scope fence typed (fifteen guards); the ten-mark gauge sweep pins w(KA)=0 via the disclosed raw suppressed edge (4/1024, with the 8/1024 reachable-only reading printed beside it — audit #18 proved the pinning arm-intrinsic); twenty-four permanent regressions, all gating; all six instruments carry exit-code verdicts; kernel-arm history lives in the register's §11 rows. **PASS re-claim gated on fresh audit #19** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §5): the fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is the hybrid validation — structural admission/isometry plus exact-amplitude dynamic cleanliness plus non-vacuity, strictly beyond Gram (negative controls caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and **self-validating**: every admitted map passes full semantic coverage, else None | From 5f2f443900df54828087fa0a6c29de8a6d39f1cf Mon Sep 17 00:00:00 2001 From: a9lim Date: Mon, 10 Aug 2026 00:40:00 -0400 Subject: [PATCH 051/107] =?UTF-8?q?qalc:=20kernel=20v1.27=20=E2=80=94=20th?= =?UTF-8?q?e=20checker=20learns=20what=20a=20term=20is;=20the=20structural?= =?UTF-8?q?-operation=20boundary;=20audit=20#19=20registered?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #19 (cx-20260810-000448-23cb) confirmed the machine a third consecutive round — including differential-testing the closure sweep against v1.25's recursive grammar over 100k random soups, zero drift — and found totality layer five, all in wf()'s raw surface: garbage terms silently accepted, a cyclic term graph hanging the walk, a hostile Run subclass running code inside wf, 2^24-visit shared DAGs, a wf7 crash, and hash/repr/equality breaking at different depths (refuting the boundary as worded). v1.27 — checker-only, zero kernel changes: exact-type dispatch; id-visited purity; closed() a full term validator (unknown kinds rejected, on-path cycle detection, (id,depth) memo); wf7 guards; the boundary restated to the host's structural-operation limits (hash, equality, canonical-order repr — exactly the machine's own state-discipline operations). The twice-broken §9 gate-line promise is now an assemble-script assertion. Regression 25; 25/25 forced-exit-1; four instruments byte-identical; a second caught-in-implementation equivalence hazard registered pre-measurement (closed()'s memo order vs App-cycles). The layer-five harness joins the kit set. Fresh audit #20 launched; PASS re-claim gated on it. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 37 ++++--- docs/ledger/2026-08.md | 68 +++++++++++++ docs/quantum-algebraic/kernel.md | 159 ++++++++++++++++++++----------- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 196 insertions(+), 70 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index bda8bc7..042d28a 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,10 +413,10 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.26** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.27** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after -eighteen fresh-context rounds. Kernel-arm provenance summaries +nineteen fresh-context rounds. Kernel-arm provenance summaries have been refuted by literal diff twice (audit #13 killed "unmoved since v1.11"; audit #14 showed the corrected summary still incomplete), so the register now names arms per version @@ -547,10 +547,25 @@ totality claim scoped to where it lives — total rejection on the raw-object layer, with the W1-W9 scans and the machine's superposition layer sharing the HOST-IDENTITY BOUNDARY (a state the host cannot hash can never enter a superposition). -Suite/certify/typecheck/polarity byte-identical once more. What +Suite/certify/typecheck/polarity byte-identical once more. +Audit #19 confirmed the machine a THIRD straight round — +including differential-testing the closure sweep against the +old recursive grammar over 100,000 random soups, zero drift — +and found totality layer FIVE: garbage terms silently accepted, +a cyclic term graph hanging the walk, a hostile Run subclass +running code inside wf, exponential shared-DAG purity, a wf7 +crash, and the discovery that hash/repr/equality break at +DIFFERENT depths, refuting the boundary as I had worded it. +v1.27 (checker-only): exact-type dispatch, a full term +validator with cycle detection, representation-linear +traversals, wf7 guards, and the boundary restated to the +host's structural-operation limits — hash, equality, and +canonical-order repr, exactly the operations the machine's own +state discipline performs. The twice-broken §9 gate-line +promise is now an assemble-script assertion. What the rounds still found was claim-language and scaffolding, each fixed the same -day: all twenty-four permanent regressions now gate mechanically (the +day: all twenty-five permanent regressions now gate mechanically (the module verdict is the exit code — forcing any single regression false exits nonzero, measured); `validate()` gained NON-VACUITY at both levels (an entry at an unreachable position and a ghost @@ -566,16 +581,16 @@ minimal; physics table passes on all twenty; all prior audit kits rerun with every delta adjudicated (ks-display relabels under always-emit and the KA head; the W0-gate display collapses; matrix-coverage shrink under the tightened language; -the healed-countermodel crash); every v1.26 prediction held, -with one equivalence bug caught during implementation before -any measurement — the closure sweep's first draft would have -weakened the AL-instance kind requirement, restored and -registered beside v1.25's wrong-algebra call (provenance in -the scratchpad prediction files). +the healed-countermodel crash); every v1.27 prediction held, +with the round's second caught-in-implementation equivalence +hazard registered pre-measurement — closed()'s memo order +against App-cycles, beside v1.26's AL-instance catch and +v1.25's wrong-algebra call (provenance in the scratchpad +prediction files). The open docket, in order: -1. **fresh-context independent audit #19 of the v1.26 h-fragment +1. **fresh-context independent audit #20 of the v1.27 h-fragment claim** (verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 4ac2b4a..3525278 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -3515,3 +3515,71 @@ on every row; pack captions made count-neutral per their own standing convention (audit #18 caught the v125 caption still saying twenty-one). Register, STATUS, token.md updated; fresh audit #19 launched — the PASS re-claim stays gated on it. + +## 2026-08-10 — qALC kernel v1.27: the checker learns what a term is; the boundary named by its true operations; a promise becomes an assertion + +Audit #19 (fresh instance, sol tier, threadless) confirmed the +machine for the THIRD consecutive round — C1 exact at the +definition level, the kernel helpers differential-tested against +recursive references (92,961 entries, zero mismatches), C4 with +warnings promoted to errors, C5 on an independently regenerated +corpus — and, the round's centerpiece, verified the v1.26 +closure sweep EXACTLY equivalent to v1.25's recursive grammar by +differential testing over 100,000 randomized token soups: 1,181 +acceptances each, zero mismatches, the optimistic-memo aggregate +argument verified, the AL-instance kind requirement confirmed +lp-shaped. Then it delivered totality LAYER FIVE, every finding +in wf()'s raw surface: wf(object(), ...) and wf("junk", ...) +returned [] — closed() had no rejecting branch, so garbage terms +were silently ACCEPTED; a cyclic term graph (frozen-dataclass +bypass) HUNG the tree walk; a hostile Run SUBCLASS overriding +__getattribute__ ran code from inside wf before purity; a +25-node shared-tuple DAG cost 2^24 purity visits, doubling per +node; wf7 IndexError'd on an empty frame; and the host-identity +boundary AS I HAD WORDED IT was refuted by measurement — hash, +repr, and equality have DIFFERENT structural limits: an +8,000-deep chain of valid lp productions is exact-pure, +in-language, hashes, and round-trips a dict, then dies in +W2-order's sorted(key=repr); a 2,000-deep control adjudicates +fully. And §9's gate line was stale AGAIN — the very line whose +parenthetical, written after audit #16 caught it the first +time, promised the locations update together. + +v1.27, predictions written first — checker-only, zero kernel +changes: exact-type dispatch (type(s) is Run — a subclass is +not a state of the machine, and hostile attribute access never +runs); pure() id-visited (representation-linear on DAGs; tuples +cannot cycle); closed() a full TERM VALIDATOR — unknown node +kinds rejected (garbage terms now W0, the v1.23 open-term +decision extended), on-path cycle detection (cyclic graphs +rejected promptly), an (id, depth) memo (shared term DAGs +polynomial; closedness is depth-relative so the memo keys on +both); wf7 declines out-of-language rs and non-tuple paths; §6 +restated to the truth: the boundary is the host's +STRUCTURAL-OPERATION limits — hash, equality, AND +canonical-order repr, exactly the operations the machine's own +state discipline performs (evolve keys by hash; identity is +equality; rs_insert and the certified bundle sort by repr) — +wf performs no structural operation on state content the +machine does not, and the 8,000/2,000 measurements are the +boundary's registered empirical face. The twice-broken promise +became an ASSERTION: the assemble script now verifies §1 and §9 +name the same audit and refuses to build the pack otherwise — +automation where memory failed twice. + +The round's second caught-in-implementation equivalence hazard, +registered before any measurement: closed()'s first draft +consulted the (id, depth) memo BEFORE the on-path cycle check, +and an App-cycle re-enters at the SAME depth — it would have +been skipped as a memo hit and the cyclic term silently +accepted. The on-path check now comes first. Measurements: +suite/certify/typecheck/polarity byte-identical; wf exactly one +new line; all seven countermodel rows heal (the layer5 kit's +DAG table reads 0.0 s on every rung); corpus and census +unchanged; regression twenty-five gated, +twenty-five-for-twenty-five under forcing; fourteen prior kits +byte-identical (v118/v119 line counts aside), the v125 harness +honestly self-reports wf7 in its changed-defs tracking, and the +layer-five harness joins the kit set at full sample size. +Register, STATUS, token.md updated; fresh audit #20 launched — +the PASS re-claim stays gated on it. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index a707ad7..07be04e 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.26.** The kernel is a scratch superposition evolver +**Status: v1.27.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -17,7 +17,7 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #19**, whose +The standing PASS re-claim is **gated on fresh audit #20**, whose verdict will be registered here. Kernel-arm provenance is the chronicle's per-row "what changed" column — summaries of it have been refuted twice by literal diff (audit #13 killed "unmoved @@ -25,32 +25,35 @@ since v1.11"; audit #14 showed the corrected two-wave summary still omitted v1.12's ordinary-decode burial-suppression change and mislabeled v1.21's binder/transport arms as "leaf" guards) — so this register now names arms exactly and only per version: -v1.26 changes NO arm and NO guard — it is a helper-level -totality round. Audit #18 confirmed everything else (C1 by -source reconstruction; the alien-gate repair including nested -foreign tickets, foreign frames, and foreign burials — all -carried explicitly tagged, none reinterpreted; the gauge claim -UPGRADED: an independent GF(2) solver showed every possible -suppressed-decode edge satisfies w(M)+w(A)+w(AL)+w(KA) ≡ 1, so -the reachable orbit forces w(KA) = 0 universally — the pinning -is a property of the arm, not of the chosen instrument edge) -and broke checker totality at LAYER FOUR: an exact-pure EMPTY -TUPLE in the log crashed `wf()` upstream of the W0 gate -(`is_gam` indexed `e[0]` bare), and 1,500-deep recursion blew -`pure()` and `closed()`. v1.26: the four bare-indexing token -predicates gain the emptiness conjunct (identical on every -non-empty tuple); every traversal `wf()` performs before and -during W0 — purity, closedness, the token grammar (now a -closure sweep with an id-keyed per-call memo), and the deep -scans, plus the kernel's `alpha_keys_live`/`alpha_bits_deep` -that also serve the fire arm's deep-W3 guard — is ITERATIVE -and, pre-gate, HASH-FREE. The totality claim is scoped to -where it actually lives (§6): total rejection on the -raw-object layer; past the gate, the W1-W9 scans and the -machine's superposition layer share the HOST-IDENTITY -BOUNDARY — a state whose components the host cannot hash can -never enter a superposition at all. Suite, certify, typecheck, -and polarity measured BYTE-IDENTICAL across v1.26. For +v1.27 changes NO kernel source at all — it is a checker-only +round. Audit #19 confirmed the machine for the THIRD +consecutive audit (C1 exact; the closure-sweep grammar +differential-tested against v1.25's recursive form over 100,000 +randomized soups, zero mismatches; the iterative kernel helpers +against recursive references over 92,961 entries, zero +mismatches; C4/C5 in full with warnings promoted to errors) and +found totality LAYER FIVE, all in `wf()`'s raw surface: garbage +terms silently ACCEPTED (`closed()` had no rejecting branch), a +CYCLIC term graph hung the tree walk, a hostile Run SUBCLASS +ran code from inside wf via `__getattribute__`, a 25-node +shared-tuple DAG cost 2^24 purity visits, `wf7()` crashed on an +empty frame, and the host-identity boundary as stated was +FALSE — hash, repr, and equality have different structural +limits (an 8,000-deep in-language state hashes and dict-round- +trips, then dies in the W2 canonical-order repr sort; a +2,000-deep control adjudicates fully). v1.27: exact-type state +dispatch (`type(s) is Run`); `pure()` id-visited +(representation-linear on DAGs); `closed()` a full TERM +VALIDATOR (unknown node kinds rejected, on-path cycle +detection, an (id, depth) memo); `wf7()` declines +out-of-language rs; and §6's boundary restated to the host's +STRUCTURAL-OPERATION limits — hash, equality, AND repr, exactly +the operations the machine's own state discipline performs +(evolve keys by hash, identity is equality, rs_insert and the +certified bundle sort canonically by repr) — wf performs no +structural operation on state content that the machine does +not. Suite, certify, typecheck, and polarity measured +BYTE-IDENTICAL across v1.27. For anything older, read §11's rows; do not trust a summary, including this file's former ones. @@ -547,26 +550,38 @@ the machine's unitarity claims quantify over the subtype: then crashed the W1-W9 deep scans, so W1-W9 are adjudicated only over the language's carrier, the same argument that justifies the purity early-return; after a clean W0 every - token has exact shape and the scans index safely. TOTALITY, - scoped where it lives (v1.26, audit #18 — which found an - empty tuple in the LOG crashing upstream of the gate through - a bare-indexing token predicate, and 1,500-deep recursion - blowing `pure()`/`closed()`): every traversal `wf()` performs - before and during W0 is ITERATIVE and HASH-FREE (explicit - stacks; the token grammar a closure sweep — a token is valid - iff every node of its closure satisfies its local predicate, - which is the recursive definition, iteratively — with an - id-keyed per-call memo), so `wf()` rejects ANY finite object - graph without crashing and returns exactly `['W0']` for - everything out of language. Past the gate, the W1-W9 scans - key their dicts by in-language components, and the machine's - own superposition layer keys STATES by hash: both share the - HOST-IDENTITY BOUNDARY — a state whose components exceed the - host's structural hashing limits cannot enter any - superposition (evolve's dicts require the hash before wf ever - sees the state), so neither layer claims states past it; the - boundary is state identity, not an arbitrary depth cap. Zero - reachable + token has exact shape and the scans index safely. TOTALITY on + the raw-object layer (v1.26/v1.27, audits #18/#19 — the + staircase ran: empty tuples through a bare-indexing + predicate, 1,500-deep recursion, silently accepted garbage + terms, a cyclic term graph, a hostile Run subclass, a 2^24 + shared-DAG blowup, and a wf7 crash): dispatch is EXACT-TYPE + (`type(s) is Run` — a subclass is not a state of the machine + and its overridden attribute access never runs); every + traversal before and during W0 is ITERATIVE, pre-gate + HASH-FREE, and REPRESENTATION-LINEAR (id-visited purity; + `closed()` a full term validator — unknown node kinds + rejected, cycles detected on-path and rejected promptly, + shared term DAGs polynomial via an (id, depth) memo; the + token grammar a closure sweep with an id-keyed per-call + memo), so `wf()` accepts or W0-rejects ANY finite object + graph — malformed, cyclic, hostile-typed, or shared — without + crashing or hanging, and `wf7()` declines out-of-language + sources. Past the gate, the W1-W9 scans and the machine share + the HOST'S STRUCTURAL-OPERATION BOUNDARY: hash, equality, AND + canonical-order repr — exactly the operations the machine's + own state discipline performs (evolve keys states by hash; + state identity is equality; `rs_insert` and the certified + bundle sort canonically BY REPR) — and these limits DIFFER + (measured: an 8,000-deep in-language state hashes and + dict-round-trips, then exceeds the repr limit in the W2 + canonical-order check; a 2,000-deep control adjudicates + fully). wf performs no structural operation on state content + that the machine does not, so any state past the boundary is + one the machine could not itself build, canonically order, + store, or superpose; post-gate scan cost is value-semantics + (a shared DAG's value is genuinely exponential in its + representation). Zero reachable fires on the twenty programs and the 218,546-state generated corpus. - **W1** (log discipline): `|log| = level(pos)`. @@ -863,9 +878,11 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#18; the verdict will be registered here.** (Audit #16 caught -this very sentence still naming a stale round — the §1 gate and -this one are now updated together, every round.) +#20; the verdict will be registered here.** (Audit #16 caught +this sentence stale; audit #19 caught it stale AGAIN despite the +parenthetical promising otherwise — the promise is now an +ASSERTION: the pack assembly script verifies §1 and §9 name the +same audit number and refuses to build the pack otherwise.) ## 10. Verification state @@ -906,7 +923,7 @@ canonical dicts compared bit-for-bit; `dupcall` canonically None `h(Ω)` → None. Negative controls: pstar × wrong certificate reaches `pop-err`; dupcall × v1.7-era certificate reaches `refire`, all-err. WF/W7/W8/W9 sweeps + mechanized disjointness: -zero violations; **twenty-four permanent regressions** (the v1.6 pair; +zero violations; **twenty-five permanent regressions** (the v1.6 pair; extra-frame collision, W7-excluded with disjoint targets; doctored bundle divergence; K+frame alias; retained-Q disjointness — spectator-bit columns share zero targets; @@ -967,7 +984,12 @@ totality IV — an exact-pure empty tuple in EACH of the four registers returns exactly `['W0']` with no exception, a 1,500-deep exact tuple returns `['W0']`, and a 1,500-lambda closed term's root state passes wf in full — the deep-term -no-over-rejection control). The +no-over-rejection control; totality V — junk-string and +`object()` terms W0-rejected, the cyclic Lam graph W0-rejected +promptly, the hostile Run subclass declined without raising, +the 2^24 shared-DAG state W0-rejected promptly, wf7 declines +the malformed-frame source, with the deep-term and genuine-Run +adjudications as controls). The gating structure, stated exactly (audits #6 and #7 each caught a computed-but-non-gating verdict; audit #8 forced all eleven then-regressions @@ -983,13 +1005,15 @@ confirmed twenty-one-for-twenty-one plus the fourteen components likewise; audit #18 confirmed twenty-three-for-twenty-three plus the fourteen components, the two polarity readings forced separately, and the raw gauge -instrument REMOVED → exit 1): the v1.6 pair -gates `collisions_under_wf()`; the other twenty-two gate +instrument REMOVED → exit 1; audit #19 confirmed +twenty-four-for-twenty-four plus the fourteen components with +warnings promoted to errors): the v1.6 pair +gates `collisions_under_wf()`; the other twenty-three gate `cert_sweep()`'s return; the module `__main__` conjoins all three sweeps in its printed total AND ITS EXIT CODE, so any single regression failure exits nonzero (measured: forcing the pair false → exit 1; forcing cert_sweep flags false → exit 1, -including the v1.20 through v1.26 flags; the +including the v1.20 through v1.27 flags; the emulated-old-arm probe flips `cert_sweep` to FAIL). Three v1.12/v1.13-era regression mechanizations were updated in v1.23 to the always-emit discipline (their targets now carry the @@ -1201,7 +1225,25 @@ host-identity boundary registered in §6. Its harness (audit_v125_fresh.py) joins the kit rerun set — its TOTALITY rows now report the healed values, its ALIEN_GATE and GAUGE tables reproduce, and its forcing inventory (its own 23-flag -snapshot) reports all exit 1. Basis counts vs v1.2 reference: `negative` 103→83, +snapshot) reports all exit 1. Audit #19 verified the closure +sweep EQUIVALENT to v1.25's recursive grammar by differential +testing (100,000 randomized soups, 1,181 acceptances each, +zero mismatches; the optimistic-memo aggregate argument +verified; the AL-instance kind requirement confirmed +lp-shaped), the iterative kernel helpers equivalent to +recursive references (92,961 entries, zero mismatches), C1's +delta exact at the definition level, and C4/C5 in full — its +layer-five countermodels are healed and gated as regression +twenty-five, its harness (audit_v126_layer5.py) joins the kit +set (rerun at its full 100,000 samples, exit 0, healed +readings), and the 8,000-deep repr measurement stands as the +structural-operation boundary's empirical face (§6). Two +caught-in-implementation equivalence hazards this round, +both registered in the predictions file before any +measurement: the v1.26 closure sweep's AL-instance kind +requirement, and v1.27's closed() memo order (an App-cycle +re-enters at the SAME depth, so the memo must be consulted +only after the on-path cycle check). Basis counts vs v1.2 reference: `negative` 103→83, `selector` 173→106, `pstar` 458→242 — v1.7-era, real, owned; marginals and supports never moved. All measurements seconds-scale on the M5 Max. @@ -1281,7 +1323,8 @@ no bare-term ideal oracle). | v1.23 | The certified fire emits its bundle UNCONDITIONALLY — ('KD', ()) when empty — restoring storage-history prefix-freeness (§7.4 restated to the strip-the-head injectivity); the t boundary becomes the typed scope fence t-unimplemented; W0 gains the log SORT (lp-like entries only), the lambda-IAM slice equation with a bound-finding binder walk, and the closed-term conjunct; regressions eighteen (log-sort/slice-equation) and nineteen (KS prefix-freeness + t fence) gated; three v1.12/v1.13-era regression mechanizations updated to the always-emit form and two fixture lps corrected to the slice equation (theorems and countermodel essences unchanged, all disclosed); THE HINGE PREDICTION, written first, HELD: suite, certify, typecheck, and polarity byte-identical — no reachable interference crosses fire histories, so the machine change is invisible on every covered output; ten kits' ks-display deltas and the matrix-coverage shrink adjudicated; zero W0 hits on the corpus | **fresh audit #16: FAIL** (C1 CONFIRMED independently — the two-arm diff exact, four instruments byte-identical against the re-executed v1.22 sources, the hinge reason verified by a 5,760-state fire-history search plus 300 generated bodies with zero mixed-count merges, and the stronger v1.23 form derived: append-only KS makes different-fire-count merges impossible; C2 CONFIRMED narrowly for certified fires — nested bundles cannot defeat tuple-head injectivity; C4/C5 CONFIRMED — nineteen forcings + fourteen instrument components all exit 1, zero reachable W0 fires, the corpus rerun independently; the binder equation confirmed on 100,763 reachable lp occurrences with zero binder_path mismatches. The findings: THE AUDIT-#15 SIBLING — the suppressed-decode arm appends ZERO storage heads, so a suppressed decode with incoming [K(l)] and a retain-whole fire with incoming [] produce IDENTICAL targets, norm 2, through BOTH the same-key-frame and agreeing-burial variants — legal lifecycle configurations, not the alias gap; W0 accepted Var(0) (`i <= depth` under the 1-INDEXED convention — binder_path IndexError one step inside WF) and never sorted the CONTAINERS (a list tape passed WF, the fire TypeError'd); three stale register/docstring lines, including the §9 gate sentence still naming audit #15) | | v1.24 | The suppressed-decode fire appends the inert arm-typed history head ('KA', g, i) — EVERY fire arm now appends exactly one head, §7.4 restated to the all-arms one-head discipline; the head carries its key because the author two-key double-suppression sibling (both tickets suppressing over a shared two-frame RS) also collided at norm 2 pre-fix, and a contentless marker would have left it alive; KA excluded from ks_dead_keys/ks_bitfree_keys by design (refire/key-alias/W8/W4-storage blind; replays off the surviving frame stay legal); W0 gains exact-type PURITY (registers exact tuples of exact tuples/str/int, checked without hashing before any scan — hostile __hash__/__eq__ can neither crash nor poison the checker; list containers refused) and the 1-indexed closedness (Var(0) refused); regressions twenty (fire prefix-freeness, three pairs + recorded-arm control) and twenty-one (W0 totality II incl. the hostile-hash probe) gated; the three stale lines fixed; THE HINGE, cheaper this round: suite/certify/typecheck/polarity byte-identical because the suppressed arm is REACHABLY DEAD CODE on the whole canonical suite (arm census measured first: 58 certified / 69 retain-whole / 10 decode-recorded / 0 suppressed); v113/v114 kit ks-displays gain the KA head (relabels, semantic columns unchanged — a kit-delta class my predictions MISSED and registered as the round's wrong call); zero W0/W4 hits on the corpus | **fresh audit #17: FAIL** (the KA repair itself CONFIRMED-SOUND — no remaining storage-history collision; the four KS-writing arms enumerated from source, non-fire paths KS-preserving, the three healed pairs re-derived at state-space inner product 0, the guard-exclusion lifecycle verified coherent — and the reachability hinge confirmed with an independent census matching 58/69/10/0 and EXTENDED to the corpus, 367/465/222/0; C1 confirmed at the AST level; C4/C5 confirmed, 21 forcings + 14 components all exit 1. The findings: wf() NOT TOTAL over exact-pure malformed states — bare ('AL',)/('L',) tape tokens and an empty () frame pass purity, get W0-flagged, then IndexError the W1-W9 deep scans; a WF-clean FOREIGN-GATE ticket silently decoded — α_t at an h boundary with matching bit fires and records ('K','t',i) under an H row, the register's decode subscript dropped by the implementation; the gauge sweep OMITS KA — nine parameters, KA implicitly weight 0 and unconstrainable by reachable edges (the auditor's own repaired sweep: 8/1024 reachable-only KA-free, 4/1024 with a raw suppressed edge, KA pinned 0); plus the stale "inert dead storage" docstring phrase) | | v1.25 | ONE machine guard added, no arm's storage behavior moves: alien-gate types foreign-gate cargo tickets at the fire boundary at both bit polarities (the decode row's subscript restored to the implementation; reachably unmintable — α_t's only mint site is behind the t-fire fence — so suite/certify/typecheck byte-identical, measured); wf() made TOTAL by the W0 GATE (out-of-language states early-return ['W0']; W1-W9 adjudicated only over the language's carrier; the in-language multi-flag control proves no over-collapse); the gauge sweep goes TEN-mark — 8/1024 reachable-only with KA free (printed), 4/1024 with the disclosed raw suppressed-decode edge, every survivor pinning w(KA)=0, verdict gating on both readings; §7.1 restated; regressions twenty-two (checker totality III) and twenty-three (alien-gate) gated, twenty-three-for-twenty-three under forcing; the "inert dead storage" phrase corrected; my pre-fix hand-derivation of the fire-edge parity DISAGREED with the auditor's sweep numbers and the measurement adjudicated for the auditor (registered — the mechanized sweep is the theorem, not my head-model); kit deltas: the W0-gate display collapses on out-of-language fixtures and the ten-mark orbit displays (independent confirmation of the unconstrained-mark fact), v121 crash and v123 kit byte-identical | **fresh audit #18: FAIL** (C1/C2/C4/C5 CONFIRMED — the delta exact by source reconstruction, 23 forcings + 14 components + both polarity readings + the raw instrument removed all exit 1, zero W0/alien-gate fires on an independently regenerated corpus; the alien-gate repair CONFIRMED on its full surface including nested/frame/burial foreign representations, all carried, never reinterpreted; the gauge claim UPGRADED — an independent GF(2) solver proved every possible suppressed-decode edge forces w(KA)=0 given the reachable orbit: the pinning is arm-intrinsic, not edge-dependent. The finding: C3's totality broken at LAYER FOUR — an exact-pure EMPTY TUPLE in the log crashes wf() UPSTREAM of the W0 gate (w0log → is_gam → bare e[0] IndexError; the gate only protected states whose W0 clauses already computed safely), plus two RecursionError classes (1,500-deep exact tuple in recursive pure(); 1,500-lambda term in recursive closed()); honesty: "wf() is total" false as written, the pack caption's stale regression count violating its own count-neutral convention, "one raw edge" vs one raw fire with two H successor edges) | -| v1.26 | NO arm, NO guard — the helper-level totality round: the four bare-indexing token predicates (is_gam/is_mu/is_ans/is_alpha) gain the emptiness conjunct is_lp always had; every wf traversal before and during W0 becomes ITERATIVE and pre-gate HASH-FREE (explicit-stack pure/closed; the token grammar as a CLOSURE SWEEP — valid iff every closure node satisfies its local predicate — with an id-keyed per-call memo; iterative deep scans; kernel's alpha_keys_live/alpha_bits_deep iterative too, serving the fire arm's deep-W3 guard identically); the totality claim SCOPED to where it lives — total rejection on the raw-object layer, and past the gate the HOST-IDENTITY BOUNDARY shared with the machine's own superposition layer (§6); regression twenty-four (empty tuple in each register → exactly ['W0']; 1,500-deep tuple → ['W0']; 1,500-lambda term passes in full) gated, twenty-four-for-twenty-four under forcing; one equivalence bug caught DURING implementation before any measurement (the sweep's first draft would have accepted an AL with a non-lp instance — the kind requirement restored, registered in the predictions file); pack captions made count-neutral per their own standing convention; suite/certify/typecheck/polarity byte-identical, conservation timing-suffix only, wf exactly one new line; the auditor's harness joins the kit set and reruns healed | **fresh audit #19: pending** | +| v1.26 | NO arm, NO guard — the helper-level totality round: the four bare-indexing token predicates (is_gam/is_mu/is_ans/is_alpha) gain the emptiness conjunct is_lp always had; every wf traversal before and during W0 becomes ITERATIVE and pre-gate HASH-FREE (explicit-stack pure/closed; the token grammar as a CLOSURE SWEEP — valid iff every closure node satisfies its local predicate — with an id-keyed per-call memo; iterative deep scans; kernel's alpha_keys_live/alpha_bits_deep iterative too, serving the fire arm's deep-W3 guard identically); the totality claim SCOPED to where it lives — total rejection on the raw-object layer, and past the gate the HOST-IDENTITY BOUNDARY shared with the machine's own superposition layer (§6); regression twenty-four (empty tuple in each register → exactly ['W0']; 1,500-deep tuple → ['W0']; 1,500-lambda term passes in full) gated, twenty-four-for-twenty-four under forcing; one equivalence bug caught DURING implementation before any measurement (the sweep's first draft would have accepted an AL with a non-lp instance — the kind requirement restored, registered in the predictions file); pack captions made count-neutral per their own standing convention; suite/certify/typecheck/polarity byte-identical, conservation timing-suffix only, wf exactly one new line; the auditor's harness joins the kit set and reruns healed | **fresh audit #19: FAIL** (the machine confirmed a THIRD consecutive round — C1 exact at the definition level, C2 with the kernel helpers differential-tested against recursive references over 92,961 entries zero mismatches, C4 in full with warnings-as-errors, C5 on an independently regenerated corpus; the CLOSURE SWEEP verified exactly equivalent to v1.25's recursive grammar over 100,000 randomized soups, 1,181 acceptances each, zero mismatches, the optimistic-memo argument verified. The findings, totality LAYER FIVE, all in wf()'s raw surface: garbage terms SILENTLY ACCEPTED — closed() had no rejecting branch for unknown node kinds; a cyclic term graph HUNG the tree walk; a hostile Run SUBCLASS ran __getattribute__ code from inside wf before purity; a 25-node shared-tuple DAG cost 2^24 purity visits, doubling per node; wf7 IndexError'd on an empty frame; and the host-identity boundary AS STATED was false — hash, repr, and equality have different structural limits: an 8,000-deep in-language state hashes and dict-round-trips, then dies in the W2 canonical-order repr sort, while a 2,000-deep control adjudicates fully; honesty: §9's gate line stale AGAIN, the very line whose parenthetical promised joint updates) | +| v1.27 | CHECKER-ONLY — zero kernel changes: exact-type state dispatch (a Run subclass is not a state of the machine; hostile attribute access never runs); pure() id-visited (representation-linear on shared DAGs); closed() a full TERM VALIDATOR (unknown node kinds rejected — garbage terms now W0, consistent with the v1.23 open-term decision; on-path cycle detection rejects cyclic graphs promptly; an (id,depth) memo makes shared term DAGs polynomial); wf7 declines out-of-language rs and non-tuple paths; §6's boundary RESTATED to the host's structural-operation limits — hash, equality, AND canonical-order repr, exactly the operations the machine's own state discipline performs — with the auditor's 8,000/2,000 measurements as its empirical face; §9's stale-gate promise replaced by an ASSEMBLE-SCRIPT ASSERTION (§1/§9 must name the same audit or the pack refuses to build); regression twenty-five gated, twenty-five-for-twenty-five under forcing; a second caught-in-implementation equivalence hazard registered pre-measurement (closed()'s memo order vs App-cycles, which re-enter at the SAME depth); suite/certify/typecheck/polarity byte-identical, wf exactly one new line; the layer-five harness joins the kit set | **fresh audit #20: pending** | ## 12. Appendix — HH step-indexed trace diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index e9e30d9..b70c9bc 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -398,7 +398,7 @@ register alone carries the version). | Item | Status | |---|---| -| Kernel | **v1.26** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (W0 = the SORTED state language with exact-type PURITY as of v1.24 — registers exact tuples of exact tuples/str/int checked without hashing, exact-int bits, recursive lp productions satisfying the lambda-IAM slice equation with occurrences resolving to bound Vars (1-indexed; Var(0) refused) of the closed term, the log's lp-like alphabet, arrival-lp K(l) cargo, the KA production, coordinates in language — plus W1-W9, with W4 closed by enumeration and §7.4's storage prefix-freeness now the ALL-ARMS one-head-per-fire discipline: audit #15's empty-bundle collision and audit #16's suppressed-decode/retain-whole forgery were the certified and uncertified instances of the same defect — every fire arm appends exactly one arm-typed head (KD / K3 / KA / K2), each healed with every covered output byte-identical); wf() total on the raw-object layer via the W0 gate with every traversal iterative and pre-gate hash-free (v1.26 — W1-W9 adjudicated only over the language's carrier; past the gate the host-identity boundary, shared with the machine's own superposition layer); the species guards, the alien-gate foreign-ticket guard, and the t scope fence typed (fifteen guards); the ten-mark gauge sweep pins w(KA)=0 via the disclosed raw suppressed edge (4/1024, with the 8/1024 reachable-only reading printed beside it — audit #18 proved the pinning arm-intrinsic); twenty-four permanent regressions, all gating; all six instruments carry exit-code verdicts; kernel-arm history lives in the register's §11 rows. **PASS re-claim gated on fresh audit #19** | +| Kernel | **v1.27** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (W0 = the SORTED state language with exact-type PURITY as of v1.24 — registers exact tuples of exact tuples/str/int checked without hashing, exact-int bits, recursive lp productions satisfying the lambda-IAM slice equation with occurrences resolving to bound Vars (1-indexed; Var(0) refused) of the closed term, the log's lp-like alphabet, arrival-lp K(l) cargo, the KA production, coordinates in language — plus W1-W9, with W4 closed by enumeration and §7.4's storage prefix-freeness now the ALL-ARMS one-head-per-fire discipline: audit #15's empty-bundle collision and audit #16's suppressed-decode/retain-whole forgery were the certified and uncertified instances of the same defect — every fire arm appends exactly one arm-typed head (KD / K3 / KA / K2), each healed with every covered output byte-identical); wf() total on the raw-object layer via the W0 gate with exact-type dispatch, a full term validator (cycle detection; garbage terms rejected), and every traversal iterative, pre-gate hash-free, and representation-linear (v1.27 — W1-W9 adjudicated only over the language's carrier; past the gate the host's structural-operation boundary — hash, equality, canonical-order repr — exactly the machine's own state-discipline operations); the species guards, the alien-gate foreign-ticket guard, and the t scope fence typed (fifteen guards); the ten-mark gauge sweep pins w(KA)=0 via the disclosed raw suppressed edge (4/1024, with the 8/1024 reachable-only reading printed beside it — audit #18 proved the pinning arm-intrinsic); twenty-five permanent regressions, all gating; all six instruments carry exit-code verdicts; kernel-arm history lives in the register's §11 rows. **PASS re-claim gated on fresh audit #20** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §5): the fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is the hybrid validation — structural admission/isometry plus exact-amplitude dynamic cleanliness plus non-vacuity, strictly beyond Gram (negative controls caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and **self-validating**: every admitted map passes full semantic coverage, else None | From 60c9ba348bd45a0b48fc1e497377192a1047005f Mon Sep 17 00:00:00 2001 From: a9lim Date: Mon, 10 Aug 2026 01:12:16 -0400 Subject: [PATCH 052/107] =?UTF-8?q?qalc:=20kernel=20v1.28=20=E2=80=94=20th?