# Final ledger: Cheon r−1 on Yukon's BLS12-381 auxiliary powers

Research artifact for @Benyorke, IMD agent #19. Prepared 2026-10-24. No challenge submission or numerical score is declared.

**Determination.** The known algorithm is eligible and the specified exhaustive two-stage search is algebraically correct, with success 1 conditional on a correct implementation. The evidence does **not** establish a competitive TOTAL computation bound. Reject both the prior approximately 120-bit claim and `memory-design.md`'s replacement approximately 125.31-bit TOTAL claim. Retain **125.2683050986 only as a partial sampled-price projection** for the implemented eight-bit arithmetic path. This rejection concerns accounting evidence; it is neither an impossibility result for Cheon nor a memory-cap argument. A better implementation, success-limited exact search, or published low-memory reformulation remains possible.

The decisive quantitative objection is that the prescribed exhaustive search has about 2^118.42854 encodings. A budget of 2^120 normalized units allows **5,944.09 scalar instructions per encoding for the entire attack**, whereas the supplied four-component projection spends **229,088.3671875 per encoding** before the missing work. Sampled measurements do not prove a lower bound on all implementations, but they do not support that claimed upper bound. The approximately 125.31 replacement adds unsubstantiated local and network tariffs to these samples and compares against an insufficiently optimized, differently normalized baseline.

Labels: **PROVED** = algebra/combinatorial deduction under stated premises; **SOURCED** = checked primary document; **REPORTED MEASUREMENT** = requester evidence, not rerun here; **PROJECTION** = arithmetic substitution, not a bound; **ASSUMED** = extra implementation/machine/stochastic premise; **UNRESOLVED** = missing evidence preventing a numerical total. A small local test is evidence only at its tested scope.

**1. Sources, version check, and scope**

All three input reports were read as evidence. Their SHA-256 hashes match the assignment:

| Input | SHA-256 |
| --- | --- |
| memory-design.md | `05acfdef1f77b35c09d6c7154e8f9b18d712a750356f8f77cb09a9bc9eb86f37` |
| alternatives.md | `c36dbac943a31ec421e8a58d953db332c4702185a8f7618f9802947ae61aa8be` |
| hostile-audit.md | `f8b0c6f8cd321eb2f4e243cecae9e21b16a4603e144d8ba5ee7f7c96294a4240` |

The findings needed from those reports are reproduced here; they need not accompany this artifact. Their assertions of prior experiments are not relabelled as this report's independent measurements.

**SOURCED, independent check about 01:57 UTC, 2026-10-24:** GitHub's [upstream HEAD endpoint](https://api.github.com/repos/Layr-Labs/curvesma.sh/commits/HEAD) returned `6423c2728dc03d5f2d647c7f22adf1dac0643a66`, the requested pin, with committer timestamp `2026-10-23T01:02:24Z`. All four complete files were downloaded, read, and separately compared with their `HEAD` versions; every pair was byte-identical. No current change was observed. The local assignment checkout is `0243d7da4a4337ae8b16bcdf15bb4ead736fd68f`, not the upstream challenge revision.

| Required primary rules/profile at pin | SHA-256 |
| --- | --- |
| [Powers-track rules](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/bls12-381-g1-ecdlp/rules.md) | `a96fd77aa4cd28bcda78e4f2a9331d6fc9fbe51148bb24289a008d8d92375f70` |
| [Target profile](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/bls12-381-g1-ecdlp/target-profile.json) | `7efc64c4327d983a9dcd2e26eee449aba20039000d368a451b7e58f61192b602` |
| [Classical work model](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/classical-group-work-v2.json) | `e0edc25a3e8b4a4b116442b2c2eb37f81f4aa0068fb6a1906312b040d5e17294` |
| [COST_MODEL.md](https://github.com/Layr-Labs/curvesma.sh/blob/6423c2728dc03d5f2d647c7f22adf1dac0643a66/tracks/docs/COST_MODEL.md) | `a1d1e0c7dfd052f1306e7412781f832714a603f58e1d748733b63a258eb743c6` |

These establish C=2000; scalar AArch64 64-bit instruction-equivalent accounting; all processors' work, transfers and cold advice included; memory unscored but reported in total; subset use allowed; success at least .39 on unchanged production inputs; and exploratory review allowing supported heuristics and analytical bounds. They do not specify a giant-memory interconnect tariff. The auxiliary powers belong only to this track. Public G2 can be used for a separately analyzed pairing transfer; independent pairing-challenge targets or powers cannot be borrowed.

Primary literature actually obtained and checked:

* **Cheon, 2010**, [author manuscript](https://www.math.snu.ac.kr/~jhcheon/publications/2010/StrongDH_JoC_Final2.pdf), SHA-256 `fd7746b9d2c37c228b63e9b993e7eb58a90045740f5d1fd6aac3e5a5af70b4de`. HTTPS retrieval failed; the same author URL over HTTP supplied the PDF, matching the other reports' hash. Lemma 1/Theorem 1 (PDF pp. 4–6) give the deterministic r−1 search, counting group exponentiations and comparisons. Section 3.1 (pp. 11–12) gives the lifted kangaroo, approximate first-stage cost `2 sqrt(m)+1/Theta` group exponentiations, and distinguished-point storage proportional to `Theta sqrt(m)`; second stage is approximately `2 sqrt(d)` exponentiations. Its walk model is approximate, not a finite-budget BLS instruction guarantee. Related work credits KKM's precomputed-table improvement. Cheon's `CompG` already includes element reading/writing; it must not be charged again alongside a decomposed dictionary implementation.
* **Kozaki–Kutsuma–Matsuo, Pairing 2007**, [publisher abstract](https://link.springer.com/chapter/10.1007/978-3-540-73489-5_17), pp. 302–316: the abstract confirms the improved group-operation asymptotic. **Full chapter unavailable:** the PDF request returned HTML, and the publisher offers subscription access. No full-chapter proof or constant is attributed to it here.
* **Kutsuma–Matsuo, SCIS 2007**, [author-hosted precursor](https://kazutomatsuo.github.io/publications/pdf/scis07_4A1-2.pdf), SHA-256 `61bfbb8f9dfc33296f5f0b6d6a485d1b7e85213617b6afe5dfef1dc5f663dca2`. Section 4, pp. 3–4, constructs c positional rows with radix `ceil(r^(1/c))`, fills rows by repeated addition, and evaluates a multiplication with c−1 additions after lookup. It includes construction in its asymptotic and chooses constant c≥4 for a uniform theorem. This two-author primary precursor is not the unavailable three-author chapter. Its weak-DH shortcut producing a group element is not automatically scalar recovery.
* **Izu–Takenaka–Yasuda, 2011**, [Experimental Analysis of Cheon's Algorithm against Pairing-friendly Curves](https://www.jstage.jst.go.jp/article/ipsjjip/19/0/19_0_441/_pdf), SHA-256 `612b687b9081f1ecaa8142ba0d8408d755fcec6717f1997b5851de3f9a834fd4`. Section 3, Algorithms 2/2′ and equation (2), pp. 443–444, explicitly replace changing-base multiplication by fixed-base recomputation using an accumulated exponent and discuss self-collision restarts. Their experiment did not use KKM. This is not a BLS12-381 timing source.
* **Bos–Costello–Miele, PKC 2014**, [author-hosted full paper](https://www.microsoft.com/en-us/research/wp-content/uploads/2013/10/644.pdf), SHA-256 `ceadb9e720a9cb22e29aff15038a59da20456a7fc5ef9ffcdc3c2562f0d924d7`. Sections 2–4 describe automorphism-aware rho, batch-affine arithmetic, coefficient tracking and fruitless-cycle handling, including order six. Their measured curves and timing constants are not BLS12-381 calibration. Application of the order-six map below is an algebraic deduction from this profile's curve.

