Production Shard Checkpoints Pass Independent Replay, and Rice-Coded Sparse Overrides Shrink Both the Raw Stream and the Packaged Artifact: A Lifetime Cost Model Shows Scheduler Choice Depends on Replay Count and Continuation Cost

Round 18 (AMRAL-LUC-FC-R18, 2026-09-19) takes the two-layer proof stack that Round 17 left behind — the theorem-critical D₃ canonical wedge, and the performance-only Official default split / Tail-Window CPG override — and turns it into a persistable, independently replayable production-style shard checkpoint format, answering six interface questions under a fixed partition at seed depth 3 (S=2³=8 shard roots, each run independently to global depth 16): how topology is encoded (a preorder tree, 1 bit per node), how the leaf tag is encoded (2 bits distinguishing 00=SYM / 01=CERT / 10=PENDING / 11=RESERVED), how the non-default split axis is sparse-encoded, whether the verifier needs to re-run CPG, when Tail-Window's extra emitter cost can be recovered, and whether the checkpoint can really be replayed independently. A SYM leaf is not an area lower bound at all but the geometric condition y₃,min>√3·x₃,max itself — a root-domain quotient that the verifier recomputes directly, not a search heuristic; a CERT leaf is accepted only because the independent verifier does not trust the emitter's T_search=0.8350002 pruning buffer, and instead independently recomputes APR / REP / CORE against the actual proof target 0.835, accepting the leaf if any one of the three one-sided routes succeeds; a PENDING leaf can occur only at depth 16, and for as long as any remain, theorem_ready=false by definition. The default split axis (MISHRA-FIRST-ORDER, the largest of h_x3, h_y3, R5·h_φ5, h_x5, h_y5) never needs to be written into the certificate, since the verifier reconstructs it itself, and only the roughly one-tenth of internal nodes that override this default need encoding at all — rather than storing a flag on every internal node (still O(N_internal)), this round switches to event coding: each override records only the gap since the previous override index (Rice-coded with parameter k∈{0,…,6}, g_j=2^k·q_j+r_j, a unary quotient plus a k-bit remainder, each shard choosing its own shortest k) and a 2-bit rank for the non-default axis; on the verifier side, the round states explicitly that it does not reproduce CPG — it needs no knowledge of b3=0.025, the activation depth of 10, child scoring, tie-breaking, or the expected-prune model, and reads only the implicit default split, any explicit axis given by an override event, and whether the midpoint children cover the parent, i.e. "scheduler intelligence is not part of the proof premise." Measured results: the Official production checkpoint has N_O=12350 nodes and L_O=6179 leaves (SYM 109, CERT 3304, PENDING 2766, with all 3304 CERT leaves re-proved via the CORE route); the Tail-Window production checkpoint has N_T=10086 nodes and L_T=5047 leaves (SYM 106, CERT 2893, PENDING 2048, likewise all re-proved via CORE), with 573 override events across 4983 internal nodes for an override fraction of 11.37%, an 18.33% node-count reduction relative to Official, and a 25.96% PENDING reduction (718 fewer next-stage continuation obligations). Storing an explicit 3-bit axis on every Tail-Window internal node would cost 15117 bits; the Rice-coded sparse override events need only 3823 bits, 25.29% of that explicit-all-axis scheme; on raw binary streams, Official is 3094 bytes against Tail+Rice's 3011 bytes (2.68% smaller) — yet concatenating the streams alone and running zlib-9 makes Tail (1782 bytes) about 7.35% larger than Official (1660 bytes), because override-event entropy is higher, while the full shard directory (manifests, pending paths and streams together) zips to 25045 bytes for Official against 22263 bytes for Tail, 11.11% smaller, mainly because Tail has fewer nodes, a shorter pending frontier, and less manifest/path data. The independent verifier replays using only a handwritten monotone-chain convex hull, the shoelace area formula, and its own stream parser — never SciPy's ConvexHull, the CPG score or gate, or the emitter's split-choice logic — finishing the Official replay in 2.3140s and the Tail replay in 1.9887s, about 14.06% faster; the worst accepted CERT slack is 6.15×10⁻⁶ for Official and 1.14×10⁻⁵ for Tail, both positive, though the round still relies on the pilot-grade FP_PAD=10⁻⁹ rather than a publication-grade floating-point theorem. Emitter cost runs the other way: Official takes E_O≈6.98s against Tail's E_T≈17.32s, about 2.48× slower — the direct price of trading sparse lookahead for a smaller tree. To weigh this trade-off, Round 18 replaces a scheduler objective of raw emitter cost E with a lifetime cost model C = E + RV + κP + μB (E: one emit; V: one independent replay; R: the expected number of replay/audit passes; P: pending leaves; κ: the future continuation cost per pending obligation; B: artifact bytes; μ: a storage/network weight), and derives two break-evens from it: with κ=μ=0, solving E_T+RV_T