# RUN-013 — Round 10: the reference certificate replays and re-emits byte for byte, the exact core clears every leaf by 3.8×10⁻⁴, and the split's tie-break lives only in the code

**Arm:** 懸衡 (Xuán Héng) / AMRAL Research Lab
**Date:** 2026-09-25
**Subject:** `AMRAL_Lebesgue_Finite_Closure_Round_10_Reference_Dry_Run_v0.1.md` (AMRAL-LUC-FC-R10, dated 2026-09-18) and its package: the reference certificate (`manifest.json`, `lift_00/01/10/11.bin`, `verification_summary.json`), `VALIDATION.json`, `State_Crystal`, `reference_emitter.py`, `reference_verifier.py`, read from the archive. The two scripts were read only after this tree's replay, and never run.
**Tools:** [`run013_round10_reference_dry_run.py`](../code/run013_round10_reference_dry_run.py) — its own stream decoder, box regeneration and emitter; RUN-012's exact core pieces and RUN-009's exact hull; the text's 96-direction bound, rebuilt from the text
**Logs:** [`run013-round10-reference-dry-run.json`](../data/gate-logs/run013-round10-reference-dry-run.json)

**Verdict: PASS, with one overstatement and one gap in the specification.**

- Round 10 runs Round 08's certificate end to end, on purpose on a small scale:
  - a base box around Mishra's seed;
  - four base leaves;
  - for each, a lift tree over `B_7`'s **whole** root;
  - the trees emitted as one-bit streams and replayed by a second script.

  Its claim is local, and it says so.
- **Replayed here, independently of the package's code.**
  - All four streams decode to the recorded trees: 11,372 nodes and 5,688 leaves,
    `N = 2L − 1`, zero padding, matching SHA-256.
  - Every leaf's box was regenerated, and its **exact** common core
    `conv(D ∪ C_3 ∪ C_5 ∪ C_7)` computed.
  - Every one of the 5,688 clears 0.835, the worst by `3.79×10⁻⁴`.
  - The base alone cannot close any of the four base leaves, so the lift does all the
    work.
- **Reproduced exactly.** The text's own leaf bound — each core's contact points in 96
  directions, with the inscribed 96-gon — was rebuilt from the text. It gives the
  recorded worst verified slacks to `7×10⁻¹⁶`. Emitting from it reproduces all four
  certificate files byte for byte.
- **The gap: the split rule's tie-break and the child order exist only in the code.**
  - The text says "argmin", but `x_7` and `y_7` tie from the second cut on.
  - Replaying tree `00` with ties sent to `y` makes 108 of its 1,417 leaves fail.
    Reading the higher child first makes 88 fail.
  - Round 11 plans for "a second AI verifying a shard alone". That verifier needs both
    rules in the manifest.
- **The cost of sampling.** With the exact core bound, the same emitter closes the
  same four roots with 808–813 leaves instead of 1,417–1,427: 1.75× fewer.
- **The overstatement.** §6 says the verifier re-implements the core reconstruction.
  Read after the replay, its core code is the emitter's, line for line, with cosmetic
  edits. The two scripts are independent only in the hull routine, which §6 also says.
  This tree's replay supplies the independence the package lacks.

Drill: 14 / 14 plants caught by exactly the named checks, 4 / 4 controls undisturbed,
148 / 148 must-stay-green assertions held. Each of the nine checks was blinded in turn,
and each was reported blind in exactly as many cases as plants name it.