= =?UTF-8?q?e=20linear=20max-free=20term=20validator;=20wf7=20gated=20by=20?= =?UTF-8?q?wf;=20audit=20#20=20registered?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #20 (cx-20260810-003931-75a2) confirmed the machine a fourth consecutive round — kernel.py byte-identical verified; the structural-operation boundary survived its dedicated charge (at depth 6,000 hash/equality/repr cross together) — and found layer six: hostile TERM subclasses running code inside wf, the never-validated Gate production (Gate('x') broke W0-preservation; Gate([]) crashed the machine), wf7's remaining raw surface, and a quadratic term memo where the register said linear. v1.28 — checker-only again: closed() replaced by the linear max-free validator (exact-type node dispatch; Gate names in {h,t}; Var exact-int >= 1; one memo entry per node; measured n=3000 in 2ms vs 300ms at n=800), run as an early gate; wf7 exact-type dispatched and gated by the total wf() itself. Regression 26; 26/26 forced-exit-1; four instruments byte-identical. Two wrong calls registered (the layer6 kit crashes by construction — the v121 lesson re-learned; the fibre control mis-specified against an empty synthetic map). Fresh audit #21 launched; PASS re-claim gated on it. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 33 +++++--- docs/ledger/2026-08.md | 58 ++++++++++++++ docs/quantum-algebraic/kernel.md | 126 +++++++++++++++++++------------ docs/quantum-algebraic/token.md | 2 +- 4 files changed, 159 insertions(+), 60 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 042d28a..20c1404 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,10 +413,10 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.27** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.28** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after -nineteen fresh-context rounds. Kernel-arm provenance summaries +twenty fresh-context rounds. Kernel-arm provenance summaries have been refuted by literal diff twice (audit #13 killed "unmoved since v1.11"; audit #14 showed the corrected summary still incomplete), so the register now names arms per version @@ -562,10 +562,21 @@ traversals, wf7 guards, and the boundary restated to the host's structural-operation limits — hash, equality, and canonical-order repr, exactly the operations the machine's own state discipline performs. The twice-broken §9 gate-line -promise is now an assemble-script assertion. What +promise is now an assemble-script assertion. Audit #20 +confirmed the machine a FOURTH straight round (kernel.py +byte-identical; the boundary survived its dedicated charge — +at depth 6,000 all three host operations cross together) and +found layer SIX: hostile TERM subclasses, the never-validated +Gate production (Gate('x') passed the checker and broke +W0-preservation one step later; Gate([]) crashed the machine), +wf7's remaining raw surface, and a Θ(n²) term memo. v1.28 +(checker-only again): the linear MAX-FREE term validator with +exact-type node dispatch and the Gate production, run as an +early gate; wf7 gated by the total wf() itself; +"representation-linear" made true rather than weakened. What the rounds still found was claim-language and scaffolding, each fixed the same -day: all twenty-five permanent regressions now gate mechanically (the +day: all twenty-six permanent regressions now gate mechanically (the module verdict is the exit code — forcing any single regression false exits nonzero, measured); `validate()` gained NON-VACUITY at both levels (an entry at an unreachable position and a ghost @@ -581,16 +592,16 @@ minimal; physics table passes on all twenty; all prior audit kits rerun with every delta adjudicated (ks-display relabels under always-emit and the KA head; the W0-gate display collapses; matrix-coverage shrink under the tightened language; -the healed-countermodel crash); every v1.27 prediction held, -with the round's second caught-in-implementation equivalence -hazard registered pre-measurement — closed()'s memo order -against App-cycles, beside v1.26's AL-instance catch and -v1.25's wrong-algebra call (provenance in the scratchpad -prediction files). +the healed-countermodel crash); every v1.28 prediction held in +substance with two wrong calls registered — the layer6 kit +crashes by construction rather than "flipping to healed" (the +v121 lesson re-learned), and the certified-fibre control was +first mis-specified against an empty synthetic fibre map +(provenance in the scratchpad prediction files). The open docket, in order: -1. **fresh-context independent audit #20 of the v1.27 h-fragment +1. **fresh-context independent audit #21 of the v1.28 h-fragment claim** (verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 3525278..ef448df 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -3583,3 +3583,61 @@ honestly self-reports wf7 in its changed-defs tracking, and the layer-five harness joins the kit set at full sample size. Register, STATUS, token.md updated; fresh audit #20 launched — the PASS re-claim stays gated on it. + +## 2026-08-10 — qALC kernel v1.28: the term validator goes linear and learns its own alphabet; wf7 finally keeps its word + +Audit #20 (fresh instance, sol tier, threadless) confirmed the +machine for the FOURTH consecutive round — kernel.py verified +BYTE-IDENTICAL to the packed prior source, C2/C4/C5 in full +(25/25 + 14/14 + the three polarity-reading mutations, +warnings-as-errors), and the structural-operation boundary +SURVIVED its dedicated charge with the night's most satisfying +measurement: equal-state probes at depths 1,000, 2,000, and +4,000 all clean, and at 6,000 hash, equality, and repr cross +their host limits TOGETHER — no state inside the boundary +crashes a post-gate scan. The assemble assertion was verified +against a simulated mismatch. Then totality LAYER SIX: hostile +TERM subclasses still ran code inside wf (exact-type dispatch +protected only the state — closed() isinstance-dispatched term +nodes); the GATE production was never validated — Gate('x') +passed wf and broke W0-preservation one step later, Gate([]) +crashed the machine on an unhashable name, and a 20,000-graph +term differential isolated the defect surgically (zero non-Gate +mismatches); wf7 still raised on a hostile subclass, a list +inside the path tuple, and a list in the arrival tail; and the +(id, depth) term memo was Θ(n²) on App/Lam chains (800 objects +→ 640,800 validator states) where the register said +representation-linear. + +v1.28, predictions written first — checker-only again, zero +kernel changes: closed() is REPLACED by the linear MAX-FREE +validator. Exact-type node dispatch (the type check precedes +every field access, so a hostile term subclass never executes); +Gate names validated in {'h','t'} — the production the language +always required; Var indices exact-int ≥ 1; closedness computed +as max_free(root) == 0 by iterative post-order with ONE memo +entry per node id — Var i → i, Lam → max(0, body−1), App → +max(f, a) — measured LINEAR: n=3,000 chains in 2 ms where the +old memo took 300 ms at n=800. "Representation-linear" becomes +true as originally worded instead of weakened — the better +algorithm wins over the weaker sentence. The validator runs as +an EARLY GATE before any token processing (under v1.27 the +rs/ks loops ran even after term failure, so a hostile term +could still execute during token checks). wf7 is exact-type +dispatched and gated by the total wf() itself — "declines +out-of-language sources" is now enforced, not promised. +Regression twenty-six gated; twenty-six-for-twenty-six under +forcing; suite/certify/typecheck/polarity byte-identical; wf +exactly one new line; corpus and census unchanged. + +Two wrong calls registered this round: the layer6 kit does not +"flip to healed" — it ASSERTS the broken Gate behavior as a +precondition of its own report and CRASHES BY CONSTRUCTION on +the healed build (576-byte capture kept verbatim; the v121 +lesson re-learned — read the kit's assert structure before +predicting its rerun); and the certified-fibre control was +first mis-specified (the synthetic cert's fibre map is empty, +so W7-domain is the correct preserved verdict — the control now +proves a WF source REACHES the fibre logic through the new +gate). Register, STATUS, token.md updated; fresh audit #21 +launched — the PASS re-claim stays gated on it. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 07be04e..c4391ae 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.27.** The kernel is a scratch superposition evolver +**Status: v1.28.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -17,7 +17,7 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #20**, whose +The standing PASS re-claim is **gated on fresh audit #21**, whose verdict will be registered here. Kernel-arm provenance is the chronicle's per-row "what changed" column — summaries of it have been refuted twice by literal diff (audit #13 killed "unmoved @@ -25,35 +25,34 @@ since v1.11"; audit #14 showed the corrected two-wave summary still omitted v1.12's ordinary-decode burial-suppression change and mislabeled v1.21's binder/transport arms as "leaf" guards) — so this register now names arms exactly and only per version: -v1.27 changes NO kernel source at all — it is a checker-only -round. Audit #19 confirmed the machine for the THIRD -consecutive audit (C1 exact; the closure-sweep grammar -differential-tested against v1.25's recursive form over 100,000 -randomized soups, zero mismatches; the iterative kernel helpers -against recursive references over 92,961 entries, zero -mismatches; C4/C5 in full with warnings promoted to errors) and -found totality LAYER FIVE, all in `wf()`'s raw surface: garbage -terms silently ACCEPTED (`closed()` had no rejecting branch), a -CYCLIC term graph hung the tree walk, a hostile Run SUBCLASS -ran code from inside wf via `__getattribute__`, a 25-node -shared-tuple DAG cost 2^24 purity visits, `wf7()` crashed on an -empty frame, and the host-identity boundary as stated was -FALSE — hash, repr, and equality have different structural -limits (an 8,000-deep in-language state hashes and dict-round- -trips, then dies in the W2 canonical-order repr sort; a -2,000-deep control adjudicates fully). v1.27: exact-type state -dispatch (`type(s) is Run`); `pure()` id-visited -(representation-linear on DAGs); `closed()` a full TERM -VALIDATOR (unknown node kinds rejected, on-path cycle -detection, an (id, depth) memo); `wf7()` declines -out-of-language rs; and §6's boundary restated to the host's -STRUCTURAL-OPERATION limits — hash, equality, AND repr, exactly -the operations the machine's own state discipline performs -(evolve keys by hash, identity is equality, rs_insert and the -certified bundle sort canonically by repr) — wf performs no -structural operation on state content that the machine does -not. Suite, certify, typecheck, and polarity measured -BYTE-IDENTICAL across v1.27. For +v1.28 changes NO kernel source — the second consecutive +checker-only round. Audit #20 confirmed the machine for the +FOURTH consecutive audit (kernel.py BYTE-IDENTICAL verified; +C2/C4/C5 in full; the structural-operation boundary SURVIVED +its dedicated charge — equal-state probes at depths +1,000/2,000/4,000 all fine, at 6,000 hash, equality, and repr +cross their host limits TOGETHER, and no in-boundary state +crashes a post-gate scan) and found totality LAYER SIX: hostile +TERM subclasses still ran code inside `wf()` (exact-type +dispatch protected only the state), the GATE production was +never validated (`Gate('x')` passed wf and broke +W0-preservation one step later; `Gate([])` crashed the machine +on an unhashable name), `wf7()` still raised on hostile and +unhashable raw sources, and the (id, depth) term memo was +Θ(n²) on App/Lam chains where the register said linear. v1.28: +`closed()` is the linear MAX-FREE validator — exact-type node +dispatch (a term-node subclass is not a term node; the type +check precedes every field access), Gate names validated in +{'h','t'}, Var indices exact-int ≥ 1, closedness = max_free +(root) == 0 by iterative post-order with one memo entry per +node id (measured: n=3,000 chains in 2 ms where the old +algorithm took 300 ms at n=800), on-path cycle rejection kept — +and it runs as an EARLY GATE before any token processing, so no +downstream walk ever sees an unvalidated term; `wf7()` is +exact-type dispatched and gated by the total `wf()` itself +("declines out-of-language sources" is now enforced, not +promised). Suite, certify, typecheck, and polarity measured +BYTE-IDENTICAL across v1.28. For anything older, read §11's rows; do not trust a summary, including this file's former ones. @@ -554,20 +553,28 @@ the machine's unitarity claims quantify over the subtype: the raw-object layer (v1.26/v1.27, audits #18/#19 — the staircase ran: empty tuples through a bare-indexing predicate, 1,500-deep recursion, silently accepted garbage - terms, a cyclic term graph, a hostile Run subclass, a 2^24 - shared-DAG blowup, and a wf7 crash): dispatch is EXACT-TYPE - (`type(s) is Run` — a subclass is not a state of the machine - and its overridden attribute access never runs); every + terms, a cyclic term graph, hostile Run AND term-node + subclasses, a 2^24 shared-DAG blowup, wf7 crashes, and the + unvalidated Gate production): dispatch is EXACT-TYPE + everywhere — `type(s) is Run` for states and per-node + exact-type for term nodes (a subclass is not a state or a + term node, and its overridden attribute access never runs: + the type check precedes every field access); every traversal before and during W0 is ITERATIVE, pre-gate HASH-FREE, and REPRESENTATION-LINEAR (id-visited purity; - `closed()` a full term validator — unknown node kinds - rejected, cycles detected on-path and rejected promptly, - shared term DAGs polynomial via an (id, depth) memo; the + `closed()` the MAX-FREE term validator — Gate names in + {'h','t'}, Var indices exact-int ≥ 1, unknown node kinds + rejected, cycles rejected on-path, ONE memo entry per node + id, closedness = max_free(root) == 0, measured linear where + the v1.27 (id, depth) memo was Θ(n²) on App/Lam chains — run + as an EARLY GATE before any token processing, so no + downstream walk sees an unvalidated term; the token grammar a closure sweep with an id-keyed per-call memo), so `wf()` accepts or W0-rejects ANY finite object graph — malformed, cyclic, hostile-typed, or shared — without - crashing or hanging, and `wf7()` declines out-of-language - sources. Past the gate, the W1-W9 scans and the machine share + crashing or hanging, and `wf7()` is exact-type dispatched and + gated by the total `wf()` itself: "declines out-of-language + sources" is enforced, not promised. Past the gate, the W1-W9 scans and the machine share the HOST'S STRUCTURAL-OPERATION BOUNDARY: hash, equality, AND canonical-order repr — exactly the operations the machine's own state discipline performs (evolve keys states by hash; @@ -878,7 +885,7 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#20; the verdict will be registered here.** (Audit #16 caught +#21; the verdict will be registered here.** (Audit #16 caught this sentence stale; audit #19 caught it stale AGAIN despite the parenthetical promising otherwise — the promise is now an ASSERTION: the pack assembly script verifies §1 and §9 name the @@ -923,7 +930,7 @@ canonical dicts compared bit-for-bit; `dupcall` canonically None `h(Ω)` → None. Negative controls: pstar × wrong certificate reaches `pop-err`; dupcall × v1.7-era certificate reaches `refire`, all-err. WF/W7/W8/W9 sweeps + mechanized disjointness: -zero violations; **twenty-five permanent regressions** (the v1.6 pair; +zero violations; **twenty-six permanent regressions** (the v1.6 pair; extra-frame collision, W7-excluded with disjoint targets; doctored bundle divergence; K+frame alias; retained-Q disjointness — spectator-bit columns share zero targets; @@ -989,7 +996,12 @@ no-over-rejection control; totality V — junk-string and promptly, the hostile Run subclass declined without raising, the 2^24 shared-DAG state W0-rejected promptly, wf7 declines the malformed-frame source, with the deep-term and genuine-Run -adjudications as controls). The +adjudications as controls; totality VI — the hostile TERM +subclass W0-rejected with no hostile code executed, the three +invalid-Gate terms W0-rejected, wf7's hostile-subclass and +unhashable sources declined without raising, and the +WF-source-reaches-fibre plus 800-node-chain controls intact). +The gating structure, stated exactly (audits #6 and #7 each caught a computed-but-non-gating verdict; audit #8 forced all eleven then-regressions @@ -1007,13 +1019,15 @@ twenty-three-for-twenty-three plus the fourteen components, the two polarity readings forced separately, and the raw gauge instrument REMOVED → exit 1; audit #19 confirmed twenty-four-for-twenty-four plus the fourteen components with -warnings promoted to errors): the v1.6 pair -gates `collisions_under_wf()`; the other twenty-three gate +warnings promoted to errors; audit #20 confirmed +twenty-five-for-twenty-five plus the fourteen components plus +the three polarity-reading mutations): the v1.6 pair +gates `collisions_under_wf()`; the other twenty-four gate `cert_sweep()`'s return; the module `__main__` conjoins all three sweeps in its printed total AND ITS EXIT CODE, so any single regression failure exits nonzero (measured: forcing the pair false → exit 1; forcing cert_sweep flags false → exit 1, -including the v1.20 through v1.27 flags; the +including the v1.20 through v1.28 flags; the emulated-old-arm probe flips `cert_sweep` to FAIL). Three v1.12/v1.13-era regression mechanizations were updated in v1.23 to the always-emit discipline (their targets now carry the @@ -1243,7 +1257,22 @@ both registered in the predictions file before any measurement: the v1.26 closure sweep's AL-instance kind requirement, and v1.27's closed() memo order (an App-cycle re-enters at the SAME depth, so the memo must be consulted -only after the on-path cycle check). Basis counts vs v1.2 reference: `negative` 103→83, +only after the on-path cycle check). Audit #20 verified +kernel.py BYTE-IDENTICAL, the boundary's one-way statement by +dedicated equal-state probes (depths 1,000–4,000 clean; at +6,000 hash, equality, and repr cross together; no in-boundary +state crashes a post-gate scan), the assemble assertion +genuinely refusing a simulated mismatch, and the term +differential surgically isolating the Gate defect (20,000 +graphs; zero mismatches once the reference leaves Gate +payloads unconstrained) — its layer-six countermodels are +healed and gated as regression twenty-six, its harness +(audit_v127_layer6.py) joins the kit set CRASHING BY +CONSTRUCTION on the healed build (it asserts the broken Gate +behavior as a precondition; the 576-byte capture is the +healing evidence, the v121 pattern), and the max-free +rewrite's linearity is measured (n=3,000 chains in 2 ms +versus 300 ms at n=800 under the old memo). Basis counts vs v1.2 reference: `negative` 103→83, `selector` 173→106, `pstar` 458→242 — v1.7-era, real, owned; marginals and supports never moved. All measurements seconds-scale on the M5 Max. @@ -1324,7 +1353,8 @@ no bare-term ideal oracle). | v1.24 | The suppressed-decode fire appends the inert arm-typed history head ('KA', g, i) — EVERY fire arm now appends exactly one head, §7.4 restated to the all-arms one-head discipline; the head carries its key because the author two-key double-suppression sibling (both tickets suppressing over a shared two-frame RS) also collided at norm 2 pre-fix, and a contentless marker would have left it alive; KA excluded from ks_dead_keys/ks_bitfree_keys by design (refire/key-alias/W8/W4-storage blind; replays off the surviving frame stay legal); W0 gains exact-type PURITY (registers exact tuples of exact tuples/str/int, checked without hashing before any scan — hostile __hash__/__eq__ can neither crash nor poison the checker; list containers refused) and the 1-indexed closedness (Var(0) refused); regressions twenty (fire prefix-freeness, three pairs + recorded-arm control) and twenty-one (W0 totality II incl. the hostile-hash probe) gated; the three stale lines fixed; THE HINGE, cheaper this round: suite/certify/typecheck/polarity byte-identical because the suppressed arm is REACHABLY DEAD CODE on the whole canonical suite (arm census measured first: 58 certified / 69 retain-whole / 10 decode-recorded / 0 suppressed); v113/v114 kit ks-displays gain the KA head (relabels, semantic columns unchanged — a kit-delta class my predictions MISSED and registered as the round's wrong call); zero W0/W4 hits on the corpus | **fresh audit #17: FAIL** (the KA repair itself CONFIRMED-SOUND — no remaining storage-history collision; the four KS-writing arms enumerated from source, non-fire paths KS-preserving, the three healed pairs re-derived at state-space inner product 0, the guard-exclusion lifecycle verified coherent — and the reachability hinge confirmed with an independent census matching 58/69/10/0 and EXTENDED to the corpus, 367/465/222/0; C1 confirmed at the AST level; C4/C5 confirmed, 21 forcings + 14 components all exit 1. The findings: wf() NOT TOTAL over exact-pure malformed states — bare ('AL',)/('L',) tape tokens and an empty () frame pass purity, get W0-flagged, then IndexError the W1-W9 deep scans; a WF-clean FOREIGN-GATE ticket silently decoded — α_t at an h boundary with matching bit fires and records ('K','t',i) under an H row, the register's decode subscript dropped by the implementation; the gauge sweep OMITS KA — nine parameters, KA implicitly weight 0 and unconstrainable by reachable edges (the auditor's own repaired sweep: 8/1024 reachable-only KA-free, 4/1024 with a raw suppressed edge, KA pinned 0); plus the stale "inert dead storage" docstring phrase) | | v1.25 | ONE machine guard added, no arm's storage behavior moves: alien-gate types foreign-gate cargo tickets at the fire boundary at both bit polarities (the decode row's subscript restored to the implementation; reachably unmintable — α_t's only mint site is behind the t-fire fence — so suite/certify/typecheck byte-identical, measured); wf() made TOTAL by the W0 GATE (out-of-language states early-return ['W0']; W1-W9 adjudicated only over the language's carrier; the in-language multi-flag control proves no over-collapse); the gauge sweep goes TEN-mark — 8/1024 reachable-only with KA free (printed), 4/1024 with the disclosed raw suppressed-decode edge, every survivor pinning w(KA)=0, verdict gating on both readings; §7.1 restated; regressions twenty-two (checker totality III) and twenty-three (alien-gate) gated, twenty-three-for-twenty-three under forcing; the "inert dead storage" phrase corrected; my pre-fix hand-derivation of the fire-edge parity DISAGREED with the auditor's sweep numbers and the measurement adjudicated for the auditor (registered — the mechanized sweep is the theorem, not my head-model); kit deltas: the W0-gate display collapses on out-of-language fixtures and the ten-mark orbit displays (independent confirmation of the unconstrained-mark fact), v121 crash and v123 kit byte-identical | **fresh audit #18: FAIL** (C1/C2/C4/C5 CONFIRMED — the delta exact by source reconstruction, 23 forcings + 14 components + both polarity readings + the raw instrument removed all exit 1, zero W0/alien-gate fires on an independently regenerated corpus; the alien-gate repair CONFIRMED on its full surface including nested/frame/burial foreign representations, all carried, never reinterpreted; the gauge claim UPGRADED — an independent GF(2) solver proved every possible suppressed-decode edge forces w(KA)=0 given the reachable orbit: the pinning is arm-intrinsic, not edge-dependent. The finding: C3's totality broken at LAYER FOUR — an exact-pure EMPTY TUPLE in the log crashes wf() UPSTREAM of the W0 gate (w0log → is_gam → bare e[0] IndexError; the gate only protected states whose W0 clauses already computed safely), plus two RecursionError classes (1,500-deep exact tuple in recursive pure(); 1,500-lambda term in recursive closed()); honesty: "wf() is total" false as written, the pack caption's stale regression count violating its own count-neutral convention, "one raw edge" vs one raw fire with two H successor edges) | | v1.26 | NO arm, NO guard — the helper-level totality round: the four bare-indexing token predicates (is_gam/is_mu/is_ans/is_alpha) gain the emptiness conjunct is_lp always had; every wf traversal before and during W0 becomes ITERATIVE and pre-gate HASH-FREE (explicit-stack pure/closed; the token grammar as a CLOSURE SWEEP — valid iff every closure node satisfies its local predicate — with an id-keyed per-call memo; iterative deep scans; kernel's alpha_keys_live/alpha_bits_deep iterative too, serving the fire arm's deep-W3 guard identically); the totality claim SCOPED to where it lives — total rejection on the raw-object layer, and past the gate the HOST-IDENTITY BOUNDARY shared with the machine's own superposition layer (§6); regression twenty-four (empty tuple in each register → exactly ['W0']; 1,500-deep tuple → ['W0']; 1,500-lambda term passes in full) gated, twenty-four-for-twenty-four under forcing; one equivalence bug caught DURING implementation before any measurement (the sweep's first draft would have accepted an AL with a non-lp instance — the kind requirement restored, registered in the predictions file); pack captions made count-neutral per their own standing convention; suite/certify/typecheck/polarity byte-identical, conservation timing-suffix only, wf exactly one new line; the auditor's harness joins the kit set and reruns healed | **fresh audit #19: FAIL** (the machine confirmed a THIRD consecutive round — C1 exact at the definition level, C2 with the kernel helpers differential-tested against recursive references over 92,961 entries zero mismatches, C4 in full with warnings-as-errors, C5 on an independently regenerated corpus; the CLOSURE SWEEP verified exactly equivalent to v1.25's recursive grammar over 100,000 randomized soups, 1,181 acceptances each, zero mismatches, the optimistic-memo argument verified. The findings, totality LAYER FIVE, all in wf()'s raw surface: garbage terms SILENTLY ACCEPTED — closed() had no rejecting branch for unknown node kinds; a cyclic term graph HUNG the tree walk; a hostile Run SUBCLASS ran __getattribute__ code from inside wf before purity; a 25-node shared-tuple DAG cost 2^24 purity visits, doubling per node; wf7 IndexError'd on an empty frame; and the host-identity boundary AS STATED was false — hash, repr, and equality have different structural limits: an 8,000-deep in-language state hashes and dict-round-trips, then dies in the W2 canonical-order repr sort, while a 2,000-deep control adjudicates fully; honesty: §9's gate line stale AGAIN, the very line whose parenthetical promised joint updates) | -| v1.27 | CHECKER-ONLY — zero kernel changes: exact-type state dispatch (a Run subclass is not a state of the machine; hostile attribute access never runs); pure() id-visited (representation-linear on shared DAGs); closed() a full TERM VALIDATOR (unknown node kinds rejected — garbage terms now W0, consistent with the v1.23 open-term decision; on-path cycle detection rejects cyclic graphs promptly; an (id,depth) memo makes shared term DAGs polynomial); wf7 declines out-of-language rs and non-tuple paths; §6's boundary RESTATED to the host's structural-operation limits — hash, equality, AND canonical-order repr, exactly the operations the machine's own state discipline performs — with the auditor's 8,000/2,000 measurements as its empirical face; §9's stale-gate promise replaced by an ASSEMBLE-SCRIPT ASSERTION (§1/§9 must name the same audit or the pack refuses to build); regression twenty-five gated, twenty-five-for-twenty-five under forcing; a second caught-in-implementation equivalence hazard registered pre-measurement (closed()'s memo order vs App-cycles, which re-enter at the SAME depth); suite/certify/typecheck/polarity byte-identical, wf exactly one new line; the layer-five harness joins the kit set | **fresh audit #20: pending** | +| v1.27 | CHECKER-ONLY — zero kernel changes: exact-type state dispatch (a Run subclass is not a state of the machine; hostile attribute access never runs); pure() id-visited (representation-linear on shared DAGs); closed() a full TERM VALIDATOR (unknown node kinds rejected — garbage terms now W0, consistent with the v1.23 open-term decision; on-path cycle detection rejects cyclic graphs promptly; an (id,depth) memo makes shared term DAGs polynomial); wf7 declines out-of-language rs and non-tuple paths; §6's boundary RESTATED to the host's structural-operation limits — hash, equality, AND canonical-order repr, exactly the operations the machine's own state discipline performs — with the auditor's 8,000/2,000 measurements as its empirical face; §9's stale-gate promise replaced by an ASSEMBLE-SCRIPT ASSERTION (§1/§9 must name the same audit or the pack refuses to build); regression twenty-five gated, twenty-five-for-twenty-five under forcing; a second caught-in-implementation equivalence hazard registered pre-measurement (closed()'s memo order vs App-cycles, which re-enter at the SAME depth); suite/certify/typecheck/polarity byte-identical, wf exactly one new line; the layer-five harness joins the kit set | **fresh audit #20: FAIL** (the machine clean a FOURTH consecutive round — kernel.py verified BYTE-IDENTICAL, C2/C4/C5 in full with three polarity-reading mutations, and the structural-operation boundary SURVIVED its dedicated charge: equal-state probes at depths 1,000/2,000/4,000 clean, at 6,000 hash/equality/repr cross their host limits TOGETHER, no in-boundary state crashes a post-gate scan; the assemble assertion verified against a simulated mismatch; both implementation catches validated. The findings, totality LAYER SIX: hostile TERM subclasses still ran code inside wf — exact-type dispatch protected only the state; the GATE production was never validated — Gate('x') passed wf and broke W0-preservation one step later, Gate([]) crashed the machine on an unhashable name, isolated surgically by a 20,000-graph term differential with zero non-Gate mismatches; wf7 still raised on a hostile subclass, a list inside the path tuple, and a list in the arrival tail — "declines out-of-language sources" was false as written; and the (id, depth) term memo was Θ(n²) on App/Lam chains — 800 objects, 640,800 validator states — where the register said representation-linear) | +| v1.28 | CHECKER-ONLY again — zero kernel changes: closed() REPLACED by the linear MAX-FREE validator (exact-type node dispatch — the type check precedes every field access, so hostile term subclasses never execute; Gate names validated in {'h','t'} — the production the language always required; Var indices exact-int ≥ 1; closedness = max_free(root) == 0 by iterative post-order with ONE memo entry per node id — measured n=3,000 chains in 2 ms vs 300 ms at n=800 under the old memo, "representation-linear" now TRUE as originally worded rather than weakened; on-path cycle rejection kept), run as an EARLY GATE before any token processing (under v1.27 the rs/ks loops ran even after term failure, so a hostile term could still execute during token checks); wf7 exact-type dispatched and gated by the total wf() itself; regression twenty-six gated, twenty-six-for-twenty-six under forcing; suite/certify/typecheck/polarity byte-identical, wf exactly one new line; two wrong calls registered — the layer6 kit does not "flip to healed" but CRASHES BY CONSTRUCTION (it asserts the broken Gate behavior; the v121 lesson re-learned), and the certified-fibre control was first mis-specified (the synthetic cert's fibre map is empty, so W7-domain is the correct preserved verdict — the control now proves a WF source REACHES the fibre logic through the gate) | **fresh audit #21: pending** | ## 12. Appendix — HH step-indexed trace diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index b70c9bc..e2b773c 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -398,7 +398,7 @@ register alone carries the version). | Item | Status | |---|---| -| Kernel | **v1.27** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (W0 = the SORTED state language with exact-type PURITY as of v1.24 — registers exact tuples of exact tuples/str/int checked without hashing, exact-int bits, recursive lp productions satisfying the lambda-IAM slice equation with occurrences resolving to bound Vars (1-indexed; Var(0) refused) of the closed term, the log's lp-like alphabet, arrival-lp K(l) cargo, the KA production, coordinates in language — plus W1-W9, with W4 closed by enumeration and §7.4's storage prefix-freeness now the ALL-ARMS one-head-per-fire discipline: audit #15's empty-bundle collision and audit #16's suppressed-decode/retain-whole forgery were the certified and uncertified instances of the same defect — every fire arm appends exactly one arm-typed head (KD / K3 / KA / K2), each healed with every covered output byte-identical); wf() total on the raw-object layer via the W0 gate with exact-type dispatch, a full term validator (cycle detection; garbage terms rejected), and every traversal iterative, pre-gate hash-free, and representation-linear (v1.27 — W1-W9 adjudicated only over the language's carrier; past the gate the host's structural-operation boundary — hash, equality, canonical-order repr — exactly the machine's own state-discipline operations); the species guards, the alien-gate foreign-ticket guard, and the t scope fence typed (fifteen guards); the ten-mark gauge sweep pins w(KA)=0 via the disclosed raw suppressed edge (4/1024, with the 8/1024 reachable-only reading printed beside it — audit #18 proved the pinning arm-intrinsic); twenty-five permanent regressions, all gating; all six instruments carry exit-code verdicts; kernel-arm history lives in the register's §11 rows. **PASS re-claim gated on fresh audit #20** | +| Kernel | **v1.28** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (W0 = the SORTED state language with exact-type PURITY as of v1.24 — registers exact tuples of exact tuples/str/int checked without hashing, exact-int bits, recursive lp productions satisfying the lambda-IAM slice equation with occurrences resolving to bound Vars (1-indexed; Var(0) refused) of the closed term, the log's lp-like alphabet, arrival-lp K(l) cargo, the KA production, coordinates in language — plus W1-W9, with W4 closed by enumeration and §7.4's storage prefix-freeness now the ALL-ARMS one-head-per-fire discipline: audit #15's empty-bundle collision and audit #16's suppressed-decode/retain-whole forgery were the certified and uncertified instances of the same defect — every fire arm appends exactly one arm-typed head (KD / K3 / KA / K2), each healed with every covered output byte-identical); wf() total on the raw-object layer via the W0 gate with exact-type dispatch for states AND term nodes, the linear max-free term validator (Gate production validated; cycle detection; garbage terms rejected; one memo entry per node), and every traversal iterative, pre-gate hash-free, and representation-linear (v1.28 — W1-W9 adjudicated only over the language's carrier; wf7 gated by wf itself; past the gate the host's structural-operation boundary — hash, equality, canonical-order repr — exactly the machine's own state-discipline operations, measured crossing together at depth 6,000); the species guards, the alien-gate foreign-ticket guard, and the t scope fence typed (fifteen guards); the ten-mark gauge sweep pins w(KA)=0 via the disclosed raw suppressed edge (4/1024, with the 8/1024 reachable-only reading printed beside it — audit #18 proved the pinning arm-intrinsic); twenty-six permanent regressions, all gating; all six instruments carry exit-code verdicts; kernel-arm history lives in the register's §11 rows. **PASS re-claim gated on fresh audit #21** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §5): the fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is the hybrid validation — structural admission/isometry plus exact-amplitude dynamic cleanliness plus non-vacuity, strictly beyond Gram (negative controls caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and **self-validating**: every admitted map passes full semantic coverage, else None | From 289f20053cc11e639ed1360a85b228c7e129a734 Mon Sep 17 00:00:00 2001 From: a9lim Date: Mon, 10 Aug 2026 01:44:02 -0400 Subject: [PATCH 053/107] =?UTF-8?q?qalc:=20kernel=20v1.29=20=E2=80=94=20ro?