**2. Contradictions resolved and counterarguments**

| Disputed claim / objection | Resolution and strongest defensible response |
| --- | --- |
| memory-design: approximately 125.31 is a defensible TOTAL bound despite sampled prices | **Rejected.** Its own unresolved worst-case qualification, unpriced transport, omitted scalar conversion/setup and uncertain kernel boundaries prevent that conclusion. Analytical instruction schedules could repair this without executing an exponential attack. |
| Its N differs from the task because of rounding | **Incorrect.** The difference is exactly `B2+G2=2048`. The task's N includes stage 2. Ceilings should use integer square roots. |
| Recovery uses CRT with coprime m,d | **Incorrect proof, correct recoverability.** Here `gcd(m,d)=4096`. Use unique quotient/remainder `t=i0+m*i1`, not coprime CRT. |
| Its quoted `6 ExpG+2 MulG` proof term describes r−1 | That term occurs in Cheon's r+1 analysis (Lemma 2). Lemma 1 is the relevant r−1 source. Our finite counts below are independently derived. |
| Fixed-constant recurrence `[a]P` is priced as the measured fixed-base kernel | Those are different computations. Maintain a known Fr coefficient x and compute `[x]G` from the G table; charge its Fr update. Do not apply fixed-base measurements directly to a changing point P. |
| KKM is a separate unknown table beyond the positional method | The primary precursor supplies the positional construction itself. Eight-bit positional multiplication is a finite member of that technique; do not charge a second mysterious “KKM table” or declare an unpriced 121-bit regime. Full published chapter availability remains limited. |
| hostile-audit: changing-base jumps prevent three fixed-base tables | True only for the literal recurrence. Izu equation (2) explicitly repairs it. For finite jumps, a maintained coefficient gives the same path with one Fr update plus a fixed-base multiplication. Literal full-range jumps can still require an Fr exponentiation each step. |
| Low-memory Cheon has identical total computation and therefore dominates exact search | Unsupported. It adds dependent normalization/partitioning, collisions, starts, restarts, DP storage and a success model. Same asymptotic order does not prove equal total cost. |
| 40–80 instructions per compare/copy and about 50 per routed probe settle memory | Local copies do not include remote endpoint movement. A binary search may route every probe; sorting also moves data. A leaf id can exceed 64 bits. A claim that tens of routing levels cost tens of instructions total is unsupported. Count each hop and each transferred word. |
| Window 24/32 need multiword flat addresses; window 64 cannot be indexed | Window 24/32 tables are below 2^64 bytes, although far beyond caches. Window 64 exceeds 64-bit addressing but can use explicit segmented multiword indices. None is excluded by a memory cap. |
| A 120.9-bit “floor” follows from one add plus normalization/serialization | **Not a universal lower bound.** It fixes an unproved representation and operation schedule. Different exact keys, batching, quotient searches and success coverage change it. Reject the specific numerical claim without inventing a lower bound. |
| Ordinary/negation-only rho around 127.3 establishes a two-bit advantage | It omits order-three symmetry, uses an unmatched success statistic and lacks complete per-step accounting. Compare order-six rho at .39 success with the same arithmetic/transport conventions. No completed ranking follows. |
| Huge memory is fatal | Not under these rules. The fatal issue is the absence of a justified full instruction ledger. A finite segmented protocol is possible, but its prices must be explicit. |
| Restricted 16/16 recoveries prove .39 production success | No. The interval `i0<64` has production mass `64/m≈2^−228.857`. Keep these as correctness controls; prove full/truncated exact coverage separately. |

The biggest surviving objection is the **unsupported conversion of a complete computation into a numerical instruction bound**, not the size of the memory or the algebra. The evidence-based response is constructive: the following exact algorithm has a proof of success, finite data representations, and a cost expression identifying every remaining implementation obligation. It does not yet establish a competitive total.

**3. Exact algorithm, indices, and success proof**

Use

```
r = 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
zeta = 7                 # primitive, requester-attested premise
1 <= n < r
d(n) = 2^min(32, floor(log2(n)))
m = (r-1)/d;  a = zeta^d mod r;  beta = zeta^m mod r
B = ceil_sqrt(m); Gcount = ceil(m/B)
B2 = ceil_sqrt(d); G2 = ceil(d/B2)
```

**PROVED:** `v2(r−1)=32`, so d divides r−1 and d≤n for every stated n. `a` has order m and `beta` order d under the supplied primitiveness premise. If `s=zeta^t`, unique division gives `t=i0+m*i1`, `0≤i0<m`, `0≤i1<d`. Stage-1 equality implies `a^(j+Bk)=s^d=a^i0`; the rectangle contains the canonical exponent. Reject padded matches `j+Bk≥m`. Stage 2 similarly gives `beta^(j+B2k)=s*zeta^(−i0)`; reject `j+B2k≥d`. Injectivity of `[x]G` modulo r justifies using exact point equality. Reconstruction returns s. This proves success 1 for every allowed secret, assuming correct complete routines and reliable execution; no stochastic walk premise or restart is used.

At n=d=2^20:

```
m = 50006747412801924209068050869165387952509453297164571592906626415194112
B = Gcount = 223621884914696853578958571250384896
B2 = G2 = 1024
N = B + Gcount + B2 + G2
  = 447243769829393707157917142500771840
B*Gcount-m = 218380746987008646073201729736704
log2(N) = 118.4285447065236
```

A baby record is canonical affine x||y (96 bytes) plus j (16 bytes); j needs 118 bits, whereas recovered i0 needs 235 bits. Store indices as two u64 limbs and reconstruct `B*k+j` using four limbs. Compute each 64×64 product with low MUL and high UMULH plus carry propagation; no 236-bit unit multiplication. All general-n input counters can require four limbs. Three fixed bases **G,A_d,T** suffice, including stage 2.

Implementable high-level schedule (helper work is charged below):

```
parse input, obtain T=A1 and A_d; decode/validate consumed points
compute dimensions and a,beta, ag=pow(a,(-B)%m,r), bg=pow(beta,(-B2)%d,r)
build three positional tables cold

MAKE_STREAM(base, seed, ratio, length):
    x = toMont(seed); c = toMont(ratio)
    for t = 0 .. length-1:
        scalar = fromMont(x)
        buffer point MUL_FIXED(table[base], scalar) and index t
        if buffer full or t is last:
            normalize batch; encode every exact96 key; consume keys in order
        if t+1 < length: x = FrMontMul(x,c)

MAKE_STREAM(G, 1, a, B): write baby(key,j)
stable bottom-up mergesort babies, retain final array selector
MAKE_STREAM(A_d, 1, ag, Gcount):
    exact binary search; retain first match j with wide(j+B*k)<m as i0
    # scanning all giants gives a fixed upper schedule, even after finding i0
z = pow(zeta,i0,r)
reuse baby/scratch storage
MAKE_STREAM(G, z, beta, B2): write baby2(key,j)
sort baby2
MAKE_STREAM(T, 1, bg, G2):
    search; retain first canonical match i1=j+B2*k<d
s = z*pow(beta,i1,r) mod r
check 1<=s<r; verify [s]G == T; emit canonical 32-byte scalar as required JSON hex
```

Retaining only the first canonical match avoids multiplying reconstruction work by the search size. All search points are nonidentity since all scalar coefficients and bases are nonzero; intermediate table additions still need identity/equal/opposite handling. No scalar stream uses a full modular exponentiation per point. The four streams require exactly `U=N−4` ratio multiplications in the full schedule. Padded dimensions and actual residual batches are charged even if execution may stop earlier.

**Optional exact .39-success redesign, PROVED:** choose `L=ceil(39m/100)`, `b=ceil_sqrt(L)`, `g=ceil(L/b)`; accept only `j+bk<L`. Under uniform s, i0 is uniform modulo m, so success is exactly L/m≥.39 with exhaustive stage 2. This changes dimensions, memory and all dictionary counts. Its leading point count is about `sqrt(.39)` times exhaustive, saving approximately .67923 bits in that component. Failed secrets still incur the capped budget. It is not a change in the input distribution.

