# RUN-006 — Round 03: the placement certificate holds, and its sanity example could not have failed

**Arm:** 懸衡 (Xuán Héng) / AMRAL Research Lab
**Date:** 2026-09-24
**Subject:** `AMRAL_Lebesgue_Finite_Closure_Round_03_Placement_Certificate_v0.1.md` (AMRAL-LUC-FC-R03, dated 2026-09-18) and its package (`VALIDATION.json`, `State_Crystal`), read from the archive; the package's `sanity.py` was not run
**Tools:** [`run006_round03_placement_certificate.py`](../code/run006_round03_placement_certificate.py) — this tree's own grid linear programs (scipy 1.17, HiGHS), primal and dual solved separately; sympy for the reflection law
**Logs:** [`run006-round03-placement-certificate.json`](../data/gate-logs/run006-round03-placement-certificate.json) (random instances from a fixed seed, `20260924`); citation snapshot [`round03-citations.json`](../data/external/round03-citations.json)

**Verdict: PASS.** For a fixed candidate cover `U`, Round 03 turns every rigid
placement of every target into finite data — two reflection branches × `P`
orientations × an `M`-direction linear program — with explicit errors `η_M` (upper
side) and `ρ_P` (lower side). Every step holds. Its six `PROVED` are analytic, each
resting on standard convex analysis it names or implies.

- **The reflection watch item is honoured.** Round 03 writes the law for the mirrored
  branch (`h_K(φ − θ)`), takes the minimum over both `σ = ±1` in its finite grid
  value, and loops over both in its pseudo-algorithm. The watch item carried from
  RUN-002 and RUN-004 is satisfied here in definition, theorem and algorithm.
- **The branch is not a formality.** A chiral target `K` and a cover `U` built from its
  mirror image give a pair for which rotations and translations alone are *proved*
  to fail — by Round 03's own Theorem 17.1 applied to one branch — while a reflection
  fits with margin `−0.002`. A certificate that skipped `σ = −1` would give the wrong
  verdict.
- **The sanity example (§30) reproduces, and cannot fail.** Its margin is `−0.02` at
  *every* orientation in *both* branches, because the only binding constraint is the
  cover's minimal width, which no motion of a constant-width target can change. So
  `SANITY: PASS` could not have detected an error in orientation or reflection
  handling. The drill confirms it: with the reflection law replaced by the rotation
  law, the sanity recomputation stays green.

Drill: 16 / 16 plants caught by exactly the named checks, 5 / 5 controls
undisturbed, 231 / 231 must-stay-green assertions held; each of the twelve checks,
blinded in turn, is reported blind in exactly as many cases as plants name it — after
the blinding itself found one check no plant named (below).

---

## What Round 03 claims

Round 02 made the targets finite. Round 03 does the same for placements, for one
fixed convex candidate cover `U`:

1. **Reflections** are a discrete choice: `Q_{σ,φ} = R_φ S^{(1−σ)/2}`, and for `σ = −1`,
   `h_K(Qᵀu_θ) = h_K(φ − θ)` (§3).
2. **Translation**, for fixed orientation, is a convex problem whose value equals a
   dual over zero-mean probability measures (Thm 6.1); an optimal dual needs exactly
   two antipodal directions or three enclosing the origin (§7) — and Round 01's
   "one-active" branch is formally corrected (§8, `R01-CORRECTION-001`).
3. **Support directions**: on `M` equally spaced directions the value is a
   three-variable LP, and `m_M ≤ m ≤ m_M + η_M` with
   `η_M = L(1 + 2/cos(π/M))π/M` (§9–13).
4. **Orientations**: `m_σ` is `R_K`-Lipschitz in `φ`, and on `P` samples per branch
   `G − ρ_P ≤ M_U(K) ≤ G + η_M`, `ρ_P = R_Kπ/P` (Thm 17.1).
5. Merged with Round 02's dictionary, a fixed `U` is **certified universal** when the
   worst upper bound plus the shape error is `≤ 0`, and **certified non-universal**
   when some dictionary shape's lower bound is `> 0` (§20–23). Universality pays only
   `η_M`, non-universality only `ρ_P` — the quantifier `∀K ∃g` in the error budget
   (§25–26).

