[petalas]

Summary

Scoped written proof with exact finite corroboration. For a finite rational rounded-linear program F on unrestricted integer parameters, prove its exact finite-coset output set and smallest containing affine lattice:

q clears the idealized linear drift at every half-up rounding node
C = {0,...,q-1}^k, M = idealized output matrix
F(Z^k) = union_c (F(c) + q M Z^k)
hull_Z(F(Z^k)) = F(0) + span_Z(q M e_i, F(c)-F(0))

This gives a necessary and sufficient finite closure test for any rational affine target lattice, including lower-rank and changing domains. The at-most q^k-1+k generator bound is finite, without a polynomial-time or minimal-period claim. On x=3n, y=2m followed by y += floor(x/2+1/2), the exact hull is 3Z x Z. All four q=2 residue outputs have even second coordinate, but the drift witness F(2,0)=(6,3) rejects 3Z x 2Z. The idealized output lattice instead contains (3,3/2), so using it alone rejects the valid target 3Z x Z.

Produced by Nick Petalas. Credit woklerx #1848 for the intervening-update closure question and affine-domain precision interface, retaining bitplane, chafreaky and aliromman's credited lineage. adamgall #1908 supplies a different actual-leaf counterexample; petalas #6446 classifies common planar shear lattices. Their results are cited context and their verifiers are not replayed or extended as the main step. Integer-translation equivariance and lattice/coset methods are classical; no literature-wide priority is claimed for those ingredients.

Only six files under research/rounded-program-affine-hull are added. The uniform-transfer-audit card changes scope from a selected-caller assumption to this general interface theorem. Advance CLAIM. Canonical base e545235, priority revision 8, selected #7000 unchanged. Fresh main, open work, claims, account reuse and merged/main formula searches were checked before committing.

Evidence

• Before: the affine-domain handoff leaves actual rounded-update closure to be established. After: PROOF.md gives an exact finite output-set and hull formula with both residue differences and drift generators, and proves the closure criterion for every program in its stated contract.
• Local CPython 3.12.15 on macOS arm64, standard library only: 336 enumerated rational programs, 3,904 residue outputs, 33,696 literal signed-box outputs and 6,336 target affine-lattice closure comparisons pass. The literal-output lattice is computed without idealizing any rounding node.
• All 729 ordered triples of planar vectors over {-1,0,1} check the normal-form calculation against determinant minors and rank-one content. Fourteen named semantic controls and five invalid-program rejections pass, including residue-only and ideal-image-only failures, nested denominators and signed ties.
• Warning-strict direct normal and optimized checks pass in 0.50 s and 0.62 s. The complete registered runner passes in 1.31 s, below both 120-second command limits. These are replay-budget timings, not speedup measurements. Normal and optimized checks emit the same generated source-hash-bound receipt. No handwritten receipt is included.
• Registered metadata/source pins, exact committed bytes and declared source history pass at d3220b9. AST compilation, function-length inspection and staged whitespace checks pass. No registered command is deferred solely to CI.

Exact reproduction from the repository root:

/Users/nick/git/integer-mult-bounds/.venv/bin/python3.12 -I -W error -B research/rounded-program-affine-hull/verify.py
/Users/nick/git/integer-mult-bounds/.venv/bin/python3.12 -I -O -W error -B research/rounded-program-affine-hull/verify.py
/Users/nick/git/integer-mult-bounds/.venv/bin/python3.12 -B scripts/research_package.py --package research/rounded-program-affine-hull
/Users/nick/git/integer-mult-bounds/.venv/bin/python3.12 -B scripts/check_research_commit.py --package research/rounded-program-affine-hull --check-source-history

Any CPython 3.12 executable may substitute for the local interpreter path. Expected markers: PASS_ROUNDED_PROGRAM_AFFINE_HULL, PASS_REGISTERED_RESEARCH_PACKAGE and PASS_RESEARCH_COMMIT_BYTES. Direct replay is read-only and Git-free; historical source pins need repository history for metadata validation.

Limitations and unrun obligations

The theorem covers fixed rational affine arithmetic and half-up rounding in a finite program on the entire parameter lattice. Variable products, data-dependent branches, overflow and saturation are excluded. The affine hull can be strictly larger than the true reachable set. The finite census corroborates the written proof and does not establish the universal statement by enumeration.

No actual selected-caller entrance or reachability, useful precision policy, physical native implementation, owner/restoration contract, complete movement/storage/precision charge or recursive invoice is established. All five selected framework assumptions remain. No supplier admission, new kappa, selected-frontier change or complete multiplication theorem is claimed. No predecessor scientific replay, selected cold replay, Lean or Docker run was performed. Independent human and formal proof-kernel review are unclaimed.

Open next questions

Apply the criterion to one literal selected rounded caller with an admitted rational affine entrance. First extract its fixed fragment and compute the residue outputs and drift generators, then test the next required domain. Exact entrance/reachability, inverse compatibility and the full precision, movement, storage and restoration bill remain blockers. The investigation stops at this first proved result.

Related open work

• #4017 implements a source-specific reversible rounded macro with dirty scratch. This theorem gives a general lattice-image criterion and does not validate its macro or price its caller.

• #7192 proves injectivity for a fixed rounded inverse restricted by owner residues. This theorem decides output-lattice containment under a different half-up contract; it proves no competing injectivity threshold or residue budget.

• #7474 studies sharp error and periodicity for a nearest-even Walsh/half-shear word. This PR proves output-lattice containment under half-up rounding and computes no error or period for that word.

The completion refresh checked the seven other account open PRs created since the advance CLAIM: #7469, #7470, #7472, #7473, #7474, #7476 and #7477. The new related entry is #7474 above. The others concern a persistence threshold, a bounded shear biclique, partition optimization, field-extension certificates, a Type A sign gauge and reversal cleanup. No extra computation was run to check another contribution, and no shared-instance numerical disagreement was identified.

The source #1848, actual-leaf #1908 and common-planar-lattice #6446 packages are merged context. No competing same-instance number is recomputed.

CI notes

CI did not certify this package. At unchanged head d3220b9d9c3748e560e23768556b095217ffb21a, run 43290064692, plan job 131433624254, failed in Onboarding helper tests. The checks were read once and the failed job log was inspected directly. It reports exactly one failure among 760 tests, with 24 skipped. The failing test is test_research_current_status.CurrentCiNavigationTests.test_current_ci_section_matches_selected_record, with AssertionError: '`make frontier7000-verify`' not found in the CI verification document. The dependent replay job 131436631324 was skipped, so no hosted package verification ran.

The mismatch is already present on canonical base e54523517d0f03e58352e647c403a5af3e525a57: certificates/selected-result.json names make frontier7000-verify, while docs/ci-verification.md still describes #6030 and make frontier6030-verify. Both base files were read directly, and the exact diff confirms that this contribution changes only its six package files. It does not cause this repository-level navigation failure.

The failed logs of run 42905094314, run 42903313790, #7468 run 43281155683 and #7469 run 43289715434 were also inspected directly. Each reports the same exact test and missing-command assertion, with one failure among 760 tests and 24 skipped. No broader set of comparison runs is claimed verified.

No fix, retrigger commit, push or CI rerun was made. The successful local checks above remain the executed package evidence. Independent human and formal proof-kernel review remain unclaimed.

Merge danger

Door: two-way. Blast radius: isolated research package. This adds a proof, exact verifier and source metadata without modifying shared code, frozen evidence, predecessor notices or the selected frontier.