Audit: exact gate-operand parity contract at the checker/exporter boundary (answers PR3696 OQ1; no new kappa)

[petalas]

Summary

Bounded boundary audit, no new κ (selected 0.001672660197076918 unchanged). New package research/gate-operand-parity-contract/, completing the checker/exporter schema cascade's remaining open question — PR #3696's open question 1 (itself refining #3004 under #2977's cascade):

The exact gate-operand parity contract. For one gate (d, srcs) the pinned symbolic checker operator (xcheck_p.py: accumulate pre-gate XOR, then write once) and the pinned exporter operator (export_records.py: one sequential ADD(d, s) per listed source) agree as linear maps over F2^n iff d ∉ srcs, or (m_d odd and every register occurring before the destination's last occurrence occurs an even number of times there).

Measured (independent re-implementation, stdlib only; simulation vs an independent coefficient-level prediction agree on 100% of pairs; -O-enforced admissions):

• Domain n=6, source lists length 0..4 (the published census domain): 9,330 pairs; destination-free 4,686 all agree — matching PR Research: gate-operand export parity — dest-free always agrees; dest-in can diverge (answers #3004 OQ2; no new kappa) #3696's published count exactly; destination-in 4,644 = 3,492 divergent + 1,152 agreeing. Extended domain length ≤ 5: 55,986 pairs, 26,172 divergent, same contract.
• Guard census at the export boundary: checker's own contract (nonempty, [d]+srcs distinct) sound, 4,608 agreeing rejections; distinct-only sound, 4,602; dest-free-only sound, 1,152 (exactly the agreeing destination-in residue); transplanted scatter simple-support unsound — admits 1,350 divergent gates (destination in sources but not first, e.g. [a,d]); exact minimal guard sound with zero over-rejections (accepted chain 1,230 ⊂ 1,236 ⊂ 4,686 ⊂ 5,838, all matching closed forms).
• Answer to the literal question: simple-support is insufficient — it also rejects agreeing dest-free duplicate lists (smallest nonempty witness [a,a]; smallest overall: the empty source list, which agrees but the checker rejects as malformed). Every rejected agreeing list is already checker-rejected (bad operands), so adopting the checker's own operand contract at the exporter aligns the two boundaries without affecting any checker-accepted word.
• Blast radius on the selected word: the pinned tuned word (e3e301e6…, v=111, R=439) has 5,472 D/A/B/C gates, all with distinct nonempty operands, and 111 simple scatter rows (9 retained totals, 527 terms) — every sound guard preserves each selected gate's export. Gate-list census only; the 27,234/27,235-record stream counts are PR Research: gate-operand export parity — dest-free always agrees; dest-in can diverge (answers #3004 OQ2; no new kappa) #3696's published measurements, cited not re-derived.

Task and overlap

• Card supplier-boundary-audit, scope_status: changed with the reason recorded in TASK.json: the scatter side is settled on main (scatter-parity-contract-audit + Enforce simple scatter supports at opt-in checker and exporter boundaries #2992/Repair scatter export with a versioned XOR-normalized boundary #3273/Compose integer labels with checked XOR scatter export #3346), and this takes PR Research: gate-operand export parity — dest-free always agrees; dest-in can diverge (answers #3004 OQ2; no new kappa) #3696's stated open question 1.
• Base: 20ecf2891d80b5acf18d980b2164fb44ea7faa90 (current main).
• Overlap checked with scripts/find_overlap.py --task supplier-boundary-audit and by reading the cascade packages; a CLAIM was posted in discussion Handoffs and requests for independent checks #1166 before the work. No open PR touches gate-operand schema selection as of submission.

Validation

All commands from a repository root, CPython 3.12.15 (~/git/integer-mult-bounds/.venv/bin/python3.12, used read-only):

python3.12 -B research/gate-operand-parity-contract/verify.py
python3.12 -I -O -Werror -B research/gate-operand-parity-contract/verify.py
python3.12 -B scripts/research_package.py --package research/gate-operand-parity-contract
python3.12 -B scripts/check_research_commit.py --package research/gate-operand-parity-contract --check-source-history
python3.12 -B scripts/research_baseline.py

Expected:

PASS_GATE_OPERAND_PARITY_CONTRACT domain=9330 dest_free_agree=4686 dest_in=4644 divergent=3492 agreeing_dest_in=1152 checker_sound=true checker_over_rejects=4608 transplant_admits=1350 exact_over_rejects=0 selected_gates=5472 selected_distinct=5472 no_new_kappa
PASS_REGISTERED_RESEARCH_PACKAGE research/gate-operand-parity-contract outcome=completed
PASS_RESEARCH_COMMIT_BYTES {"commit": "19fa53f4f10bde32e20e59f1d11e0c1d344f4386", ...}
PASS_RESEARCH_BASELINE_BINDINGS_ONLY

All five checks were run locally and pass. No native backend, Lean, Docker or historical replay was run; the native-rejection question stays open (see package OQ2) and CI replay is welcome as additional certification.

Credit

Credit Nick Petalas for the scatter multiplicity gap (#2977); Kumagi for the exact scatter agreement contract (#3004); Wentao Li (VictorLiwentao) for the gate-operand census, witnesses and the open question completed here; Dylan Crow for the exporter; eumemic for the symbolic checker; and the retained tuned-word lineage. This contribution was produced by Nick Petalas with AI assistance. No independent human or proof-assistant review is claimed.

Open next questions

1. Which sound guard should a successor gate schema adopt (checker's own contract / dest-free-only / exact minimal)? Weakening the export guard without loosening the checker contract re-opens the boundary.
2. Does the native formal-column checker independently reject a divergent self-operand export? (blocked by a C++17 toolchain this session)
3. Does the contract survive reordered emission? The census harness re-runs with any per-source emission order.