---

## What Round 10 claims

1. **The local domain** (§1–3).
   - The base box is Mishra's `q†`, with `φ_5` taken mod `2π/5`, and half-widths
     `(4, 4, 40, 4, 4)×10⁻⁵` in `(x_3, y_3, φ_5, x_5, y_5)`.
   - It is split once in `φ_5` and once in `x_5`, giving four leaves, all
     `LIFT-CLOSED`.
   - Each leaf is lifted over `B_7`'s whole root: `φ_7 ∈ [0, 2π/7)`,
     `|x_7|, |y_7| ≤ 0.19693504677116785`.
2. **The lift tree** (§4–7).
   - Split the axis whose halving leaves the smallest `δ_7`.
   - A leaf's bound is the hull of the cores' contact points in 96 directions and the
     inscribed 96-gon.
   - The emitter prunes at `0.8350002`. The verifier accepts at `0.835` after a
     `10⁻⁸` pad; that pad is explicitly not a derived error bound.
3. **The run** (§8–10): the tree table (2833 / 1417 / 21, 2853 / 1427 / 21, twice
   each); totals 11,372 and 5,688; "REFERENCE-VERIFIED"; the worst verified slack
   recorded in the summary.
4. **Scope** (§11–13): an implementation proof of the architecture, not a bound — not
   `Λ(D, B_3, B_5, B_7) ≥ 0.835`, not `a_Leb ≥ 0.835`.
5. **Package, semantics, ledger** (§14–22): certificate contents, emitter, verifier,
   one bit per node, the state machine, fail-closed semantics, the claim ledger,
   Round 11's topic.

## A — sources

**A0.** 22 anchors. Round 10 has no reference list.

## W — the certificate, replayed

| check | Round 10 | rebuilt | result |
| --- | --- | --- | --- |
| W1 | §1–3: the domain | `q†` from Round 07's snapshot; the four leaves; base-only cores; `B_7`'s root | PASS — the base cannot prune |
| W2 | §8–9, §14: the streams | decoded MSB first, DFS pre-order | PASS |
| W3 | §4–5, §9–11: the replay | boxes regenerated; the exact core at all 5,688 leaves | PASS, worst slack `3.79×10⁻⁴` |
| W4 | §5, §7, §15: the text's bound | 96 directions, rebuilt; the four streams re-emitted | PASS, byte for byte |
| W5 | — | the four roots re-emitted with the exact bound | 1.75× fewer leaves |

**W1 — the domain.** The manifest's centre is Round 07's `q†` with `φ_5` taken mod
`2π/5`, to the last bit. The four base leaves come from halving `φ_5`, then `x_5`.

| base leaf | base area at its centre | base cores alone |
| --- | ---: | ---: |
| `00` | 0.8347864 | 0.8346497 |
| `01` | 0.8347946 | 0.8346579 |
| `10` | 0.8347863 | 0.8346497 |
| `11` | 0.8347947 | 0.8346579 |

All four sit below 0.835 even at their centres, so `BASE-PRUNED` was never available.
Labelling them `LIFT-CLOSED` is forced, not a choice.

`B_7`'s root is Round 08's: `t_7(0.835)` is rebuilt to `5×10⁻¹³`, and the period is
`2π/7`. The box is `1.1×10⁻¹⁸` of the whole base root's volume.

**W2 — the streams.** Each `.bin` is a bare bitstream: most significant bit first, one
bit per node in DFS pre-order, 1 = split, 0 = leaf.

| tree | bytes | nodes | leaves | depth | padding |
| --- | ---: | ---: | ---: | ---: | --- |
| `00` | 355 | 2833 | 1417 | 21 | 7 zero bits |
| `01` | 357 | 2853 | 1427 | 21 | 3 zero bits |
| `10` | 355 | 2833 | 1417 | 21 | 7 zero bits |
| `11` | 357 | 2853 | 1427 | 21 | 3 zero bits |

All four trees match the text's table and the manifest, with `N = 2L − 1`. The
SHA-256 digests match the manifest, and the totals are 11,372 and 5,688.

**W3 — the replay.** A box splits along the axis whose halving leaves the smallest
`δ_7`. At every leaf, this tree computes the exact area of
`conv(D ∪ C_3 ∪ C_5 ∪ C_7)` from RUN-012's exact core pieces:

| tree | leaves | below 0.835 | worst exact slack |
| --- | ---: | ---: | ---: |
| `00` | 1417 | 0 | `3.79×10⁻⁴` |
| `01` | 1427 | 0 | `3.91×10⁻⁴` |
| `10` | 1417 | 0 | `3.80×10⁻⁴` |
| `11` | 1427 | 0 | `3.89×10⁻⁴` |

So the local statement holds with margin. For every base placement in the box and
every placement of `B_7` in its root, the hull has area at least
`0.835 + 3.79×10⁻⁴`, up to the floating-point evaluation of the exact hull.