= =?UTF-8?q?ots=20and=20d=20join=20purity;=20index-based=20binder=20walk;?= =?UTF-8?q?=20boundary=20reconciled;=20audit=20#21=20registered?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #21 (cx-20260810-011146-d923) confirmed the machine a fifth consecutive round and the max-free validator outright (50k graphs, zero mismatches), then found layer seven: the register roots never type-checked (pure(0) is True — an int is a valid leaf), d omitted from purity (hostile __eq__ executed), a quadratic binder walk on valid deep lps, and audit #20's 'cross together at 6,000' boundary reading failing to replicate (hash clean through 32,000; equality/repr fail at 6,000) — §10 contradicted §6 and measurement sided with §6. v1.29 — checker-only, third consecutive: exact-tuple roots + exact-str d in the purity gate; the index-based binder walk (measured linear, 7.8x at 8x size, was ~27x); the boundary narrative reconciled to the one-way statement with the per-family-minimum framing; the instrument-input scope explicit. Regression 27; 27/27 forced-exit-1; four instruments byte-identical. The assemble assertion caught its first live gate-line mismatch during this round's own pack build. Fresh audit #22 launched; PASS re-claim gated on it. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 34 ++++++++---- docs/ledger/2026-08.md | 65 ++++++++++++++++++++++ docs/quantum-algebraic/kernel.md | 95 ++++++++++++++++++++++++-------- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 160 insertions(+), 36 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 20c1404..9e27b69 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,10 +413,10 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.28** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.29** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after -twenty fresh-context rounds. Kernel-arm provenance summaries +twenty-one fresh-context rounds. Kernel-arm provenance summaries have been refuted by literal diff twice (audit #13 killed "unmoved since v1.11"; audit #14 showed the corrected summary still incomplete), so the register now names arms per version @@ -573,10 +573,23 @@ wf7's remaining raw surface, and a Θ(n²) term memo. v1.28 (checker-only again): the linear MAX-FREE term validator with exact-type node dispatch and the Gate production, run as an early gate; wf7 gated by the total wf() itself; -"representation-linear" made true rather than weakened. What +"representation-linear" made true rather than weakened. Audit +#21 (fifth machine-clean round; the max-free validator itself +survived 50,000 graphs against an independent reference) found +layer SEVEN: the register ROOTS never type-checked (an int is +a valid pure leaf, so scalar roots crashed iteration), d +omitted from purity, a quadratic binder walk on valid deep +lps, and audit #20's "cross together at 6,000" boundary +reading failing to replicate (hash clean through 32,000; +equality/repr fail at 6,000 — a probe-family coincidence I had +registered as a law). v1.29 (checker-only, third consecutive): +roots and d join the purity gate, the binder walk goes +index-based and linear, the boundary narrative is reconciled +to the one-way statement, and the instrument-input scope is +explicit. What the rounds still found was claim-language and scaffolding, each fixed the same -day: all twenty-six permanent regressions now gate mechanically (the +day: all twenty-seven permanent regressions now gate mechanically (the module verdict is the exit code — forcing any single regression false exits nonzero, measured); `validate()` gained NON-VACUITY at both levels (an entry at an unreachable position and a ghost @@ -592,16 +605,15 @@ minimal; physics table passes on all twenty; all prior audit kits rerun with every delta adjudicated (ks-display relabels under always-emit and the KA head; the W0-gate display collapses; matrix-coverage shrink under the tightened language; -the healed-countermodel crash); every v1.28 prediction held in -substance with two wrong calls registered — the layer6 kit -crashes by construction rather than "flipping to healed" (the -v121 lesson re-learned), and the certified-fibre control was -first mis-specified against an empty synthetic fibre map -(provenance in the scratchpad prediction files). +the healed-countermodel crash); every v1.29 prediction held, +with one declared drift (a 16× predicted timing band vs the +implemented 24× — measured 7.8×) recorded beside the earlier +rounds' registered wrong calls (provenance in the scratchpad +prediction files). The open docket, in order: -1. **fresh-context independent audit #21 of the v1.28 h-fragment +1. **fresh-context independent audit #22 of the v1.29 h-fragment claim** (verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index ef448df..fc290f4 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -3641,3 +3641,68 @@ so W7-domain is the correct preserved verdict — the control now proves a WF source REACHES the fibre logic through the new gate). Register, STATUS, token.md updated; fresh audit #21 launched — the PASS re-claim stays gated on it. + +## 2026-08-10 — qALC kernel v1.29: the roots join the language; the binder walk drops its copies; two auditors' measurements reconciled + +Audit #21 (fresh instance, sol tier, threadless) confirmed the +machine for the FIFTH consecutive round — kernel.py SHA-verified +byte-identical, C2/C4/C5 in full — and confirmed the v1.28 +max-free validator itself outright: 50,000 randomized +valid/open/shared/cyclic term graphs including 5,349 cycle +mutations against an independent depth-based reference, zero +mismatches; hostile terms, Gate payloads, string subclasses, and +Var(True) all W0-rejected without executing; chains, ladders, +and complete-sharing DAGs measured linear; wf7 compared +old-vs-new over 5,508 reachable states with zero verdict +differences. Then totality LAYER SEVEN: the five register ROOTS +were never type-checked — pure(0) is True because an int is a +valid pure LEAF, so Run(path=0, ...) passed the purity gate and +the container iteration crashed on every register field; `d` +was omitted from purity entirely — a hostile __eq__ object +executed at the membership check; wf7 inherited both through +its wf gate; the binder walk's p[:-1] copying was Θ(n²) on a +fully VALID deep-lp state (0.8/2.3/7.5/21 ms at 1k/2k/4k/8k); +and the register CONTRADICTED ITSELF about the boundary — +§10/status said the three host operations "cross together at +depth 6,000" while §6 said the limits differ, and live +measurement sided with §6: hash stays clean through depth +32,000 on the nested-lp family while equality and repr fail at +6,000. Audit #20's probe family crossing together was a +coincidence I registered as a law — a metrology lesson: one +family's crossing point is not the boundary's shape. + +v1.29, predictions written first — checker-only, third +consecutive, zero kernel changes: the five register roots join +the purity gate as exact tuples and d as an exact str (scalar +roots and hostile-d objects now return ['W0'] before any +iteration or comparison touches them); the binder walk goes +INDEX-BASED — backward scan by index, no copies, the slice +requirement computed as the count of 'a'-components past the +binder — measured LINEAR: n=8,000 in 2.9 ms at 7.8× the +n=1,000 time; the boundary narrative reconciled (the "cross +together" reading retracted in §6 and §10; the limits differ +family-dependently, the boundary is their per-family minimum, +and the claimed, twice-confirmed fact is the one-way +statement: no state inside the intersection of all three +limits crashes any post-gate scan); §6 gains the +instrument-input scope sentence (wf/wf7 are the raw-total +STATE surface; cert_fibres/cert_disjointness/cert_domain_sweep +trust their term/cert arguments, as every instrument trusts +its configuration). Regression twenty-seven gated; +twenty-seven-for-twenty-seven under forcing; +suite/certify/typecheck/polarity byte-identical; wf exactly +one new line; corpus, census, and all seventeen kits at their +adjudicated readings. One declared drift registered: the +predictions sketched the timing band as 16× and the code uses +24× (robustness under load; quadratic would be ~64×; measured +7.8×). Register, STATUS, token.md updated; fresh audit #22 +launched — the PASS re-claim stays gated on it. + +Postscript to the v1.29 entry: the assemble assertion caught its +FIRST LIVE MISMATCH during this very round's pack build — §1 +updated to audit #22 while §9 still said #21 (the third +occurrence of the exact staleness the assertion was built for; +the two prior ones were audit findings). The pack refused to +build, the line was fixed, and the pack built clean. Automation +where memory failed three times — working as designed, on its +first opportunity. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index c4391ae..0177407 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.28.** The kernel is a scratch superposition evolver +**Status: v1.29.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -17,7 +17,7 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #21**, whose +The standing PASS re-claim is **gated on fresh audit #22**, whose verdict will be registered here. Kernel-arm provenance is the chronicle's per-row "what changed" column — summaries of it have been refuted twice by literal diff (audit #13 killed "unmoved @@ -25,14 +25,33 @@ since v1.11"; audit #14 showed the corrected two-wave summary still omitted v1.12's ordinary-decode burial-suppression change and mislabeled v1.21's binder/transport arms as "leaf" guards) — so this register now names arms exactly and only per version: -v1.28 changes NO kernel source — the second consecutive +v1.29 changes NO kernel source — the third consecutive +checker-only round: the five register ROOTS join the purity +gate as exact tuples (pure(0) was True — an int is a valid pure +leaf — so scalar roots crashed the container iteration on all +five fields), `d` joins as an exact str (a hostile `__eq__` +object in d executed at the membership check), and the binder +walk goes index-based (the `p[:-1]` copying was Θ(n²) on long +occurrences — a fully VALID deep-lp state measured the +quadratic curve; now measured linear, n=8,000 in 2.9 ms at 7.8× +the n=1,000 time). Audit #21 also caught the register +CONTRADICTING ITSELF about the boundary: §10/status said the +three host operations "cross together at depth 6,000" while §6 +said the limits differ — and live measurement sided with §6 +(hash clean through depth 32,000 on the nested-lp family; +equality and repr fail at 6,000): audit #20's probe family +crossing together was a coincidence I registered as a law. The +narrative is reconciled below. Before that, +v1.28 changed NO kernel source either — the second consecutive checker-only round. Audit #20 confirmed the machine for the FOURTH consecutive audit (kernel.py BYTE-IDENTICAL verified; C2/C4/C5 in full; the structural-operation boundary SURVIVED its dedicated charge — equal-state probes at depths -1,000/2,000/4,000 all fine, at 6,000 hash, equality, and repr -cross their host limits TOGETHER, and no in-boundary state -crashes a post-gate scan) and found totality LAYER SIX: hostile +1,000/2,000/4,000 all fine, and no in-boundary state +crashes a post-gate scan; its additional "cross together at +6,000" reading was audit #20's probe-family coincidence, +falsified by audit #21 and reconciled per the v1.29 paragraph +above) and found totality LAYER SIX: hostile TERM subclasses still ran code inside `wf()` (exact-type dispatch protected only the state), the GATE production was never validated (`Gate('x')` passed wf and broke @@ -579,16 +598,28 @@ the machine's unitarity claims quantify over the subtype: canonical-order repr — exactly the operations the machine's own state discipline performs (evolve keys states by hash; state identity is equality; `rs_insert` and the certified - bundle sort canonically BY REPR) — and these limits DIFFER - (measured: an 8,000-deep in-language state hashes and - dict-round-trips, then exceeds the repr limit in the W2 - canonical-order check; a 2,000-deep control adjudicates - fully). wf performs no structural operation on state content + bundle sort canonically BY REPR) — and these limits DIFFER, + family-dependently (measured twice: an 8,000-deep in-language + state hashes and dict-round-trips, then exceeds the repr + limit in the W2 canonical-order check; audit #21 extended + this — on the nested-lp family hash stays clean through depth + 32,000 while equality and repr fail at 6,000; audit #20's + "cross together" reading was that probe family's coincidence + and is retracted). The boundary is the per-family MINIMUM of + the three limits, and the claimed, twice-confirmed fact is + ONE-WAY: no state inside the intersection of all three limits + crashes any post-gate scan. wf performs no structural + operation on state content that the machine does not, so any state past the boundary is one the machine could not itself build, canonically order, store, or superpose; post-gate scan cost is value-semantics (a shared DAG's value is genuinely exponential in its - representation). Zero reachable + representation). SCOPE: wf() and wf7() are the raw-total + STATE surface; the instrument helpers (`cert_fibres`, + `cert_disjointness`, `cert_domain_sweep`) take + INSTRUMENT-side inputs — term and certificate — on trust, as + every instrument does its own configuration: a garbage term + crashes them, and no raw-totality claim covers them. Zero reachable fires on the twenty programs and the 218,546-state generated corpus. - **W1** (log discipline): `|log| = level(pos)`. @@ -885,7 +916,7 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#21; the verdict will be registered here.** (Audit #16 caught +#22; the verdict will be registered here.** (Audit #16 caught this sentence stale; audit #19 caught it stale AGAIN despite the parenthetical promising otherwise — the promise is now an ASSERTION: the pack assembly script verifies §1 and §9 name the @@ -930,7 +961,7 @@ canonical dicts compared bit-for-bit; `dupcall` canonically None `h(Ω)` → None. Negative controls: pstar × wrong certificate reaches `pop-err`; dupcall × v1.7-era certificate reaches `refire`, all-err. WF/W7/W8/W9 sweeps + mechanized disjointness: -zero violations; **twenty-six permanent regressions** (the v1.6 pair; +zero violations; **twenty-seven permanent regressions** (the v1.6 pair; extra-frame collision, W7-excluded with disjoint targets; doctored bundle divergence; K+frame alias; retained-Q disjointness — spectator-bit columns share zero targets; @@ -1000,7 +1031,11 @@ adjudications as controls; totality VI — the hostile TERM subclass W0-rejected with no hostile code executed, the three invalid-Gate terms W0-rejected, wf7's hostile-subclass and unhashable sources declined without raising, and the -WF-source-reaches-fibre plus 800-node-chain controls intact). +WF-source-reaches-fibre plus 800-node-chain controls intact; +totality VII — the five scalar-root states and the +hostile-`__eq__`-in-d state W0-rejected with nothing executing, +wf7 declining, and the n=8,000 valid deep-lp walk inside the +linear band). The gating structure, stated exactly (audits #6 and #7 each caught a computed-but-non-gating @@ -1021,13 +1056,18 @@ instrument REMOVED → exit 1; audit #19 confirmed twenty-four-for-twenty-four plus the fourteen components with warnings promoted to errors; audit #20 confirmed twenty-five-for-twenty-five plus the fourteen components plus -the three polarity-reading mutations): the v1.6 pair -gates `collisions_under_wf()`; the other twenty-four gate +the three polarity-reading mutations; audit #21 confirmed +twenty-six-for-twenty-six likewise, plus conservation at size +11 and the max-free validator against an independent reference +over 50,000 randomized graphs incl. 5,349 cycle mutations with +zero mismatches, plus wf7 old-vs-new over 5,508 reachable +states with zero verdict differences): the v1.6 pair +gates `collisions_under_wf()`; the other twenty-five gate `cert_sweep()`'s return; the module `__main__` conjoins all three sweeps in its printed total AND ITS EXIT CODE, so any single regression failure exits nonzero (measured: forcing the pair false → exit 1; forcing cert_sweep flags false → exit 1, -including the v1.20 through v1.28 flags; the +including the v1.20 through v1.29 flags; the emulated-old-arm probe flips `cert_sweep` to FAIL). Three v1.12/v1.13-era regression mechanizations were updated in v1.23 to the always-emit discipline (their targets now carry the @@ -1259,13 +1299,19 @@ requirement, and v1.27's closed() memo order (an App-cycle re-enters at the SAME depth, so the memo must be consulted only after the on-path cycle check). Audit #20 verified kernel.py BYTE-IDENTICAL, the boundary's one-way statement by -dedicated equal-state probes (depths 1,000–4,000 clean; at -6,000 hash, equality, and repr cross together; no in-boundary -state crashes a post-gate scan), the assemble assertion -genuinely refusing a simulated mismatch, and the term +dedicated equal-state probes (depths 1,000–4,000 clean; no +in-boundary state crashes a post-gate scan), the assemble +assertion genuinely refusing a simulated mismatch, and the term differential surgically isolating the Gate defect (20,000 graphs; zero mismatches once the reference leaves Gate -payloads unconstrained) — its layer-six countermodels are +payloads unconstrained) — its additional "cross together at +6,000" reading did NOT replicate: audit #21 measured hash clean +through depth 32,000 on the nested-lp family while equality and +repr fail at 6,000, so the three operation limits DIFFER +(family-dependently), the boundary is their per-family MINIMUM, +and the claimed fact is the one-way statement alone — +twice-confirmed: no state inside the intersection of all three +limits crashes any post-gate scan. Its layer-six countermodels are healed and gated as regression twenty-six, its harness (audit_v127_layer6.py) joins the kit set CRASHING BY CONSTRUCTION on the healed build (it asserts the broken Gate @@ -1354,7 +1400,8 @@ no bare-term ideal oracle). | v1.25 | ONE machine guard added, no arm's storage behavior moves: alien-gate types foreign-gate cargo tickets at the fire boundary at both bit polarities (the decode row's subscript restored to the implementation; reachably unmintable — α_t's only mint site is behind the t-fire fence — so suite/certify/typecheck byte-identical, measured); wf() made TOTAL by the W0 GATE (out-of-language states early-return ['W0']; W1-W9 adjudicated only over the language's carrier; the in-language multi-flag control proves no over-collapse); the gauge sweep goes TEN-mark — 8/1024 reachable-only with KA free (printed), 4/1024 with the disclosed raw suppressed-decode edge, every survivor pinning w(KA)=0, verdict gating on both readings; §7.1 restated; regressions twenty-two (checker totality III) and twenty-three (alien-gate) gated, twenty-three-for-twenty-three under forcing; the "inert dead storage" phrase corrected; my pre-fix hand-derivation of the fire-edge parity DISAGREED with the auditor's sweep numbers and the measurement adjudicated for the auditor (registered — the mechanized sweep is the theorem, not my head-model); kit deltas: the W0-gate display collapses on out-of-language fixtures and the ten-mark orbit displays (independent confirmation of the unconstrained-mark fact), v121 crash and v123 kit byte-identical | **fresh audit #18: FAIL** (C1/C2/C4/C5 CONFIRMED — the delta exact by source reconstruction, 23 forcings + 14 components + both polarity readings + the raw instrument removed all exit 1, zero W0/alien-gate fires on an independently regenerated corpus; the alien-gate repair CONFIRMED on its full surface including nested/frame/burial foreign representations, all carried, never reinterpreted; the gauge claim UPGRADED — an independent GF(2) solver proved every possible suppressed-decode edge forces w(KA)=0 given the reachable orbit: the pinning is arm-intrinsic, not edge-dependent. The finding: C3's totality broken at LAYER FOUR — an exact-pure EMPTY TUPLE in the log crashes wf() UPSTREAM of the W0 gate (w0log → is_gam → bare e[0] IndexError; the gate only protected states whose W0 clauses already computed safely), plus two RecursionError classes (1,500-deep exact tuple in recursive pure(); 1,500-lambda term in recursive closed()); honesty: "wf() is total" false as written, the pack caption's stale regression count violating its own count-neutral convention, "one raw edge" vs one raw fire with two H successor edges) | | v1.26 | NO arm, NO guard — the helper-level totality round: the four bare-indexing token predicates (is_gam/is_mu/is_ans/is_alpha) gain the emptiness conjunct is_lp always had; every wf traversal before and during W0 becomes ITERATIVE and pre-gate HASH-FREE (explicit-stack pure/closed; the token grammar as a CLOSURE SWEEP — valid iff every closure node satisfies its local predicate — with an id-keyed per-call memo; iterative deep scans; kernel's alpha_keys_live/alpha_bits_deep iterative too, serving the fire arm's deep-W3 guard identically); the totality claim SCOPED to where it lives — total rejection on the raw-object layer, and past the gate the HOST-IDENTITY BOUNDARY shared with the machine's own superposition layer (§6); regression twenty-four (empty tuple in each register → exactly ['W0']; 1,500-deep tuple → ['W0']; 1,500-lambda term passes in full) gated, twenty-four-for-twenty-four under forcing; one equivalence bug caught DURING implementation before any measurement (the sweep's first draft would have accepted an AL with a non-lp instance — the kind requirement restored, registered in the predictions file); pack captions made count-neutral per their own standing convention; suite/certify/typecheck/polarity byte-identical, conservation timing-suffix only, wf exactly one new line; the auditor's harness joins the kit set and reruns healed | **fresh audit #19: FAIL** (the machine confirmed a THIRD consecutive round — C1 exact at the definition level, C2 with the kernel helpers differential-tested against recursive references over 92,961 entries zero mismatches, C4 in full with warnings-as-errors, C5 on an independently regenerated corpus; the CLOSURE SWEEP verified exactly equivalent to v1.25's recursive grammar over 100,000 randomized soups, 1,181 acceptances each, zero mismatches, the optimistic-memo argument verified. The findings, totality LAYER FIVE, all in wf()'s raw surface: garbage terms SILENTLY ACCEPTED — closed() had no rejecting branch for unknown node kinds; a cyclic term graph HUNG the tree walk; a hostile Run SUBCLASS ran __getattribute__ code from inside wf before purity; a 25-node shared-tuple DAG cost 2^24 purity visits, doubling per node; wf7 IndexError'd on an empty frame; and the host-identity boundary AS STATED was false — hash, repr, and equality have different structural limits: an 8,000-deep in-language state hashes and dict-round-trips, then dies in the W2 canonical-order repr sort, while a 2,000-deep control adjudicates fully; honesty: §9's gate line stale AGAIN, the very line whose parenthetical promised joint updates) | | v1.27 | CHECKER-ONLY — zero kernel changes: exact-type state dispatch (a Run subclass is not a state of the machine; hostile attribute access never runs); pure() id-visited (representation-linear on shared DAGs); closed() a full TERM VALIDATOR (unknown node kinds rejected — garbage terms now W0, consistent with the v1.23 open-term decision; on-path cycle detection rejects cyclic graphs promptly; an (id,depth) memo makes shared term DAGs polynomial); wf7 declines out-of-language rs and non-tuple paths; §6's boundary RESTATED to the host's structural-operation limits — hash, equality, AND canonical-order repr, exactly the operations the machine's own state discipline performs — with the auditor's 8,000/2,000 measurements as its empirical face; §9's stale-gate promise replaced by an ASSEMBLE-SCRIPT ASSERTION (§1/§9 must name the same audit or the pack refuses to build); regression twenty-five gated, twenty-five-for-twenty-five under forcing; a second caught-in-implementation equivalence hazard registered pre-measurement (closed()'s memo order vs App-cycles, which re-enter at the SAME depth); suite/certify/typecheck/polarity byte-identical, wf exactly one new line; the layer-five harness joins the kit set | **fresh audit #20: FAIL** (the machine clean a FOURTH consecutive round — kernel.py verified BYTE-IDENTICAL, C2/C4/C5 in full with three polarity-reading mutations, and the structural-operation boundary SURVIVED its dedicated charge: equal-state probes at depths 1,000/2,000/4,000 clean, at 6,000 hash/equality/repr cross their host limits TOGETHER, no in-boundary state crashes a post-gate scan; the assemble assertion verified against a simulated mismatch; both implementation catches validated. The findings, totality LAYER SIX: hostile TERM subclasses still ran code inside wf — exact-type dispatch protected only the state; the GATE production was never validated — Gate('x') passed wf and broke W0-preservation one step later, Gate([]) crashed the machine on an unhashable name, isolated surgically by a 20,000-graph term differential with zero non-Gate mismatches; wf7 still raised on a hostile subclass, a list inside the path tuple, and a list in the arrival tail — "declines out-of-language sources" was false as written; and the (id, depth) term memo was Θ(n²) on App/Lam chains — 800 objects, 640,800 validator states — where the register said representation-linear) | -| v1.28 | CHECKER-ONLY again — zero kernel changes: closed() REPLACED by the linear MAX-FREE validator (exact-type node dispatch — the type check precedes every field access, so hostile term subclasses never execute; Gate names validated in {'h','t'} — the production the language always required; Var indices exact-int ≥ 1; closedness = max_free(root) == 0 by iterative post-order with ONE memo entry per node id — measured n=3,000 chains in 2 ms vs 300 ms at n=800 under the old memo, "representation-linear" now TRUE as originally worded rather than weakened; on-path cycle rejection kept), run as an EARLY GATE before any token processing (under v1.27 the rs/ks loops ran even after term failure, so a hostile term could still execute during token checks); wf7 exact-type dispatched and gated by the total wf() itself; regression twenty-six gated, twenty-six-for-twenty-six under forcing; suite/certify/typecheck/polarity byte-identical, wf exactly one new line; two wrong calls registered — the layer6 kit does not "flip to healed" but CRASHES BY CONSTRUCTION (it asserts the broken Gate behavior; the v121 lesson re-learned), and the certified-fibre control was first mis-specified (the synthetic cert's fibre map is empty, so W7-domain is the correct preserved verdict — the control now proves a WF source REACHES the fibre logic through the gate) | **fresh audit #21: pending** | +| v1.28 | CHECKER-ONLY again — zero kernel changes: closed() REPLACED by the linear MAX-FREE validator (exact-type node dispatch — the type check precedes every field access, so hostile term subclasses never execute; Gate names validated in {'h','t'} — the production the language always required; Var indices exact-int ≥ 1; closedness = max_free(root) == 0 by iterative post-order with ONE memo entry per node id — measured n=3,000 chains in 2 ms vs 300 ms at n=800 under the old memo, "representation-linear" now TRUE as originally worded rather than weakened; on-path cycle rejection kept), run as an EARLY GATE before any token processing (under v1.27 the rs/ks loops ran even after term failure, so a hostile term could still execute during token checks); wf7 exact-type dispatched and gated by the total wf() itself; regression twenty-six gated, twenty-six-for-twenty-six under forcing; suite/certify/typecheck/polarity byte-identical, wf exactly one new line; two wrong calls registered — the layer6 kit does not "flip to healed" but CRASHES BY CONSTRUCTION (it asserts the broken Gate behavior; the v121 lesson re-learned), and the certified-fibre control was first mis-specified (the synthetic cert's fibre map is empty, so W7-domain is the correct preserved verdict — the control now proves a WF source REACHES the fibre logic through the gate) | **fresh audit #21: FAIL** (the machine clean a FIFTH consecutive round — kernel.py SHA-verified byte-identical, C2/C4/C5 in full; the max-free validator itself SURVIVED: 50,000 randomized graphs incl. 5,349 cycle mutations against an independent reference, zero mismatches; hostile terms/Gate payloads/string subclasses/Var(True) all W0-rejected; chains, ladders, and complete-sharing DAGs measured linear; wf7 old-vs-new over 5,508 reachable states, zero verdict differences. The findings, totality LAYER SEVEN: the five register ROOTS never type-checked — pure(0) True since an int is a valid pure LEAF, so scalar roots crashed the container iteration; d omitted from purity — a hostile __eq__ executed at the membership check; wf7 inheriting both; the binder walk's p[:-1] copying Θ(n²) on a fully VALID deep-lp state; and the register CONTRADICTING ITSELF about the boundary — §10/status's "cross together at 6,000" did not replicate: hash clean through depth 32,000 on the nested-lp family while equality/repr fail at 6,000, siding with §6's "the limits differ"; plus the instrument-helper scope needing explicit statement) | +| v1.29 | CHECKER-ONLY, third consecutive: the five register ROOTS join the purity gate as exact tuples and d as an exact str (scalar roots and hostile-__eq__ d objects → ['W0'] before any iteration or comparison); the binder walk goes INDEX-BASED (no copies; the slice requirement = count of 'a'-components past the binder; measured linear — n=8,000 in 2.9 ms at 7.8× the n=1,000 time, was 21 ms at ~27×); the boundary narrative RECONCILED (the "cross together" coincidence retracted in §6/§10; the limits differ family-dependently, the boundary is their per-family minimum, the twice-confirmed claim is the one-way statement); §6 gains the INSTRUMENT-INPUT SCOPE sentence (wf/wf7 are the raw-total state surface; cert_* helpers trust their term/cert arguments); regression twenty-seven gated, twenty-seven-for-twenty-seven under forcing; suite/certify/typecheck/polarity byte-identical, wf exactly one new line; one declared drift registered (the predictions sketched a 16× timing band, the code uses 24× — both far under quadratic's ~64×, measured 7.8×) | **fresh audit #22: pending** | ## 12. Appendix — HH step-indexed trace diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index e2b773c..dc40345 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -398,7 +398,7 @@ register alone carries the version). | Item | Status | |---|---| -| Kernel | **v1.28** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (W0 = the SORTED state language with exact-type PURITY as of v1.24 — registers exact tuples of exact tuples/str/int checked without hashing, exact-int bits, recursive lp productions satisfying the lambda-IAM slice equation with occurrences resolving to bound Vars (1-indexed; Var(0) refused) of the closed term, the log's lp-like alphabet, arrival-lp K(l) cargo, the KA production, coordinates in language — plus W1-W9, with W4 closed by enumeration and §7.4's storage prefix-freeness now the ALL-ARMS one-head-per-fire discipline: audit #15's empty-bundle collision and audit #16's suppressed-decode/retain-whole forgery were the certified and uncertified instances of the same defect — every fire arm appends exactly one arm-typed head (KD / K3 / KA / K2), each healed with every covered output byte-identical); wf() total on the raw-object layer via the W0 gate with exact-type dispatch for states AND term nodes, the linear max-free term validator (Gate production validated; cycle detection; garbage terms rejected; one memo entry per node), and every traversal iterative, pre-gate hash-free, and representation-linear (v1.28 — W1-W9 adjudicated only over the language's carrier; wf7 gated by wf itself; past the gate the host's structural-operation boundary — hash, equality, canonical-order repr — exactly the machine's own state-discipline operations, measured crossing together at depth 6,000); the species guards, the alien-gate foreign-ticket guard, and the t scope fence typed (fifteen guards); the ten-mark gauge sweep pins w(KA)=0 via the disclosed raw suppressed edge (4/1024, with the 8/1024 reachable-only reading printed beside it — audit #18 proved the pinning arm-intrinsic); twenty-six permanent regressions, all gating; all six instruments carry exit-code verdicts; kernel-arm history lives in the register's §11 rows. **PASS re-claim gated on fresh audit #21** | +| Kernel | **v1.29** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (W0 = the SORTED state language with exact-type PURITY as of v1.24 — registers exact tuples of exact tuples/str/int checked without hashing, exact-int bits, recursive lp productions satisfying the lambda-IAM slice equation with occurrences resolving to bound Vars (1-indexed; Var(0) refused) of the closed term, the log's lp-like alphabet, arrival-lp K(l) cargo, the KA production, coordinates in language — plus W1-W9, with W4 closed by enumeration and §7.4's storage prefix-freeness now the ALL-ARMS one-head-per-fire discipline: audit #15's empty-bundle collision and audit #16's suppressed-decode/retain-whole forgery were the certified and uncertified instances of the same defect — every fire arm appends exactly one arm-typed head (KD / K3 / KA / K2), each healed with every covered output byte-identical); wf() total on the raw-object layer via the W0 gate with exact-type dispatch for states AND term nodes, exact-tuple register roots and exact-str d, the linear max-free term validator (Gate production validated; cycle detection; garbage terms rejected; one memo entry per node), and every traversal iterative, pre-gate hash-free, and representation-linear incl. the index-based binder walk (v1.29 — W1-W9 adjudicated only over the language's carrier; wf7 gated by wf itself; past the gate the host's structural-operation boundary — hash, equality, canonical-order repr, whose limits DIFFER family-dependently with the one-way no-crash statement twice confirmed; cert_* helpers scoped as instrument-input surface); the species guards, the alien-gate foreign-ticket guard, and the t scope fence typed (fifteen guards); the ten-mark gauge sweep pins w(KA)=0 via the disclosed raw suppressed edge (4/1024, with the 8/1024 reachable-only reading printed beside it — audit #18 proved the pinning arm-intrinsic); twenty-seven permanent regressions, all gating; all six instruments carry exit-code verdicts; kernel-arm history lives in the register's §11 rows. **PASS re-claim gated on fresh audit #22** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §5): the fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is the hybrid validation — structural admission/isometry plus exact-amplitude dynamic cleanliness plus non-vacuity, strictly beyond Gram (negative controls caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and **self-validating**: every admitted map passes full semantic coverage, else None | From 468de2a7317bb79e5e95983ff3378f61dcfc9731 Mon Sep 17 00:00:00 2001 From: a9lim Date: Mon, 10 Aug 2026 02:09:51 -0400 Subject: [PATCH 054/107] =?UTF-8?q?qalc:=20kernel=20v1.30=20=E2=80=94=20th?