**Optional order-six exact quotient, PROVED conditional on verified map:** at scoring, 6 divides m. Set q=m/6 and eta=a^q. On `y²=x³+4`, cube-root x multiplication and y negation give six maps. Find the map psi with `[eta]G=psi(G)` by computing and testing the six candidates; charge this setup. Equality on G proves equality on G1. Canonicalize over the six exact encodings and retain tag t. No nonidentity map fixes a nonzero prime-order point. Search a rectangle for q with the original a. If baby/giant tags are tb,tg, recover

```
i0 = (j+b*k+(tb-tg)*q) mod m
```

and then perform ordinary stage 2. Keep `j+bk<q`, or `<ceil(.39q)` for truncated quotient coverage. Success is respectively 1 or `ceil(.39q)/q`. A three-bit tag fits alongside the index in 16 bytes at these dimensions. Charge two Fp multiplications for the other x coordinates, a y negation, all six candidate conversions/comparisons and tag handling. This is an exact candidate, not a proved total speedup or a novelty claim. Its adaptation to kangaroo intervals is not automatic. The same quotient factor cannot be applied to stage 2, whose order is a power of two.

**4. Exact dictionary bounds and a collision-bounded alternative**

**PROVED counts.** Compare fixed-length full affine keys lexicographically: at most twelve 64-bit word pairs, with explicit endian conversion. Long common prefixes and adversarial order do not alter this bound. No x-only equality and no probabilistic fingerprint equality. Duplicates, if provided to the sorting routine, are handled stably, although honest baby keys in each unquotiented stage are distinct.

Bottom-up stable mergesort uses two arrays. Each pass merges adjacent half-open runs and copies all unpaired tails. Use two-limb run bounds and clipped endpoints. Alternate array roles, avoiding an extra final copy. For b babies, sort comparisons ≤`b ceil(log2 b)` and full-record copies equal `b ceil(log2 b)` for this all-records-per-pass schedule. Binary search with `mid=lo+((hi-lo)>>1)` uses at most `ceil(log2(b+1))` three-way comparisons; 1024 keys can require **11**.

Define

```
S = B*ceil(log2 B) + B2*ceil(log2 B2)                  # sort comparisons bound
Q = Gcount*ceil(log2(B+1)) + G2*ceil(log2(B2+1))       # search comparisons bound
D = S                                               # full-record sort copies
P = B+B2                                            # initial baby writes
Arec = 2*S + Q + 2*D + P
S+Q = 52774764839868457444634222815090856960          # at scoring
```

An explicit deliberately redundant implementation fetches both source records afresh per merge comparison; it then fetches the chosen record again and writes it for each copy. Search fetches one record per comparison, with its query retained locally. This explains **every transaction in Arec**; it does not assume free lookahead caches. Each copy transfers 112 bytes from source to destination, or 224 bytes counting source reads and destination writes. A local copy has 14 loads+14 stores before address/control instructions. Logical accesses also pay the remote protocol below. Index packing is local work before the P initial writes.

Let `Kcmp` bound the comparator on two local returned buffers, `Kaccess` a complete record transaction, and `Kloop` all controller operations: pass/run initialization, endpoint min, two-limb compare/increment/subtraction/shifts, merge choices, binary-search updates and return logic. Then

```
I_dictionary <= (S+Q)*Kcmp + Arec*Kaccess + Kloop.
```

These costs deliberately separate remote fetch from subsequent local comparator loads; both really occur. `Kloop` must be derived from the chosen emitted/analytic schedule, not silently set to zero. Twelve pairs of local loads/endian swaps/comparisons are straightforward to bound; “40 instructions including the network” is not. This formula is not a priced total until these K's are justified.

A deterministic alternative is 96-pass stable byte-radix sort. Each pass clears 256 two-limb counters, reads b records to count, computes 256 prefix positions, rereads b records and scatters b full records with two-limb counter increments. Charge `288b` record transactions over all passes, counter storage/zeroing/prefix arithmetic, byte extraction and routing; search remains extra. It handles adversarial keys and can reduce passes relative to 118-pass merging, but unit-cost global scatter is not supplied by the rules.

**PROVED conditional randomness bound for static hashing, independently derived:** take K=2^h≥b buckets, h=ceil(log2 b). Sample h independent 768-bit binary rows and hash each 96-byte key by their dot products over F2. Distinct fixed keys collide with probability exactly 1/K. Each hash evaluates h rows of twelve ANDs and an XOR reduction followed by six shift/XOR parity folds, with row loads, result assembly and loops charged. This is a finite scalar program, not an ideal hash. Charge 768h independent random bits, seed generation and storage (`96h` bytes), plus all hash calls.

Use full exact keys in chains: 128-byte record = 96 key+16 index+16 next; 16K bytes of head pointers; an invalid index such as all-one u128 marks empty (not a scalar/address stand-in). Initialize every head and charge it. Prepend babies without chain searches. For the full giant scan, at most two baby/giant pairs have genuinely equal keys because the rectangle covers less than two complete periods. If X is total chain visits, for every fixed honest input

```
E[X] <= b*g/K + 2.
cap = ceil((b*g/K+2)/delta).
```

Abort if more than cap visits would be needed. Markov bounds that failure by delta. Every visited candidate gets exact96 comparison and every reported scalar is verified. Full stage-1 coverage gives success ≥1−delta; truncated coverage L/m gives ≥`(L/m)*(1−delta)` since the conditional bound holds for every fixed secret. For delta=.01 a .39 rectangle must be enlarged to at least `.39/.99`. There are no retries in this design. A fallback exact sort instead gives deterministic completion but must be charged on top of the failed hash budget. Arbitrary duplicate-key multisets do not inherit the two-match success bound; the runtime cap still applies.

The hash ledger is: seed+K-head initialization+b record writes+b head reads/writes+g head reads+(b+g) hash evaluations+cap record fetches/exact comparisons+all pointer/controller work+stage 2+verification. Record size changes its access/memory tariff. The 100-fold Markov cap at delta=.01 may eliminate its advantage; measure/derive rather than assuming expected lookup time as a worst-case bound. A 256-bit fingerprint has collision union bound below 2^−19 for fewer than 2^119 predetermined keys, but does not itself implement lookup or eliminate exact verification. Pairwise hashing of fixed lists proves nothing about adaptive kangaroo mixing.

**5. Segmented 64-bit realization, transport and peak storage**

**PROVED representation; ASSUMED machine implementation prices.** Here is a concrete serial distributed design. It establishes feasibility of the index representation, not a physically available network or a competitive price.

Use q=4096 records per leaf. A record index is `(hi,lo)`; local slot is `lo & 4095`. Page limbs are `page_lo=(lo>>12)|(hi<<52)`, `page_hi=hi>>12`. All shifts are 64-bit; unused high bits are zero. Within a leaf, `112*slot=(slot<<7)-(slot<<4)`, maximum local arena 458,752 bytes per array. No wide global byte pointer is dereferenced. There are `ceil(B/q)` logical pages. Provision a padded binary tree with

```
hR = ceil(log2(ceil(B/q))) = 106
VR = 2^(hR+1)-1
```

nodes. Every router has only parent/left/right neighbor ports, local buffers and a depth. Extract one page-path bit per level from the proper limb. A 20-word packet holds opcode/array selector, two index limbs, path/offset metadata and up to fourteen data words. Route request down and response/acknowledgement up, one packet in flight. A read sends its record back; a write includes its record in the request and returns an acknowledgement. Nodes retain parent direction; no global return pointer or routing oracle is needed. Serial execution eliminates queue contention and distributed termination ambiguity, not executed notification or polling costs.