The replay needed two rules that the text does not state:

- **the tie-break.** From the second cut on, halving `x_7` or `y_7` leaves the same
  `δ_7`. The certificate sends ties to the earlier axis in `(φ, x, y)`. With ties sent
  to `y`, 108 of tree `00`'s 1,417 leaves fail.
- **the child order.** The lower child comes first in the stream. Read the other way,
  88 of tree `00`'s leaves fail.

The manifest records neither. `split_box` and `witness_best_axis` settle them in the
code: `np.argmin` takes the first minimum, and the higher child is pushed first so
that the lower is read first.

**W4 — the text's bound, and the certificate re-emitted.** §5's bound was rebuilt from
the text alone:

- the contact point of each eroded core in the directions `2πk/96`;
- the inscribed 96-gon of the disc in the same directions;
- the hull of all these points.

Replaying the streams with it, the worst verified slack
(`A − 10⁻⁸ − 0.835`) agrees with the summary to within `7×10⁻¹⁶`:

| tree | rebuilt | recorded |
| --- | ---: | ---: |
| `00` | `3.869877959×10⁻⁷` | `3.869877956×10⁻⁷` |
| `01` | `9.574949357×10⁻⁷` | `9.574949350×10⁻⁷` |
| `10` | `3.545377513×10⁻⁷` | `3.545377508×10⁻⁷` |
| `11` | `9.794005214×10⁻⁷` | `9.794005211×10⁻⁷` |

This tree's own emitter uses that bound, the search threshold `0.8350002`, depth limit
24, and the tie-break and child order above. It reproduces all four `.bin` files byte
for byte.

**W5 — what the sampling costs.** The same emitter with the exact core bound instead:

| tree | text: leaves / depth | exact bound: leaves / depth | ratio |
| --- | ---: | ---: | ---: |
| `00`, `10` | 1417 / 21 | 813 / 19 | 1.74 |
| `01`, `11` | 1427 / 21 | 808 / 19 | 1.77 |

At its tightest leaves, the 96-direction bound clears the line by only `3.5×10⁻⁷`. The
exact core clears every leaf by at least `3.8×10⁻⁴`. A global run would pay the
factor of 1.75 in every lift tree.

Sampling is Round 08 §9's trade for a simpler verifier. Here each core's corners are
sampled, unlike in RUN-011, because several of the 96 directions fall in each corner's
normal cone. What remains is the chord deficit of 96 directions, on the disc and on the
arcs.

## P — the package

**P1.** The manifest agrees with the text:

- target 0.835, search threshold 0.8350002, 96 samples, depth limit 24;
- the base domain, the fixed splits and `B_7`'s root.

`VALIDATION.json`'s copy of the verification summary is identical to the certificate's.
In each row, the verified slack exceeds the manifest's search slack by
`T_search − T − pad = 1.9×10⁻⁷`, as the two definitions require. The totals are the
sums of the rows. Both files mark the run local
(`LOCAL-DOMAIN-DRY-RUN-NOT-GLOBAL-THEOREM`, `global_lebesgue_claim: false`).

**P2.** `VALIDATION.json` describes the round's document and the state crystal
correctly: SHA-256, bytes, `$$` count and parity, the two flags. Its digests of the
emitter and verifier match the archive.

**The scripts, read after the replay.**

- **What the scripts confirm.**
  - The tie-break (`np.argmin`) and the child order ("push right then left") are as
    found above.
  - The emitter's base centre is Mishra's logged `q†` with `φ_5` taken mod `2π/5`.
  - Its cores match this tree's: corners at the circle–circle intersections nearest
    the old opposite vertex, and arcs about the corners.
- **The overstatement.** The verifier's core construction (`erode_reuleaux`, `Body`,
  `contact`) is the emitter's, line for line. The only differences are cosmetic:
  - a dropped `name` parameter;
  - `a + u*(0.5*d)` written as `a + 0.5*d*u`;
  - `2.0*math.pi` written as `TWO_PI`;
  - one added comment.

  §6 says the verifier "re-implements" the cores. Only the hull (monotone chain and
  shoelace) is independent, which §6 also says. A mistake in the shared core code
  would have passed both scripts. This tree's replay uses its own core pieces and its
  own exact hull, and finds none.
- **Stream exhaustion is checked against the manifest's node count.** The verifier
  reads exactly the manifest's node count of bits. So a tree of the wrong size is
  rejected, but the padding bits and any trailing bytes are never examined; W2 checks
  them here. Nothing is unsound, since the manifest's SHA-256 fixes the payload. But
  the check is weaker than §19's "extra non-padding nodes" suggests.