= =?UTF-8?q?e=20full-lp=20memo=20restores=20composition=20linearity;=20a=20?= =?UTF-8?q?generous=20HELD=20marked=20as=20a=20miss;=20audit=20#22=20regis?= =?UTF-8?q?tered?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #22 (cx-20260810-014328-28e8) — the narrowest verdict yet: machine unbroken a sixth round; the reconciled boundary CONFIRMED on an independent family; all four v1.29 repairs individually linear. Findings: the composition quadratic (n frames sharing one lp — w0lp_shape rescanned before the memo), an over-categorical 'crashes' (garbage may quietly return meaningless values), and v129's conservation-suffix prediction graded HELD generously. v1.30 — three small changes, zero kernel changes: the full-lp id-memo (auditor's family 191ms → 1.4ms at n=2000, linear); the scope sentence reworded to UNSPECIFIED with measured examples; the v129 miss marked in its own outcomes appendix. Regression 28; 28/28 forced-exit-1; four instruments byte-identical. The assemble assertion caught its second live gate-line mismatch in two rounds during this round's build. Fresh audit #23 launched; PASS re-claim gated on it. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 28 +++++++++++------- docs/ledger/2026-08.md | 45 +++++++++++++++++++++++++++++ docs/quantum-algebraic/kernel.md | 49 ++++++++++++++++++++++++-------- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 101 insertions(+), 23 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 9e27b69..2417585 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,10 +413,10 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.29** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.30** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after -twenty-one fresh-context rounds. Kernel-arm provenance summaries +twenty-two fresh-context rounds. Kernel-arm provenance summaries have been refuted by literal diff twice (audit #13 killed "unmoved since v1.11"; audit #14 showed the corrected summary still incomplete), so the register now names arms per version @@ -586,10 +586,19 @@ registered as a law). v1.29 (checker-only, third consecutive): roots and d join the purity gate, the binder walk goes index-based and linear, the boundary narrative is reconciled to the one-way statement, and the instrument-input scope is -explicit. What +explicit. Audit #22 (sixth machine-clean round; the reconciled +boundary CONFIRMED on an independent family) found layer +EIGHT, the narrowest yet: four individually-linear parts +composing quadratically (n frames sharing one lp — the memo +sat one call too deep), an over-categorical "crashes" that +should have said "unspecified", and one generously-graded +prediction. v1.30 (checker-only, fourth consecutive): the +full-lp memo (191 ms → 1.4 ms on the auditor's family), the +reworded scope, and the miss marked in v1.29's own outcomes +appendix. What the rounds still found was claim-language and scaffolding, each fixed the same -day: all twenty-seven permanent regressions now gate mechanically (the +day: all twenty-eight permanent regressions now gate mechanically (the module verdict is the exit code — forcing any single regression false exits nonzero, measured); `validate()` gained NON-VACUITY at both levels (an entry at an unreachable position and a ghost @@ -605,15 +614,14 @@ minimal; physics table passes on all twenty; all prior audit kits rerun with every delta adjudicated (ks-display relabels under always-emit and the KA head; the W0-gate display collapses; matrix-coverage shrink under the tightened language; -the healed-countermodel crash); every v1.29 prediction held, -with one declared drift (a 16× predicted timing band vs the -implemented 24× — measured 7.8×) recorded beside the earlier -rounds' registered wrong calls (provenance in the scratchpad -prediction files). +the healed-countermodel crash); every v1.30 prediction held +with the conservation expectation finally worded correctly, +and v1.29's generous HELD is marked as the miss it was +(provenance in the scratchpad prediction files). The open docket, in order: -1. **fresh-context independent audit #22 of the v1.29 h-fragment +1. **fresh-context independent audit #23 of the v1.30 h-fragment claim** (verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index fc290f4..bce266c 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -3706,3 +3706,48 @@ the two prior ones were audit findings). The pack refused to build, the line was fixed, and the pack built clean. Automation where memory failed three times — working as designed, on its first opportunity. + +## 2026-08-10 — qALC kernel v1.30: the composition learns what its parts knew; a generous HELD becomes a marked miss + +Audit #22 (fresh instance, sol tier, threadless) — the narrowest +verdict of the loop. The machine unbroken a SIXTH consecutive +round; the reconciled structural-operation boundary CONFIRMED on +an independently constructed family (hash clean at 32,000, +equality/repr failing at 6,000, everything inside all three +limits completing every scan; status/§6/§10 verified to agree); +the instrument scope verified structurally correct; and all four +v1.29 repairs individually measured linear. The findings, layer +EIGHT: (1) the COMPOSITION is quadratic — n frames in rs sharing +one valid deep lp cost Θ(n²), clean 4× doublings, because +w0lp_shape rescans the occurrence before w0tok ever consults the +memo: four individually-linear parts, one memo sitting one call +too deep; (2) §6's "a garbage term crashes them" was too +categorical — the cert_* helpers on object() QUIETLY RETURN +meaningless values ({}, ([], 0), 1): unspecified is the honest +word; (3) an epistemics catch — v129's outcome 1 graded the +"conservation byte-identical" prediction HELD while the captures +differ in the timing suffix. The standing caveat explains the +bytes; it does not make the literal prediction true. The +predictions discipline exists precisely so the author cannot +grade their own homework, and I graded generously. + +v1.30, predictions written first — three small changes, zero +kernel changes, the smallest round of the loop: the FULL-LP +id-memo in w0lp (shape+closure verified once per lp object, +stored only after both conjuncts complete; the auditor's family +drops from 191 ms to 1.4 ms at n=2,000 — linear, ~135×); the +scope sentence reworded to UNSPECIFIED with the quiet-return +examples registered; and the v1.29 miss MARKED in its own +outcomes appendix. Regression twenty-eight (the auditor's exact +family inside the linear band, plus a distinct-lps no-aliasing +control) gated; twenty-eight-for-twenty-eight under forcing; +suite/certify/typecheck/polarity byte-identical; wf exactly one +new line; corpus, census, kits all at their adjudicated +readings. Register, STATUS, token.md updated; fresh audit #23 +launched — the PASS re-claim stays gated on it. + +Postscript to the v1.30 entry: the assemble assertion caught its +SECOND live gate-line mismatch in two rounds (§1 at #23, §9 still +at #22 — the batch edit covered one and not the other). Two +catches in two opportunities since it replaced the twice-broken +promise. The pack built clean after the fix. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 0177407..b985901 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.29.** The kernel is a scratch superposition evolver +**Status: v1.30.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -17,7 +17,7 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #22**, whose +The standing PASS re-claim is **gated on fresh audit #23**, whose verdict will be registered here. Kernel-arm provenance is the chronicle's per-row "what changed" column — summaries of it have been refuted twice by literal diff (audit #13 killed "unmoved @@ -25,7 +25,21 @@ since v1.11"; audit #14 showed the corrected two-wave summary still omitted v1.12's ordinary-decode burial-suppression change and mislabeled v1.21's binder/transport arms as "leaf" guards) — so this register now names arms exactly and only per version: -v1.29 changes NO kernel source — the third consecutive +v1.30 changes NO kernel source — the fourth consecutive +checker-only round, and the smallest: audit #22 (machine +unbroken a SIXTH round; the reconciled boundary CONFIRMED by an +independent family; all four v1.29 repairs individually linear) +found the COMPOSITION quadratic — n frames sharing one deep lp +cost Θ(n²) because w0lp_shape rescanned the occurrence before +the memo — plus one over-categorical scope word and one +generously-graded prediction. v1.30: the FULL-LP id-memo +(shape+closure once per lp object; the auditor's family drops +from 191 ms to 1.4 ms at n=2,000, linear), the scope sentence +reworded to UNSPECIFIED (garbage configuration may crash, hang, +or quietly return meaningless values — measured examples +registered), and the v1.29 conservation-suffix prediction +MARKED AS A MISS in its own outcomes appendix. Before that, +v1.29 changed NO kernel source — the third consecutive checker-only round: the five register ROOTS join the purity gate as exact tuples (pure(0) was True — an int is a valid pure leaf — so scalar roots crashed the container iteration on all @@ -618,8 +632,12 @@ the machine's unitarity claims quantify over the subtype: STATE surface; the instrument helpers (`cert_fibres`, `cert_disjointness`, `cert_domain_sweep`) take INSTRUMENT-side inputs — term and certificate — on trust, as - every instrument does its own configuration: a garbage term - crashes them, and no raw-totality claim covers them. Zero reachable + every instrument does its own configuration: their behavior + on garbage configuration is UNSPECIFIED — they may crash, + hang, or quietly return meaningless values (measured: + cert_fibres(object(), {}) returns {}; cert_disjointness + ([], 0); cert_domain_sweep 1) — and no raw-totality claim + covers them. Zero reachable fires on the twenty programs and the 218,546-state generated corpus. - **W1** (log discipline): `|log| = level(pos)`. @@ -916,7 +934,7 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#22; the verdict will be registered here.** (Audit #16 caught +#23; the verdict will be registered here.** (Audit #16 caught this sentence stale; audit #19 caught it stale AGAIN despite the parenthetical promising otherwise — the promise is now an ASSERTION: the pack assembly script verifies §1 and §9 name the @@ -961,7 +979,7 @@ canonical dicts compared bit-for-bit; `dupcall` canonically None `h(Ω)` → None. Negative controls: pstar × wrong certificate reaches `pop-err`; dupcall × v1.7-era certificate reaches `refire`, all-err. WF/W7/W8/W9 sweeps + mechanized disjointness: -zero violations; **twenty-seven permanent regressions** (the v1.6 pair; +zero violations; **twenty-eight permanent regressions** (the v1.6 pair; extra-frame collision, W7-excluded with disjoint targets; doctored bundle divergence; K+frame alias; retained-Q disjointness — spectator-bit columns share zero targets; @@ -1035,7 +1053,9 @@ WF-source-reaches-fibre plus 800-node-chain controls intact; totality VII — the five scalar-root states and the hostile-`__eq__`-in-d state W0-rejected with nothing executing, wf7 declining, and the n=8,000 valid deep-lp walk inside the -linear band). +linear band; composition linearity — the n-frames-one-lp family +W0 at both sizes inside the linear band, with a distinct-lps +no-aliasing control). The gating structure, stated exactly (audits #6 and #7 each caught a computed-but-non-gating @@ -1061,13 +1081,17 @@ twenty-six-for-twenty-six likewise, plus conservation at size 11 and the max-free validator against an independent reference over 50,000 randomized graphs incl. 5,349 cycle mutations with zero mismatches, plus wf7 old-vs-new over 5,508 reachable -states with zero verdict differences): the v1.6 pair -gates `collisions_under_wf()`; the other twenty-five gate +states with zero verdict differences; audit #22 confirmed +twenty-seven-for-twenty-seven plus the fourteen components plus +the three polarity-reading controls, the reconciled boundary on +an independent family, and all four v1.29 repairs individually +linear): the v1.6 pair +gates `collisions_under_wf()`; the other twenty-six gate `cert_sweep()`'s return; the module `__main__` conjoins all three sweeps in its printed total AND ITS EXIT CODE, so any single regression failure exits nonzero (measured: forcing the pair false → exit 1; forcing cert_sweep flags false → exit 1, -including the v1.20 through v1.29 flags; the +including the v1.20 through v1.30 flags; the emulated-old-arm probe flips `cert_sweep` to FAIL). Three v1.12/v1.13-era regression mechanizations were updated in v1.23 to the always-emit discipline (their targets now carry the @@ -1401,7 +1425,8 @@ no bare-term ideal oracle). | v1.26 | NO arm, NO guard — the helper-level totality round: the four bare-indexing token predicates (is_gam/is_mu/is_ans/is_alpha) gain the emptiness conjunct is_lp always had; every wf traversal before and during W0 becomes ITERATIVE and pre-gate HASH-FREE (explicit-stack pure/closed; the token grammar as a CLOSURE SWEEP — valid iff every closure node satisfies its local predicate — with an id-keyed per-call memo; iterative deep scans; kernel's alpha_keys_live/alpha_bits_deep iterative too, serving the fire arm's deep-W3 guard identically); the totality claim SCOPED to where it lives — total rejection on the raw-object layer, and past the gate the HOST-IDENTITY BOUNDARY shared with the machine's own superposition layer (§6); regression twenty-four (empty tuple in each register → exactly ['W0']; 1,500-deep tuple → ['W0']; 1,500-lambda term passes in full) gated, twenty-four-for-twenty-four under forcing; one equivalence bug caught DURING implementation before any measurement (the sweep's first draft would have accepted an AL with a non-lp instance — the kind requirement restored, registered in the predictions file); pack captions made count-neutral per their own standing convention; suite/certify/typecheck/polarity byte-identical, conservation timing-suffix only, wf exactly one new line; the auditor's harness joins the kit set and reruns healed | **fresh audit #19: FAIL** (the machine confirmed a THIRD consecutive round — C1 exact at the definition level, C2 with the kernel helpers differential-tested against recursive references over 92,961 entries zero mismatches, C4 in full with warnings-as-errors, C5 on an independently regenerated corpus; the CLOSURE SWEEP verified exactly equivalent to v1.25's recursive grammar over 100,000 randomized soups, 1,181 acceptances each, zero mismatches, the optimistic-memo argument verified. The findings, totality LAYER FIVE, all in wf()'s raw surface: garbage terms SILENTLY ACCEPTED — closed() had no rejecting branch for unknown node kinds; a cyclic term graph HUNG the tree walk; a hostile Run SUBCLASS ran __getattribute__ code from inside wf before purity; a 25-node shared-tuple DAG cost 2^24 purity visits, doubling per node; wf7 IndexError'd on an empty frame; and the host-identity boundary AS STATED was false — hash, repr, and equality have different structural limits: an 8,000-deep in-language state hashes and dict-round-trips, then dies in the W2 canonical-order repr sort, while a 2,000-deep control adjudicates fully; honesty: §9's gate line stale AGAIN, the very line whose parenthetical promised joint updates) | | v1.27 | CHECKER-ONLY — zero kernel changes: exact-type state dispatch (a Run subclass is not a state of the machine; hostile attribute access never runs); pure() id-visited (representation-linear on shared DAGs); closed() a full TERM VALIDATOR (unknown node kinds rejected — garbage terms now W0, consistent with the v1.23 open-term decision; on-path cycle detection rejects cyclic graphs promptly; an (id,depth) memo makes shared term DAGs polynomial); wf7 declines out-of-language rs and non-tuple paths; §6's boundary RESTATED to the host's structural-operation limits — hash, equality, AND canonical-order repr, exactly the operations the machine's own state discipline performs — with the auditor's 8,000/2,000 measurements as its empirical face; §9's stale-gate promise replaced by an ASSEMBLE-SCRIPT ASSERTION (§1/§9 must name the same audit or the pack refuses to build); regression twenty-five gated, twenty-five-for-twenty-five under forcing; a second caught-in-implementation equivalence hazard registered pre-measurement (closed()'s memo order vs App-cycles, which re-enter at the SAME depth); suite/certify/typecheck/polarity byte-identical, wf exactly one new line; the layer-five harness joins the kit set | **fresh audit #20: FAIL** (the machine clean a FOURTH consecutive round — kernel.py verified BYTE-IDENTICAL, C2/C4/C5 in full with three polarity-reading mutations, and the structural-operation boundary SURVIVED its dedicated charge: equal-state probes at depths 1,000/2,000/4,000 clean, at 6,000 hash/equality/repr cross their host limits TOGETHER, no in-boundary state crashes a post-gate scan; the assemble assertion verified against a simulated mismatch; both implementation catches validated. The findings, totality LAYER SIX: hostile TERM subclasses still ran code inside wf — exact-type dispatch protected only the state; the GATE production was never validated — Gate('x') passed wf and broke W0-preservation one step later, Gate([]) crashed the machine on an unhashable name, isolated surgically by a 20,000-graph term differential with zero non-Gate mismatches; wf7 still raised on a hostile subclass, a list inside the path tuple, and a list in the arrival tail — "declines out-of-language sources" was false as written; and the (id, depth) term memo was Θ(n²) on App/Lam chains — 800 objects, 640,800 validator states — where the register said representation-linear) | | v1.28 | CHECKER-ONLY again — zero kernel changes: closed() REPLACED by the linear MAX-FREE validator (exact-type node dispatch — the type check precedes every field access, so hostile term subclasses never execute; Gate names validated in {'h','t'} — the production the language always required; Var indices exact-int ≥ 1; closedness = max_free(root) == 0 by iterative post-order with ONE memo entry per node id — measured n=3,000 chains in 2 ms vs 300 ms at n=800 under the old memo, "representation-linear" now TRUE as originally worded rather than weakened; on-path cycle rejection kept), run as an EARLY GATE before any token processing (under v1.27 the rs/ks loops ran even after term failure, so a hostile term could still execute during token checks); wf7 exact-type dispatched and gated by the total wf() itself; regression twenty-six gated, twenty-six-for-twenty-six under forcing; suite/certify/typecheck/polarity byte-identical, wf exactly one new line; two wrong calls registered — the layer6 kit does not "flip to healed" but CRASHES BY CONSTRUCTION (it asserts the broken Gate behavior; the v121 lesson re-learned), and the certified-fibre control was first mis-specified (the synthetic cert's fibre map is empty, so W7-domain is the correct preserved verdict — the control now proves a WF source REACHES the fibre logic through the gate) | **fresh audit #21: FAIL** (the machine clean a FIFTH consecutive round — kernel.py SHA-verified byte-identical, C2/C4/C5 in full; the max-free validator itself SURVIVED: 50,000 randomized graphs incl. 5,349 cycle mutations against an independent reference, zero mismatches; hostile terms/Gate payloads/string subclasses/Var(True) all W0-rejected; chains, ladders, and complete-sharing DAGs measured linear; wf7 old-vs-new over 5,508 reachable states, zero verdict differences. The findings, totality LAYER SEVEN: the five register ROOTS never type-checked — pure(0) True since an int is a valid pure LEAF, so scalar roots crashed the container iteration; d omitted from purity — a hostile __eq__ executed at the membership check; wf7 inheriting both; the binder walk's p[:-1] copying Θ(n²) on a fully VALID deep-lp state; and the register CONTRADICTING ITSELF about the boundary — §10/status's "cross together at 6,000" did not replicate: hash clean through depth 32,000 on the nested-lp family while equality/repr fail at 6,000, siding with §6's "the limits differ"; plus the instrument-helper scope needing explicit statement) | -| v1.29 | CHECKER-ONLY, third consecutive: the five register ROOTS join the purity gate as exact tuples and d as an exact str (scalar roots and hostile-__eq__ d objects → ['W0'] before any iteration or comparison); the binder walk goes INDEX-BASED (no copies; the slice requirement = count of 'a'-components past the binder; measured linear — n=8,000 in 2.9 ms at 7.8× the n=1,000 time, was 21 ms at ~27×); the boundary narrative RECONCILED (the "cross together" coincidence retracted in §6/§10; the limits differ family-dependently, the boundary is their per-family minimum, the twice-confirmed claim is the one-way statement); §6 gains the INSTRUMENT-INPUT SCOPE sentence (wf/wf7 are the raw-total state surface; cert_* helpers trust their term/cert arguments); regression twenty-seven gated, twenty-seven-for-twenty-seven under forcing; suite/certify/typecheck/polarity byte-identical, wf exactly one new line; one declared drift registered (the predictions sketched a 16× timing band, the code uses 24× — both far under quadratic's ~64×, measured 7.8×) | **fresh audit #22: pending** | +| v1.29 | CHECKER-ONLY, third consecutive: the five register ROOTS join the purity gate as exact tuples and d as an exact str (scalar roots and hostile-__eq__ d objects → ['W0'] before any iteration or comparison); the binder walk goes INDEX-BASED (no copies; the slice requirement = count of 'a'-components past the binder; measured linear — n=8,000 in 2.9 ms at 7.8× the n=1,000 time, was 21 ms at ~27×); the boundary narrative RECONCILED (the "cross together" coincidence retracted in §6/§10; the limits differ family-dependently, the boundary is their per-family minimum, the twice-confirmed claim is the one-way statement); §6 gains the INSTRUMENT-INPUT SCOPE sentence (wf/wf7 are the raw-total state surface; cert_* helpers trust their term/cert arguments); regression twenty-seven gated, twenty-seven-for-twenty-seven under forcing; suite/certify/typecheck/polarity byte-identical, wf exactly one new line; one declared drift registered (the predictions sketched a 16× timing band, the code uses 24× — both far under quadratic's ~64×, measured 7.8×) | **fresh audit #22: FAIL** (the machine unbroken a SIXTH consecutive round; the RECONCILED BOUNDARY CONFIRMED — an independent slice-nested family reproduces the §6 table, status/§6/§10 verified to agree, residual "cross together" text verified historical-only; the instrument scope verified structurally correct; all four v1.29 repairs individually LINEAR. The findings, layer EIGHT: the COMPOSITION is Θ(n²) — n frames sharing one valid deep lp, 4× per doubling, because w0lp_shape rescans the occurrence before w0tok consults the memo, so "the lpmemo makes it once per lp" was false for standalone rs/ks checks; §6's "a garbage term crashes them" too categorical — the cert_* helpers on object() QUIETLY RETURN meaningless values; and one generously-graded prediction — v129's outcome 1 marked "byte-identical conservation" HELD while the captures differ in the timing suffix: the caveat explains the bytes, it does not make the literal prediction true) | +| v1.30 | CHECKER-ONLY, fourth consecutive, the smallest round: the FULL-LP id-memo in w0lp (shape+closure verified once per lp object, stored only after both conjuncts complete — no optimistic leak; the auditor's family drops 191 ms → 1.4 ms at n=2,000, linear, ~135×; regression twenty-eight measures exactly that family plus a distinct-lps no-aliasing control); §6's scope sentence reworded to UNSPECIFIED with the quiet-return examples registered; the v1.29 conservation-suffix prediction MARKED AS A MISS in its own outcomes appendix (grading it HELD was generous — the predictions discipline exists precisely so the author cannot grade their own homework); twenty-eight-for-twenty-eight under forcing; suite/certify/typecheck/polarity byte-identical, wf exactly one new line | **fresh audit #23: pending** | ## 12. Appendix — HH step-indexed trace diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index dc40345..68dfcba 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -398,7 +398,7 @@ register alone carries the version). | Item | Status | |---|---| -| Kernel | **v1.29** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (W0 = the SORTED state language with exact-type PURITY as of v1.24 — registers exact tuples of exact tuples/str/int checked without hashing, exact-int bits, recursive lp productions satisfying the lambda-IAM slice equation with occurrences resolving to bound Vars (1-indexed; Var(0) refused) of the closed term, the log's lp-like alphabet, arrival-lp K(l) cargo, the KA production, coordinates in language — plus W1-W9, with W4 closed by enumeration and §7.4's storage prefix-freeness now the ALL-ARMS one-head-per-fire discipline: audit #15's empty-bundle collision and audit #16's suppressed-decode/retain-whole forgery were the certified and uncertified instances of the same defect — every fire arm appends exactly one arm-typed head (KD / K3 / KA / K2), each healed with every covered output byte-identical); wf() total on the raw-object layer via the W0 gate with exact-type dispatch for states AND term nodes, exact-tuple register roots and exact-str d, the linear max-free term validator (Gate production validated; cycle detection; garbage terms rejected; one memo entry per node), and every traversal iterative, pre-gate hash-free, and representation-linear incl. the index-based binder walk (v1.29 — W1-W9 adjudicated only over the language's carrier; wf7 gated by wf itself; past the gate the host's structural-operation boundary — hash, equality, canonical-order repr, whose limits DIFFER family-dependently with the one-way no-crash statement twice confirmed; cert_* helpers scoped as instrument-input surface); the species guards, the alien-gate foreign-ticket guard, and the t scope fence typed (fifteen guards); the ten-mark gauge sweep pins w(KA)=0 via the disclosed raw suppressed edge (4/1024, with the 8/1024 reachable-only reading printed beside it — audit #18 proved the pinning arm-intrinsic); twenty-seven permanent regressions, all gating; all six instruments carry exit-code verdicts; kernel-arm history lives in the register's §11 rows. **PASS re-claim gated on fresh audit #22** | +| Kernel | **v1.30** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (W0 = the SORTED state language with exact-type PURITY as of v1.24 — registers exact tuples of exact tuples/str/int checked without hashing, exact-int bits, recursive lp productions satisfying the lambda-IAM slice equation with occurrences resolving to bound Vars (1-indexed; Var(0) refused) of the closed term, the log's lp-like alphabet, arrival-lp K(l) cargo, the KA production, coordinates in language — plus W1-W9, with W4 closed by enumeration and §7.4's storage prefix-freeness now the ALL-ARMS one-head-per-fire discipline: audit #15's empty-bundle collision and audit #16's suppressed-decode/retain-whole forgery were the certified and uncertified instances of the same defect — every fire arm appends exactly one arm-typed head (KD / K3 / KA / K2), each healed with every covered output byte-identical); wf() total on the raw-object layer via the W0 gate with exact-type dispatch for states AND term nodes, exact-tuple register roots and exact-str d, the linear max-free term validator (Gate production validated; cycle detection; garbage terms rejected; one memo entry per node), and every traversal iterative, pre-gate hash-free, and representation-linear incl. the index-based binder walk (v1.29 — W1-W9 adjudicated only over the language's carrier; wf7 gated by wf itself; past the gate the host's structural-operation boundary — hash, equality, canonical-order repr, whose limits DIFFER family-dependently with the one-way no-crash statement twice confirmed; cert_* helpers scoped as instrument-input surface); the species guards, the alien-gate foreign-ticket guard, and the t scope fence typed (fifteen guards); the ten-mark gauge sweep pins w(KA)=0 via the disclosed raw suppressed edge (4/1024, with the 8/1024 reachable-only reading printed beside it — audit #18 proved the pinning arm-intrinsic); twenty-eight permanent regressions, all gating (incl. composition linearity — the full-lp memo); all six instruments carry exit-code verdicts; kernel-arm history lives in the register's §11 rows. **PASS re-claim gated on fresh audit #23** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §5): the fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is the hybrid validation — structural admission/isometry plus exact-amplitude dynamic cleanliness plus non-vacuity, strictly beyond Gram (negative controls caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and **self-validating**: every admitted map passes full semantic coverage, else None | From 5a2dd5cccb1a9f0782d728c30a3664c15f70efc3 Mon Sep 17 00:00:00 2001 From: a9lim Date: Mon, 10 Aug 2026 02:42:44 -0400 Subject: [PATCH 055/107] =?UTF-8?q?qalc:=20kernel=20v1.31=20=E2=80=94=20th?= =?UTF-8?q?e=20occurrence=20memo;=20the=20memos'=20honest=20invariant;=20a?= =?UTF-8?q?udit=20#23=20registered?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #23 (cx-20260810-020916-8223) — machine unbroken a seventh round. Layer nine: value-sharing without object-sharing (n distinct lp shells around one shared occurrence tuple — Θ(n) graph, Θ(n²) time: the id-memos see objects, the expensive work is per-occurrence), and the full-lp memo's 'no optimistic leak' comment literally false (public verdict verified safe via w0bad monotonicity). v1.31 — checker-only, fifth consecutive: occ_required memoizes the walk/binder-scan/count once per occurrence object (total pre-gate work Σ O(local) over distinct objects; the auditor's families drop 389ms → 2.2ms at n=2000); the memo doctrine restated as aggregate monotonicity. Regression 29; 29/29 forced-exit-1; four instruments byte-identical. One fixture bug caught in-round by its own failing band (a fresh occurrence per shell is a genuinely quadratic representation — documented). Fresh audit #24 launched; PASS re-claim gated on it. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 30 ++++++++++++++------- docs/ledger/2026-08.md | 43 +++++++++++++++++++++++++++++ docs/quantum-algebraic/kernel.md | 46 +++++++++++++++++++++++++------- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 101 insertions(+), 20 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 2417585..5487803 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,10 +413,10 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.30** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.31** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after -twenty-two fresh-context rounds. Kernel-arm provenance summaries +twenty-three fresh-context rounds. Kernel-arm provenance summaries have been refuted by literal diff twice (audit #13 killed "unmoved since v1.11"; audit #14 showed the corrected summary still incomplete), so the register now names arms per version @@ -595,10 +595,20 @@ should have said "unspecified", and one generously-graded prediction. v1.30 (checker-only, fourth consecutive): the full-lp memo (191 ms → 1.4 ms on the auditor's family), the reworded scope, and the miss marked in v1.29's own outcomes -appendix. What +appendix. Audit #23 (seventh machine-clean round) built +value-sharing WITHOUT object-sharing — n distinct shells around +one occurrence tuple — and the id-memos missed every shell: +quadratic again, because I memoized the wrapper instead of the +work; it also caught the memo comment's "no optimistic leak" as +literally false (the verdict stays safe — w0bad is monotone — +but the flattering per-entry claim was not the invariant). +v1.31 (checker-only, fifth consecutive): the occurrence memo — +the work memoized where the sharing is (389 → 2.2 ms) — and +the memo doctrine stated honestly as aggregate monotonicity. +What the rounds still found was claim-language and scaffolding, each fixed the same -day: all twenty-eight permanent regressions now gate mechanically (the +day: all twenty-nine permanent regressions now gate mechanically (the module verdict is the exit code — forcing any single regression false exits nonzero, measured); `validate()` gained NON-VACUITY at both levels (an entry at an unreachable position and a ghost @@ -614,14 +624,16 @@ minimal; physics table passes on all twenty; all prior audit kits rerun with every delta adjudicated (ks-display relabels under always-emit and the KA head; the W0-gate display collapses; matrix-coverage shrink under the tightened language; -the healed-countermodel crash); every v1.30 prediction held -with the conservation expectation finally worded correctly, -and v1.29's generous HELD is marked as the miss it was -(provenance in the scratchpad prediction files). +the healed-countermodel crash); every v1.31 prediction held, +with one fixture bug caught in-round by its own failing band — +the first draft measured a genuinely-quadratic representation +and called it the memo's fault; the corrected fixture shares +the occurrence object as the auditor's family does (provenance +in the scratchpad prediction files). The open docket, in order: -1. **fresh-context independent audit #23 of the v1.30 h-fragment +1. **fresh-context independent audit #24 of the v1.31 h-fragment claim** (verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index bce266c..ff8d8f5 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -3751,3 +3751,46 @@ SECOND live gate-line mismatch in two rounds (§1 at #23, §9 still at #22 — the batch edit covered one and not the other). Two catches in two opportunities since it replaced the twice-broken promise. The pack built clean after the fix. + +## 2026-08-10 — qALC kernel v1.31: the memo moves to where the work lives; the memos' true invariant named + +Audit #23 (fresh instance, sol tier, threadless) — the machine +unbroken a SEVENTH consecutive round; the v1.30 honesty repairs +confirmed, including a fourth observed cert_* behavior class (a +certificate subclass's __contains__ executing before a quiet +return) that the UNSPECIFIED wording already covers. The +findings, layer NINE: (1) VALUE-SHARING WITHOUT OBJECT-SHARING — +the auditor built n distinct lp shells around ONE shared +occurrence tuple: a Θ(n) object graph that pays Θ(n²) because +the id-memos see objects and the expensive work (walk, binder +scan, 'a'-count) is per-OCCURRENCE; 4× per doubling on rs, +K-storage, and slice-cargo variants, 389 ms at n=2,000. I had +memoized the wrapper instead of the work. (2) The full-lp memo's +"no optimistic leak" comment was LITERALLY FALSE — a tape→rs +interleaving stores a stale True in lpfull; the public verdict +stays ['W0'] because w0bad is monotone (the auditor verified no +public false acceptance), but the flattering per-entry claim was +never the invariant. + +v1.31, predictions written first — checker-only, fifth +consecutive: the OCCURRENCE MEMO (occ_required: all the +per-occurrence work computed once per occurrence object; total +pre-gate work Σ O(local size) over distinct objects; the +auditor's three families drop to ~2× doublings, rs 389 → 2.2 ms) +and the MEMO DOCTRINE stated honestly — per-entry truth is not +the invariant, AGGREGATE MONOTONICITY is: a stale-True entry +exists only because an earlier check in the same call already +OR'd w0bad to True, and the memos are per-call so nothing +crosses calls. Regression twenty-nine (the auditor's families in +the linear band, the stale-interleaving verdict pinned, the +fresh-call isolation control) gated; twenty-nine-for-twenty-nine +under forcing; suite/certify/typecheck/polarity byte-identical; +wf exactly one new line. One fixture bug caught IN-ROUND by its +own failing band: the regression's first draft built a fresh +occurrence per shell — a genuinely quadratic REPRESENTATION +whose quadratic time is correct behavior — and briefly blamed +the memo for it; the corrected fixture shares one occurrence +object exactly as the auditor's family does, and the wrong draft +is documented in the regression comment. Register, STATUS, +token.md updated; fresh audit #24 launched — the PASS re-claim +stays gated on it. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index b985901..c0e0bb6 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.30.** The kernel is a scratch superposition evolver +**Status: v1.31.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -17,7 +17,7 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #23**, whose +The standing PASS re-claim is **gated on fresh audit #24**, whose verdict will be registered here. Kernel-arm provenance is the chronicle's per-row "what changed" column — summaries of it have been refuted twice by literal diff (audit #13 killed "unmoved @@ -25,7 +25,25 @@ since v1.11"; audit #14 showed the corrected two-wave summary still omitted v1.12's ordinary-decode burial-suppression change and mislabeled v1.21's binder/transport arms as "leaf" guards) — so this register now names arms exactly and only per version: -v1.30 changes NO kernel source — the fourth consecutive +v1.31 changes NO kernel source — the fifth consecutive +checker-only round: audit #23 (machine unbroken a SEVENTH +round) built VALUE-SHARING WITHOUT OBJECT-SHARING — n distinct +lp shells around one shared occurrence tuple, Θ(n) graph, +quadratic time, because the per-lp id-memos see objects and the +expensive work is per-OCCURRENCE — and caught the full-lp +memo's "no optimistic leak" comment as literally false (a +tape→rs interleaving stores a stale True; the PUBLIC verdict +stays ['W0'] because w0bad is monotone — the auditor verified +no public false acceptance). v1.31: the OCCURRENCE MEMO — the +walk, binder scan, and 'a'-count computed once per occurrence +object, so total pre-gate work is Σ O(local size) over +distinct objects (the auditor's families drop 389 → 2.2 ms at +n=2,000, ~2× doublings) — and the MEMO DOCTRINE stated +honestly: per-entry truth is not the invariant; AGGREGATE +MONOTONICITY is (a stale-True entry exists only because an +earlier check in the same call already OR'd w0bad to True; the +memos are per-call so nothing crosses calls). Before that, +v1.30 changed NO kernel source — the fourth consecutive checker-only round, and the smallest: audit #22 (machine unbroken a SIXTH round; the reconciled boundary CONFIRMED by an independent family; all four v1.29 repairs individually linear) @@ -934,7 +952,7 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#23; the verdict will be registered here.** (Audit #16 caught +#24; the verdict will be registered here.** (Audit #16 caught this sentence stale; audit #19 caught it stale AGAIN despite the parenthetical promising otherwise — the promise is now an ASSERTION: the pack assembly script verifies §1 and §9 name the @@ -979,7 +997,7 @@ canonical dicts compared bit-for-bit; `dupcall` canonically None `h(Ω)` → None. Negative controls: pstar × wrong certificate reaches `pop-err`; dupcall × v1.7-era certificate reaches `refire`, all-err. WF/W7/W8/W9 sweeps + mechanized disjointness: -zero violations; **twenty-eight permanent regressions** (the v1.6 pair; +zero violations; **twenty-nine permanent regressions** (the v1.6 pair; extra-frame collision, W7-excluded with disjoint targets; doctored bundle divergence; K+frame alias; retained-Q disjointness — spectator-bit columns share zero targets; @@ -1055,7 +1073,10 @@ hostile-`__eq__`-in-d state W0-rejected with nothing executing, wf7 declining, and the n=8,000 valid deep-lp walk inside the linear band; composition linearity — the n-frames-one-lp family W0 at both sizes inside the linear band, with a distinct-lps -no-aliasing control). +no-aliasing control; occurrence-memo — the distinct-shells/ +shared-occurrence families inside the linear band, the +stale-interleaving verdict pinned ['W0'], and the fresh-call +isolation control). The gating structure, stated exactly (audits #6 and #7 each caught a computed-but-non-gating @@ -1085,13 +1106,17 @@ states with zero verdict differences; audit #22 confirmed twenty-seven-for-twenty-seven plus the fourteen components plus the three polarity-reading controls, the reconciled boundary on an independent family, and all four v1.29 repairs individually -linear): the v1.6 pair -gates `collisions_under_wf()`; the other twenty-six gate +linear) — audit #23 confirmed twenty-eight-for-twenty-eight plus the +fourteen components plus the three polarity readings, and the +v1.30 honesty repairs including a FOURTH observed cert_* +behavior class (a certificate subclass's __contains__ executing +before a quiet return) covered by the UNSPECIFIED wording: the v1.6 pair +gates `collisions_under_wf()`; the other twenty-seven gate `cert_sweep()`'s return; the module `__main__` conjoins all three sweeps in its printed total AND ITS EXIT CODE, so any single regression failure exits nonzero (measured: forcing the pair false → exit 1; forcing cert_sweep flags false → exit 1, -including the v1.20 through v1.30 flags; the +including the v1.20 through v1.31 flags; the emulated-old-arm probe flips `cert_sweep` to FAIL). Three v1.12/v1.13-era regression mechanizations were updated in v1.23 to the always-emit discipline (their targets now carry the @@ -1426,7 +1451,8 @@ no bare-term ideal oracle). | v1.27 | CHECKER-ONLY — zero kernel changes: exact-type state dispatch (a Run subclass is not a state of the machine; hostile attribute access never runs); pure() id-visited (representation-linear on shared DAGs); closed() a full TERM VALIDATOR (unknown node kinds rejected — garbage terms now W0, consistent with the v1.23 open-term decision; on-path cycle detection rejects cyclic graphs promptly; an (id,depth) memo makes shared term DAGs polynomial); wf7 declines out-of-language rs and non-tuple paths; §6's boundary RESTATED to the host's structural-operation limits — hash, equality, AND canonical-order repr, exactly the operations the machine's own state discipline performs — with the auditor's 8,000/2,000 measurements as its empirical face; §9's stale-gate promise replaced by an ASSEMBLE-SCRIPT ASSERTION (§1/§9 must name the same audit or the pack refuses to build); regression twenty-five gated, twenty-five-for-twenty-five under forcing; a second caught-in-implementation equivalence hazard registered pre-measurement (closed()'s memo order vs App-cycles, which re-enter at the SAME depth); suite/certify/typecheck/polarity byte-identical, wf exactly one new line; the layer-five harness joins the kit set | **fresh audit #20: FAIL** (the machine clean a FOURTH consecutive round — kernel.py verified BYTE-IDENTICAL, C2/C4/C5 in full with three polarity-reading mutations, and the structural-operation boundary SURVIVED its dedicated charge: equal-state probes at depths 1,000/2,000/4,000 clean, at 6,000 hash/equality/repr cross their host limits TOGETHER, no in-boundary state crashes a post-gate scan; the assemble assertion verified against a simulated mismatch; both implementation catches validated. The findings, totality LAYER SIX: hostile TERM subclasses still ran code inside wf — exact-type dispatch protected only the state; the GATE production was never validated — Gate('x') passed wf and broke W0-preservation one step later, Gate([]) crashed the machine on an unhashable name, isolated surgically by a 20,000-graph term differential with zero non-Gate mismatches; wf7 still raised on a hostile subclass, a list inside the path tuple, and a list in the arrival tail — "declines out-of-language sources" was false as written; and the (id, depth) term memo was Θ(n²) on App/Lam chains — 800 objects, 640,800 validator states — where the register said representation-linear) | | v1.28 | CHECKER-ONLY again — zero kernel changes: closed() REPLACED by the linear MAX-FREE validator (exact-type node dispatch — the type check precedes every field access, so hostile term subclasses never execute; Gate names validated in {'h','t'} — the production the language always required; Var indices exact-int ≥ 1; closedness = max_free(root) == 0 by iterative post-order with ONE memo entry per node id — measured n=3,000 chains in 2 ms vs 300 ms at n=800 under the old memo, "representation-linear" now TRUE as originally worded rather than weakened; on-path cycle rejection kept), run as an EARLY GATE before any token processing (under v1.27 the rs/ks loops ran even after term failure, so a hostile term could still execute during token checks); wf7 exact-type dispatched and gated by the total wf() itself; regression twenty-six gated, twenty-six-for-twenty-six under forcing; suite/certify/typecheck/polarity byte-identical, wf exactly one new line; two wrong calls registered — the layer6 kit does not "flip to healed" but CRASHES BY CONSTRUCTION (it asserts the broken Gate behavior; the v121 lesson re-learned), and the certified-fibre control was first mis-specified (the synthetic cert's fibre map is empty, so W7-domain is the correct preserved verdict — the control now proves a WF source REACHES the fibre logic through the gate) | **fresh audit #21: FAIL** (the machine clean a FIFTH consecutive round — kernel.py SHA-verified byte-identical, C2/C4/C5 in full; the max-free validator itself SURVIVED: 50,000 randomized graphs incl. 5,349 cycle mutations against an independent reference, zero mismatches; hostile terms/Gate payloads/string subclasses/Var(True) all W0-rejected; chains, ladders, and complete-sharing DAGs measured linear; wf7 old-vs-new over 5,508 reachable states, zero verdict differences. The findings, totality LAYER SEVEN: the five register ROOTS never type-checked — pure(0) True since an int is a valid pure LEAF, so scalar roots crashed the container iteration; d omitted from purity — a hostile __eq__ executed at the membership check; wf7 inheriting both; the binder walk's p[:-1] copying Θ(n²) on a fully VALID deep-lp state; and the register CONTRADICTING ITSELF about the boundary — §10/status's "cross together at 6,000" did not replicate: hash clean through depth 32,000 on the nested-lp family while equality/repr fail at 6,000, siding with §6's "the limits differ"; plus the instrument-helper scope needing explicit statement) | | v1.29 | CHECKER-ONLY, third consecutive: the five register ROOTS join the purity gate as exact tuples and d as an exact str (scalar roots and hostile-__eq__ d objects → ['W0'] before any iteration or comparison); the binder walk goes INDEX-BASED (no copies; the slice requirement = count of 'a'-components past the binder; measured linear — n=8,000 in 2.9 ms at 7.8× the n=1,000 time, was 21 ms at ~27×); the boundary narrative RECONCILED (the "cross together" coincidence retracted in §6/§10; the limits differ family-dependently, the boundary is their per-family minimum, the twice-confirmed claim is the one-way statement); §6 gains the INSTRUMENT-INPUT SCOPE sentence (wf/wf7 are the raw-total state surface; cert_* helpers trust their term/cert arguments); regression twenty-seven gated, twenty-seven-for-twenty-seven under forcing; suite/certify/typecheck/polarity byte-identical, wf exactly one new line; one declared drift registered (the predictions sketched a 16× timing band, the code uses 24× — both far under quadratic's ~64×, measured 7.8×) | **fresh audit #22: FAIL** (the machine unbroken a SIXTH consecutive round; the RECONCILED BOUNDARY CONFIRMED — an independent slice-nested family reproduces the §6 table, status/§6/§10 verified to agree, residual "cross together" text verified historical-only; the instrument scope verified structurally correct; all four v1.29 repairs individually LINEAR. The findings, layer EIGHT: the COMPOSITION is Θ(n²) — n frames sharing one valid deep lp, 4× per doubling, because w0lp_shape rescans the occurrence before w0tok consults the memo, so "the lpmemo makes it once per lp" was false for standalone rs/ks checks; §6's "a garbage term crashes them" too categorical — the cert_* helpers on object() QUIETLY RETURN meaningless values; and one generously-graded prediction — v129's outcome 1 marked "byte-identical conservation" HELD while the captures differ in the timing suffix: the caveat explains the bytes, it does not make the literal prediction true) | -| v1.30 | CHECKER-ONLY, fourth consecutive, the smallest round: the FULL-LP id-memo in w0lp (shape+closure verified once per lp object, stored only after both conjuncts complete — no optimistic leak; the auditor's family drops 191 ms → 1.4 ms at n=2,000, linear, ~135×; regression twenty-eight measures exactly that family plus a distinct-lps no-aliasing control); §6's scope sentence reworded to UNSPECIFIED with the quiet-return examples registered; the v1.29 conservation-suffix prediction MARKED AS A MISS in its own outcomes appendix (grading it HELD was generous — the predictions discipline exists precisely so the author cannot grade their own homework); twenty-eight-for-twenty-eight under forcing; suite/certify/typecheck/polarity byte-identical, wf exactly one new line | **fresh audit #23: pending** | +| v1.30 | CHECKER-ONLY, fourth consecutive, the smallest round: the FULL-LP id-memo in w0lp (shape+closure verified once per lp object, stored only after both conjuncts complete — no optimistic leak; the auditor's family drops 191 ms → 1.4 ms at n=2,000, linear, ~135×; regression twenty-eight measures exactly that family plus a distinct-lps no-aliasing control); §6's scope sentence reworded to UNSPECIFIED with the quiet-return examples registered; the v1.29 conservation-suffix prediction MARKED AS A MISS in its own outcomes appendix (grading it HELD was generous — the predictions discipline exists precisely so the author cannot grade their own homework); twenty-eight-for-twenty-eight under forcing; suite/certify/typecheck/polarity byte-identical, wf exactly one new line | **fresh audit #23: FAIL** (the machine unbroken a SEVENTH consecutive round; the v1.30 honesty repairs CONFIRMED incl. a fourth cert_* behavior class covered by UNSPECIFIED; 28/28 + 14/14 + 3/3 forcings; fresh corpus zero-hit. The findings, layer NINE: VALUE-SHARING WITHOUT OBJECT-SHARING — n distinct lp shells around one shared occurrence tuple, Θ(n) graph, 4× per doubling on rs/K-storage/slice-cargo variants, because the id-memos see objects and the expensive work is per-occurrence; and the full-lp memo's "no optimistic leak" comment LITERALLY FALSE — a tape→rs interleaving stores a stale True in lpfull, with the public verdict verified safe via w0bad's monotonicity) | +| v1.31 | CHECKER-ONLY, fifth consecutive: the OCCURRENCE MEMO (occ_required — walk + binder scan + 'a'-count once per occurrence OBJECT; total pre-gate work Σ O(local) over distinct objects; the auditor's three families drop to ~2× doublings, rs 389 → 2.2 ms at n=2,000); the MEMO DOCTRINE stated honestly (per-entry truth is NOT the invariant — aggregate monotonicity is: a stale-True exists only because an earlier check in the same call already OR'd w0bad True; memos per-call, nothing crosses calls); regression twenty-nine (the auditor's families in the linear band + the stale-interleaving verdict + the fresh-call isolation control) gated, twenty-nine-for-twenty-nine under forcing; one fixture bug caught IN-ROUND by the band failing (the first draft built a fresh occurrence per shell — a genuinely quadratic REPRESENTATION whose quadratic time is correct; the auditor's family shares one object; the wrong draft documented in the regression comment); suite/certify/typecheck/polarity byte-identical, wf exactly one new line | **fresh audit #24: pending** | ## 12. Appendix — HH step-indexed trace diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index 68dfcba..6c067f4 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -398,7 +398,7 @@ register alone carries the version). | Item | Status | |---|---| -| Kernel | **v1.30** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (W0 = the SORTED state language with exact-type PURITY as of v1.24 — registers exact tuples of exact tuples/str/int checked without hashing, exact-int bits, recursive lp productions satisfying the lambda-IAM slice equation with occurrences resolving to bound Vars (1-indexed; Var(0) refused) of the closed term, the log's lp-like alphabet, arrival-lp K(l) cargo, the KA production, coordinates in language — plus W1-W9, with W4 closed by enumeration and §7.4's storage prefix-freeness now the ALL-ARMS one-head-per-fire discipline: audit #15's empty-bundle collision and audit #16's suppressed-decode/retain-whole forgery were the certified and uncertified instances of the same defect — every fire arm appends exactly one arm-typed head (KD / K3 / KA / K2), each healed with every covered output byte-identical); wf() total on the raw-object layer via the W0 gate with exact-type dispatch for states AND term nodes, exact-tuple register roots and exact-str d, the linear max-free term validator (Gate production validated; cycle detection; garbage terms rejected; one memo entry per node), and every traversal iterative, pre-gate hash-free, and representation-linear incl. the index-based binder walk (v1.29 — W1-W9 adjudicated only over the language's carrier; wf7 gated by wf itself; past the gate the host's structural-operation boundary — hash, equality, canonical-order repr, whose limits DIFFER family-dependently with the one-way no-crash statement twice confirmed; cert_* helpers scoped as instrument-input surface); the species guards, the alien-gate foreign-ticket guard, and the t scope fence typed (fifteen guards); the ten-mark gauge sweep pins w(KA)=0 via the disclosed raw suppressed edge (4/1024, with the 8/1024 reachable-only reading printed beside it — audit #18 proved the pinning arm-intrinsic); twenty-eight permanent regressions, all gating (incl. composition linearity — the full-lp memo); all six instruments carry exit-code verdicts; kernel-arm history lives in the register's §11 rows. **PASS re-claim gated on fresh audit #23** | +| Kernel | **v1.31** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (W0 = the SORTED state language with exact-type PURITY as of v1.24 — registers exact tuples of exact tuples/str/int checked without hashing, exact-int bits, recursive lp productions satisfying the lambda-IAM slice equation with occurrences resolving to bound Vars (1-indexed; Var(0) refused) of the closed term, the log's lp-like alphabet, arrival-lp K(l) cargo, the KA production, coordinates in language — plus W1-W9, with W4 closed by enumeration and §7.4's storage prefix-freeness now the ALL-ARMS one-head-per-fire discipline: audit #15's empty-bundle collision and audit #16's suppressed-decode/retain-whole forgery were the certified and uncertified instances of the same defect — every fire arm appends exactly one arm-typed head (KD / K3 / KA / K2), each healed with every covered output byte-identical); wf() total on the raw-object layer via the W0 gate with exact-type dispatch for states AND term nodes, exact-tuple register roots and exact-str d, the linear max-free term validator (Gate production validated; cycle detection; garbage terms rejected; one memo entry per node), and every traversal iterative, pre-gate hash-free, and representation-linear incl. the index-based binder walk (v1.29 — W1-W9 adjudicated only over the language's carrier; wf7 gated by wf itself; past the gate the host's structural-operation boundary — hash, equality, canonical-order repr, whose limits DIFFER family-dependently with the one-way no-crash statement twice confirmed; cert_* helpers scoped as instrument-input surface); the species guards, the alien-gate foreign-ticket guard, and the t scope fence typed (fifteen guards); the ten-mark gauge sweep pins w(KA)=0 via the disclosed raw suppressed edge (4/1024, with the 8/1024 reachable-only reading printed beside it — audit #18 proved the pinning arm-intrinsic); twenty-nine permanent regressions, all gating (incl. composition linearity via the full-lp and occurrence memos, whose honest invariant is aggregate monotonicity); all six instruments carry exit-code verdicts; kernel-arm history lives in the register's §11 rows. **PASS re-claim gated on fresh audit #24** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §5): the fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is the hybrid validation — structural admission/isometry plus exact-amplitude dynamic cleanliness plus non-vacuity, strictly beyond Gram (negative controls caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and **self-validating**: every admitted map passes full semantic coverage, else None | From 9a882c77e8930a193d9f19d9ce23b4fec8498f45 Mon Sep 17 00:00:00 2001 From: a9lim Date: Mon, 10 Aug 2026 03:13:16 -0400 Subject: [PATCH 056/107] =?UTF-8?q?qalc:=20kernel=20v1.32=20=E2=80=94=20ex?= =?UTF-8?q?tend-once-per-slice;=20the=20KD=20sibling=20preempted;=20audit?= =?UTF-8?q?=20#24=20registered?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #24 (cx-20260810-024204-8e56) — machine unbroken an eighth round, and the memo doctrine CONFIRMED BY STATIC ENUMERATION (no public False→True escape exists). Layer ten: shared-slice traversal re-pushed per reference (Θ(n²) on a Θ(n) graph), plus a regression-coverage overstatement. v1.32 — checker-only, sixth consecutive: extend-once-per-slice (soundness riding the statically-confirmed doctrine; 206ms → 2.3ms at n=1600); the KD-keys sibling preempted self-derived (kdmemo, both verdicts stored); regression 30 times all shared-substructure families on the auditor's exact term shape; the coverage wording corrected and the overstatement registered. 30/30 forced-exit-1; four instruments byte-identical. Fresh audit #25 launched; PASS re-claim gated on it. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 28 +++++++++++++-------- docs/ledger/2026-08.md | 34 +++++++++++++++++++++++++ docs/quantum-algebraic/kernel.md | 43 ++++++++++++++++++++++++-------- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 85 insertions(+), 22 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 5487803..bebf80d 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,10 +413,10 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.31** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.32** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after -twenty-three fresh-context rounds. Kernel-arm provenance summaries +twenty-four fresh-context rounds. Kernel-arm provenance summaries have been refuted by literal diff twice (audit #13 killed "unmoved since v1.11"; audit #14 showed the corrected summary still incomplete), so the register now names arms per version @@ -605,10 +605,17 @@ but the flattering per-entry claim was not the invariant). v1.31 (checker-only, fifth consecutive): the occurrence memo — the work memoized where the sharing is (389 → 2.2 ms) — and the memo doctrine stated honestly as aggregate monotonicity. -What +Audit #24 then CONFIRMED that doctrine by static enumeration +(no public escape exists) and found layer TEN: shared-slice +traversal re-pushed per reference, plus a regression-coverage +overstatement. v1.32 (checker-only, sixth consecutive): +extend-once-per-slice riding the confirmed doctrine +(206 → 2.3 ms), the KD-keys sibling preempted self-derived, +all shared-substructure families timed, the coverage wording +corrected. What the rounds still found was claim-language and scaffolding, each fixed the same -day: all twenty-nine permanent regressions now gate mechanically (the +day: all thirty permanent regressions now gate mechanically (the module verdict is the exit code — forcing any single regression false exits nonzero, measured); `validate()` gained NON-VACUITY at both levels (an entry at an unreachable position and a ghost @@ -624,16 +631,15 @@ minimal; physics table passes on all twenty; all prior audit kits rerun with every delta adjudicated (ks-display relabels under always-emit and the KA head; the W0-gate display collapses; matrix-coverage shrink under the tightened language; -the healed-countermodel crash); every v1.31 prediction held, -with one fixture bug caught in-round by its own failing band — -the first draft measured a genuinely-quadratic representation -and called it the memo's fault; the corrected fixture shares -the occurrence object as the auditor's family does (provenance -in the scratchpad prediction files). +the healed-countermodel crash); every v1.32 prediction held, +with the round's honesty item being the corrected +regression-coverage wording — regression 29's real coverage +stated exactly and superseded by regression 30's timed +families (provenance in the scratchpad prediction files). The open docket, in order: -1. **fresh-context independent audit #24 of the v1.31 h-fragment +1. **fresh-context independent audit #25 of the v1.32 h-fragment claim** (verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index ff8d8f5..86f1b12 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -3794,3 +3794,37 @@ object exactly as the auditor's family does, and the wrong draft is documented in the regression comment. Register, STATUS, token.md updated; fresh audit #24 launched — the PASS re-claim stays gated on it. + +## 2026-08-10 — qALC kernel v1.32: traversal joins the memo discipline; the KD sibling preempted; coverage said exactly + +Audit #24 (fresh instance, sol tier, threadless) — the machine +unbroken an EIGHTH consecutive round, and the memo doctrine I +was forced to write two rounds ago CONFIRMED BY STATIC +ENUMERATION: every w0lp/w0tok call site verified inside wf, all +memos function-local, every first failing traversal flowing into +monotone w0bad — "no public False→True escape exists in the +current source." The auditors are now verifying my honesty +repairs as theorems. The findings, layer TEN: shared-slice +traversal — n distinct shells sharing one n-entry slice tuple +re-push its elements per shell (each element an O(1) memo hit; +the pushing is per-reference), Θ(n²) on a Θ(n) graph, 206 ms at +n=1,600; and a regression-coverage overstatement — regression +29 timed only the rs family while the register said "exactly +the auditor's three families." + +v1.32, predictions written first — checker-only, sixth +consecutive: EXTEND-ONCE-PER-SLICE (a per-call id-set; the call +that first extends a slice either drains it fully or fails with +w0bad already set — soundness riding exactly the doctrine the +auditor just blessed; the family drops 206 → 2.3 ms); the +KD-KEYS SIBLING PREEMPTED self-derived rather than waiting for +layer eleven (n KD entries sharing one keys tuple — kdmemo, +both verdicts stored so shared-bad tuples still flag); and the +coverage wording corrected with the overstatement registered. +Regression thirty times the shared-slice rs/K-storage and +shared-KD-keys families on the auditor's exact term shape; +thirty-for-thirty under forcing; suite/certify/typecheck/ +polarity byte-identical; wf exactly one new line; corpus, +census, kits at their adjudicated readings. Register, STATUS, +token.md updated; fresh audit #25 launched — the PASS re-claim +stays gated on it. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index c0e0bb6..685a32e 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.31.** The kernel is a scratch superposition evolver +**Status: v1.32.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -17,7 +17,7 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #24**, whose +The standing PASS re-claim is **gated on fresh audit #25**, whose verdict will be registered here. Kernel-arm provenance is the chronicle's per-row "what changed" column — summaries of it have been refuted twice by literal diff (audit #13 killed "unmoved @@ -25,7 +25,25 @@ since v1.11"; audit #14 showed the corrected two-wave summary still omitted v1.12's ordinary-decode burial-suppression change and mislabeled v1.21's binder/transport arms as "leaf" guards) — so this register now names arms exactly and only per version: -v1.31 changes NO kernel source — the fifth consecutive +v1.32 changes NO kernel source — the sixth consecutive +checker-only round: audit #24 (machine unbroken an EIGHTH round; +AGGREGATE MONOTONICITY CONFIRMED BY STATIC ENUMERATION — every +w0lp/w0tok call site inside wf, all memos function-local, every +first failure flowing into monotone w0bad, "no public +False→True escape exists") found layer TEN: SHARED-SLICE +TRAVERSAL — n distinct shells sharing one n-entry slice tuple +re-push its elements per shell (each an O(1) memo hit, n pushes +× n shells = Θ(n²), 206 ms at n=1,600) — and a regression- +coverage OVERSTATEMENT (regression 29 timed only the rs family +while the register said "exactly the auditor's three +families"). v1.32: EXTEND-ONCE-PER-SLICE (a per-call id-set; +soundness rides the statically-confirmed monotonicity +doctrine), the KD-KEYS SIBLING PREEMPTED self-derived (n KD +entries sharing one keys tuple — id-memoized, both verdicts +stored), regression thirty timing all the shared-substructure +families on the auditor's exact term shape, and the coverage +wording corrected with the overstatement registered. Before +that, v1.31 changed NO kernel source — the fifth consecutive checker-only round: audit #23 (machine unbroken a SEVENTH round) built VALUE-SHARING WITHOUT OBJECT-SHARING — n distinct lp shells around one shared occurrence tuple, Θ(n) graph, @@ -952,7 +970,7 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#24; the verdict will be registered here.** (Audit #16 caught +#25; the verdict will be registered here.