Two-limb addition/increment is ADD/ADCS-style carry propagation; subtraction uses borrow; compare checks high then low limbs; right shift combines limbs. Binary midpoint uses a subtraction, shift and addition. Multiplication of two index limbs into four output limbs uses four pairs of MUL/UMULH and carry accumulation. Branches, argument loads and stores remain part of controller work. Positional cell indices use the same method, with local offset `144*slot=(slot<<7)+(slot<<4)` and **24-word** packets (six metadata plus eighteen data words). For `Tw=3*k*2^w` cells, use `hT=max(0,ceil(log2(ceil(Tw/q))))`, `VT=2^(hT+1)-1`; flatten base/row/digit by multiword shift/add before routing. If using a single ordinary-memory table instead, charge its actual local accesses and allocation, not this tree as well.

Define `E20`, `E24` as bounded aggregate scalar instruction costs for a complete adjacent-edge packet transfer, covering sender/receiver buffers, every word, path selection, link protocol, notification, control and any bridge processors. Let `L14,L18` price leaf arena read/write work, and `Iaddr` controller limb/path work. Then a transaction can be bounded by

```
FR = Iaddr + L14 + 2*hR*E20
FT = Iaddr_table + L18 + 2*hT*E24.
```

This counts request **and** reply; payload transfers are not already paid by a later local key comparison. These E's are unresolved tariffs, not machine primitives granted by the rules. If delivery blocks without executing instructions while idle, charge the bounded wakeup path. If receivers busy-poll, sum all polling instructions instead. Hardware transfer is not a license to omit its instruction-equivalent movement. Every positional digit fetch pays FT, even when table construction is relatively cheap.

Provision through a depth-first controller with a bounded stack, creating fixed local arenas and linking neighbor ports. If a node uses c words of replicated code/constants and a fixed 4096-byte state/buffer arena, charge per-node local allocation/initialization `Knode(c)`, root initialization and teardown, plus setup packets along every edge. An explicit protocol can reserve four setup/ack packets per edge plus one code broadcast packet per 14-word payload block (use `ceil(c/14)` blocks); hence a conditional setup allowance is

```
I_provision <= (VR+VT)*Knode(c)
             + (VR-1)*(4+ceil(c/14))*E20
             + (VT-1)*(4+ceil(c/14))*E24
             + I_controller_setup/teardown.
```

Code packets on both networks use at most fourteen payload words, leaving space for headers even in the smaller packet. Knode excludes packet endpoint work already inside E; it includes the local arena allocation and non-message state initialization. Range/port initialization and completion acknowledgements occupy the four reserved packets; if an implementation exceeds them, replace the allowance. No charge is hidden in “allocation”: Knode must include executed allocator/page-map/state initialization work, including any mandated zero-on-allocation. Our abstract arena version does not clear untouched record arrays: each record read is preceded by an initial write or a previous merge pass write; padded slots are never read. If the chosen allocator clears arenas, add its explicit stores. Table cells are initialized separately below. The number of processors, their code and endpoint state all count even in a serial schedule.

The rules specify neither E, Knode, topology, failure model, bandwidth nor physical availability of these nodes. Ordinary reliable abstract-machine execution is an explicit premise; a claimed fault-tolerant implementation must include its repair work. Latency by itself is not the score. This is a conditional compliant representation, **not a filled numerical total**, and no requirement for network access to complete the offline ledger.

For this padded implementation, with 4096 bytes/node for state and buffers, c code words/node, one bounded controller/batch allocation Mlocal, and retained input/certificate/seed storage Mret:

```
Mpeak <= 224*q*2^hR + 144*q*2^hT
         + (4096+8*c)*(VR+VT) + Mlocal + Mret.
```

Packet buffers are already in the node reserve; do not add them twice. Mlocal covers root code/stack, complete arithmetic scratch, local records/scalars, prefix products and normalized batch output; choose and verify a fixed arena (e.g. 1 MiB for a serial worker) rather than assuming it for an arbitrary parallel pool. Stage 2 reuses stage-1 storage. This expression includes padding and table nodes. The **un-padded array payload alone** is exactly `224B=50091302220892095201686719960086216704` bytes, log2=125.2358996285812; it is not peak total storage. Neither c nor the implemented allocator/buffer footprint has been certified, so no numerical peak-total-memory claim is made.

As a sensitivity check, use the alternatives report's separate q=2^20 tree, depth 98, hypothetical `FR=98*(32*tau+32)+256`. Even setting tau=1 makes FR=6528. Our redundant dictionary has approximately `295.5*N` record transactions (their looser count was about `355*N`). The reserved dictionary-transfer contribution alone is then approximately log2=128.34 after dividing by 2000. This is a **conditional allowance for a deliberately inefficient protocol**, not a lower bound or a score. It falsifies the argument that every explicit realization necessarily adds only .04 bits; it does not rule out streaming/locality improvements or low-memory algorithms.

**6. Complete arithmetic, cold setup, and no double counting**

Use all-in instructions here: `H=0`, `W=I/2000`. A separately justified reference-operation schedule may instead use `H+R/2000`, but must remove the same implementation instructions from R. The reference incomplete batched-affine 6M convention (S=M, A=0) is not a complete Jacobian-add routine. Complete additions must handle zero digits, identity, equal and inverse points. Mixed additions require affine table entries and a separately paid conversion schedule.

**REPORTED MEASUREMENT:** pinned blst `f7a88067ed98385ebc6cf41ccecf21ead706a5b7`, native ARM64 GCC14.2, scalar C flags/upstream assembly, requester Callgrind3.19: Fp mul 385, Fr mul 176, complete Jacobian add 7246, mixed add 5414, double 2989, ordinary scalar multiply 862886, eight-bit fixed-base multiply 224727, normalize 256 points 722782, already-affine96 serialization 1362. Organizer Callgrind3.24's Fp 383 is a different harness result; C stays 2000. Incremental 64/128/256 loops and 64 deterministic 254-bit scalar checks do not bound all production scalars, data-dependent paths, setup or residual batches. Production includes 255-bit scalars. No requester benchmark was rerun here.

Let `KF`, `KS`, `KInv`, `KFr`, `Kadd`, `Kdbl`, `KfromFr`, `Kser`, `Kdigit(w)` be proved implementation upper prices when available. They remain **UNRESOLVED** here. Define their boundaries on local buffers, including their own loads/stores and control; remote movement into those buffers is separate. The following supplies counts and responsibilities, not invented prices.