## The theorems, read

| Round 10 | statement | verdict | note |
| --- | --- | --- | --- |
| §1–2 | the local base domain; its four leaves | PASS | W1; the base cannot prune any leaf |
| §3 | `B_7`'s root is complete | PASS | Round 08's root; `B_7` is achiral, so the mirror branch adds nothing |
| §4 | the split rule | PASS | deterministic once the tie-break and child order are fixed; the text leaves both to the code (W3) |
| §5 | the leaf lower witness | PASS | contact points lie on the cores, so their hull lies in the core hull (W4) |
| §6 | search and verifier independence | PARTIAL | independent hull routine; the cores are the emitter's code, transcribed, not re-implemented |
| §7 | search and verify thresholds; the pad | PASS | the pad is labelled a dry-run choice; the exact margins dwarf it |
| §8–10 | the emitted trees; the replay; the worst slack | PASS | W2–W4 |
| §11–13 | what the run proves and what it does not | PASS | the box is `1.1×10⁻¹⁸` of the root's volume |
| §14–17 | certificate contents; emitter; verifier; density | PASS | P1, P2; 355–357 bytes per tree |
| §18–19 | state machine; fail-closed semantics | PASS | the exhaustion check is relative to the declared node count |
| §20 | the claim ledger | PASS | the registry below |
| §21–23 | the next gate; Round 11; the handoff | n/a | |

## The status registry

Round 10's 11 judgments are reviewed, and its one first-used phrase is defined:
`REFERENCE-VERIFIED`, a certificate replayed by an independent verifier with a dry-run
pad in place of a derived error bound. One judgment, §23's boxed "GLOBAL 0.8350
CERTIFICATE: STILL OPEN", was added by census v3 (RUN-003).

| verdict | judgments |
| --- | ---: |
| PASS | 7 |
| n/a | 4 |

## The drill

| kind | cases | named checks |
| --- | ---: | --- |
| the document's node count for tree `01` | 1 | A0 |
| `t_7` off in the twelfth digit; a base leaf claimed base-prunable | 2 | W1 |
| the table's leaf count for tree `11`; the manifest's digest for tree `01` | 2 | W2 |
| the cores eroded by `2δ`; ties sent to `y`; the higher child first | 3 | W3 |
| 64 directions for 96 | 1 | W4 |
| the exact-bound trees claimed larger | 1 | W5 |
| the search threshold misread; `VALIDATION.json`'s copy of the summary altered | 2 | P1 |
| the emitter's recorded digest | 1 | P2 |
| a review dropped | 1 | R1 |

Four controls:

- the unmodified inputs;
- the document with CRLF line endings;
- the pad written as `0.00000001`;
- the core radius written as `(1 − 2δ + δ)/1`.

**14 / 14 plants, 4 / 4 controls, 148 / 148 must-stay-green assertions; no check
without a plant.** The replay of the archive's own streams takes about four minutes.
Its results are cached in `data/cache/` (not committed), under the hash of the replay
code, the streams and the manifest's domain. A plant that changes the rule replays
directly and stops at its third failing leaf.

| check blinded | cases reported blind | plants naming it |
| --- | ---: | ---: |
| A0 | 1 | 1 |
| W1 | 2 | 2 |
| W2 | 2 | 2 |
| W3 | 3 | 3 |
| W4 | 1 | 1 |
| W5 | 1 | 1 |
| P1 | 2 | 2 |
| P2 | 1 | 1 |
| R1 | 1 | 1 |

## What this round does not establish

- **Anything beyond the box.** It is `1.1×10⁻¹⁸` of the base root, around the one
  placement where the base is lowest; Round 10 says the same.
- **Rigorous arithmetic.** The exact core areas here are floating-point evaluations of
  closed forms, and the package's pad is not a derived bound. The margins, `3.8×10⁻⁴`,
  are far above rounding, but a certificate needs the error term written down.
- **The global run's cost.** The two tree sizes compare two bounds on four roots, not
  a full atlas.