No bound on `a_Leb` is claimed (§35, §37).

## A — sources

**A0.** 11 anchors pin the formulas and the sanity instance to the document, including
the pseudo-algorithm's `FOR sigma in {+1, -1}`. **A1.** The one new reference,
Rockafellar's *Convex Analysis*, exists (Princeton University Press, 1970,
doi:10.1515/9781400873173); the others were verified in RUN-002 and RUN-004.

## B — the recomputations

| check | Round 03 | recomputed | result |
| --- | --- | --- | --- |
| B1 | §3: `Q_{σ,φ}` has determinant `σ`, and `Q_{σ,φ}ᵀu_θ = u_{θ−φ}` or `u_{φ−θ}` | symbolically | PASS |
| B2 | Thm 6.1, §7, §10–11: primal = dual; an optimal dual vertex has 2 or 3 nonzero weights; 2 means antipodal at `½` | 168 grid LPs (`M = 96`) on 12 random instances, both branches, 7 orientations each; primal and dual solved as separate LPs | PASS — 63 two-active, 105 three-active; values agree to `10⁻⁹` |
| B3 | §12: `‖t*_M‖ ≤ 2L/cos(π/M)` | 120 grid LPs | PASS |
| B4 | Thm 17.1 | **under attack** — see below | PASS |
| B5 | §13, §17: `η_M`, `ρ_P`, and §30's bracket from its recorded `G` | the formulas against the package's record | PASS — `η₆₄ = 0.25349455…`, `ρ₄₈ = π/48` |
| B6 | §30: the sanity instance and its reference | this tree's own LPs, `M = 64, P = 48` and `M = 512, P = 192` | PASS — `−0.02` both, matching the record |
| B7 | — | the exact value of §30's margin | see below |
| B8 | the package's description of the document | SHA-256, bytes, `$$` count against the archive | PASS |
| B9 | the reflection branch matters | a constructed pair | see below |

The random instances (fixed seed) come from three regimes, chosen so that
orientation and reflection actually matter somewhere: ellipses, round covers without
mirror symmetry, and round covers with a strongly triangular chiral target. That
three-active witnesses outnumber two-active ones in B2 shows the instances reach
beyond the width-bound case described below.

**B4 — Theorem 17.1 under attack.** The theorem gives, for one instance, a bracket
`[G − ρ_P, G + η_M]` around the true margin at every resolution. Two resolutions of the
same instance must therefore give intersecting brackets; disjoint brackets would be a
counterexample. On six instances, a coarse grid (`M = 16, P = 12`) and a fine one
(`M = 256, P = 96`):

| instance | coarse bracket | fine bracket |
| ---: | --- | --- |
| 1 | [−0.4229, 0.8656] | [−0.1938, −0.0978] |
| 2 | [−0.2988, 0.9051] | [−0.0693, 0.0216] |
| 3 | [−0.3161, 0.8810] | [−0.0865, 0.0039] |
| 4 | [−0.3246, 1.0098] | [−0.0955, 0.0034] |
| 5 | [−0.3340, 0.8813] | [−0.1046, −0.0130] |
| 6 | [−0.3112, 0.8960] | [−0.0813, 0.0097] |

Every fine bracket lies inside its coarse one. No counterexample. Four of the six fine
brackets still straddle zero: at that resolution the certificate would say
`REFINE`, which is what §24 says it should.

## The sanity example, and why it could not fail

§30 tests the pipeline on an ellipse with semi-axes `0.72` and `0.52` and a legal
chiral target, `r = ½ + 0.22 cos 3θ + 0.10 sin 5θ`. The document reports only
`SANITY: PASS`; the package records the numbers. This tree's own LPs reproduce them:
the coarse value `G₆₄,₄₈ = −0.02` and the dense reference `G₅₁₂,₁₉₂ = −0.02` (B6).