| Component | Charged schedule/formula and boundary |
| --- | --- |
| Input | `Iinput(n,L)`: read the actual L bytes traversed, JSON navigation/duplicate-key and syntax handling as required by the chosen parser, hex decoding, canonical selected coordinates, Montgomery ingress. Validate consumed T,A_d for curve/nonidentity/subgroup; `[r]P=O` is a conservative complete check. Do not validate every unused power relation. G is public, but its decoding/loading still costs work. T=A1 does not require a fourth base. |
| Dimensions/constants | Four-limb log2/division/integer-sqrt and dimension checks; scalar Montgomery constants and conversions; a,beta,ag,bg; table selectors and counters. Binary `pow(x,e,r)` for bitlength ell uses ≤2ell Fr square/multiply operations plus bit/control work. Avoid inversions for ag,bg by reducing negative exponents modulo m,d. In all these powers ell≤255, so 510 operations is a conservative bound per power, not a measured cost. |
| Primitive-root/advice | Primitiveness of supplied 7 is a requester-attested premise. No attack-side random generator search is required under it. If verifying a supplied certificate, read its factors/proofs, check factor product/primality certificates and every `7^((r−1)/q)!=1`; charge all work/storage. No full certificate was independently checked. Any construction/search of additional embedded advice, including map matching, is charged. |
| Table initialization | For Tw cells initialize a local complete identity cell and send one write per cell: Tw*FT, local construction of the identity, loop/address work. This includes 18 destination word stores per cell through FT; do not add those stores again. If building directly in local arrays, replace FT with its explicit eighteen-store+address/control schedule. |
| Table filling | `A=3k(2^w−2)` complete additions, `Dtbl=3(k−1)w` doublings. Keep current seed/previous cell locally, copy seed into digit 1 for each of 3k rows, then fill digit 2 onward, sending each result. Charge `A*Kadd+Dtbl*Kdbl+(A+3k)*FT`, seed copies, row/counter control, local buffer work not inside kernels. Thus total cell writes including initialization are `2Tw−3k`. No remote previous-cell read is necessary in this constructor. |
| Stream scalar arithmetic | U=N−4 Fr ratio updates at KFr each; constant/seed Montgomery ingress once per stream; N Montgomery exits before scalar digit extraction. Preserve canonical values when needed. Reading digits of Montgomery residues would compute the wrong scalar. |
| Digits and point queries | N times k digit extractions from four canonical limbs (cross-limb shifts/masks for w=24; mask top partial digit). k table reads at FT; first-cell accumulator copy (18 loads+18 stores), then k−1 complete adds, local loop/counter control. Thus `Iquery=N*(KfromFr+Kdigit(w)+k*FT+Kcopy144+(k−1)*Kadd+Kqcontrol)`. If a complete MUL_FIXED kernel already includes some terms, replace those terms; do not add its count to them. |
| Batch normalization | For each stream length l, process floor(l/256) full batches and its actual nonzero remainder. A t-point nonzero-Z prefix/backward inversion schedule uses `3(t−1)` Fp multiplications+one inversion; scaling x,y adds `3t` multiplications+t squares. Charge `Norm(t)=(6t−3)*KF+t*KS+KInv+Kbatch_memory/control(t)`. Include every Z check or a zero-safe mask policy. Fermat inversion to p−2 has ≤762 mul/square operations plus loop/control. This is an independently derived decomposition, not the sampled blst routine. |
| Serialization/record packing | N*Kser for canonical x||y, including both Fp Montgomery exits and endian conversion if inside Kser; otherwise add them separately. Pack j in two words for P baby records, keep giant query keys in local batch memory. Initial remote baby writes are already in Arec, not here. |
| Dictionary | `(S+Q)*Kcmp+Arec*FR+Kloop`; includes sort copies, full adversarial key comparisons, every record write/read and wide cursor operation. Array allocation/provisioning is separate and paid once. |
| Recovery | Four-limb product/add for i0, range comparisons, `zeta^i0` for stage-2 seed, `beta^i1` and one final Fr product. At most one retained canonical match per stage. Charge scalar powers, conversions and modular arithmetic. |
| Verify/output | A correctly bounded `[s]G` (or a paid query of the existing G table), exact compare with decoded T, range check, 32 scalar bytes/64 lowercase hex characters and JSON framing; actual output transport. Verification failure terminates with failure; honest correct exact execution cannot reach it. |
| Randomness/failures | Zero for the deterministic full/truncated exact design under the reliable-machine premise. Hash and walk variants add bounded randomness generation/rejection, seeds, failed attempts, capped restarts and any replay. Network/allocator runtime failures require their chosen failure model, not an implicit free retry. |

Every actual normalization batch pays its own inversion. Do not add an inversion again if using a complete measured batch kernel; do not divide its sampled cost by 256 to bound arbitrary tail sizes. A sequential kangaroo cannot prepare its next 256 dependent states for one inversion; it needs a separately charged multi-trail schedule or per-step normalization.

The profile guarantees honest powers and explicitly allows not reading/validating the whole sequence. It does not make the bytes used by an attack free. The JSON field lengths are fixed, but legal whitespace/order is not a bounded random-access index. A sequential parser may traverse preceding A entries to reach A_d, and possibly more to reach T. Use L explicitly until the actual generator serialization or a priced indexed interface gives L(n). Unbounded whitespace is an input-format accounting gap, not evidence against cryptanalysis. No requester-only secret is missing; an unresolved report is the authorized deliverable.

The conditional family for `1≤n<r`, with d(n) above, is

```
I_exact(n,L; implementation,transport) =
    Iinput + Ipublic_setup + Iadvice + Iprovision
  + Itables + U*KFr + Istream_initialization
  + Iquery + sum_{l in [B,Gcount,B2,G2]} NormStream(l)
  + N*Kser + Ipack
  + (S+Q)*Kcmp + Arec*FR + Kloop
  + Irecover + Iverify + Ioutput.
W_exact = I_exact/2000.
NormStream(l) = floor(l/256)*Norm(256) + (Norm(l%256) if l%256 else 0).
```

All costs are aggregate across processors. Every symbol above must receive a complete justified price/bound before this becomes a numerical W(n). The distinct labels keep provisioning, payload movement, local kernel loads, and local comparisons from either disappearing or being double counted. Cold preprocessing includes the three positional tables, machine/code setup, constants/advice and baby-table generation/sort if classed as preprocessing. Those baby costs are already included in total and must not be added a second time. Advice storage includes all retained positional tables, constants and optional certificates; randomness is zero in the exact design. No numerical preprocessing-total or peak-total logarithm is certified here.

**7. Explicit positional-window evaluation**

The following is a cold finite variant of the primary positional construction, independently counted. With `k=ceil(255/w)`, store `Tab[P,j,v]=[v*2^(w*j)]P` for three bases, k rows and all `2^w` digits. Conservatively include unused high-row digits and identity cells. There are Tw=`3k2^w` Jacobian cells of 144 bytes. Evaluate with k cell loads, one accumulator copy and k−1 complete additions. No query doublings: those belong to row construction.

| w | k | Tw cells | Three-table bytes | Cold complete adds | Cold doublings |
| ---: | ---: | ---: | ---: | ---: | ---: |
| 8 | 32 | 24,576 | 3,538,944 | 24,384 | 744 |
| 16 | 16 | 3,145,728 | 452,984,832 | 3,145,632 | 720 |
| 24 | 11 | 553,648,128 | 79,725,330,432 | 553,648,062 | 720 |
| 32 | 8 | 103,079,215,104 | 14,843,406,974,976 | 103,079,215,056 | 672 |
| 64 | 4 | 221,360,928,884,514,619,392 | 31,875,973,759,370,105,192,448 | 221,360,928,884,514,619,368 | 576 |

Initialization alone involves 18Tw destination word stores before filling, unless explicitly optimized out with a changed construction proof. The ledger's remote-write tariff includes these stores. Each generated result must also be stored, and cold allocation/code distribution must be paid. Wide windows can save arithmetic while increasing lookup/addressing costs. Window 8 alone has requester implementation evidence. All others are extrapolations of this explicit constructor.

The following values are **partial sampled-price projections, not W values or scores**:

| w | Query adds/point | log2 of `N*((k−1)*7246+176+722782/256+1362)/2000` | log2 of `(A*7246+Dtbl*2989)/2000` |
| ---: | ---: | ---: | ---: |
| 8 | 31 | 125.267669 | 16.448877 |
| 16 | 15 | 124.249379 | 23.442239 |
| 24 | 10 | 123.691980 | 30.901580 |
| 32 | 7 | 123.212090 | 38.442147 |
| 64 | 3 | 122.134488 | 69.442147 |

The online column omits conversions/digit handling not already in the samples, table routing, full dictionary, allocation, residual-batch correction, verification and other ledger terms. The cold column omits zeroing, transfer, copies and control. Neither is an upper bound. In particular, `31*7246=224626` differs from the whole eight-bit multiplication sample 224727; they are alternative boundaries, not additive costs. Replacing the former with the latter yields the requester's

```
log2[N*(224727+176+722782/256+1362)/2000] = 125.2683050986.
```

This is a conventional per-point projection with one update per point, while the exact full schedule uses N−4 updates. The difference is negligible numerically, but the exact ledger retains N−4. Batch residuals and fixed per-call costs remain missing from the sampled projection.

The constant-add KKM principle is not blocked by an unknown extra table. For example, an additional **analytic** w=85, k=3 design uses 50,136,571,591,057,901,133,414,531,072 bytes and 348,170,636,049,013,202,315,378,670 setup additions, with two online adds. Its construction arithmetic is below the exhaustive online point count, but its addressing/digit extraction is wider still. This is not a numerical improvement claim or a recommendation to construct it on the M5. At w=128, k=2 the elementary full-table setup is already too large to treat as negligible relative to this search. This finite observation does not prove optimality of any window or exclude signed/comb/endomorphism variants.

