# RUN-021 — Round 18: both checkpoints decode, re-prove and re-emit byte for byte; the tail forest is not Round 17's tail window, three conventions of the format are unstated, and the shipped verifier never reads the pending frontier **Arm:** 懸衡 (Xuán Héng) / AMRAL Research Lab **Date:** 2026-09-25 **Subject:** `AMRAL_Lebesgue_Finite_Closure_Round_18_Production_Shard_Emitter_v0.1.md` (AMRAL-LUC-FC-R18, dated 2026-09-19) and its package, read from the archive: - `FORMAT_SPEC.json`, `BENCHMARK_SUMMARY.json`, `COST_POLICY.json`, `VALIDATION.json`, `State_Crystal`; - both certificates: eight shards each, with topology, leaf-tag and override streams, manifests and pending paths, plus global manifests, pending frontiers and zipped copies; - the emitter's and verifier's summaries and stdout; - `production_shard_emitter.py`, `production_shard_verifier.py` and `round16_base_pilot.py`, read only after this tree's reconstruction, and never run. **Tools:** [`run021_round18_shard_emitter.py`](../code/run021_round18_shard_emitter.py) — a decoder built from the text's grammar and the format spec; the re-proof of every CERT leaf (the pilot's sampled bound and exact cores); an emitter re-writing both forests; RUN-019's routes and RUN-020's D3 root **Logs:** [`run021-round18-shard-emitter.json`](../data/gate-logs/run021-round18-shard-emitter.json) **Verdict: PASS for both checkpoints and the Rice events; PARTIAL for the grammar as specified and for the cost model's calibration.** - **Both checkpoints hold, independently of the shipped verifier.** - Decoded from the text's grammar (§3, §9–10) and the format spec, both certificates give exactly their manifests' and the text's counts: - official: 12,350 nodes, 109 SYM, 3,304 CERT, 2,766 PENDING; - tail: 10,086 nodes, 106 SYM, 2,893 CERT, 2,048 PENDING, and 573 override events in 3,823 Rice bits. - Every digest, bit count and pending file agrees. Every SYM leaf lies outside the wedge, and every PENDING leaf sits at depth 16. - Every CERT leaf is re-proved by CORE. With the pilot's 40-direction bound the worst slacks are 6.150×10⁻⁶ and 1.144×10⁻⁵, the verifier's to 6×10⁻¹⁶. With exact cores every leaf clears 0.835 by at least 2.39×10⁻³. - **Both forests re-emit byte for byte.** - The official forest re-emits from the text alone: the D3 root split officially to depth 3, closing at `T_search = 0.8350002`, streams in preorder. - The tail forest re-emits byte for byte only with one rule its emitter adds: the lookahead does not count a SYM child as certified, as Round 17's does. That rule opens the window more often. - So the certificate is not Round 17's tail window. Round 17's rule gives Round 17's tree here (9,990 forest nodes, 536 overrides), not the certified 10,086 and 573. - **Three conventions of the grammar are stated nowhere.** - The format is: bits most significant first, the lower child first, and unary as ones closed by a zero. - The text and the spec give none of the three. Only the data fixes them: each alternative fails to decode. - One more rule lives only in the code: the order in which the streams are concatenated for zlib. - **The shipped verifier checks less than §29 and §31 say.** - Its parser and its hull (monotone chain, shoelace) are its own. Its bodies, contact points and erosion cores are transcribed from Round 16's code, as RUN-013 found for Round 10. - It never opens `pending_paths.txt` or `pending_frontier.txt`, so "Pending frontier preservation: PASS" is not its finding. It is this tree's, and it holds. - It never compares a manifest's counts with what it decodes. - Its forest identity holds by construction once a decode succeeds. - **The cost model is arithmetic of four single timings, one of them inflated.** - The tail emitter re-evaluates every internal node's box to test the window gate, a value the node already holds. That is 5,039 of its 30,229 evaluations. - By evaluation counts the tail/official ratio is 2.45 as run and 2.04 without the redundancy. - So the break-evens `R⋆ ≈ 31.79` and `κ > 0.0144 s` are overstated. The preference they support, the tail window for long runs, only gets stronger. - **The text's "internal nodes: 4983" (§14) is wrong.** - The tail forest has 5,039, as its own 11.37% (573 / 5,039) and 15,117 bits (3 × 5,039) show. - **The rest of the arithmetic is right.** - Every reduction, fraction and size in §15–24 recomputes from the certificates and the recorded timings. - The zipped certificates are 25,045 and 22,263 bytes. - Concatenated and zlib-9 compressed, the streams are 1,660 and 1,782 bytes. - **Round 18 also exposed a third blind spot in this tree's status census.