Both are `−0.02` to thirteen decimals — and so is **every** sampled orientation, in
both branches: all 96 on the coarse grid and all 384 on the dense one. The package's
"best orientation" (index 33, `σ = −1`; index 47, `σ = +1`) is a tie-break among
equals. The reason is exact (B7):

> For any placement, take the two directions along the cover's minor axis. The target
> has width 1 in every direction, the cover has width `2 × 0.52 = 1.04` along that
> axis, so the larger of the two slacks is at least `(1 − 1.04)/2 = −0.02` —
> `max(a(π/2) + t_y, a(3π/2) − t_y) ≥ (a(π/2) + a(3π/2))/2`, and
> `a(π/2) + a(3π/2) = 1 − 1.04` because `h_K(v) + h_K(−v) = 1`.

So `M_U(K) ≥ −0.02` for this target, for every rotation, reflection and translation at
once. In the other direction, B7 exhibits a placement whose margin, sampled at 2×10⁶
directions, is `−0.0199999846`; adding the most the function can rise between samples
gives the rigorous `M_U(K) ≤ −0.0199972`. The margin is `−0.02` to within `3 × 10⁻⁶`.

The consequence for §30 as a test: the only constraint that binds is the cover's
minimal width, which no motion of a constant-width body can change. Orientation and
reflection play no part. A pipeline that skipped `σ = −1`, or wrote its law wrong,
would have produced the same `−0.02` and the same `PASS`. The drill makes this
concrete: plant M1 replaces the reflection law by the rotation law; B1 and B9 catch
it, and **B6 — the recomputation of §30 — stays green.**

This is not an error in Round 03's mathematics; it is a test that could not have
failed on the thing it was there to test. A useful sanity instance needs a cover
whose binding constraints are not an antipodal pair — a rounder cover, a more
triangular target, no mirror symmetry — as B2's instances show exist.

## B9 — why the reflection branch cannot be skipped

Take the chiral target `K` with `r = ½ + 0.30 cos 3θ + 0.12 sin 5θ`, and let `U` be
`K`'s mirror image enlarged by `ε = 0.002` — `h_U(θ) = h_K(−θ) + ε`.

- **Reflected, `K` fits:** at `σ = −1, φ = 0, t = 0` the slack is `−ε` in every
  direction (residual `5 × 10⁻¹⁷`), so `M_U(K) ≤ −0.002`.
- **Rotated, it does not:** a rotation by `4π/3` matches the third harmonic exactly, but
  the fifth harmonic of amplitude `0.12/24 = 0.005` cannot be matched, and no
  translation touches it. Applying Theorem 17.1's lower side to the `σ = +1` branch
  alone, with `P = 720`, `M = 512` and a certified `R_K = 0.54204`:
  `G₊ − ρ_P = 0.0029998 − 0.0023651 = 0.00063 > 0`. No rotation and translation
  places `K` in `U`.

A certificate that enumerated only rotations would declare this pair a failure; with
reflections it is a fit with margin `−0.002`. The linear programs are floating-point
(HiGHS, tolerance about `10⁻⁹`); the certified gap `6.3 × 10⁻⁴` is five orders of
magnitude above it. Round 03 enumerates both branches, so this is not an error found
in the corpus — it is the reason the watch item exists, shown on a concrete pair.

## C — the theorems, read

| Round 03 | statement | verdict | note |
| --- | --- | --- | --- |
| §1 | `M_U` is translation-invariant in `U`; `R_U ≤ D_U`; `R_K ≤ 1` | PASS by cited theorem | the Steiner point lies in `K` |
| §2–3 | signed margin; two reflection branches | PASS | B1 |
| §4–5 | the translation minimum exists, `‖t*‖ ≤ 2L` | PASS | coercivity |
| Thm 6.1 | primal = zero-mean dual | PASS by cited theorem | weak duality direct; strong duality via the subdifferential of a maximum of affine maps and Carathéodory; B2 |
| §7 | 2 active means antipodal at `½`; 3 active means origin-enclosing | PASS | |
| §8 | Round 01's one-active branch is impossible | PASS | the same correction RUN-004 made independently |
| §9–13 | grid LP, dual, translation bound, `η_M` | PASS by cited theorem | LP duality; B2, B3, B5 |
| §14 | local `η` from a verified `‖t_M‖` | PASS | |
| §15–17 | orientation Lipschitz; Thm 17.1 | PASS by cited theorem | inherits `R_K ≤ 1`; B4 |
| §18–24 | interval enclosure; witness schema; merge with Round 02; the two rules; the ambiguous zone | PASS | |
| §25–26 | the error budget and its quantifier asymmetry | PASS | correct: a sampled orientation that fits is a real witness, so universality never pays `ρ_P` |
| §29 | the pseudo-algorithm | PASS | loops over both `σ` |
| §30 | sanity | PASS as reported; uninformative as a test | above |