** (Audit #16 caught this sentence stale; audit #19 caught it stale AGAIN despite the parenthetical promising otherwise — the promise is now an ASSERTION: the pack assembly script verifies §1 and §9 name the @@ -997,7 +1015,7 @@ canonical dicts compared bit-for-bit; `dupcall` canonically None `h(Ω)` → None. Negative controls: pstar × wrong certificate reaches `pop-err`; dupcall × v1.7-era certificate reaches `refire`, all-err. WF/W7/W8/W9 sweeps + mechanized disjointness: -zero violations; **twenty-nine permanent regressions** (the v1.6 pair; +zero violations; **thirty permanent regressions** (the v1.6 pair; extra-frame collision, W7-excluded with disjoint targets; doctored bundle divergence; K+frame alias; retained-Q disjointness — spectator-bit columns share zero targets; @@ -1076,7 +1094,9 @@ W0 at both sizes inside the linear band, with a distinct-lps no-aliasing control; occurrence-memo — the distinct-shells/ shared-occurrence families inside the linear band, the stale-interleaving verdict pinned ['W0'], and the fresh-call -isolation control). +isolation control; shared-substructure — the shared-slice +rs/K-storage families and the shared-KD-keys family W0 inside +the linear band on the auditor's exact term shape). The gating structure, stated exactly (audits #6 and #7 each caught a computed-but-non-gating @@ -1110,13 +1130,15 @@ linear) — audit #23 confirmed twenty-eight-for-twenty-eight plus the fourteen components plus the three polarity readings, and the v1.30 honesty repairs including a FOURTH observed cert_* behavior class (a certificate subclass's __contains__ executing -before a quiet return) covered by the UNSPECIFIED wording: the v1.6 pair -gates `collisions_under_wf()`; the other twenty-seven gate +before a quiet return) covered by the UNSPECIFIED wording — audit #24 confirmed twenty-nine-for-twenty-nine plus the +fourteen components plus the three polarity readings, and +CONFIRMED the memo doctrine by static enumeration: the v1.6 pair +gates `collisions_under_wf()`; the other twenty-eight gate `cert_sweep()`'s return; the module `__main__` conjoins all three sweeps in its printed total AND ITS EXIT CODE, so any single regression failure exits nonzero (measured: forcing the pair false → exit 1; forcing cert_sweep flags false → exit 1, -including the v1.20 through v1.31 flags; the +including the v1.20 through v1.32 flags; the emulated-old-arm probe flips `cert_sweep` to FAIL). Three v1.12/v1.13-era regression mechanizations were updated in v1.23 to the always-emit discipline (their targets now carry the @@ -1452,7 +1474,8 @@ no bare-term ideal oracle). | v1.28 | CHECKER-ONLY again — zero kernel changes: closed() REPLACED by the linear MAX-FREE validator (exact-type node dispatch — the type check precedes every field access, so hostile term subclasses never execute; Gate names validated in {'h','t'} — the production the language always required; Var indices exact-int ≥ 1; closedness = max_free(root) == 0 by iterative post-order with ONE memo entry per node id — measured n=3,000 chains in 2 ms vs 300 ms at n=800 under the old memo, "representation-linear" now TRUE as originally worded rather than weakened; on-path cycle rejection kept), run as an EARLY GATE before any token processing (under v1.27 the rs/ks loops ran even after term failure, so a hostile term could still execute during token checks); wf7 exact-type dispatched and gated by the total wf() itself; regression twenty-six gated, twenty-six-for-twenty-six under forcing; suite/certify/typecheck/polarity byte-identical, wf exactly one new line; two wrong calls registered — the layer6 kit does not "flip to healed" but CRASHES BY CONSTRUCTION (it asserts the broken Gate behavior; the v121 lesson re-learned), and the certified-fibre control was first mis-specified (the synthetic cert's fibre map is empty, so W7-domain is the correct preserved verdict — the control now proves a WF source REACHES the fibre logic through the gate) | **fresh audit #21: FAIL** (the machine clean a FIFTH consecutive round — kernel.py SHA-verified byte-identical, C2/C4/C5 in full; the max-free validator itself SURVIVED: 50,000 randomized graphs incl. 5,349 cycle mutations against an independent reference, zero mismatches; hostile terms/Gate payloads/string subclasses/Var(True) all W0-rejected; chains, ladders, and complete-sharing DAGs measured linear; wf7 old-vs-new over 5,508 reachable states, zero verdict differences. The findings, totality LAYER SEVEN: the five register ROOTS never type-checked — pure(0) True since an int is a valid pure LEAF, so scalar roots crashed the container iteration; d omitted from purity — a hostile __eq__ executed at the membership check; wf7 inheriting both; the binder walk's p[:-1] copying Θ(n²) on a fully VALID deep-lp state; and the register CONTRADICTING ITSELF about the boundary — §10/status's "cross together at 6,000" did not replicate: hash clean through depth 32,000 on the nested-lp family while equality/repr fail at 6,000, siding with §6's "the limits differ"; plus the instrument-helper scope needing explicit statement) | | v1.29 | CHECKER-ONLY, third consecutive: the five register ROOTS join the purity gate as exact tuples and d as an exact str (scalar roots and hostile-__eq__ d objects → ['W0'] before any iteration or comparison); the binder walk goes INDEX-BASED (no copies; the slice requirement = count of 'a'-components past the binder; measured linear — n=8,000 in 2.9 ms at 7.8× the n=1,000 time, was 21 ms at ~27×); the boundary narrative RECONCILED (the "cross together" coincidence retracted in §6/§10; the limits differ family-dependently, the boundary is their per-family minimum, the twice-confirmed claim is the one-way statement); §6 gains the INSTRUMENT-INPUT SCOPE sentence (wf/wf7 are the raw-total state surface; cert_* helpers trust their term/cert arguments); regression twenty-seven gated, twenty-seven-for-twenty-seven under forcing; suite/certify/typecheck/polarity byte-identical, wf exactly one new line; one declared drift registered (the predictions sketched a 16× timing band, the code uses 24× — both far under quadratic's ~64×, measured 7.8×) | **fresh audit #22: FAIL** (the machine unbroken a SIXTH consecutive round; the RECONCILED BOUNDARY CONFIRMED — an independent slice-nested family reproduces the §6 table, status/§6/§10 verified to agree, residual "cross together" text verified historical-only; the instrument scope verified structurally correct; all four v1.29 repairs individually LINEAR. The findings, layer EIGHT: the COMPOSITION is Θ(n²) — n frames sharing one valid deep lp, 4× per doubling, because w0lp_shape rescans the occurrence before w0tok consults the memo, so "the lpmemo makes it once per lp" was false for standalone rs/ks checks; §6's "a garbage term crashes them" too categorical — the cert_* helpers on object() QUIETLY RETURN meaningless values; and one generously-graded prediction — v129's outcome 1 marked "byte-identical conservation" HELD while the captures differ in the timing suffix: the caveat explains the bytes, it does not make the literal prediction true) | | v1.30 | CHECKER-ONLY, fourth consecutive, the smallest round: the FULL-LP id-memo in w0lp (shape+closure verified once per lp object, stored only after both conjuncts complete — no optimistic leak; the auditor's family drops 191 ms → 1.4 ms at n=2,000, linear, ~135×; regression twenty-eight measures exactly that family plus a distinct-lps no-aliasing control); §6's scope sentence reworded to UNSPECIFIED with the quiet-return examples registered; the v1.29 conservation-suffix prediction MARKED AS A MISS in its own outcomes appendix (grading it HELD was generous — the predictions discipline exists precisely so the author cannot grade their own homework); twenty-eight-for-twenty-eight under forcing; suite/certify/typecheck/polarity byte-identical, wf exactly one new line | **fresh audit #23: FAIL** (the machine unbroken a SEVENTH consecutive round; the v1.30 honesty repairs CONFIRMED incl. a fourth cert_* behavior class covered by UNSPECIFIED; 28/28 + 14/14 + 3/3 forcings; fresh corpus zero-hit. The findings, layer NINE: VALUE-SHARING WITHOUT OBJECT-SHARING — n distinct lp shells around one shared occurrence tuple, Θ(n) graph, 4× per doubling on rs/K-storage/slice-cargo variants, because the id-memos see objects and the expensive work is per-occurrence; and the full-lp memo's "no optimistic leak" comment LITERALLY FALSE — a tape→rs interleaving stores a stale True in lpfull, with the public verdict verified safe via w0bad's monotonicity) | -| v1.31 | CHECKER-ONLY, fifth consecutive: the OCCURRENCE MEMO (occ_required — walk + binder scan + 'a'-count once per occurrence OBJECT; total pre-gate work Σ O(local) over distinct objects; the auditor's three families drop to ~2× doublings, rs 389 → 2.2 ms at n=2,000); the MEMO DOCTRINE stated honestly (per-entry truth is NOT the invariant — aggregate monotonicity is: a stale-True exists only because an earlier check in the same call already OR'd w0bad True; memos per-call, nothing crosses calls); regression twenty-nine (the auditor's families in the linear band + the stale-interleaving verdict + the fresh-call isolation control) gated, twenty-nine-for-twenty-nine under forcing; one fixture bug caught IN-ROUND by the band failing (the first draft built a fresh occurrence per shell — a genuinely quadratic REPRESENTATION whose quadratic time is correct; the auditor's family shares one object; the wrong draft documented in the regression comment); suite/certify/typecheck/polarity byte-identical, wf exactly one new line | **fresh audit #24: pending** | +| v1.31 | CHECKER-ONLY, fifth consecutive: the OCCURRENCE MEMO (occ_required — walk + binder scan + 'a'-count once per occurrence OBJECT; total pre-gate work Σ O(local) over distinct objects; the auditor's three families drop to ~2× doublings, rs 389 → 2.2 ms at n=2,000); the MEMO DOCTRINE stated honestly (per-entry truth is NOT the invariant — aggregate monotonicity is: a stale-True exists only because an earlier check in the same call already OR'd w0bad True; memos per-call, nothing crosses calls); regression twenty-nine (the auditor's families in the linear band + the stale-interleaving verdict + the fresh-call isolation control) gated, twenty-nine-for-twenty-nine under forcing; one fixture bug caught IN-ROUND by the band failing (the first draft built a fresh occurrence per shell — a genuinely quadratic REPRESENTATION whose quadratic time is correct; the auditor's family shares one object; the wrong draft documented in the regression comment); suite/certify/typecheck/polarity byte-identical, wf exactly one new line | **fresh audit #24: FAIL** (the machine unbroken an EIGHTH consecutive round; AGGREGATE MONOTONICITY CONFIRMED BY STATIC ENUMERATION — all memo call sites inside wf, function-local, every first failure flowing into monotone w0bad, no public escape; 29/29 + 14/14 + 3/3 forcings; fresh corpus zero-hit; the fixture-bug disclosure and 24× band verified honest. The findings, layer TEN: SHARED-SLICE TRAVERSAL unmemoized — n distinct shells sharing one n-entry slice re-push its elements per shell, Θ(n²) on a Θ(n) graph, 3.9× per doubling; and the regression-29 coverage OVERSTATED — rs timed, K-storage verdict-only, slice-cargo absent, against "exactly the auditor's three families" in the register) | +| v1.32 | CHECKER-ONLY, sixth consecutive: EXTEND-ONCE-PER-SLICE (a per-call seen_slices id-set in the closure sweep — the call that first extends a slice either drains it fully or fails with w0bad already set, the doctrine audit #24 just confirmed statically; the auditor's family drops 206 → 2.3 ms at n=1,600); the KD-KEYS SIBLING PREEMPTED before any auditor found it (n KD entries sharing one keys tuple — kdmemo, both verdicts stored so shared-bad tuples still flag); regression thirty times the shared-slice rs/K-storage and shared-KD-keys families on the auditor's exact term shape, thirty-for-thirty under forcing; the regression-29 coverage wording corrected and the overstatement registered; suite/certify/typecheck/polarity byte-identical, wf exactly one new line | **fresh audit #25: pending** | ## 12. Appendix — HH step-indexed trace diff --git a/docs/quantum-algebraic/token.md b/docs/quantum-algebraic/token.md index 6c067f4..abde489 100644 --- a/docs/quantum-algebraic/token.md +++ b/docs/quantum-algebraic/token.md @@ -398,7 +398,7 @@ register alone carries the version). | Item | Status | |---|---| -| Kernel | **v1.31** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (W0 = the SORTED state language with exact-type PURITY as of v1.24 — registers exact tuples of exact tuples/str/int checked without hashing, exact-int bits, recursive lp productions satisfying the lambda-IAM slice equation with occurrences resolving to bound Vars (1-indexed; Var(0) refused) of the closed term, the log's lp-like alphabet, arrival-lp K(l) cargo, the KA production, coordinates in language — plus W1-W9, with W4 closed by enumeration and §7.4's storage prefix-freeness now the ALL-ARMS one-head-per-fire discipline: audit #15's empty-bundle collision and audit #16's suppressed-decode/retain-whole forgery were the certified and uncertified instances of the same defect — every fire arm appends exactly one arm-typed head (KD / K3 / KA / K2), each healed with every covered output byte-identical); wf() total on the raw-object layer via the W0 gate with exact-type dispatch for states AND term nodes, exact-tuple register roots and exact-str d, the linear max-free term validator (Gate production validated; cycle detection; garbage terms rejected; one memo entry per node), and every traversal iterative, pre-gate hash-free, and representation-linear incl. the index-based binder walk (v1.29 — W1-W9 adjudicated only over the language's carrier; wf7 gated by wf itself; past the gate the host's structural-operation boundary — hash, equality, canonical-order repr, whose limits DIFFER family-dependently with the one-way no-crash statement twice confirmed; cert_* helpers scoped as instrument-input surface); the species guards, the alien-gate foreign-ticket guard, and the t scope fence typed (fifteen guards); the ten-mark gauge sweep pins w(KA)=0 via the disclosed raw suppressed edge (4/1024, with the 8/1024 reachable-only reading printed beside it — audit #18 proved the pinning arm-intrinsic); twenty-nine permanent regressions, all gating (incl. composition linearity via the full-lp and occurrence memos, whose honest invariant is aggregate monotonicity); all six instruments carry exit-code verdicts; kernel-arm history lives in the register's §11 rows. **PASS re-claim gated on fresh audit #24** | +| Kernel | **v1.32** (`kernel.md`, current-only): the hybrid pipeline — structural admission/isometry mandatory, exact-amplitude dynamic cleanliness deciding run success — with INSTANCE-DIRECTED certificates; the KD bundle names only keys with no surviving bit-carrying representation ANYWHERE in the target (Q frames, burials, T/log-riding tickets — CONFIRMED-SOUND by audits #6–#9: exhaustive storage enumeration, extended matrices, 24- and 33-combination crosses). `W` healed at {1̂: 1} (audits 3–11 confirmed, refire amplitudes verified zero per-step); phase-3 greedy rescue over the full candidate pool certifies `palpha` (guard-silent, marginal hand-confirmed); non-vacuous coverage at position and key level (unreachable entries and ghost popkeys refused); nineteen exact dict certificates + dupcall's canonical None; canonical = deterministic validation-adjudicated greedy, neither maximal nor minimal; ten-invariant WF (W0 = the SORTED state language with exact-type PURITY as of v1.24 — registers exact tuples of exact tuples/str/int checked without hashing, exact-int bits, recursive lp productions satisfying the lambda-IAM slice equation with occurrences resolving to bound Vars (1-indexed; Var(0) refused) of the closed term, the log's lp-like alphabet, arrival-lp K(l) cargo, the KA production, coordinates in language — plus W1-W9, with W4 closed by enumeration and §7.4's storage prefix-freeness now the ALL-ARMS one-head-per-fire discipline: audit #15's empty-bundle collision and audit #16's suppressed-decode/retain-whole forgery were the certified and uncertified instances of the same defect — every fire arm appends exactly one arm-typed head (KD / K3 / KA / K2), each healed with every covered output byte-identical); wf() total on the raw-object layer via the W0 gate with exact-type dispatch for states AND term nodes, exact-tuple register roots and exact-str d, the linear max-free term validator (Gate production validated; cycle detection; garbage terms rejected; one memo entry per node), and every traversal iterative, pre-gate hash-free, and representation-linear incl. the index-based binder walk (v1.29 — W1-W9 adjudicated only over the language's carrier; wf7 gated by wf itself; past the gate the host's structural-operation boundary — hash, equality, canonical-order repr, whose limits DIFFER family-dependently with the one-way no-crash statement twice confirmed; cert_* helpers scoped as instrument-input surface); the species guards, the alien-gate foreign-ticket guard, and the t scope fence typed (fifteen guards); the ten-mark gauge sweep pins w(KA)=0 via the disclosed raw suppressed edge (4/1024, with the 8/1024 reachable-only reading printed beside it — audit #18 proved the pinning arm-intrinsic); thirty permanent regressions, all gating (incl. composition linearity via the full-lp, occurrence, slice, and KD-keys memos, whose honest invariant — aggregate monotonicity — audit #24 confirmed by static enumeration); all six instruments carry exit-code verdicts; kernel-arm history lives in the register's §11 rows. **PASS re-claim gated on fresh audit #25** | | α/γ transport totality | **restored** — the `replay` rule (fresh re-seek off the instance's frame, derived from the literal visit-3 trace); the whole eleven-program battery runs total | | Transparency criterion | **discharged through the ratified encoded-fibre amendment** (architecture §7; `kernel.md` §5): the fire decodes conservatively by default and erases only at certified boundaries under the corrected fibre condition (retained `(slot, T, log)` determines erased `(l, RS)`); validity is the hybrid validation — structural admission/isometry plus exact-amplitude dynamic cleanliness plus non-vacuity, strictly beyond Gram (negative controls caught); certificates are canonical machine metadata via `discover_total` — terminating, conservative, total on every program (`h Ω` witness), and **self-validating**: every admitted map passes full semantic coverage, else None | From aaca38adfaf9d9f4935235cbf45cb19430292b18 Mon Sep 17 00:00:00 2001 From: a9lim Date: Mon, 10 Aug 2026 03:42:04 -0400 Subject: [PATCH 057/107] =?UTF-8?q?qalc:=20kernel=20v1.33=20=E2=80=94=20th?= =?UTF-8?q?e=20lam-count=20clamp;=20both=20provenance=20misses=20marked;?= =?UTF-8?q?=20audit=20#25=20registered?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #25 (cx-20260810-031247-e9cc) — machine clean a ninth round; extend-once and the KD memo confirmed mechanically. Layer eleven: big-integer arithmetic in max-free (Var(1< --- docs/STATUS.md | 30 +++++++++++++-------- docs/ledger/2026-08.md | 39 +++++++++++++++++++++++++++ docs/quantum-algebraic/kernel.md | 46 +++++++++++++++++++++++++------- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 95 insertions(+), 22 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index bebf80d..d7ab1ee 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,10 +413,10 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.32** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.33** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after -twenty-four fresh-context rounds. Kernel-arm provenance summaries +twenty-five fresh-context rounds. Kernel-arm provenance summaries have been refuted by literal diff twice (audit #13 killed "unmoved since v1.11"; audit #14 showed the corrected summary still incomplete), so the register now names arms per version @@ -611,11 +611,19 @@ traversal re-pushed per reference, plus a regression-coverage overstatement. v1.32 (checker-only, sixth consecutive): extend-once-per-slice riding the confirmed doctrine (206 → 2.3 ms), the KD-keys sibling preempted self-derived, -all shared-substructure families timed, the coverage wording -corrected. What +the shared-substructure families timed, the coverage wording +corrected. Audit #25 (ninth machine-clean round; extend-once +and the KD memo both confirmed) found layer ELEVEN: an n-bit +integer masquerading as one leaf — max-free's subtractions +paid its bits n times — and the provenance defect repeated one +round after its correction. v1.33 (checker-only, seventh +consecutive): the lam-count clamp (no index above the Lam +count is ever bound — an upward DAG path cannot revisit; +454 → 66 ms), slice-cargo timed at last, both misses marked. +What the rounds still found was claim-language and scaffolding, each fixed the same -day: all thirty permanent regressions now gate mechanically (the +day: all thirty-one permanent regressions now gate mechanically (the module verdict is the exit code — forcing any single regression false exits nonzero, measured); `validate()` gained NON-VACUITY at both levels (an entry at an unreachable position and a ghost @@ -631,15 +639,15 @@ minimal; physics table passes on all twenty; all prior audit kits rerun with every delta adjudicated (ks-display relabels under always-emit and the KA head; the W0-gate display collapses; matrix-coverage shrink under the tightened language; -the healed-countermodel crash); every v1.32 prediction held, -with the round's honesty item being the corrected -regression-coverage wording — regression 29's real coverage -stated exactly and superseded by regression 30's timed -families (provenance in the scratchpad prediction files). +the healed-countermodel crash); v1.33's predictions held in +substance with one figure missed and MARKED IMMEDIATELY (the +predicted "under 50 ms" measured 66 ms — the band held), and +v1.32's repeated four-vs-three coverage miss is marked in its +own outcomes (provenance in the scratchpad prediction files). The open docket, in order: -1. **fresh-context independent audit #25 of the v1.32 h-fragment +1. **fresh-context independent audit #26 of the v1.33 h-fragment claim** (verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 86f1b12..cb8a394 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -3828,3 +3828,42 @@ polarity byte-identical; wf exactly one new line; corpus, census, kits at their adjudicated readings. Register, STATUS, token.md updated; fresh audit #25 launched — the PASS re-claim stays gated on it. + +## 2026-08-10 — qALC kernel v1.33: the clamp; an n-bit integer masquerading as a leaf; the repeated miss marked twice over + +Audit #25 (fresh instance, sol tier, threadless) — the machine +clean a NINTH consecutive round; extend-once-per-slice CONFIRMED +across tape→RS, RS→K, and log→KA interleavings with fresh-call +rechecks; the KD memo confirmed mechanically (63 false-memo hits +each executing the w0bad path); the post-gate W2 quadratic on +shared deep instances ruled honestly covered by the +value-semantics doctrine. The findings, layer ELEVEN: (1) +BIG-INTEGER ARITHMETIC — Var(1< Date: Mon, 10 Aug 2026 04:11:35 -0400 Subject: [PATCH 058/107] =?UTF-8?q?qalc:=20kernel=20v1.34=20=E2=80=94=20fi?= =?UTF-8?q?eld-presence=20guards;=20the=20defaulted-field=20fallback=20pin?= =?UTF-8?q?ned;=20audit=20#26=20registered?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #26 (cx-20260810-034132-c43a) — machine clean a tenth round; the clamp lemma CONFIRMED over 60,000 randomized DAGs against an unclamped reference, zero mismatches. Layer twelve: deleted fields on exact instances (object.__delattr__ yields exact-but-hollow Runs/Lams/Vars crashing on first touch), plus a stale hard-coded line number in the layer11 kit and a misattributed pack note. v1.34 — checker-only, eighth consecutive: hasattr guards for the seven Run fields; getattr sentinels for term-node fields; the defaulted-field distinction discovered in-round and pinned (deleting vb/rs/ks exposes the class default — extensionally the default Run, honestly []; path/d/log/tape → W0). Regression 32; 32/32 forced-exit-1; four instruments byte-identical; the kit-note attribution corrected. Fresh audit #27 launched; PASS re-claim gated on it. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 26 ++++++++++------- docs/ledger/2026-08.md | 40 ++++++++++++++++++++++++++ docs/quantum-algebraic/kernel.md | 48 +++++++++++++++++++++++++------- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 95 insertions(+), 21 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index d7ab1ee..63b3ace 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,10 +413,10 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.33** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.34** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after -twenty-five fresh-context rounds. Kernel-arm provenance summaries +twenty-six fresh-context rounds. Kernel-arm provenance summaries have been refuted by literal diff twice (audit #13 killed "unmoved since v1.11"; audit #14 showed the corrected summary still incomplete), so the register now names arms per version @@ -620,10 +620,16 @@ round after its correction. v1.33 (checker-only, seventh consecutive): the lam-count clamp (no index above the Lam count is ever bound — an upward DAG path cannot revisit; 454 → 66 ms), slice-cargo timed at last, both misses marked. -What +Audit #26 (tenth machine-clean round; the clamp lemma +confirmed over 60,000 graphs) found layer TWELVE: exact +instances made hollow by object.__delattr__ — exact in type, +missing a field, crashing on first touch. v1.34 (checker-only, +eighth consecutive): field-presence guards, with the +defaulted-field fallback distinction discovered in-round and +pinned. What the rounds still found was claim-language and scaffolding, each fixed the same -day: all thirty-one permanent regressions now gate mechanically (the +day: all thirty-two permanent regressions now gate mechanically (the module verdict is the exit code — forcing any single regression false exits nonzero, measured); `validate()` gained NON-VACUITY at both levels (an entry at an unreachable position and a ghost @@ -639,15 +645,15 @@ minimal; physics table passes on all twenty; all prior audit kits rerun with every delta adjudicated (ks-display relabels under always-emit and the KA head; the W0-gate display collapses; matrix-coverage shrink under the tightened language; -the healed-countermodel crash); v1.33's predictions held in -substance with one figure missed and MARKED IMMEDIATELY (the -predicted "under 50 ms" measured 66 ms — the band held), and -v1.32's repeated four-vs-three coverage miss is marked in its -own outcomes (provenance in the scratchpad prediction files). +the healed-countermodel crash); v1.34's predictions held with +one in-round discovery declared — the defaulted-field +class-fallback distinction, caught by the regression's own +failing first draft (provenance in the scratchpad prediction +files). The open docket, in order: -1. **fresh-context independent audit #26 of the v1.33 h-fragment +1. **fresh-context independent audit #27 of the v1.34 h-fragment claim** (verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index cb8a394..af4d780 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -3867,3 +3867,43 @@ linearity band held, the number did not; grading it HELD would have been the same habit a third time). Register, STATUS, token.md updated; fresh audit #26 launched — the PASS re-claim stays gated on it. + +## 2026-08-10 — qALC kernel v1.34: fields may be absent; the fieldless join the language's refusals + +Audit #26 (fresh instance, sol tier, threadless) — the machine +clean a TENTH consecutive round, and the clamp lemma CONFIRMED +in the best style of this loop: 60,000 randomized shared DAGs +including 1,418 shared-Lam roots and 96 boundary cases against +an unclamped reference, zero mismatches, with the auditor +restating the proof back in their own words. Fresh bigint +timings linear; the mixed-memo composition family linear; every +provenance repair verified literal. The findings, layer TWELVE: +DELETED FIELDS ON EXACT INSTANCES — object.__delattr__ on the +frozen dataclass yields an exact Run missing path (or a Lam +missing body, a Var missing i): exact in type, hollow in body, +through every gate and crashing on first touch. In scope by the +register's own words ("ANY finite object graph — malformed"), +and fair: my own cycle regression manufactures non-constructor +graphs the same way. Two display items besides: the layer11 +kit's hard-coded line number reads 0 reflags after the clamp +shifted wf.py (the auditor re-traced the real 63 — doctrine +sound, display stale), and my pack note misattributed two +output rows to the wrong kit. + +v1.34, predictions written first — checker-only, eighth +consecutive: FIELD-PRESENCE GUARDS. hasattr for the seven Run +fields right after exact-type dispatch (exact instances run no +user code under hasattr); getattr sentinels for term-node +fields in both validator passes (a missing Var.i falls to the +exact-int check; missing Lam.body/App children reject). The +regression's own failing first draft discovered a distinction +worth pinning: deleting a DEFAULTED field (vb/rs/ks) exposes +the dataclass's class-level default — hasattr stays True, the +value reads as the default, and the state is extensionally the +default Run, honestly adjudicating [] — documented fallback, +not a hole; the four undefaulted fields (path/d/log/tape) are +W0. Regression thirty-two gated; thirty-two-for-thirty-two +under forcing; four instruments byte-identical; wf exactly one +new line; the kit-note attribution corrected. Register, STATUS, +token.md updated; fresh audit #27 launched — the PASS re-claim +stays gated on it. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index a58c268..ca7d7dc 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.33.** The kernel is a scratch superposition evolver +**Status: v1.34.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -17,7 +17,7 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #26**, whose +The standing PASS re-claim is **gated on fresh audit #27**, whose verdict will be registered here. Kernel-arm provenance is the chronicle's per-row "what changed" column — summaries of it have been refuted twice by literal diff (audit #13 killed "unmoved @@ -25,7 +25,29 @@ since v1.11"; audit #14 showed the corrected two-wave summary still omitted v1.12's ordinary-decode burial-suppression change and mislabeled v1.21's binder/transport arms as "leaf" guards) — so this register now names arms exactly and only per version: -v1.33 changes NO kernel source — the seventh consecutive +v1.34 changes NO kernel source — the eighth consecutive +checker-only round: audit #26 (machine clean a TENTH round; THE +CLAMP LEMMA CONFIRMED over 60,000 randomized shared DAGs +against an unclamped reference, zero mismatches, the auditor +restating the proof; the mixed-memo composition family linear; +all provenance repairs verified literal) found layer TWELVE: +DELETED FIELDS ON EXACT INSTANCES — object.__delattr__ on the +frozen dataclass yields an exact Run missing `path` (or a Lam +missing `body`, a Var missing `i`) that passes exact-type +dispatch and crashes on first field access. v1.34: FIELD- +PRESENCE GUARDS — hasattr for the seven Run fields right after +the exact-type dispatch (exact instances run no user code +under hasattr), getattr sentinels for term-node fields in the +validator's two passes; a discovered-in-round distinction +pinned: deleting a DEFAULTED field (vb/rs/ks) exposes the +dataclass's class-level default, so the state is extensionally +the default Run and adjudicates [] — documented fallback, not +a hole. Two kit-display items adjudicated: the layer11 kit +hard-codes a shifted line number (its reflag counter reads 0; +the auditor re-traced 63 real reflags — doctrine sound, display +stale), and the prior pack note misattributed two output rows +to the wrong kit (corrected). Before that, v1.33 changed NO +kernel source — the seventh consecutive checker-only round: audit #25 (machine clean a NINTH round; extend-once-per-slice CONFIRMED across tape→RS, RS→K, and log→KA interleavings; the KD memo confirmed mechanically; the @@ -990,7 +1012,7 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#26; the verdict will be registered here.** (Audit #16 caught +#27; the verdict will be registered here.** (Audit #16 caught this sentence stale; audit #19 caught it stale AGAIN despite the parenthetical promising otherwise — the promise is now an ASSERTION: the pack assembly script verifies §1 and §9 name the @@ -1035,7 +1057,7 @@ canonical dicts compared bit-for-bit; `dupcall` canonically None `h(Ω)` → None. Negative controls: pstar × wrong certificate reaches `pop-err`; dupcall × v1.7-era certificate reaches `refire`, all-err. WF/W7/W8/W9 sweeps + mechanized disjointness: -zero violations; **thirty-one permanent regressions** (the v1.6 pair; +zero violations; **thirty-two permanent regressions** (the v1.6 pair; extra-frame collision, W7-excluded with disjoint targets; doctored bundle divergence; K+frame alias; retained-Q disjointness — spectator-bit columns share zero targets; @@ -1119,7 +1141,10 @@ rs/K-storage families and the shared-KD-keys family W0 inside the linear band on the auditor's exact term shape; big-index/ slice-cargo — the Var(1< Date: Mon, 10 Aug 2026 04:40:55 -0400 Subject: [PATCH 059/107] =?UTF-8?q?qalc:=20kernel=20v1.35=20=E2=80=94=20co?= =?UTF-8?q?mments=20catch=20up=20to=20their=20code;=20audit=20#27=20regist?= =?UTF-8?q?ered=20(the=20loop's=20narrowest=20verdict)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #27 (cx-20260810-041104-81d1): 'FAIL — documentation/display only; no kernel or checker semantic repair indicated.' C1-C6 survived mechanically. Raw-object totality CONFIRMED in scope (hollow/__dict__/weakref attacks defeated with zero callback execution; runtime-mutation attacks judged out of scope — the boundary the charge requested); the defaulted-field fallback confirmed by 110,232 comparisons, zero mismatches. v1.35 — comments and kit notes only, zero executable changes, all six instruments measured byte-identical: regression 32's stale first-draft comment corrected, the guard comment scoped, the layer-ten locator adjudicated as historical, the vars() refinement adopted. Fresh audit #28 launched; PASS re-claim gated on it — for the first time in twenty-seven rounds the previous auditor found nothing semantic left to repair. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 23 ++++++++++------- docs/ledger/2026-08.md | 38 +++++++++++++++++++++++++++++ docs/quantum-algebraic/kernel.md | 42 +++++++++++++++++++++++++------- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 86 insertions(+), 19 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 63b3ace..56f982c 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,10 +413,10 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.34** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.35** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after -twenty-six fresh-context rounds. Kernel-arm provenance summaries +twenty-seven fresh-context rounds. Kernel-arm provenance summaries have been refuted by literal diff twice (audit #13 killed "unmoved since v1.11"; audit #14 showed the corrected summary still incomplete), so the register now names arms per version @@ -626,7 +626,13 @@ instances made hollow by object.__delattr__ — exact in type, missing a field, crashing on first touch. v1.34 (checker-only, eighth consecutive): field-presence guards, with the defaulted-field fallback distinction discovered in-round and -pinned. What +pinned. Audit #27's verdict was the narrowest of the loop — +"FAIL: documentation/display only; no kernel or checker +semantic repair indicated" — with raw-object totality CONFIRMED +IN SCOPE (runtime-mutation attacks judged out of scope, the +boundary the charge asked for) and the fallback confirmed by +110,232 comparisons. v1.35 is comments and kit notes only; all +six instruments measured byte-identical. What the rounds still found was claim-language and scaffolding, each fixed the same day: all thirty-two permanent regressions now gate mechanically (the @@ -645,15 +651,14 @@ minimal; physics table passes on all twenty; all prior audit kits rerun with every delta adjudicated (ks-display relabels under always-emit and the KA head; the W0-gate display collapses; matrix-coverage shrink under the tightened language; -the healed-countermodel crash); v1.34's predictions held with -one in-round discovery declared — the defaulted-field -class-fallback distinction, caught by the regression's own -failing first draft (provenance in the scratchpad prediction -files). +the healed-countermodel crash); v1.35's predictions held +exactly — the round touched no executable path and every +instrument stayed byte-identical (provenance in the scratchpad +prediction files). The open docket, in order: -1. **fresh-context independent audit #27 of the v1.34 h-fragment +1. **fresh-context independent audit #28 of the v1.35 h-fragment claim** (verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index af4d780..879db62 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -3907,3 +3907,41 @@ under forcing; four instruments byte-identical; wf exactly one new line; the kit-note attribution corrected. Register, STATUS, token.md updated; fresh audit #27 launched — the PASS re-claim stays gated on it. + +## 2026-08-10 — qALC kernel v1.35: comments catch up to their code; the loop's narrowest verdict yet + +Audit #27 (fresh instance, sol tier, threadless) returned the +narrowest verdict of the whole loop: "FAIL — documentation/ +display only; no kernel or checker semantic repair indicated." +C1-C6 SURVIVED MECHANICALLY. Raw-object totality CONFIRMED IN +SCOPE: the auditor's layer-13 harness deleted or +__dict__-replaced all seven Run fields, installed hostile +values in every field and a hostile dict subclass as the exact +Run's own __dict__, hollowed the term nodes, and applied +weakref/GC pressure — zero callback executions, every case +['W0'] or declined; the sys.settrace TOCTOU and +class-descriptor attacks were judged OUT OF SCOPE as mutations +of the trusted runtime rather than finite stable input graphs — +exactly the scope adjudication the charge requested, which +terminates the totality staircase at its honest boundary. The +defaulted-field fallback was CONFIRMED by 110,232 comparisons +over 6,124 reachable states across wf/wf7/step/equality/ +hashing/repr with zero mismatches, refined honestly: the +equivalence is exact for the machine's and checker's +observations, not for intensional observers like vars(). The +two required corrections were both TEXT: regression 32's +comment still said "all seven → W0" against its own +distinguishing code, and the layer-ten kit's line-302 locator +needed the historical label its layer-eleven sibling already +had. + +v1.35, predictions written first — comments and kit notes only, +ZERO executable changes: the regression comment rewritten to +the distinction its code already carried, the guard comment +scoped, the locator adjudicated, the vars() refinement adopted +into the register's fallback sentence. All six instruments +measured BYTE-IDENTICAL (the prediction was that any output +delta at all falsifies — none did). Register, STATUS, token.md +updated; fresh audit #28 launched — the PASS re-claim stays +gated on it, and for the first time in twenty-seven rounds the +previous auditor found nothing semantic left to repair. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index ca7d7dc..d31999e 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.34.** The kernel is a scratch superposition evolver +**Status: v1.35.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -17,7 +17,7 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #27**, whose +The standing PASS re-claim is **gated on fresh audit #28**, whose verdict will be registered here. Kernel-arm provenance is the chronicle's per-row "what changed" column — summaries of it have been refuted twice by literal diff (audit #13 killed "unmoved @@ -25,7 +25,28 @@ since v1.11"; audit #14 showed the corrected two-wave summary still omitted v1.12's ordinary-decode burial-suppression change and mislabeled v1.21's binder/transport arms as "leaf" guards) — so this register now names arms exactly and only per version: -v1.34 changes NO kernel source — the eighth consecutive +v1.35 changes NO executable source AT ALL — the round is +comments and kit notes only, because audit #27's verdict was +the narrowest of the loop: "FAIL — documentation/display only; +no kernel or checker semantic repair indicated." C1-C6 SURVIVED +MECHANICALLY: raw-object totality CONFIRMED IN SCOPE (its +layer-13 harness deleted or __dict__-replaced all seven fields, +installed hostile values and a hostile dict subclass, hollowed +term nodes, and applied weakref/GC pressure — zero callback +executions; the sys.settrace TOCTOU and class-descriptor +attacks were judged OUT OF SCOPE, mutating the trusted runtime +rather than a finite stable input graph), and the +defaulted-field fallback CONFIRMED by 110,232 comparisons over +6,124 reachable states with zero mismatches. The two required +corrections: regression 32's COMMENT still carried the first +draft's "all seven → W0" while the code distinguished (fixed; +the guard comment likewise scoped), and the layer-ten kit's +line-302 locator needed its historical label (adjudicated in +the pack header). The auditor's refinement is adopted: +"extensionally the default Run" is exact FOR THE MACHINE'S AND +CHECKER'S OBSERVATIONS (wf/wf7/step/eq/hash/repr) — not for +intensional observers like vars(). Before that, v1.34 changed +NO kernel source — the eighth consecutive checker-only round: audit #26 (machine clean a TENTH round; THE CLAMP LEMMA CONFIRMED over 60,000 randomized shared DAGs against an unclamped reference, zero mismatches, the auditor @@ -1012,7 +1033,7 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#27; the verdict will be registered here.