** - Statuses joined by `+`, such as `IMPLEMENTED + VERIFIED`, were not read. - The census v4 correction (commit `31fcefd`) adds five, two of them Round 18's. Drill: 17 / 17 plants caught by exactly the named checks, 4 / 4 controls undisturbed, 170 / 170 must-stay-green assertions held. Each of the nine checks was blinded in turn, and each was reported blind in exactly as many cases as plants name it. --- ## What Round 18 claims 1. **The format** (§1–12). - The D3 root is split by the implicit official rule to seed depth 3: eight shard roots, each emitted to global depth 16. - Topology is 1 bit a node in preorder. Leaf tags take 2 bits: `00` SYM, `01` CERT, `10` PENDING. - SYM is a quotient proof, CERT is re-proved by the verifier at 0.835, and PENDING only at depth 16. - The default axis is implicit. Overrides are events: Rice-coded gaps `g_j = i_j − i_{j−1} − 1` with the best `k ∈ {0, …, 6}` per shard, plus a 2-bit rank among the four other axes. - The verifier never reproduces CPG. The forest identity is `N = 2L − S`. 2. **The two checkpoints** (§13–18). - Official: 12,350 nodes and 2,766 PENDING. - Tail window: 10,086 nodes, 2,048 PENDING and 573 overrides, 11.37% of 4,983 internal nodes. - Nodes −18.33%, PENDING −25.96%. - The Rice events take 3,823 bits against 15,117 explicit (25.29%). - Raw streams: 3,094 and 3,011 bytes. zlib-9: 1,660 and 1,782. ZIP: 25,045 and 22,263 (−11.11%). 3. **Replay and emission** (§19–21). - An independent verifier (its own geometry, monotone-chain hull, shoelace and parser) replays in 2.3140 and 1.9887 s. - Worst CERT slacks: 6.15×10⁻⁶ and 1.14×10⁻⁵. - Emitters: 6.98 and 17.32 s (2.48 times). 4. **Cost** (§22–26). `C = E + RV + κP + μB`, with `R⋆ ≈ 31.79` and `κ > 0.0144 s` per saved pending leaf. The tail window is preferred for long runs, the official split for one-shot benchmarks. 5. **Status and Round 19** (§27–33). - Every CERT leaf closes by CORE. - All shards are EXPANDED. - The checkpoint semantics: no hidden branch. - The final delta, the ledger, and Round 19's topic. ## A — sources **A0.** 59 anchors. Round 18 has no reference list. ## W — rebuilt | check | Round 18 | rebuilt | result | | --- | --- | --- | --- | | W1 | §2–12 | both certificates decoded from the text's grammar | PASS; three conventions fixed only by the data | | W2 | §4–6, §20, §27 | every leaf re-proved | PASS | | W3 | §13–14 | both forests re-emitted | PASS; the tail forest needs a rule Round 17 did not have | | W4 | §14–24 | sizes, evaluations, the cost arithmetic | PASS as arithmetic; §14's 4,983 is wrong; the timings are inflated | | W5 | §19, §29, §31 | the shipped verifier and emitter, read | the verifier omits the pending files and the manifests' counts | **W1 — decoding.** - The eight seed boxes come from RUN-020's D3 root, split by the official rule to depth 3. Seed path `000` is the lower half three times. - Each shard's topology is read in preorder, 1 for a split; each leaf takes its 2-bit tag in turn. An internal node's axis is the official one unless an override event names it. - The event's gap counts internal nodes in preorder. - Its rank indexes the four other axes in increasing order. - Both certificates decode exactly as their manifests record: | | nodes | internal | leaves | SYM | CERT | PENDING | overrides | Rice bits | | --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | | official | 12,350 | 6,171 | 6,179 | 109 | 3,304 | 2,766 | 0 | 0 | | tail window | 10,086 | 5,039 | 5,047 | 106 | 2,893 | 2,048 | 573 | 3,823 | Both satisfy `N = 2L − 8`. - Every stream's SHA-256, byte count and bit count are its manifest's. Every shard manifest is the one its global manifest records. - Each `pending_paths.txt` is its shard's PENDING leaves in preorder, and each `pending_frontier.txt` is all of them sorted. - No leaf carries the reserved tag. - **Three conventions come from the data.** The text and the spec do not say: - whether bits are read from a byte's high or low end; - which child comes first; - whether unary is ones closed by a zero or the reverse. The data settles each. Decoding the tail certificate LSB-first, higher child first, or with zeros-then-one unary fails every time: streams run out, counts disagree, a SYM leaf lands inside the wedge. So a second implementer can find the format by trial, and only by trial. Round 11's digests were recoverable the same way (RUN-014). **W2 — the leaves.