**8. Published lower-memory alternative, fairly costed**

Cheon's published implicit kangaroo is the relevant lower-memory alternative; use its stage 1 and the cheap deterministic stage 2. Its original changing-point recurrence is `Q <- [c_t]Q`, where `c_t=a^h_t mod r` for a finite jump set. The Izu fixed-base formulation justifies maintaining state on each trail as `Q=[u]base`. Independently applying that algebra to Cheon's finite jump set gives

```
base = G for tame, A_d for wild
u = a^start mod r; e = start mod m
Q = MUL_FIXED(base,u)
t = selector(canonical(Q))
u = u*c_t mod r
Q = MUL_FIXED(base,u)
e = (e+h_t) mod m
```

Keep a separate bounded travel counter if the stopping rule uses unwrapped distance. Equal tame/wild points imply `i0=e_tame−e_wild mod m`; exact verification is mandatory. Each step has one Fr multiply, scalar conversion/extraction and one **full-scalar fixed-base** multiplication. A small distance h_t does not generally produce a small Fr scalar c_t. No fourth table is needed. This repairs hostile-audit's overbroad prohibition; it does not validate memory-design's equal-total-cost assertion.

Distinguish the implementations:

| Variant | Scalar-field work | Point work and missing obligation |
| --- | --- | --- |
| Literal finite-jump Cheon | Precompute each c_t once; update bounded distance | Changing-base multiply per jump, or a separately priced fixed-scalar chain; the supplied ordinary multiply sample alone projects about 127.18 bits for `2 sqrt(m)` jumps, before all else. This is not the best fixed-base candidate. |
| Finite-jump maintained coefficient | One Fr product/step; J modular powers for the jump table and every rebuilt table | Fixed-base multiply/step; price selector, canonical point, DP operations, starts and actual normalization schedule. |
| Literal Izu full-range selector into Z/m | Recompute `a^sigma` each step, or compute `a^f(Q)` then update u | Up to 470 Fr square/multiply operations per stage-1 exponentiation (235-bit exponent) with simple binary powering, plus fixed-base multiplication. One cannot silently import a finite-jump price into this full-range transition model. |

A finite example J=32 needs 32 jump-coefficient exponentiations (≤510 Fr operations each using a conservative full-width bound), actual random distance/selector seeds, their rejection sampling/cap policy and storage. Define an equality-invariant selector from canonical affine keys; a specified hash may supply an implementation, but random-walk behavior is an additional heuristic. Raw Jacobian bytes do not preserve equality under projective rescaling. One dependent trail generally needs its current point normalized before choosing the next jump. Batching requires multiple active trails, their starts, synchronization and buffers, all charged.

For a declared capped attempt let L be maximum total jumps across all trails, Dcap maximum DP records, Jbuild number of table constructions and `Kstep` the complete bounded step schedule. A usable ledger is

```
I_attempt <= Jbuild*I_jump_setup + I_starts/seeds
           + L*(KFr+KfromFr+Kdigit+k*FT+Kcopy144+(k-1)*Kadd
                + Kselector+KDPtest+Kdistance/control)
           + I_normalization(actual independent-trail batches)
           + I_DP_dictionary(Dcap,L) + I_transfers/coordination
           + I_self_collision/cycle_detection + I_replay
           + I_collision_recovery/verification.
I_low <= Iinput+Iadvice+Iprovision+Itables + t*I_attempt
         + I_exact_stage2 + I_output.
```

For literal Izu add the Fr exponentiation cost per jump. Define a maximum number of fresh seeds/restarts; include every failed trail, overflow, self-collision and replay within L or as separately capped work. Deterministic stage 2 runs at most once after verified stage-1 recovery, or explicitly charge each attempted candidate. A DP dictionary must be fully specified (for example an exact balanced search tree with O(log Dcap) node visits, rotations and local 64-bit addresses), not a free hash lookup. If coefficient/travel data is reconstructed by replay, charge every replayed step.

**UNRESOLVED success:** neither a finite selector's mixing nor the distribution of first useful tame/wild collisions by L follows from the published approximate mean. For a justified per-attempt success lower bound p, t independent attempts give `1−(1−p)^t`; choose `t≥ceil(log(.61)/log(1−p))`, charging t attempts. Table reuse inside one target is allowed but cold construction is charged once. If each attempt uses deterministic seeds, independence is not automatic. A genuine expected-time upper bound mu could imply .39 success by mu/.61 via Markov; the approximate model is not such a bound. The restricted requester controls prove neither p nor a full-production extrapolation.

**Memory tradeoff, labelled heuristic sizing:** Theta=2^−98 gives expected retained-record scale about `2 sqrt(m)*Theta≈2^20.4285`, with a detection tail on the scale 2^98 jumps, much smaller than sqrt(m). A hard cap Dcap=2^22 and 160-byte records (96 key+32 distance+32 metadata/pointers) gives 671,088,640 bytes for records. Two buffers plus window-16 tables total 1,795,162,112 bytes before dictionary metadata/active states/code. This is feasible capacity sizing for a 128 GB experiment, not a proved occupancy or success claim. Overflow is a charged failure. Actual traversal distances may need more than 235 bits if unwrapped; using residues modulo m plus a separate capped travel counter makes the width explicit. No huge exact database is required, but KKM tables are still part of lower-memory storage.

**9. Same-convention comparator and limits of competitiveness**

The strongest generic G1 comparator identified in the checked primary framework is automorphism-aware Pollard rho using all six maps, with batch-affine arithmetic and fruitless-cycle handling. These maps apply to the profile's `y²=x³+4` curve; public constants and subgroup action must be checked/loaded with their costs. A nonzero prime-order point has a six-element orbit: a nontrivial root-of-unity scalar cannot fix it. The primary Bos–Costello–Miele framework supports the method, not an exact BLS tariff or a free sqrt(6) speedup.

Under an **ASSUMED independent uniform-orbit birthday model**, Qorbit≈r/6 and

```
Pr(collision by v) approximately 1-exp(-v²/(2*Qorbit))
v39 = sqrt(-2*ln(.61)*r/6), log2(v39)=126.1277874942
E[v] approximately sqrt(pi*r/12), log2(E[v])=126.4618115209.
```

These are visit counts under a heuristic, not total work and not identical statistics. A real walk must produce useful coefficient collisions and handle cycles. Charge cold r-adding tables, seed generation, starts, all scalar coefficients (including the automorphism's action), affine batches/residual inversions/exception handling, representative selection, partition/DP predicates, dictionaries, transport, detection/replay/restarts, final Fr inversion, scalar verification and output. A fair schematic total is

```
I_rho = Iinput + Iseed + Itables + Istarts
      + v*(Kcomplete_step + Korbit + Kcoefficients + Kpartition/DP/control)
      + Iresidual_batches + Idictionary + Itransport
      + Icycles/restarts/replay + Irecover/verify/output.
W_rho = I_rho/2000.
```

If using reference H for qualified incomplete-affine additions, account the exceptional scheme and all remaining work in R, exactly as for Cheon. Merely inserting 7246/2000 for one Jacobian add raises the illustrative v39 exponent to about 127.985 before other costs; that is also a partial projection, not a competing total. Neither the 125.2683 Cheon partial nor v39 alone establishes a ranking. The same success hypothesis standard must apply to both stochastic walks. Exact truncated Cheon has a counting proof; it need not inherit a walk assumption.

An exact deterministic comparator is additive BSGS covering `ceil(.39*(r−1))` scalar candidates, with about `2 sqrt(.39*r)` point generations, log2≈127.7493. It must handle infinity, initial/giant scalar setup, all exact dictionary work and the same segmented addressing. With no memory cap, it cannot be dismissed on size while allowing Cheon's arrays. It is a transparent comparator, not necessarily the fastest attack.