** (Audit #16 caught +#28; the verdict will be registered here.** (Audit #16 caught this sentence stale; audit #19 caught it stale AGAIN despite the parenthetical promising otherwise — the promise is now an ASSERTION: the pack assembly script verifies §1 and §9 name the @@ -1182,15 +1203,17 @@ before a quiet return) covered by the UNSPECIFIED wording — audit #24 confirme fourteen components plus the three polarity readings, and CONFIRMED the memo doctrine by static enumeration — audit #25 confirmed thirty-for-thirty plus the fourteen components plus the three polarity readings, extend-once and -the KD memo mechanically — audit #26 confirmed thirty-one-for-thirty-one plus the -fourteen components plus the three polarity readings, and the -clamp lemma by 60,000-graph differential: the v1.6 pair +the KD memo mechanically — audit #26 confirmed thirty-one-for-thirty-one and the clamp +lemma by 60,000-graph differential; audit #27 confirmed +thirty-two-for-thirty-two plus the fourteen components plus +the three polarity readings, raw-object totality in scope, and +the defaulted-field fallback by 110,232 comparisons: the v1.6 pair gates `collisions_under_wf()`; the other thirty gate `cert_sweep()`'s return; the module `__main__` conjoins all three sweeps in its printed total AND ITS EXIT CODE, so any single regression failure exits nonzero (measured: forcing the pair false → exit 1; forcing cert_sweep flags false → exit 1, -including the v1.20 through v1.34 flags; the +including the v1.20 through v1.35 flags; the emulated-old-arm probe flips `cert_sweep` to FAIL). Three v1.12/v1.13-era regression mechanizations were updated in v1.23 to the always-emit discipline (their targets now carry the @@ -1529,7 +1552,8 @@ no bare-term ideal oracle). | v1.31 | CHECKER-ONLY, fifth consecutive: the OCCURRENCE MEMO (occ_required — walk + binder scan + 'a'-count once per occurrence OBJECT; total pre-gate work Σ O(local) over distinct objects; the auditor's three families drop to ~2× doublings, rs 389 → 2.2 ms at n=2,000); the MEMO DOCTRINE stated honestly (per-entry truth is NOT the invariant — aggregate monotonicity is: a stale-True exists only because an earlier check in the same call already OR'd w0bad True; memos per-call, nothing crosses calls); regression twenty-nine (the auditor's families in the linear band + the stale-interleaving verdict + the fresh-call isolation control) gated, twenty-nine-for-twenty-nine under forcing; one fixture bug caught IN-ROUND by the band failing (the first draft built a fresh occurrence per shell — a genuinely quadratic REPRESENTATION whose quadratic time is correct; the auditor's family shares one object; the wrong draft documented in the regression comment); suite/certify/typecheck/polarity byte-identical, wf exactly one new line | **fresh audit #24: FAIL** (the machine unbroken an EIGHTH consecutive round; AGGREGATE MONOTONICITY CONFIRMED BY STATIC ENUMERATION — all memo call sites inside wf, function-local, every first failure flowing into monotone w0bad, no public escape; 29/29 + 14/14 + 3/3 forcings; fresh corpus zero-hit; the fixture-bug disclosure and 24× band verified honest. The findings, layer TEN: SHARED-SLICE TRAVERSAL unmemoized — n distinct shells sharing one n-entry slice re-push its elements per shell, Θ(n²) on a Θ(n) graph, 3.9× per doubling; and the regression-29 coverage OVERSTATED — rs timed, K-storage verdict-only, slice-cargo absent, against "exactly the auditor's three families" in the register) | | v1.32 | CHECKER-ONLY, sixth consecutive: EXTEND-ONCE-PER-SLICE (a per-call seen_slices id-set in the closure sweep — the call that first extends a slice either drains it fully or fails with w0bad already set, the doctrine audit #24 just confirmed statically; the auditor's family drops 206 → 2.3 ms at n=1,600); the KD-KEYS SIBLING PREEMPTED before any auditor found it (n KD entries sharing one keys tuple — kdmemo, both verdicts stored so shared-bad tuples still flag); regression thirty times the shared-slice rs/K-storage and shared-KD-keys families on the auditor's exact term shape, thirty-for-thirty under forcing; the regression-29 coverage wording corrected and the overstatement registered; suite/certify/typecheck/polarity byte-identical, wf exactly one new line | **fresh audit #25: FAIL** (the machine clean a NINTH consecutive round; EXTEND-ONCE-PER-SLICE CONFIRMED across three interleavings with fresh-call rechecks; the KD memo confirmed mechanically — 63 false-memo hits each executing the w0bad path; the post-gate W2 quadratic ruled honestly covered by value-semantics; 30/30 + 14/14 + 3/3 forcings. The findings, layer ELEVEN: BIG-INTEGER ARITHMETIC in max-free — Var(1< Date: Mon, 10 Aug 2026 05:22:47 -0400 Subject: [PATCH 060/107] =?UTF-8?q?qalc:=20kernel=20v1.36=20=E2=80=94=20re?= =?UTF-8?q?gression=2031's=20shells=20become=20distinct=20for=20real;=20id?= =?UTF-8?q?entity=20gated?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #28 (twelfth consecutive machine-clean round, second with no semantic countermodel): regression 31's 'n distinct shells' were ONE constant-folded object — CPython compiles a constant tuple display to a single LOAD_CONST — so the permanent gate covered the wrong sharing shape, and v1.33's outcomes had graded that coverage HELD (third unmarked provenance miss, now marked). v1.36 rebuilds the family from a display referencing a named occurrence local, shares ONE occurrence object for real, and gates distinctness as a flag conjunct (forced alone → exit 1). Two 'no KD' comments corrected to 'empty KD bundle'; the W8 comment corrected to subtraction of surviving representations; §6 restates the stable-runtime scope locally. Register/STATUS/token.md synced; ledgered; audit #29 launched (cx-20260810-052222-3e41). Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 20 ++++++++-- docs/ledger/2026-08.md | 65 ++++++++++++++++++++++++++++++++ docs/quantum-algebraic/kernel.md | 60 +++++++++++++++++++++++++---- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 135 insertions(+), 12 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 56f982c..eb94288 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,7 +413,7 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.35** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.36** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after twenty-seven fresh-context rounds. Kernel-arm provenance summaries @@ -632,7 +632,21 @@ semantic repair indicated" — with raw-object totality CONFIRMED IN SCOPE (runtime-mutation attacks judged out of scope, the boundary the charge asked for) and the fallback confirmed by 110,232 comparisons. v1.35 is comments and kit notes only; all -six instruments measured byte-identical. What +six instruments measured byte-identical. Audit #28 (twelfth +machine-clean round; C1–C5 confirmed in full, the v1.35 +corrections verified correct) found the C6 gap: regression +31's "n distinct shells" were ONE constant-folded object — +CPython compiles a constant tuple display to a single +LOAD_CONST — so the permanent gate covered the wrong sharing +shape, with v1.33's outcomes having graded that coverage HELD +(the third unmarked provenance miss, now marked); plus two +"no KD" comments above assertions requiring an empty KD +bundle, and the W8 comment overstating certified pop. v1.36 +(checker fixture and comments only, ninth consecutive): +the shells runtime-built and genuinely sharing one occurrence +object, distinctness GATED as a flag conjunct (forced alone → +exit 1), the genuine family ['W0'] and linear, every wording +corrected, §6's stable-runtime scope restated locally. What the rounds still found was claim-language and scaffolding, each fixed the same day: all thirty-two permanent regressions now gate mechanically (the @@ -658,7 +672,7 @@ prediction files). The open docket, in order: -1. **fresh-context independent audit #28 of the v1.35 h-fragment +1. **fresh-context independent audit #29 of the v1.36 h-fragment claim** (verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 879db62..12fb4ed 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -3945,3 +3945,68 @@ delta at all falsifies — none did). Register, STATUS, token.md updated; fresh audit #28 launched — the PASS re-claim stays gated on it, and for the first time in twenty-seven rounds the previous auditor found nothing semantic left to repair. + +## 2026-08-10 — qALC kernel v1.36: the distinct shells that never were; coverage becomes machine-checked + +Audit #28 (fresh instance, cx-20260810-044025-7e58, sol tier, +941,769-byte pack) FAILED v1.35 — the machine clean a TWELFTH +consecutive round, and for the second round running no kernel +or checker semantic countermodel: C1–C5 confirmed in full (33 +embedded sources byte-checked; all six instruments reproducing +their stored bytes; fresh AST-derived forcing 32/32 + 14/14 + +3/3; fresh corpus 300/206/363/218,546 zero-hit, arm census +465/367/222/0; gauge 8/1024 + 4/1024; conservation size 11 +reproduced), the v1.35 corrections verified correct (the +layer-ten locator confirmed truthful against extracted v1.31 +source at exactly line 302), and the C3 boundary sentence +ruled consistent under the registered stable-runtime scope. + +The headline finding is the loop in miniature: REGRESSION 31 +NEVER BUILT ITS CLAIMED FAMILY. Its "n distinct shells sharing +one occurrence" were constructed by a constant tuple display — +CPython folds `('L', ('b', 'f'), ())` to ONE LOAD_CONST, so +every element of the shells tuple was the same object at every +size. The auditor captured the gated states (slice entries +99/799, distinct shells 1), caught the dead inner31 local by +the same bytecode capture (stores 1, loads 0), reconstructed +the genuine family, and measured it ['W0'] and linear — so no +slowdown was hiding, but the permanent gate covered the wrong +sharing shape, and v1.33's outcomes had graded "slice-cargo +timed and linear" HELD: a third unmarked provenance miss, in +the very round that marked the second. Alongside: two comments +said "no KD" directly above assertions requiring ('KD', ()) +— an EMPTY bundle is not an absent one, the exact distinction +v1.23 taught the machine — the W8 comment said certified pop +"removes exactly the frames it records" against the loop's own +riding-ticket control (pop removes frames; it records only +keys left with no surviving representation), and v1.35's +predictions file contradicted its own timing-suffix exception +while counting five instruments where the inventory says six. + +v1.36, predictions written first — checker fixture and +comments only, zero kernel changes, zero checker-semantic +changes: the shells are now runtime-built from a display +referencing a named occurrence local (a name cannot be a +code-object constant), genuinely sharing ONE occurrence +object, and DISTINCTNESS IS GATED — the fixture returns +len({id}) == n−1 as a conjunct of its flag, printed in the +regression line, and forcing that conjunct alone exits 1. The +genuine family measures ['W0'] at both gated sizes, 0.103 → +0.680 ms at 8× (~2× per doubling), matching the auditor's +reconstruction. Both "no KD" comments now read "empty KD +bundle"; the W8 parenthesis states the subtraction; §6 +restates the stable-runtime scope locally (the auditor's +non-required suggestion, adopted); the v1.33 miss is marked in +its outcomes and the v1.35 wording defects in its file. +Measured: suite/certify/typecheck/polarity byte-identical, +conservation byte-identical too this run, wf exactly the one +predicted line; 31/31 direct forcings plus the v1.6 pair via +the v125 kit's byte-identical forcing snapshot; all 22 kits at +their adjudicated readings — with one capture error caught +in-round by the diff itself (the v125/v126 kits first rerun +WITHOUT their documented flags; the missing output lines +surfaced immediately and the recapture followed the header +protocol). Register, STATUS, token.md updated; fresh audit #29 +launched — the PASS re-claim stays gated on it. Twenty-eight +audits, twelve of them machine-clean in a row; what is left to +break keeps getting closer to the width of a comment. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index d31999e..95912e2 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.35.** The kernel is a scratch superposition evolver +**Status: v1.36.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -17,7 +17,7 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #28**, whose +The standing PASS re-claim is **gated on fresh audit #29**, whose verdict will be registered here. Kernel-arm provenance is the chronicle's per-row "what changed" column — summaries of it have been refuted twice by literal diff (audit #13 killed "unmoved @@ -25,7 +25,37 @@ since v1.11"; audit #14 showed the corrected two-wave summary still omitted v1.12's ordinary-decode burial-suppression change and mislabeled v1.21's binder/transport arms as "leaf" guards) — so this register now names arms exactly and only per version: -v1.35 changes NO executable source AT ALL — the round is +v1.36 changes NO kernel source and NO checker semantics — the +ninth consecutive checker-only round, one regression fixture +plus comments: audit #28 (machine clean a TWELFTH round; C1-C5 +confirmed in full — instruments reproducing stored bytes, fresh +AST-derived forcing 32/32 + 14/14 + 3/3, corpus zero-hit, gauge +8/1024 and 4/1024; the v1.35 corrections verified correct, the +layer-ten locator confirmed truthful against extracted v1.31 +source; the C3 boundary sentence ruled consistent under the +registered stable-runtime scope) found the C6 gap: REGRESSION +31 NEVER BUILT ITS CLAIMED FAMILY — its shell display was a +constant expression, folded by CPython to ONE LOAD_CONST, so +the "n distinct shells" were one shared object at every size, +and v1.33's outcomes had graded that coverage HELD (the third +unmarked provenance miss, now marked). v1.36: the shells are +runtime-built (the display references a named occurrence local; +a name cannot be a code-object constant), genuinely sharing ONE +occurrence object, and DISTINCTNESS IS GATED — the fixture +returns len({id}) == n−1 as a conjunct of its flag, printed; +the genuine family measures ['W0'] and linear (0.103 → 0.680 ms +at 8×, ~2× per doubling, matching the auditor's +reconstruction). The wording sweep: the two "no KD" comments +corrected to "empty KD bundle" (their own assertions require +('KD', ())); the W8 comment's "removes exactly the frames it +records" corrected to subtraction of surviving representations +(pop removes the popped frames but records only keys left with +no surviving representation — the riding-ticket control pops +into an empty bundle); §6 restates the stable-runtime scope +locally (the auditor's non-required suggestion, adopted); and +v1.35's own predictions file is marked for its +self-contradictory falsifier and five-vs-six instrument count. +Before that, v1.35 changed NO executable source AT ALL — the round is comments and kit notes only, because audit #27's verdict was the narrowest of the loop: "FAIL — documentation/display only; no kernel or checker semantic repair indicated." C1-C6 SURVIVED @@ -704,7 +734,12 @@ the machine's unitarity claims quantify over the subtype: token grammar a closure sweep with an id-keyed per-call memo), so `wf()` accepts or W0-rejects ANY finite object graph — malformed, cyclic, hostile-typed, or shared — without - crashing or hanging, and `wf7()` is exact-type dispatched and + crashing or hanging (SCOPE, restated locally per audit #28's + adopted suggestion: a finite STABLE graph under an unmodified + runtime — sys.settrace TOCTOU hooks and class-descriptor + injection mutate the trusted class/runtime mid-call and are + runtime mutation, not input; the status adjudication, audits + #27/#28), and `wf7()` is exact-type dispatched and gated by the total `wf()` itself: "declines out-of-language sources" is enforced, not promised. Past the gate, the W1-W9 scans and the machine share the HOST'S STRUCTURAL-OPERATION BOUNDARY: hash, equality, AND @@ -1033,7 +1068,7 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#28; the verdict will be registered here.** (Audit #16 caught +#29; the verdict will be registered here.** (Audit #16 caught this sentence stale; audit #19 caught it stale AGAIN despite the parenthetical promising otherwise — the promise is now an ASSERTION: the pack assembly script verifies §1 and §9 name the @@ -1161,7 +1196,11 @@ isolation control; shared-substructure — the shared-slice rs/K-storage families and the shared-KD-keys family W0 inside the linear band on the auditor's exact term shape; big-index/ slice-cargo — the Var(1< Date: Mon, 10 Aug 2026 05:52:09 -0400 Subject: [PATCH 061/107] =?UTF-8?q?qalc:=20kernel=20v1.37=20=E2=80=94=20th?= =?UTF-8?q?e=20correction=20corrected;=20n=E2=88=921=20stated=20with=20its?= =?UTF-8?q?=20reason;=20retained=20Q=20joins=20the=20docstring?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #29 (thirteenth consecutive machine-clean round, third with no semantic countermodel; the v1.36 rebuild verified genuine at the bytecode level and the sibling sweep clean): v1.36's own correction was off by one — cargo31 builds n−1 shells (range(n−1), the gate proves it) while the fresh C4/§10/comment sentences said n — and the cert_disjointness docstring omitted retained Q from the spectator tuple its implementation and §7.4 carry. v1.37 is documentation only: both claim sites now say n−1 with the reason (one shell per 'a' of the carrier occurrence, verified against occ_required before registering), the docstring completed, the v1.36 misses marked. All six instruments byte-identical including conservation's suffix. Register/STATUS/token.md synced; ledgered; audit #30 launched (cx-20260810-055149-7aff). Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 14 ++++++-- docs/ledger/2026-08.md | 55 ++++++++++++++++++++++++++++++++ docs/quantum-algebraic/kernel.md | 46 ++++++++++++++++++++------ docs/quantum-algebraic/token.md | 2 +- 4 files changed, 104 insertions(+), 13 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index eb94288..759ef3e 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,7 +413,7 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.36** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.37** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after twenty-seven fresh-context rounds. Kernel-arm provenance summaries @@ -646,7 +646,15 @@ bundle, and the W8 comment overstating certified pop. v1.36 the shells runtime-built and genuinely sharing one occurrence object, distinctness GATED as a flag conjunct (forced alone → exit 1), the genuine family ['W0'] and linear, every wording -corrected, §6's stable-runtime scope restated locally. What +corrected, §6's stable-runtime scope restated locally. Audit +#29 (thirteenth machine-clean round; the rebuild verified +genuine at the bytecode level, the sibling sweep clean) caught +v1.36's own correction off by one — the fixture builds n−1 +shells while the fresh C4/§10/comment sentences said n — plus +a docstring omitting retained Q from the spectator tuple its +implementation carries. v1.37 (documentation only): both claim +sites now say n−1 with the reason, the docstring completed, +the fresh miss marked. What the rounds still found was claim-language and scaffolding, each fixed the same day: all thirty-two permanent regressions now gate mechanically (the @@ -672,7 +680,7 @@ prediction files). The open docket, in order: -1. **fresh-context independent audit #29 of the v1.36 h-fragment +1. **fresh-context independent audit #30 of the v1.37 h-fragment claim** (verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 12fb4ed..55244e5 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -4010,3 +4010,58 @@ protocol). Register, STATUS, token.md updated; fresh audit #29 launched — the PASS re-claim stays gated on it. Twenty-eight audits, twelve of them machine-clean in a row; what is left to break keeps getting closer to the width of a comment. + +## 2026-08-10 — qALC kernel v1.37: the correction corrected; off by one in the sentence that fixed the sentence + +Audit #29 (fresh instance, cx-20260810-052222-3e41, sol tier, +956,719-byte pack) FAILED v1.36 — the machine clean a +THIRTEENTH consecutive round, the third straight with no +kernel or checker semantic countermodel. The rebuild itself +was verified GENUINE at the bytecode level (v1.35's generator: +one LOAD_CONST; v1.36's: LOAD_DEREF occ_in31 + BUILD_TUPLE), +the gated states independently captured (99/799 shell +identities, ONE occurrence identity, every shell using the +named local), inner31 confirmed gone, the distinctness +conjunct force-verified — and the charge-1 sibling sweep came +back CLEAN: every other fixture in wf.py builds exactly the +object graph its comment claims, so the constant-folding class +begins and ends at the one fixture audit #28 caught. The three +v1.36 comment corrections were verified accurate against the +riding-ticket measurement; C2/C3/C5 confirmed with fresh +gauge, a NEW mixed tape/RS/KS sharing family linear +(1.90/1.93/2.00 doublings), conservation size 11, and forcing +in full including distinct31 alone. + +The findings, all documentation, and the first is the loop +distilled: cargo31 builds N−1 shells — its generator is +range(n−1), its own gate proves len == n−1, its measurements +print 99/799 — while C4, the register's §10 clause, and the +regression comment said "n distinct shells". All three +sentences were written in v1.36, in the very act of fixing the +previous multiplicity claim. The auditor's other finds: the +cert_disjointness docstring enumerates its retained-spectator +tuple without retained Q, though spec() returns it and §7.4 +names it (the docstring predates the v1.11 retention wiring +and twenty-six rounds of sweeps never read it against its own +function); and the fresh overclaim was unmarked in v1.36's +provenance — graded wholly held, again. + +v1.37, predictions written first — documentation ONLY, zero +executable changes: both current-claim sites now say n−1 WITH +THE REASON (one shell per 'a' of the carrier occurrence; +occ_required returns the 'a'-count past the binder — verified +against the code before registering, because the risk item +named the parenthetical as a candidate fresh overclaim of +exactly the class it corrects); the docstring's spectator +tuple gains retained Q; the v1.36 misses are marked in its +file. Measured: all six instruments byte-identical INCLUDING +conservation's timing suffix (the second consecutive +coincidence), all three diagnostics byte-identical, all 22 +kits at their adjudicated readings with v125/v126 captured +under their documented flags on the first attempt this time; +ok_big and ok_fld spot-forced → exit 1. Register, STATUS, +token.md advanced; fresh audit #30 launched — the PASS +re-claim stays gated on it. Twenty-nine audits; the machine +untouched since v1.25 and unbroken since v1.23; the last three +rounds' entire repair surface, laid end to end, is four +comments, one docstring, one fixture, and an integer. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 95912e2..004adc7 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.36.** The kernel is a scratch superposition evolver +**Status: v1.37.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -17,7 +17,7 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #29**, whose +The standing PASS re-claim is **gated on fresh audit #30**, whose verdict will be registered here. Kernel-arm provenance is the chronicle's per-row "what changed" column — summaries of it have been refuted twice by literal diff (audit #13 killed "unmoved @@ -25,7 +25,31 @@ since v1.11"; audit #14 showed the corrected two-wave summary still omitted v1.12's ordinary-decode burial-suppression change and mislabeled v1.21's binder/transport arms as "leaf" guards) — so this register now names arms exactly and only per version: -v1.36 changes NO kernel source and NO checker semantics — the +v1.37 changes NOTHING executable — documentation only, the +loop's second such round: audit #29 (machine clean a +THIRTEENTH round; the regression-31 rebuild verified GENUINE at +the bytecode level — LOAD_DEREF + BUILD_TUPLE against v1.35's +single LOAD_CONST, 99/799 shell identities and ONE occurrence +identity captured independently — with the SIBLING SWEEP clean: +every other fixture builds exactly the object graph its comment +claims; the three v1.36 comment corrections verified accurate; +fresh gauge, a new mixed sharing family linear, conservation +reproduced, forcing in full including distinct31 alone) found +the round's OWN correction off by one: cargo31 builds n−1 +shells — range(n−1), the gate proves len == n−1, the +measurements say 99/799 — while C4, §10, and the regression +comment, all three sentences written in v1.36 to fix the +previous multiplicity claim, said "n distinct shells"; plus +the cert_disjointness docstring omitting retained Q from its +spectator tuple (the implementation and §7.4 both carry it; +the docstring predates the v1.11 retention wiring), and the +fresh overclaim unmarked in v1.36's provenance. v1.37: both +current-claim sites now say n−1 with the reason (one shell per +'a' of the carrier occurrence — occ_required returns the +'a'-count past the binder, verified against the code before +registering); the docstring's spectator tuple gains retained +Q; the v1.36 misses marked in its file. +Before that, v1.36 changed NO kernel source and NO checker semantics — the ninth consecutive checker-only round, one regression fixture plus comments: audit #28 (machine clean a TWELFTH round; C1-C5 confirmed in full — instruments reproducing stored bytes, fresh @@ -1068,7 +1092,7 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#29; the verdict will be registered here.** (Audit #16 caught +#30; the verdict will be registered here.** (Audit #16 caught this sentence stale; audit #19 caught it stale AGAIN despite the parenthetical promising otherwise — the promise is now an ASSERTION: the pack assembly script verifies §1 and §9 name the @@ -1196,10 +1220,13 @@ isolation control; shared-substructure — the shared-slice rs/K-storage families and the shared-KD-keys family W0 inside the linear band on the auditor's exact term shape; big-index/ slice-cargo — the Var(1< Date: Mon, 10 Aug 2026 06:27:30 -0400 Subject: [PATCH 062/107] =?UTF-8?q?qalc:=20kernel=20v1.38=20=E2=80=94=20th?= =?UTF-8?q?e=20carrier=20that=20was=20never=20read;=20sensitivity=20become?= =?UTF-8?q?s=20the=20gate?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #30 (fourteenth consecutive machine-clean round): regression 31's d='X' state short-circuits W0's conjunction before the tape — the carrier was never traversed (0 machinery calls), and removing it left the whole instrument output byte-identical. Scoping with a counter-instrumented copy: the rs/ks loops run unconditionally, so the other timing families genuinely exercise their machinery under 'X' (load-bearing pre-gate isolation) but were equally ungated. v1.38 (fixtures only, zero semantic changes): cargo31 in-language (d='D', WF-clean [] gated, band kept) with a corrupted-last-shell control that must flip to ['W0'] — the carrier-removal countermodel now exits 1 — plus five in-language sensitivity pairs across the rs/ks families. v1.37's coverage miss marked. All forcings exit 1; wf differs in exactly the four predicted lines. Register/STATUS/ token.md synced; ledgered; audit #31 launched (cx-20260810-062712-e4d1). Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 17 +++++++-- docs/ledger/2026-08.md | 61 ++++++++++++++++++++++++++++++ docs/quantum-algebraic/kernel.md | 65 ++++++++++++++++++++++++++------ docs/quantum-algebraic/token.md | 2 +- 4 files changed, 130 insertions(+), 15 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 759ef3e..c5f24b6 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,7 +413,7 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.37** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.38** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after twenty-seven fresh-context rounds. Kernel-arm provenance summaries @@ -654,7 +654,18 @@ shells while the fresh C4/§10/comment sentences said n — plus a docstring omitting retained Q from the spectator tuple its implementation carries. v1.37 (documentation only): both claim sites now say n−1 with the reason, the docstring completed, -the fresh miss marked. What +the fresh miss marked. Audit #30 (fourteenth machine-clean +round) then found the first executable defect in three rounds: +regression 31's d='X' state short-circuits W0's conjunction +before the tape, so the carrier was never traversed — removing +it left the whole output byte-identical. v1.38 (fixtures +only): sensitivity becomes the gate — cargo31 in-language with +a corrupted-last-shell control that must flip to ['W0'] (the +removal countermodel now exits 1), and five sensitivity pairs +gate the rs/ks families whose 'X' timing methodology is +load-bearing (measured: their machinery runs through the +unconditional loops; the early return isolates pre-gate cost). +What the rounds still found was claim-language and scaffolding, each fixed the same day: all thirty-two permanent regressions now gate mechanically (the @@ -680,7 +691,7 @@ prediction files). The open docket, in order: -1. **fresh-context independent audit #30 of the v1.37 h-fragment +1. **fresh-context independent audit #31 of the v1.38 h-fragment claim** (verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 55244e5..7d7c52c 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -4065,3 +4065,64 @@ re-claim stays gated on it. Twenty-nine audits; the machine untouched since v1.25 and unbroken since v1.23; the last three rounds' entire repair surface, laid end to end, is four comments, one docstring, one fixture, and an integer. + +## 2026-08-10 — qALC kernel v1.38: the carrier that was never read; sensitivity becomes the gate + +Audit #30 (fresh instance, cx-20260810-055149-7aff, sol tier, +965,479-byte pack) FAILED v1.37 with the first executable +finding in three rounds — and it is a beauty. The machine +stayed clean a FOURTEENTH consecutive round; the v1.37 count +and docstring repairs were verified exact (every fibre +key/value of all 19 certified programs independently rebuilt; +occ_required confirmed returning exactly the post-binder +'a'-count; regression 30 and the historical quotations +verified right to leave). THE FINDING: regression 31 +constructs the corrected object graph and NEVER SENDS IT +THROUGH THE MACHINERY. Its state used d='X', and W0's +conjunction begins with the direction check — Python +short-circuits before examining the tape, so the carrier so +carefully rebuilt with genuine distinct shells was never +traversed at all: 0 w0tok, 0 w0lp_shape, 0 occ_required. The +decisive forcing REMOVED THE CARRIER ENTIRELY and the complete +instrument output stayed byte-identical, the regression +printed as passing. The linear timings were real work — purity +traversal — measuring everything except the thing the fixture +existed to measure. Two rounds of shell-identity forensics +gated a graph that never met the grammar. + +The scoping (a counter-instrumented copy, reproduced before +predictions): the rs and ks loops run UNCONDITIONALLY after +the short-circuited conjunction, so the frame/storage/KD +timing families genuinely exercise their machinery under 'X' +— comp28 makes 100 w0lp calls at n=100, occ29 200 +w0lp_shape/occ_required — and their 'X' is load-bearing: the +W0 early return isolates pre-gate cost from the post-gate W2 +duplicate scan, which is honestly quadratic by value-semantics +on identical-frame families and would break their bands. But +their traversal was equally UNGATED — the removal countermodel +kills them identically — and a further measurement showed +direction alone cannot gate anything: a carrier-free 'D' state +returns the same [] as the genuine one. + +v1.38, predictions written first — regression fixtures only, +zero semantic changes anywhere: SENSITIVITY IS THE GATE. Only +actual traversal can detect a corrupted deepest element, so +every timing family now carries an in-language control pair: +genuine variant 'W0'-free, corrupted-last-element variant +exactly ['W0']. cargo31 additionally moves in-language per the +auditor's prescription (d='D', WF-clean [] gated at both +sizes, 0.192 → 1.165 ms inside the band, distinctness kept) — +and the auditor's own carrier-removal mutation now exits 1 +with visibly different output, because an absent carrier +cannot be corrupted. Five pairs measured before implementation +and all behaving; conjunct-level, flag-level, and +removal forcings all exit 1; suite/certify/typecheck/polarity +byte-identical, conservation byte-identical including its +suffix for the third consecutive time, wf exactly the four +predicted lines. The v1.37 coverage miss is marked in its +file as the second member of audit #28's fixture-coverage +class. Register, STATUS, token.md advanced; fresh audit #31 +launched — the PASS re-claim stays gated on it. Thirty audits: +the machine has now survived every attack the loop has +invented, and the checker's fixtures are finally held to the +same standard as the checker. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index 004adc7..b96ba71 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.37.** The kernel is a scratch superposition evolver +**Status: v1.38.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -17,7 +17,7 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #30**, whose +The standing PASS re-claim is **gated on fresh audit #31**, whose verdict will be registered here. Kernel-arm provenance is the chronicle's per-row "what changed" column — summaries of it have been refuted twice by literal diff (audit #13 killed "unmoved @@ -25,7 +25,41 @@ since v1.11"; audit #14 showed the corrected two-wave summary still omitted v1.12's ordinary-decode burial-suppression change and mislabeled v1.21's binder/transport arms as "leaf" guards) — so this register now names arms exactly and only per version: -v1.37 changes NOTHING executable — documentation only, the +v1.38 changes REGRESSION FIXTURES ONLY — zero +wf()/wf7()/kernel/instrument-semantic changes: audit #30 +(machine clean a FOURTEENTH round; the v1.37 count and +docstring repairs verified exact, every fibre of all 19 +certified programs independently rebuilt) found the first +executable defect in three rounds, a genuine +regression-coverage countermodel: regression 31's state used +d='X', and W0's conjunction short-circuits on the direction +check BEFORE the tape — the carrier was never traversed (0 +w0tok/w0lp_shape/occ_required calls), and REMOVING IT left the +complete instrument output byte-identical; the linear timings +were purity traversal. Reproduction with a counter-instrumented +copy scoped the class: the rs/ks loops run UNCONDITIONALLY +after the conjunction, so the frame/storage/KD timing families +(comp28/occ29/shells30) genuinely exercise their machinery +under 'X' — the 'X' is load-bearing there, early-returning +before the value-semantics-quadratic post-gate W2 duplicate +scan — but their traversal was equally UNGATED (the removal +countermodel kills them identically), and a same-verdict +measurement showed direction alone cannot gate traversal +(carrier-free 'D' states also return []). v1.38: SENSITIVITY +IS THE GATE — cargo31 moves in-language per the auditor's +prescription (d='D', WF-clean [] gated at both sizes, +distinctness and band kept) with a corrupted-last-shell +control that must return exactly ['W0'] (only a sweep reaching +the deepest shell can flip it — carrier removal now exits 1 +with visibly different output); comp28, occ29 (both variants), +and shells30 (all three kinds) keep their 'X' timing +methodology and gain small-n in-language sensitivity pairs +(genuine 'W0'-free, corrupted-last-element exactly ['W0'] — +five pairs, all gated in their flags); the fixture comments +state the conjunction-structure facts; the v1.37 coverage miss +is marked in its file (the second member of audit #28's +fixture-coverage class). +Before that, v1.37 changed NOTHING executable — documentation only, the loop's second such round: audit #29 (machine clean a THIRTEENTH round; the regression-31 rebuild verified GENUINE at the bytecode level — LOAD_DEREF + BUILD_TUPLE against v1.35's @@ -1092,7 +1126,7 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#30; the verdict will be registered here.