** - Every SYM leaf satisfies `y₃⁻ > √3 x₃⁺`, and every PENDING leaf is at depth 16 (W1). - Every CERT leaf is re-proved by RUN-019's routes at 0.835, with the verifier's order APR → REP → CORE: | | CERT | by CORE | worst slack, pilot's bound | worst slack, exact cores | | --- | ---: | ---: | ---: | ---: | | official | 3,304 | 3,304 | 6.150283528×10⁻⁶ | 2.3857×10⁻³ | | tail window | 2,893 | 2,893 | 1.144322404×10⁻⁵ | 2.3857×10⁻³ | - The sampled slacks are the verifier's to 6×10⁻¹⁶. The exact cores add what the verifier cannot: its geometry is the emitter's (W5), and the exact bound is not. Every leaf closes, with some 390 times the pilot's worst margin. **W3 — re-emission.** - **Official.** The D3 root is split officially to depth 3. Each shard is refined level by level: - `SYM` first, with the 10⁻¹⁵ margin; - then the best of APR, REP and CORE against `T_search = 0.8350002`; - PENDING at global depth 16. Written in preorder, most significant bit first, all eight shards' topology and tag streams are the certificate's byte for byte. The override files are empty. - **Tail window.** Round 17's tail rule, rebuilt in RUN-020, gives Round 17's own tree here: 9,990 forest nodes (its 9,997 less the 7 above the seeds) and 536 overrides. It is not the certificate. - The emitter, read then, differs in one place. Its lookahead evaluates a SYM child like any cell, so the child counts as certified only when its bound closes it. That happens both when the window's gate asks whether the official split certifies a child and when an alternate is scored. With that rule every shard's three streams, and its Rice `k`, are the certificate's byte for byte. - The certified tail forest is therefore a variant of the scheduler Round 17 recommended. It is sound: a lookahead rule is performance-only, and every leaf holds (W2). But §0 and §33 present it as Round 17's tail window made production. - Round 17's rule would give fewer overrides (536) and a slightly smaller forest. - **Evaluations.** Per shard the emitter records: - `1 + 2I` evaluations for the official scheduler: every internal node evaluates its two official children; - `1 + 3I + 2A` for the tail window: `A` is the alternates evaluated, 7,552 in all. All sixteen shards agree with their manifests. **W4 — the numbers.** - From the decoded certificates, the files and the recorded timings, every fraction in the benchmark's comparison recomputes to 10⁻¹²: - nodes −18.33%, PENDING −25.96% (718 leaves); - raw streams −2.68%, zip −11.11%, zlib +7.35%; - override fraction 11.37%, Rice 25.29% of 15,117 bits; - emitter 2.48 times, replay −14.06%, `R⋆ = 31.794`, `κ = 0.014406 s`. - The zlib figure compresses the eight shards' streams concatenated in sorted path order, a rule only the code states. - **§14's internal count.** "internal nodes: 4983" is wrong. The tail forest has 5,039, which is also the denominator of §14's own 11.37% and §16's 15,117 = 3 × 5,039. - **The evaluations behind the emitter's time.** - The tail emitter evaluates every internal node's own box a second time, at 0.835, to test the window's gate `best ≥ T − 0.025`. The node already holds that value from its evaluation at 0.8350002; the two differ only in REP's `4Tτ` term, and REP is never the maximum. - That is 5,039 of 30,229 evaluations (16.7%). - Official emission takes 12,350. The ratio is 2.45 as run and 2.04 without the redundancy. §21's timing ratio, 2.48, tracks the first. - Timings are not reproducible, so this is a count, not a clock. By that count, the extra emitter cost the break-evens charge to the tail window is 1.45 official emissions, and 0.41 of it is the redundancy. **W5 — the shipped code, read after the rebuild.** | | fact | | --- | --- | | verifier: stream parser, hull | its own (bit reader; monotone chain; shoelace) | | verifier: bodies, contact points, erosion cores | transcribed from Round 16's code: the same constructions and tolerances, the erosion's corner rule verbatim | | verifier: `pending_paths.txt`, `pending_frontier.txt` | never opened | | verifier: a manifest's counts against the decode | never compared | | emitter: SYM in the lookahead | not tested; a SYM child is evaluated as a cell | | emitter: the window's gate | re-evaluates the parent box | - The verifier's forest identity `nodes = 2·leaves − roots` holds by construction once every shard decodes, and its per-shard identity reads the manifest's own numbers. Neither can fail on a certificate the parser accepts. - The checks that matter, SYM geometry and CERT re-proof, are real. The two omissions matter for §28–29: the pending frontier is the checkpoint's continuation contract, and nothing in the shipped verification binds it to the streams. Here it is bound (W1). ## P — the package **P1.