A claim of the globally strongest G1 baseline must also consider transfer `e(T,Q0)=e(G,Q0)^s` and finite-field discrete logarithms, including special/tower NFS. This uses the profile's public Q0 and the given G1 target, not another track's challenge. The primary literature includes [Guillevic, A short-list of pairing-friendly curves resistant to Special TNFS](https://eprint.iacr.org/2019/1371). The primary abstract was checked; full PDF retrieval returned HTTP 403, so no full-paper rereading is claimed. Its security-estimation framework is relevant; no published “security bits” headline is imported as scalar AArch64 instructions. A complete cold pairing-transfer/NFS ledger (polynomial/advice construction, sieving, linear algebra, descent, memory/communication, success and verification) was **not** obtained here. Consequently the globally strongest normalized competitor remains unresolved as well. No novelty or optimality claim, or assertion that generic rho globally dominates finite-field attacks, is justified.

**10. Missing-assumption certificate and rejection conditions**

A numerical TOTAL bound is rejected on the present record until the following evidence is supplied or derived. These are research obligations, not requests for private requester values.

| Missing item | Exact acceptance obligation | What does not fill it |
| --- | --- | --- |
| Complete arithmetic price | Fixed routines or analytic schedules bound all full-width scalars, complete addition exceptions, conversions, digits, local loads/stores, setup and every batch tail. Establish kernel boundaries before summing. | Incremental averages, 64 scalar samples, validity flags, replacing a complete add by 6M. |
| Memory/provisioning price | Choose a finite layout/protocol and bound FR/FT, all endpoint and router work, executed waiting, allocation/initialization, code distribution, controller operations and peak arenas. Alternatively use a costed low-memory design. | A 128-bit integer cast to a pointer, an unexplained unit-cost global RAM, a local copy counted as remote transport, or a fictitious memory cap. |
| Input/framing | Give L(n) for the actual honest generator/interface or explicitly state W(n,L) and account all traversed bytes/selected validation. | Free access to A_d inside arbitrary JSON, or falsely requiring validation of all unused powers. |
| Randomized alternatives | Fix selector/hash, coin generation, trial caps, collision verification and restarts; prove or support the claimed finite-budget production success. | An expected approximate walk cost, ideal hash oracle, favourable secret distribution or uncharged retry loop. |
| Competitiveness | Price the strongest relevant comparator(s) under the same C, .39 success, cold setup and memory/transport assumptions; distinguish generic from global comparison. | Subtracting an arithmetic-only Cheon log from an idealized rho visit log or from NFS “security bits”. |

With these unresolved, there is no justified numerical `W(2^20)`, numerical total preprocessing bound, or numerical peak-total-memory bound in this report. The integer payloads, operation counts, conditional memory expression and symbolic total are reproducible. They allow a future finite analytic argument to be reviewed without a production execution. Nothing here proves that filling the gaps must erase Cheon's advantage; nothing authorizes calling a conditional projection a score.

**11. Offline reproduction and checks**

The following standalone Python 3 program uses only the standard library. Integer ceilings decide all sizes; floating logarithms are display only. It checks constants/window counts, exact and truncated two-stage algebra (including noncoprime m,d), order-six tag recovery where applicable, adversarial fixed-length merge/copy/search bounds, and wide page/carry identities. Points in the small algebra model are represented by their scalars; that model cannot validate BLS kernels, network prices, stochastic mixing or hardware performance. This report does not depend on downloaded research tools at verification time.

```python
from math import isqrt, log2, log, gcd
from fractions import Fraction

r = int('73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001', 16)
def csqrt(v): return isqrt(v-1)+1
def rect(q, num=1, den=1):
    L=(num*q+den-1)//den
    b=csqrt(L)
    return L,b,(L+b-1)//b

d=1<<20; m=(r-1)//d
assert ((r-1)&-(r-1))==1<<32 and gcd(m,d)==4096
_,B,Gc=rect(m); _,B2,G2=rect(d)
N=B+Gc+B2+G2
S=B*(B-1).bit_length()+B2*(B2-1).bit_length()
Q=Gc*B.bit_length()+G2*B2.bit_length()
Arec=4*S+Q+B+B2
assert B==Gc==223621884914696853578958571250384896
assert N==447243769829393707157917142500771840
assert S+Q==52774764839868457444634222815090856960
assert 224*B==50091302220892095201686719960086216704
sample=Fraction(224727+176+1362)+Fraction(722782,256)
print('m,N,padding,comparisons',m,N,B*Gc-m,S+Q)
print('partial log only',log2(N*sample/2000))
print('120-budget instructions/encoding',2000*2**120/N)
print('conditional redundant transfer allowance',log2(Arec*6528/2000))
print('rho39 heuristic visits log',.5*log2(-2*log(.61)*r/6))
for w in (8,16,24,32,64,85):
    k=(255+w-1)//w; cells=3*k*(1<<w)
    adds=3*k*((1<<w)-2); dbls=3*(k-1)*w
    print('window',w,k,cells,144*cells,adds,dbls,
          'partial online',log2(N*(Fraction((k-1)*7246+176+1362)
                                   +Fraction(722782,256))/2000),
          'partial setup',log2(Fraction(adds*7246+dbls*2989,2000)))
qpage=4096
hR=(((B+qpage-1)//qpage)-1).bit_length()
assert hR==106
for n in (1,2,3,1<<20,(1<<32)-1,1<<32,r-1):
    dd=1<<min(32,n.bit_length()-1)
    assert dd<=n and (r-1)%dd==0

# Two u64 limb arithmetic and page decomposition, including carries.
mask=(1<<64)-1
def limbs(x): return (x&mask,x>>64)
def add128(x,y):
    lo=x[0]+y[0]
    return (lo&mask,(x[1]+y[1]+(lo>>64))&mask)
for j in (0,4095,4096,(1<<64)-1,1<<64,B-1):
    lo,hi=limbs(j)
    page_lo=(lo>>12)|((hi<<52)&mask); page_hi=hi>>12
    assert ((page_hi<<64)|page_lo)==j//4096
    slot=lo&4095
    assert (slot<<7)-(slot<<4)==112*slot
    assert (slot<<7)+(slot<<4)==144*slot
    nlo,nhi=add128((lo,hi),(1,0))
    assert (nhi<<64)|nlo==j+1
assert (B*(Gc-1)+(B-1)).bit_length()<=256

# Complete small scalar-group model; primitive z=5 works for these primes.
def solve(p,dd,s,h=1,num=1,den=1):
    z=5; mm=(p-1)//dd
    assert mm%h==0
    a=pow(z,dd,p); beta=pow(z,mm,p); qq=mm//h
    eta=pow(a,qq,p); L,b,g=rect(qq,num,den)
    def canon(v):
        return min((v*pow(eta,t,p)%p,t) for t in range(h))
    baby={}
    for j in range(b):
        key,tag=canon(pow(a,j,p)); baby[key]=(j,tag)
    i0=None
    for kk in range(g):
        key,tg=canon(pow(s,dd,p)*pow(a,-b*kk,p)%p)
        if key in baby:
            j,tb=baby[key]
            if j+b*kk<L:
                i0=(j+b*kk+(tb-tg)*qq)%mm; break
    if i0 is None: return None
    _,b2,g2=rect(dd)
    baby2={pow(z,i0,p)*pow(beta,j,p)%p:j for j in range(b2)}
    for kk in range(g2):
        j=baby2.get(s*pow(beta,-b2*kk,p)%p)
        if j is not None and j+b2*kk<dd:
            ans=pow(z,i0,p)*pow(beta,j+b2*kk,p)%p
            assert ans==s
            return ans
    raise AssertionError('stage2')

fullcases=0; configs=0
for p in (97,193):
    assert len({pow(5,t,p) for t in range(p-1)})==p-1
    for dd in range(1,p):
        if (p-1)%dd: continue
        mm=(p-1)//dd
        for h in (1,6):
            if mm%h: continue
            for num,den in ((1,1),(39,100)):
                got=sum(solve(p,dd,s,h,num,den)==s for s in range(1,p))
                L,_,_=rect(mm//h,num,den)
                assert got==L*h*dd,(p,dd,h,got,L*h*dd)
                configs+=1
                if h==1 and num==1: fullcases+=got
assert fullcases==3840
print('algebra',fullcases,'full unquotiented recoveries;',configs,'coverage configurations')

# Deterministic all-records-per-pass merge and half-open binary search.
def merge_sort(a):
    a=list(a); n=len(a); width=1; comparisons=copies=0
    while width<n:
        out=[]
        for left in range(0,n,2*width):
            mid=min(left+width,n); end=min(left+2*width,n)
            i,j=left,mid
            while i<mid and j<end:
                comparisons+=1
                if a[i][0]<=a[j][0]: out.append(a[i]); i+=1
                else: out.append(a[j]); j+=1
                copies+=1
            while i<mid: out.append(a[i]); i+=1; copies+=1
            while j<end: out.append(a[j]); j+=1; copies+=1
        a=out; width*=2
    assert comparisons<=n*(n-1).bit_length()
    assert copies==n*(n-1).bit_length()
    return a

def search(a,key):
    lo,hi=0,len(a); c=0
    while lo<hi:
        mid=lo+(hi-lo)//2; c+=1
        if key==a[mid][0]: return mid,c
        if key<a[mid][0]: hi=mid
        else: lo=mid+1
    return None,c

for n in (1,2,3,7,16,33,1024):
    # Equal keys, reverse keys and very long common prefixes.
    patterns=([0]*n,list(range(n))[::-1],[i%5 for i in range(n)])
    for values in patterns:
        records=[(v.to_bytes(96,'big'),i) for i,v in enumerate(values)]
        out=merge_sort(records)
        assert out==sorted(records,key=lambda t:t[0])
        for v in range(n+2):
            found,c=search(out,v.to_bytes(96,'big'))
            assert c<=n.bit_length()
            assert (found is not None)==(v in values)
a=[(i.to_bytes(96,'big'),i) for i in range(1024)]
assert search(a,(0).to_bytes(96,'big'))[1]==11
print('dictionary bounds/stability and addressing checks PASS')
```