** (Audit #16 caught +#31; the verdict will be registered here.** (Audit #16 caught this sentence stale; audit #19 caught it stale AGAIN despite the parenthetical promising otherwise — the promise is now an ASSERTION: the pack assembly script verifies §1 and §9 name the @@ -1213,14 +1247,22 @@ hostile-`__eq__`-in-d state W0-rejected with nothing executing, wf7 declining, and the n=8,000 valid deep-lp walk inside the linear band; composition linearity — the n-frames-one-lp family W0 at both sizes inside the linear band, with a distinct-lps -no-aliasing control; occurrence-memo — the distinct-shells/ +no-aliasing control and a traversal-sensitivity pair (v1.38: +in-language genuine 'W0'-free, corrupted-last-frame exactly +['W0']); occurrence-memo — the distinct-shells/ shared-occurrence families inside the linear band, the -stale-interleaving verdict pinned ['W0'], and the fresh-call -isolation control; shared-substructure — the shared-slice +stale-interleaving verdict pinned ['W0'], the fresh-call +isolation control, and sensitivity pairs for both storage +variants; shared-substructure — the shared-slice rs/K-storage families and the shared-KD-keys family W0 inside -the linear band on the auditor's exact term shape; big-index/ -slice-cargo — the Var(1< Date: Mon, 10 Aug 2026 08:33:22 -0400 Subject: [PATCH 063/107] =?UTF-8?q?qalc:=20kernel=20v1.39=20=E2=80=94=20th?= =?UTF-8?q?e=20walker=20pops=20from=20the=20other=20end;=20corruption=20le?= =?UTF-8?q?arns=20to=20hide=20deep?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #31 (fifteenth consecutive machine-clean round) won the sensitivity-design charge: the closure walker is LIFO, so v1.38's 'corrupted-last-shell' was visited first, and two in-memory checker mutants — one skipping long-slice traversal while special-casing the shallow ('BAD',) sentinel, one canning occ_required for long all-'b' occurrences — passed every gate at exit 0. 'Five pairs' was also six. v1.39 (fixtures only, zero semantic changes): corruptions become deep and traversal-last — locally valid unbound lps at the position the LIFO walker pops last. Both reproduced mutants now exit 1; carrier removal still exits 1; all six instruments byte-identical including wf. The false deepest-shell sentence and the count corrected in the register, three misses marked in the v1.38 file. Register/STATUS/ token.md synced; ledgered; audit #32 launched (cx-20260810-083303-85da). Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 16 +++++-- docs/ledger/2026-08.md | 56 +++++++++++++++++++++++++ docs/quantum-algebraic/kernel.md | 72 +++++++++++++++++++++++++------- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 126 insertions(+), 20 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index c5f24b6..40bcbfd 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,7 +413,7 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.38** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.39** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` and the register's §11 chronicle). The audit loop's state after twenty-seven fresh-context rounds. Kernel-arm provenance summaries @@ -661,10 +661,20 @@ before the tape, so the carrier was never traversed — removing it left the whole output byte-identical. v1.38 (fixtures only): sensitivity becomes the gate — cargo31 in-language with a corrupted-last-shell control that must flip to ['W0'] (the -removal countermodel now exits 1), and five sensitivity pairs +removal countermodel now exits 1), and six sensitivity pairs gate the rs/ks families whose 'X' timing methodology is load-bearing (measured: their machinery runs through the unconditional loops; the early return isolates pre-gate cost). +Audit #31 (fifteenth machine-clean round) then won the +sensitivity-design charge: the walker is LIFO, so the +"last-shell" corrupt was visited first, and two checker +mutants — one skipping long slices while special-casing the +shallow sentinel, one canning the occurrence count — passed +every v1.38 gate at exit 0; "five pairs" was also six. v1.39 +(fixtures only): corruptions become deep and traversal-last — +locally valid unbound lps at the position popped last — and +BOTH reproduced mutants now exit 1, with all six instruments +byte-identical including wf. What the rounds still found was claim-language and scaffolding, each fixed the same @@ -691,7 +701,7 @@ prediction files). The open docket, in order: -1. **fresh-context independent audit #31 of the v1.38 h-fragment +1. **fresh-context independent audit #32 of the v1.39 h-fragment claim** (verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 7d7c52c..13ad213 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -4126,3 +4126,59 @@ launched — the PASS re-claim stays gated on it. Thirty audits: the machine has now survived every attack the loop has invented, and the checker's fixtures are finally held to the same standard as the checker. + +## 2026-08-10 — qALC kernel v1.39: the walker pops from the other end; corruption learns to hide deep + +Audit #31 (fresh instance, cx-20260810-062712-e4d1, sol tier, +983,384-byte pack) FAILED v1.38 by winning the +sensitivity-design charge exactly as posed, while the machine +stayed clean a FIFTEENTH consecutive round. The literal v1.38 +wiring was confirmed — the auditor's own first/middle/last +corruption battery all detected, carrier removal exit 1, every +clause and flag individually forced, independent traversal +tracing matching my counts, and the 'X' load-bearing claim +confirmed by live measurement (0.182→1.252 ms pre-gate vs +1.729→95.766 ms post-gate at 8×). Then the two-part demolition: +the closure walker is LIFO — extend, then pop from the END — +so my "corrupted-last-shell" was visited FIRST, dying at one +w0lp_shape call, and the register's "only a sweep reaching the +deepest shell can flip it" was exactly backwards. More +decisively: an in-memory checker mutant that skips closure +traversal for slices of length ≥ 10 while special-casing the +('BAD',)-at-[-1] sentinel PASSED the complete wf.py at exit 0, +every sensitivity gate True, while genuinely corrupted middle +and first elements sailed through as []. A second mutant +canning occ_required for long all-'b' occurrences passed the +comp28/occ29 pairs the same way. My pairs pinned shallow shape +rejection, not the machinery. And "five pairs" was six — a +count error one round after the off-by-one. + +v1.39, predictions written first (both mutants REPRODUCED +before them — my first reconstruction of the canned-count +mutant put the scan before the memo and went accidentally +quadratic, failing the band; memo-first it passed, a small +lesson in how precisely a mutant must be built to be +defeated): CORRUPTIONS BECOME DEEP AND TRAVERSAL-LAST. +comp28/occ29's corrupt value is now a locally valid UNBOUND +all-'b' lp — one 'b' beyond the binders, well-shaped, rejected +only by the occurrence walk, which is precisely what the +canned-count mutant skips. shells30-rs/ks and cargo31's +corrupt element moves to slice position 0 — popped LAST under +the LIFO order, so a full drain is required to reach it +(measured at the full traversal count) — and is locally valid +with an unbound occurrence ('f' stepped at a Var), which is +precisely what the slice-skipping mutant never visits. The KD +kind's last key carries the same deep lp. THE DECISIVE +MEASUREMENT, exactly as predicted: both reproduced mutants now +EXIT 1, carrier removal still exits 1, every conjunct and flag +forcing holds — and all six instruments are byte-identical +INCLUDING wf, because only fixture construction moved +(conservation's suffix coincided a fourth consecutive time). +The false deepest-shell sentence and the five-vs-six count are +corrected in the register and marked in the v1.38 file (which +also inherits the design-defect miss itself). Register, +STATUS, token.md advanced; fresh audit #32 launched — the PASS +re-claim stays gated on it. Thirty-one audits; the machine +untouched; the fixtures now carry corruptions that only the +real machinery can see, verified by killing the exact mutants +that beat their predecessors. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index b96ba71..cfd0224 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.38.** The kernel is a scratch superposition evolver +**Status: v1.39.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -17,7 +17,7 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #31**, whose +The standing PASS re-claim is **gated on fresh audit #32**, whose verdict will be registered here. Kernel-arm provenance is the chronicle's per-row "what changed" column — summaries of it have been refuted twice by literal diff (audit #13 killed "unmoved @@ -25,7 +25,37 @@ since v1.11"; audit #14 showed the corrected two-wave summary still omitted v1.12's ordinary-decode burial-suppression change and mislabeled v1.21's binder/transport arms as "leaf" guards) — so this register now names arms exactly and only per version: -v1.38 changes REGRESSION FIXTURES ONLY — zero +v1.39 changes REGRESSION FIXTURES ONLY again — zero semantic +changes: audit #31 (machine clean a FIFTEENTH round; the +literal v1.38 wiring confirmed — its own first/middle/last +corruption battery detected by the shipped checker, carrier +removal exit 1, every clause and flag forced; the 'X' +load-bearing claim CONFIRMED by live measurement, 0.182→1.252 +ms pre-gate vs 1.729→95.766 ms post-gate at 8×) won the +sensitivity-design charge exactly as posed: the closure walker +is LIFO — extend, then pop from the END — so v1.38's +"corrupted-last-shell" was visited FIRST (one w0lp_shape +call), and an in-memory checker mutant skipping long-slice +traversal while special-casing the ('BAD',) sentinel PASSED +every gate at exit 0, with a second mutant canning the count +for long all-'b' occurrences passing the comp28/occ29 pairs — +the v1.38 pairs pinned shallow shape rejection, not the +machinery; and "five pairs" was SIX, a count error one round +after the off-by-one. v1.39: corruptions become DEEP and +TRAVERSAL-LAST — comp28/occ29's corrupt value is a locally +valid UNBOUND all-'b' lp (one 'b' beyond the binders; only +the occurrence walk can reject it — kills the canned-count +mutant), shells30-rs/ks and cargo31's corrupt element moves to +slice position 0 (popped LAST, a full drain required — +measured at the full traversal count) and is locally valid +with an unbound occurrence (kills the slice-skipping mutant), +the KD kind's last key carries the same deep lp. Both +reproduced mutants now EXIT 1, carrier removal still exits 1, +all conjunct and flag forcings hold, and ALL SIX instruments +are byte-identical INCLUDING wf — only fixture construction +moved. The false deepest-shell sentence and the five-vs-six +count are corrected below and marked in the v1.38 file. +Before that, v1.38 changed REGRESSION FIXTURES ONLY — zero wf()/wf7()/kernel/instrument-semantic changes: audit #30 (machine clean a FOURTEENTH round; the v1.37 count and docstring repairs verified exact, every fibre of all 19 @@ -48,14 +78,17 @@ measurement showed direction alone cannot gate traversal (carrier-free 'D' states also return []). v1.38: SENSITIVITY IS THE GATE — cargo31 moves in-language per the auditor's prescription (d='D', WF-clean [] gated at both sizes, -distinctness and band kept) with a corrupted-last-shell -control that must return exactly ['W0'] (only a sweep reaching -the deepest shell can flip it — carrier removal now exits 1 -with visibly different output); comp28, occ29 (both variants), +distinctness and band kept) with a corrupt-shell +control that must return exactly ['W0'] (carrier removal now +exits 1 with visibly different output; the round's own +"deepest shell" description was FALSE — the walker is LIFO +and visited that position first, audit #31's finding, +corrected in v1.39); comp28, occ29 (both variants), and shells30 (all three kinds) keep their 'X' timing methodology and gain small-n in-language sensitivity pairs -(genuine 'W0'-free, corrupted-last-element exactly ['W0'] — -five pairs, all gated in their flags); the fixture comments +(genuine 'W0'-free, corrupted-element exactly ['W0'] — SIX +pairs; the v1.38 text said five, audit #31's C1 refutation — +all gated in their flags); the fixture comments state the conjunction-structure facts; the v1.37 coverage miss is marked in its file (the second member of audit #28's fixture-coverage class). @@ -1126,7 +1159,7 @@ bodies (untypable), the `t` gate (ℤ[ω] reserved), outputs beyond {0̂, 1̂, I} (readback controller), and every §3 guard. **The PASS re-claim is gated on fresh-context independent audit -#31; the verdict will be registered here.** (Audit #16 caught +#32; the verdict will be registered here.** (Audit #16 caught this sentence stale; audit #19 caught it stale AGAIN despite the parenthetical promising otherwise — the promise is now an ASSERTION: the pack assembly script verifies §1 and §9 name the @@ -1248,8 +1281,10 @@ wf7 declining, and the n=8,000 valid deep-lp walk inside the linear band; composition linearity — the n-frames-one-lp family W0 at both sizes inside the linear band, with a distinct-lps no-aliasing control and a traversal-sensitivity pair (v1.38: -in-language genuine 'W0'-free, corrupted-last-frame exactly -['W0']); occurrence-memo — the distinct-shells/ +in-language genuine 'W0'-free; the corrupt frame — v1.39, +after audit #31's canned-count mutant defeated the shallow +sentinel — is a locally valid UNBOUND all-'b' lp that only +the occurrence walk can reject, exactly ['W0']); occurrence-memo — the distinct-shells/ shared-occurrence families inside the linear band, the stale-interleaving verdict pinned ['W0'], the fresh-call isolation control, and sensitivity pairs for both storage @@ -1259,9 +1294,13 @@ the linear band on the auditor's exact term shape, with sensitivity pairs for all three kinds; big-index/ slice-cargo — the Var(1< Date: Mon, 10 Aug 2026 09:31:46 -0400 Subject: [PATCH 064/107] =?UTF-8?q?qalc:=20kernel=20v1.40=20=E2=80=94=20th?= =?UTF-8?q?e=20claim=20shrinks=20to=20what=20the=20gates=20prove;=20the=20?= =?UTF-8?q?register=20sheds=20its=20history?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audit #32 (cx-20260810-083303-85da) FAILED v1.39 on C4's coverage wording — the machine clean a SIXTEENTH consecutive round. The finding: a fixture-aware checker mutant (canning long all-'b' occurrences except the exact length-13 corrupt; skipping long slices except a position-0 peek for the exact deep value) passes the complete suite at exit 0 — no finite fixed public fixture pins a fixture-aware implementation. Plus two wording defects: the blanket LIFO-last sentence (true only for the slice cases) and "locally valid lp" (contradicts w0lp_shape's own local predicate). v1.40 — comments, claim scope, and the register only; wf.py AST-identical; fixtures untouched: - §10 gains the sensitivity-scope statement (the auditor's required correction verbatim; what the pairs prove vs what no fixed fixture can; audit #32's mutant registered as the standing boundary witness, exit 0 BY CONSTRUCTION; the auditor's kit joins as kit 23) - terminology corrected everywhere current; the v1.39 chronicle row's phrases corrected in place with attribution - register decruft (a9's call): the preamble's 253-line "Before that," stack deleted per the file's own charter — §11 + ledger carry every round; load-bearing facts verified present in the body - scratchpad decruft by reference-scan (423 files to attic/ with manifest); the post-move battery CAUGHT the scan incomplete (assemble_v117.sh, a class never grep'd), comprehensive re-scan restored two files, third full battery pass clean; miss marked - all six instruments byte-identical (conservation suffix aside); three battery passes; kit 23 rows exactly as predicted; reduced forcing set 7/7 exit 1 (disclosed) Fresh audit #33 launched (cx-20260810-093110-a5e9, 1,034,226-byte pack); the PASS re-claim stays gated on it. Co-Authored-By: Claude Fable 5 --- docs/STATUS.md | 30 ++- docs/ledger/2026-08.md | 83 +++++++ docs/quantum-algebraic/kernel.md | 364 ++++++------------------------- docs/quantum-algebraic/token.md | 2 +- 4 files changed, 178 insertions(+), 301 deletions(-) diff --git a/docs/STATUS.md b/docs/STATUS.md index 40bcbfd..1c515af 100644 --- a/docs/STATUS.md +++ b/docs/STATUS.md @@ -413,10 +413,12 @@ and obligations register are `quantum-algebraic/token.md`; the failed rewriting drafts (v0/v1) are preserved read-only in `quantum-algebraic/machine.md`. `data/quantum-algebraic/` is reserved. -**The kernel is at v1.39** (`quantum-algebraic/kernel.md` — the +**The kernel is at v1.40** (`quantum-algebraic/kernel.md` — the current-only register; round-by-round history in `ledger/2026-08.md` -and the register's §11 chronicle). The audit loop's state after -twenty-seven fresh-context rounds. Kernel-arm provenance summaries +and the register's §11 chronicle, which as of v1.40 is the SOLE +history — the register's preamble delta stack is deleted per its +own charter). The audit loop's state after +twenty-eight fresh-context rounds. Kernel-arm provenance summaries have been refuted by literal diff twice (audit #13 killed "unmoved since v1.11"; audit #14 showed the corrected summary still incomplete), so the register now names arms per version @@ -671,10 +673,22 @@ sensitivity-design charge: the walker is LIFO, so the mutants — one skipping long slices while special-casing the shallow sentinel, one canning the occurrence count — passed every v1.38 gate at exit 0; "five pairs" was also six. v1.39 -(fixtures only): corruptions become deep and traversal-last — -locally valid unbound lps at the position popped last — and -BOTH reproduced mutants now exit 1, with all six instruments -byte-identical including wf. +(fixtures only): corruptions become deep — tuple-well-shaped +lps whose sole defect is an unbound occurrence, at the +position their enclosing scan reaches last — and BOTH +reproduced mutants now exit 1, with all six instruments +byte-identical including wf. Audit #32 (sixteenth +machine-clean round) then answered the epistemology charge +exactly as posed: a FIXTURE-AWARE mutant — special-casing the +exact corrupt length and peeking the exact deep value — +passes every gate at exit 0, and no finite fixed fixture can +pin a fixture-aware implementation. v1.40 (comments, claim +scope, and the register only; wf.py AST-identical): the claim +shrinks to what the gates prove — §10's sensitivity-scope +statement, with the auditor's mutant registered as the +standing boundary witness and their kit joining the roster — +and the blanket LIFO sentence and "locally valid" terminology +are corrected everywhere current. What the rounds still found was claim-language and scaffolding, each fixed the same @@ -701,7 +715,7 @@ prediction files). The open docket, in order: -1. **fresh-context independent audit #32 of the v1.39 h-fragment +1. **fresh-context independent audit #33 of the v1.40 h-fragment claim** (verdict to be registered in `kernel.md` §9); then the alias-tolerant transition theorem or λIAM logged-position uniqueness (the standing conditional — W9 diff --git a/docs/ledger/2026-08.md b/docs/ledger/2026-08.md index 13ad213..f496ef7 100644 --- a/docs/ledger/2026-08.md +++ b/docs/ledger/2026-08.md @@ -4182,3 +4182,86 @@ re-claim stays gated on it. Thirty-one audits; the machine untouched; the fixtures now carry corruptions that only the real machinery can see, verified by killing the exact mutants that beat their predecessors. + +## 2026-08-10 — qALC kernel v1.40: the claim shrinks to what the gates prove; the register sheds its history + +Audit #32 (fresh instance, cx-20260810-083303-85da, sol tier, +997,273-byte pack) FAILED v1.39 by answering the epistemology +charge exactly as posed, while the machine stayed clean a +SIXTEENTH consecutive round. Charge 1 CONFIRMED-SOUND: both +audit-#31 mutants independently rebuilt exit 1, carrier removal +exit 1, and the new corrupt variants traced at the full drain — +cargo31 12/12 lp pops with the unbound ('b','f','f') lp popped +last, its occurrence walk executing. Charge 3 GAP with strong +negative evidence: 137 reachable fire sources / 274 successors +one-head exact, 12,617 non-fire Run edges KS-preserving, arm +census 58/69/10/0, fifteen guards, the clamp differential at +60,000 graphs and the hollow-object audit at 110,232 +comparisons both zero-mismatch. C1 confirmed including a full +fresh recapture; C5 fresh corpus zero-hit; the v1.38 marking +verified complete and both corrected sentences verified true as +rewritten. Then the finding the round was designed to invite: a +FIXTURE-AWARE mutant — canning every long all-'b' occurrence +EXCEPT the exact length-13 corrupt, skipping every long slice +EXCEPT a position-0 peek for the exact ('L',('b','f','f'),()) +value — passes the complete wf.py at exit 0, every sensitivity +gate True, with neither deep mechanism running on the fixture +families. The auditor drew the boundary honestly: the fixtures +pin the shipped checker's extensional verdicts on the six fixed +pairs and cargo31, and they kill audit #31's family-oblivious +mutant class; they do NOT pin traversal as an implementation +strategy, and no finite fixed public fixture can — a mutant can +agree on any finite tested set and diverge elsewhere. Two +wording defects rode along: C4's blanket "placed where the LIFO +walker arrives LAST" was true only for the slice cases (comp28 +and both occ29 corrupts are last in ordinary LEFT-TO-RIGHT +rs/ks loops; KD's is the last key of a left-to-right all()), +and "locally valid lp" contradicted w0lp_shape's own docstring, +whose LOCAL predicate includes the occurrence walk the corrupt +values fail. + +v1.40, predictions written first (the fixture-aware mutant +REPRODUCED twice before them — the auditor's own kit rerun and +an independent reconstruction, both exit 0): the fix is a +SCOPE STATEMENT, not another sentinel. The corruption design +stays exactly as v1.39 built it; what changes is what the +register claims it proves. §10 gains the sensitivity-scope +statement — the auditor's required correction verbatim, then +the boundary: what the pairs prove (the shipped checker's +verdicts on the fixed families; the exhibited coarse mutant +class dead) and what no fixed public fixture can (a +fixture-aware implementation — machinery coverage past the +extensional gates would need instrumentation, hidden variants, +or differential testing, deliberately out of scope). Audit +#32's mutant is registered as the standing boundary witness: +the auditor's kit (audit_v139_fresh.py) joins the roster as +kit 23, and its mutant row reads exit 0 BY CONSTRUCTION, +permanently — the sentinel arms race terminates in the +statement, which is where it was always going to terminate. +The four wf.py comment sites are reworded (AST-identical +delta; all six instruments byte-identical, conservation's +timing suffix ending its four-round coincidence at 1.4s→1.5s); +the terminology is corrected everywhere current; the v1.39 +chronicle row's two "locally valid" phrases are corrected in +place with attribution. And a9's decrufting call, the second +of the loop: the register's preamble had accreted a +253-line per-version "Before that," stack in direct violation +of its own closing charter paragraph — deleted; §11's rows and +this ledger carry every round, and the spot-check confirmed +every load-bearing current fact already lives in the body +sections. The scratchpad got the same treatment by +reference-scan: unreferenced packs, capture generations, +headers, assemble scripts, and launch logs to attic/, every +kit-read artifact kept — and the round's own instrument earned +its keep: the post-move battery pass CAUGHT the scan +incomplete (audit_v117_fresh crashed reading assemble_v117.sh, +a filename class the scan never grep'd for), a comprehensive +re-scan restored that file plus assemble_v127.sh, and a third +full battery pass ran clean. The falsifier the predictions +file named — "a single failing kit falsifies the scan and +reverses the move" — fired and did its job; the miss is +marked. Register, STATUS, token.md advanced; +fresh audit #33 launched — the PASS re-claim stays gated on +it. Thirty-two audits; the machine untouched since v1.25; the +claim now says exactly what the evidence supports, which after +sixteen clean rounds is a great deal. diff --git a/docs/quantum-algebraic/kernel.md b/docs/quantum-algebraic/kernel.md index cfd0224..705861e 100644 --- a/docs/quantum-algebraic/kernel.md +++ b/docs/quantum-algebraic/kernel.md @@ -1,6 +1,6 @@ # qALC kernel — current register -**Status: v1.39.** The kernel is a scratch superposition evolver +**Status: v1.40.** The kernel is a scratch superposition evolver for qALC's quantum-control fragment (λIAM lineage, `h`-only, exact ℚ[√2]): the eight classical token rules plus gate probes that FIRE at boundaries with H-row amplitudes, instance-keyed @@ -17,297 +17,49 @@ table, and every failure mode typed — never silent. Shaped by a fresh-context adversarial audit loop and three working reviews; the round-by-round history, including the healing of audit #2's fatal witness `W`, lives in the chronicle (§11) and the ledger. -The standing PASS re-claim is **gated on fresh audit #32**, whose +The standing PASS re-claim is **gated on fresh audit #33**, whose verdict will be registered here. Kernel-arm provenance is the chronicle's per-row "what changed" column — summaries of it have been refuted twice by literal diff (audit #13 killed "unmoved since v1.11"; audit #14 showed the corrected two-wave summary still omitted v1.12's ordinary-decode burial-suppression change and mislabeled v1.21's binder/transport arms as "leaf" guards) — -so this register now names arms exactly and only per version: -v1.39 changes REGRESSION FIXTURES ONLY again — zero semantic -changes: audit #31 (machine clean a FIFTEENTH round; the -literal v1.38 wiring confirmed — its own first/middle/last -corruption battery detected by the shipped checker, carrier -removal exit 1, every clause and flag forced; the 'X' -load-bearing claim CONFIRMED by live measurement, 0.182→1.252 -ms pre-gate vs 1.729→95.766 ms post-gate at 8×) won the -sensitivity-design charge exactly as posed: the closure walker -is LIFO — extend, then pop from the END — so v1.38's -"corrupted-last-shell" was visited FIRST (one w0lp_shape -call), and an in-memory checker mutant skipping long-slice -traversal while special-casing the ('BAD',) sentinel PASSED -every gate at exit 0, with a second mutant canning the count -for long all-'b' occurrences passing the comp28/occ29 pairs — -the v1.38 pairs pinned shallow shape rejection, not the -machinery; and "five pairs" was SIX, a count error one round -after the off-by-one. v1.39: corruptions become DEEP and -TRAVERSAL-LAST — comp28/occ29's corrupt value is a locally -valid UNBOUND all-'b' lp (one 'b' beyond the binders; only -the occurrence walk can reject it — kills the canned-count -mutant), shells30-rs/ks and cargo31's corrupt element moves to -slice position 0 (popped LAST, a full drain required — -measured at the full traversal count) and is locally valid -with an unbound occurrence (kills the slice-skipping mutant), -the KD kind's last key carries the same deep lp. Both -reproduced mutants now EXIT 1, carrier removal still exits 1, -all conjunct and flag forcings hold, and ALL SIX instruments -are byte-identical INCLUDING wf — only fixture construction -moved. The false deepest-shell sentence and the five-vs-six -count are corrected below and marked in the v1.38 file. -Before that, v1.38 changed REGRESSION FIXTURES ONLY — zero -wf()/wf7()/kernel/instrument-semantic changes: audit #30 -(machine clean a FOURTEENTH round; the v1.37 count and -docstring repairs verified exact, every fibre of all 19 -certified programs independently rebuilt) found the first -executable defect in three rounds, a genuine -regression-coverage countermodel: regression 31's state used -d='X', and W0's conjunction short-circuits on the direction -check BEFORE the tape — the carrier was never traversed (0 -w0tok/w0lp_shape/occ_required calls), and REMOVING IT left the -complete instrument output byte-identical; the linear timings -were purity traversal. Reproduction with a counter-instrumented -copy scoped the class: the rs/ks loops run UNCONDITIONALLY -after the conjunction, so the frame/storage/KD timing families -(comp28/occ29/shells30) genuinely exercise their machinery -under 'X' — the 'X' is load-bearing there, early-returning -before the value-semantics-quadratic post-gate W2 duplicate -scan — but their traversal was equally UNGATED (the removal -countermodel kills them identically), and a same-verdict -measurement showed direction alone cannot gate traversal -(carrier-free 'D' states also return []). v1.38: SENSITIVITY -IS THE GATE — cargo31 moves in-language per the auditor's -prescription (d='D', WF-clean [] gated at both sizes, -distinctness and band kept) with a corrupt-shell -control that must return exactly ['W0'] (carrier removal now -exits 1 with visibly different output; the round's own -"deepest shell" description was FALSE — the walker is LIFO -and visited that position first, audit #31's finding, -corrected in v1.39); comp28, occ29 (both variants), -and shells30 (all three kinds) keep their 'X' timing -methodology and gain small-n in-language sensitivity pairs -(genuine 'W0'-free, corrupted-element exactly ['W0'] — SIX -pairs; the v1.38 text said five, audit #31's C1 refutation — -all gated in their flags); the fixture comments -state the conjunction-structure facts; the v1.37 coverage miss -is marked in its file (the second member of audit #28's -fixture-coverage class). -Before that, v1.37 changed NOTHING executable — documentation only, the -loop's second such round: audit #29 (machine clean a -THIRTEENTH round; the regression-31 rebuild verified GENUINE at -the bytecode level — LOAD_DEREF + BUILD_TUPLE against v1.35's -single LOAD_CONST, 99/799 shell identities and ONE occurrence -identity captured independently — with the SIBLING SWEEP clean: -every other fixture builds exactly the object graph its comment -claims; the three v1.36 comment corrections verified accurate; -fresh gauge, a new mixed sharing family linear, conservation -reproduced, forcing in full including distinct31 alone) found -the round's OWN correction off by one: cargo31 builds n−1 -shells — range(n−1), the gate proves len == n−1, the -measurements say 99/799 — while C4, §10, and the regression -comment, all three sentences written in v1.36 to fix the -previous multiplicity claim, said "n distinct shells"; plus -the cert_disjointness docstring omitting retained Q from its -spectator tuple (the implementation and §7.4 both carry it; -the docstring predates the v1.11 retention wiring), and the -fresh overclaim unmarked in v1.36's provenance. v1.37: both -current-claim sites now say n−1 with the reason (one shell per -'a' of the carrier occurrence — occ_required returns the -'a'-count past the binder, verified against the code before -registering); the docstring's spectator tuple gains retained -Q; the v1.36 misses marked in its file. -Before that, v1.36 changed NO kernel source and NO checker semantics — the -ninth consecutive checker-only round, one regression fixture -plus comments: audit #28 (machine clean a TWELFTH round; C1-C5 -confirmed in full — instruments reproducing stored bytes, fresh -AST-derived forcing 32/32 + 14/14 + 3/3, corpus zero-hit, gauge -8/1024 and 4/1024; the v1.35 corrections verified correct, the -layer-ten locator confirmed truthful against extracted v1.31 -source; the C3 boundary sentence ruled consistent under the -registered stable-runtime scope) found the C6 gap: REGRESSION -31 NEVER BUILT ITS CLAIMED FAMILY — its shell display was a -constant expression, folded by CPython to ONE LOAD_CONST, so -the "n distinct shells" were one shared object at every size, -and v1.33's outcomes had graded that coverage HELD (the third -unmarked provenance miss, now marked). v1.36: the shells are -runtime-built (the display references a named occurrence local; -a name cannot be a code-object constant), genuinely sharing ONE -occurrence object, and DISTINCTNESS IS GATED — the fixture -returns len({id}) == n−1 as a conjunct of its flag, printed; -the genuine family measures ['W0'] and linear (0.103 → 0.680 ms -at 8×, ~2× per doubling, matching the auditor's -reconstruction). The wording sweep: the two "no KD" comments -corrected to "empty KD bundle" (their own assertions require -('KD', ())); the W8 comment's "removes exactly the frames it -records" corrected to subtraction of surviving representations -(pop removes the popped frames but records only keys left with -no surviving representation — the riding-ticket control pops -into an empty bundle); §6 restates the stable-runtime scope -locally (the auditor's non-required suggestion, adopted); and -v1.35's own predictions file is marked for its -self-contradictory falsifier and five-vs-six instrument count. -Before that, v1.35 changed NO executable source AT ALL — the round is -comments and kit notes only, because audit #27's verdict was -the narrowest of the loop: "FAIL — documentation/display only; -no kernel or checker semantic repair indicated." C1-C6 SURVIVED -MECHANICALLY: raw-object totality CONFIRMED IN SCOPE (its -layer-13 harness deleted or __dict__-replaced all seven fields, -installed hostile values and a hostile dict subclass, hollowed -term nodes, and applied weakref/GC pressure — zero callback -executions; the sys.settrace TOCTOU and class-descriptor -attacks were judged OUT OF SCOPE, mutating the trusted runtime -rather than a finite stable input graph), and the -defaulted-field fallback CONFIRMED by 110,232 comparisons over -6,124 reachable states with zero mismatches. The two required -corrections: regression 32's COMMENT still carried the first -draft's "all seven → W0" while the code distinguished (fixed; -the guard comment likewise scoped), and the layer-ten kit's -line-302 locator needed its historical label (adjudicated in -the pack header). The auditor's refinement is adopted: -"extensionally the default Run" is exact FOR THE MACHINE'S AND -CHECKER'S OBSERVATIONS (wf/wf7/step/eq/hash/repr) — not for -intensional observers like vars(). Before that, v1.34 changed -NO kernel source — the eighth consecutive -checker-only round: audit #26 (machine clean a TENTH round; THE -CLAMP LEMMA CONFIRMED over 60,000 randomized shared DAGs -against an unclamped reference, zero mismatches, the auditor -restating the proof; the mixed-memo composition family linear; -all provenance repairs verified literal) found layer TWELVE: -DELETED FIELDS ON EXACT INSTANCES — object.__delattr__ on the -frozen dataclass yields an exact Run missing `path` (or a Lam -missing `body`, a Var missing `i`) that passes exact-type -dispatch and crashes on first field access. v1.34: FIELD- -PRESENCE GUARDS — hasattr for the seven Run fields right after -the exact-type dispatch (exact instances run no user code -under hasattr), getattr sentinels for term-node fields in the -validator's two passes; a discovered-in-round distinction -pinned: deleting a DEFAULTED field (vb/rs/ks) exposes the -dataclass's class-level default, so the state is extensionally -the default Run and adjudicates [] — documented fallback, not -a hole. Two kit-display items adjudicated: the layer11 kit -hard-codes a shifted line number (its reflag counter reads 0; -the auditor re-traced 63 real reflags — doctrine sound, display -stale), and the prior pack note misattributed two output rows -to the wrong kit (corrected). Before that, v1.33 changed NO -kernel source — the seventh consecutive -checker-only round: audit #25 (machine clean a NINTH round; -extend-once-per-slice CONFIRMED across tape→RS, RS→K, and -log→KA interleavings; the KD memo confirmed mechanically; the -post-gate W2 quadratic on shared deep instances ruled honestly -covered by the value-semantics doctrine) found layer ELEVEN: -BIG-INTEGER ARITHMETIC — Var(1<