Finite complete native-prefix controls
Use twelve supported generated identities: three candidates, two processing treatments and physical-domain versus training-conditioned acceleration proofs. Every identity has sixteen nonuniform packets and three predeclared queries, including a knot-related time and its next binary64 value. No aircraft files are read.
Compare the complete batched reports with independent cold runs of the sealed original remainder orchestration. Preserve expression order, all remainder vectors, source/reference/proof identities, packet counts and coefficient maps. Check all 51 design columns using the same independent native point Jacobian. The center must agree with that point query within the existing generated-control oracle allowance of 1e-5 m; this is not a measurement-accuracy specification.
The conditioned proof uses a generated ±0.2 m/s² acceleration constraint around the reference. It is an algebraic control, not an invented receiver observation. Physical calibration bounds stay fixed. Local unit tests additionally compare zero time, exact packet boundaries and adjacent representable query values.
Two additional identities preserve an initially broader, non-gravity-centered source fixture whose initial nonlinear cap is not certified by the original engine. The cold and batched paths must both reject it with the same cap error. That is a rejection control, not a supported result or a relaxed source bound.
Fixed allowance
- Fourteen identities, one worker and one numerical thread, at most 600 seconds.
- Each supported identity: three native point calls (48 packet visits), three cold bounds and one batched call. Reserve 864 conservative bound steps: 9 × 16 × 6.
- Batched packet advancement: at most 48 steps, with at most sixteen canonical steps, forty-eight tail steps, three cursor copies and nine source-state copies.
- Record sixteen preparation packets, forty-eight cold force-profile packets and nine typed source-query checks separately. These are not skipped work.
- Conditioned proofs permit six LP proposals and twenty-four exact checks each; physical proofs perform neither. Preserve all source/environment/input hashes.
- Each rejection control permits two diagnostic calls and 576 conservative bound steps, zero native point calls and two expected source-cap rejections.
- No optimizer starts, aircraft fits, retries, allowance expansion or old-study resume.
The original cold code is an explicitly hashed input copied from its closed source freeze; shared dependencies are fixed in the new environment/source freeze. The C++ compiler identity is recorded before launch and checked with every component. Passing qualifies this short generated comparison only. Long-history equivalence, measured speed/memory and complete-cadence prediction bounds need later finite studies. Useful ranges and an adequate observation-error law remain separate gates.