** - The benchmark's emitter blocks are the two global manifests, and the emitter's summary and stdout are both. - The verifier's summary and stdout are the benchmark's verifier blocks. - The cost policy's figures are the benchmark's. - The format spec states the text's grammar. - The crystal carries the same numbers, rounded as the text rounds them. **P2.** - `VALIDATION.json` describes the document and the crystal correctly: SHA-256, bytes, `$$` 200 and 38, the two flags. - Its digests of the format spec, the benchmark, the cost policy, the emitter and the verifier are the archive's. - Its eight checks each follow from the data, from `official_verified` to `global_claim_false`. - `round16_base_pilot.py` is Round 16's code again. ## Round 18, read | Round 18 | statement | verdict | note | | --- | --- | --- | --- | | §0–2 | the format; eight seeds at depth 3 | PASS | W1 | | §3–10 | grammar; tags; SYM, CERT, PENDING; implicit axis; Rice events | PARTIAL | W1: it decodes, but three conventions are stated nowhere | | §11 | the verifier does not reproduce CPG | PASS | the decoder reads axes from the stream alone (W1) | | §12 | `N = 2L − S` | PASS | W1 | | §13 | the official checkpoint | PASS | W1–W3 | | §14 | the tail checkpoint; 4,983 internal nodes | PASS / FAIL for 4,983 | W1–W3; 5,039 (W4); it is not Round 17's tail window (W3) | | §15–18 | reductions; axis metadata; sizes; compression | PASS | W4 | | §19–20 | independent replay; worst slacks | PASS | W2; the verifier's geometry is transcribed, its pending check absent (W5) | | §21 | emitter cost | PASS as measured | the tail emitter re-evaluates every parent (W4) | | §22–26 | the cost model; break-evens; preference | PARTIAL | the arithmetic holds; the calibration is four single timings, one inflated (W4) | | §27 | every CERT by CORE | PASS | W2 | | §28–29 | shard status; checkpoint semantics | PASS | W1: every branch is CERT, SYM or an explicit PENDING path, and the paths are bound here | | §30–33 | final delta; ledger; Round 19; handoff | n/a | the ledger is reviewed in the registry | ## The status registry Round 18's 13 judgments are reviewed, and its 3 first-used phrases defined: `Tail-Window preferred`, `IMPLEMENTED + VERIFIED` and `FORMALIZED + EMPIRICALLY CALIBRATED`. The last two are found by census v4 only. The two PARTIALs are: - "Production shard grammar: CLOSED" — three conventions left to trial; - "Lifetime cost model: FORMALIZED + EMPIRICALLY CALIBRATED" — single timings, one inflated by the redundant parent evaluations. "Pending frontier preservation: PASS" stands, on this tree's check rather than the shipped verifier's. | verdict | judgments | | --- | ---: | | PASS | 8 | | PARTIAL | 2 | | n/a | 3 | ## The drill | kind | cases | named checks | | --- | ---: | --- | | the document's official node count | 1 | A0 | | a pending path; a manifest's CERT count; the other conventions said to decode | 3 | W1 | | the exact slack; the verifier's recorded slack | 2 | W2 (the second also P1) | | Round 17's rule said to reproduce the tail; the evaluation accounting denied | 2 | W3 | | §14's 4,983 said right; an emitter timing; a zip size; the redundant evaluations | 4 | W4 (the timing also P1) | | the verifier said to read the pending files; the lookahead said to test SYM | 2 | W5 | | the emitter's recorded digest; a VALIDATION check | 2 | P2 | | a review dropped | 1 | R1 | Four controls: - the unmodified inputs; - the document with CRLF line endings; - the certificate files in reverse order; - the format spec with its keys sorted. **17 / 17 plants, 4 / 4 controls, 170 / 170 must-stay-green assertions; no check without a plant.** - The manifest plant is the one the shipped verifier would pass: it changes a count and the manifest's digest, and nothing else. - The pending-path plant is the other: the verifier never reads the file. | check blinded | cases reported blind | plants naming it | | --- | ---: | ---: | | A0 | 1 | 1 | | W1 | 3 | 3 | | W2 | 2 | 2 | | W3 | 2 | 2 | | W4 | 4 | 4 | | W5 | 2 | 2 | | P1 | 2 | 2 | | P2 | 2 | 2 | | R1 | 1 | 1 | ## What this round does not establish - **Any bound.** Both checkpoints are pilot-arithmetic forests with 2,766 and 2,048 open leaves. - **Timings.** Replay and emitter seconds are single measurements. Only their arithmetic, and the evaluation counts behind them, are checked here. - **The tail window's lookahead rule as a choice.** Whether counting a SYM child as certified would give a better production scheduler is a performance question. It is not tested here beyond the two forests it produces.