## The status registry

Round 03's 16 judgments are reviewed and its 3 first-used phrases defined (`EXPLICIT`;
`RECORDED`; and `R01-CORRECTION-001`, an identifier rather than a status). Its six
`PROVED` — continuous translation dual, finite support LP, support-grid error,
orientation Lipschitz, full placement bracket, shape-and-placement certificate — are
all analytic, and all rest on standard convex analysis: `PASS by cited theorem`.

| verdict | judgments |
| --- | ---: |
| PASS | 6 |
| PASS by cited theorem | 7 |
| n/a | 3 |

## The drill

| kind | cases | named checks |
| --- | ---: | --- |
| reflection law replaced by the rotation law | 1 | B1 + B9 (**not** B6) |
| rotation law replaced by the reflection law | 1 | B1 + B9 |
| only 3-active duals allowed | 1 | B2 |
| translation bound `10⁻⁶` | 1 | B3 |
| `η_M` missing its factor 2; `ρ_P` halved | 2 | B5 |
| both error terms dropped | 1 | B4 + B5 + B6 |
| recorded `G` altered | 1 | B5 + B6 |
| recorded reference altered | 1 | B6 |
| width bound claimed `−0.03` | 1 | B7 |
| B9's `ε` above the chirality gap `0.005` | 1 | B9 |
| `η_M`'s formula edited in the document | 1 | A0 |
| the package's recorded SHA-256 | 1 | B8 |
| the reference's title | 1 | A1 |
| a review dropped; a definition dropped | 2 | R1 |

Controls: the unmodified inputs; the law written `σ(θ − φ)`; `η_M` written with a
secant; the document with CRLF line endings; a recorded value moved by `10⁻¹⁵`.

**16 / 16 plants, 5 / 5 controls, 231 / 231 must-stay-green assertions.**

**A gap the drill-of-the-drill found.** The first version of this drill had fifteen
plants and passed them all — and none of them named B4. B4 had only ever been green:
the plants that weaken `η_M` or `ρ_P` shrink the brackets without making any pair
disjoint, so B4 never had to fire. Blinding B4 in turn reported it blind in *zero*
cases, which is how it showed. The plant "both error terms dropped" was added: with no
error terms each bracket collapses to its grid value, and two grids give two different
values. It trips B4 on the random instances, B5 against the record, and — not predicted
at first — B6 as well, whose own bracket test on the sanity instance sees the two grid
values differ in the last bit. From this round on the drill summary flags, by name, any
check no plant names.

| check blinded | cases reported blind | plants naming it |
| --- | ---: | ---: |
| A0 | 1 | 1 |
| A1 | 1 | 1 |
| B1 | 2 | 2 |
| B2 | 1 | 1 |
| B3 | 1 | 1 |
| B4 | 1 | 1 |
| B5 | 4 | 4 |
| B6 | 3 | 3 |
| B7 | 1 | 1 |
| B8 | 1 | 1 |
| B9 | 3 | 3 |
| R1 | 2 | 2 |

## What this round does not establish

- Anything about a real candidate cover. Round 03 builds the certificate for a *fixed*
  `U`; running it on Pál's or Gibbs' cover is its deferred C03-1.
- An independent verifier in the sense of C03-4 — this tree's LPs are independent of
  the package's, but they are floating-point, not interval-certified.
- Anything about the candidate-cover optimization, which is Round 04.