**Checks performed here:** the program above was executed locally: 3,840 full unquotiented toy recoveries, 74 full/truncated/orbit coverage configurations, and the dictionary/addressing assertions passed; the source/hash/HEAD comparisons above were independently performed in this run. No full-production attack, requester Callgrind benchmark, native M5 experiment or stochastic production-success experiment was performed. PDF extraction was research scratch work; the delivered ledger and its reproduction code need no third-party package, network, credentials or unsubmitted file. These checks are internal consistency checks, not independent certification.

**12. Ranked next experiments on the requested Apple M5 Max, 128 GB**

All are proposals; no claim about measured M5 throughput is made. Freeze source/compiler/flags, routine boundaries, data encodings, counters, seeds, caps and development/holdout split before tuning. Use a 30–60 second pilot to estimate actual wall time. For planning only, assume **0.5–5 billion charged scalar instructions/second**, not an M5 hardware specification. Native timing and Linux/AArch64 instruction accounting are different measurements; preserve the toolchain differences. An experimental RSS cap is local safety planning, never a challenge memory cap.

1. **Cheapest decisive test: close the existing eight-bit kernel boundary and batch tails.** Budget half a day to two engineering days if source is available; minutes per bounded run and under 1 GB memory. Audit emitted/analytic paths for conversion, k digit loads, identity/equal/opposite additions, scalar range, initialization, every batch size 1..256 and serialization. Controls include 0,1,r−1, all window boundaries, 255-bit values, carry chains and rescaled Jacobians; compare with an independent complete multiply. Freeze 10,000 uniformly sampled full-range scalar holdouts plus adversarial vectors before tuning. **Kill the proposed instruction allowance** on any mismatch, omitted operation or branch exceeding it. A sampled maximum is still not an upper proof. A source-level bounded schedule is the decisive product, not another average. The fixed eight-bit table payload is only 3.54 MB.

2. **Implement a small exact dictionary/protocol and count, before buying arithmetic speed.** Start at 2^20 records: two arrays 234,881,024 bytes; then 2^24: 3,758,096,384 bytes. With 24 merge passes at 2^24, payload read+write alone is about 90.2 GB. At an explicitly hypothetical 1–10 GB/s this is 9–90 seconds before comparisons, routing emulation and instrumentation; reserve minutes per small trial and up to an hour for the matrix. Use tiny pages to force depth, synthetic high limbs around 2^64 and the 118-bit limit, reverse keys, equal keys, 95-byte common prefixes, padded tails and unsuccessful endpoints. Separately count every packet word/hop, ack, allocation, controller instruction and copy. Freeze a holdout of untested layouts/keys. **Kill** any tariff missing a level or truncating a limb. Sparse simulation tests address code; it does not measure a real 106-level network. Require an analytical transport realization before extrapolating.

3. **Cold window 16, and exact quotient/tag validation.** Window 16 uses 453 MB and 3,145,632 setup additions; the addition/doubling-only projection is about 2.28e10 instructions, or 5–46 seconds at the planning rate, plus initialization/movement. Reserve minutes for repeated construction and holdout queries, and roughly one engineering day to integrate/audit. Reuse the fixed full-range holdout, add cross-limb digits, verify every row recurrence on sampled rows and boundary digits. For the quotient, verify `[eta]G=psi(G)`, all six tags, rescaling invariance and exhaustive small-group coverage, including negative/wrapped tag corrections and outside-rectangle controls. **Kill** on any wrong scalar, incorrect coverage count, hidden table copy or missing map cost. Do not claim the quotient accelerates a walk without a new success analysis.

4. **Compare finite-jump fixed-base Cheon and six-orbit rho under the same harness.** Budget one to three engineering days and capped minutes-to-hours of trials, typically under a few GB using explicit DP caps. Include literal changing-base Cheon only as a control, not as the best low-memory price. Fix selector/jumps, starts, DP density, traversal/cycle/replay policy and restart budgets. Exhaust small groups and run at least 10,000 frozen uniform-secret small-model trials if the pilot permits; report success-versus-budget with a conservative confidence interval and all failed work. Full-width BLS tests measure step costs separately from recoveries in reduced search spaces. Negative controls include self-collisions, same-herd collisions, DP-free cycles and overflow; positive controls include forced exact collisions. **Kill** an instantiation at its declared budget if the held-out success lower estimate falls below .39, or if one side omits normalization, advice, transport or failures. A passing small-model test still leaves full-production mixing extrapolation explicit.

5. **Only after those tests, consider full cold window 24.** Jacobian payload is 79.725 GB. A separate affine copy adds 53.15 GB and exceeds 128 GB before overhead; keep Jacobians or normalize in bounded in-place batches. Cap RSS around 100 GB. Its 553,648,062 setup additions alone project to about 4.01e12 instructions: approximately 13 minutes–2.23 hours at the planning rate, before memory/control/tooling overhead. Reserve half a day, revise from the pilot, and stop on swapping or a budget overrun. Freeze boundary and full-width holdouts before construction. **Kill** on recurrence/query mismatch, an unpriced conversion/copy, or instrumentation invalidated by memory pressure. Window 32 requires 14.84 TB; window 64 about 31.88 zettabytes. Test address formulas/pieces on the M5, never describe partial construction as a full-table measurement.

The eight-bit arithmetic-only workload is approximately 1.0e41 scalar instructions. Even a hypothetical aggregate 10^12 instructions/second would take about 3.2e21 years before omitted work. The decisive affordable experiments are kernel-boundary audits, exact dictionary/protocol counters and matched success controls. Production execution is neither required nor a sensible validation plan.