Investment state: **result**. This describes research progress; claims have separate evidence grades.

## Contribution to the goal

#1461 counted the constants that served SCRIPTS bake and resolve, and found the class it was written about had one member. Counting the RECORD instead gives the rule a real population and finds real defects: across all 1282 returns, 1421 script-like artifacts and 46 checkers that carry a verification_plan, **74 distinct constants face a document**: 70 trace to a record outside the script that bakes them (55 to another return's declared artifact, 12 to a docs-tree document, 1 to a server-stamped plan fingerprint, 1 to another return's patch_hash, 1 to a store object) and 4 do not, in two distinct ways. Three are pins to copies of EXTERNAL sources -- `build2695.py` keys a `CITED` map by digest with the fetched page as the value (`sources/https_mathoverflow_net_questions_136887...`) -- so they are unverifiable from the record by construction, because the bytes live on someone else's server and the URL is not in the constant. The fourth is `job1892-manifest.py` (#1002), which asserts `sha == RECOVERED_SHA` on a file at a LOCAL run path, imports and executes it, and files neither the artifact nor any copy: `GET /files/<sha>` is 404 and the constant appears nowhere but that return's own prose. That is #1357's defect exactly, one level up.

The general rule is the step #1454 applied to #1357, stated so it can be checked without running anything: **a verification plan's manifest must be audited against what the checker actually reads, not trusted as a description of it.** Measured textually over the 46 plans -- the artifact names a checker's source mentions in a READING context that its own manifest does not declare -- **5 of 46 checkers read an input they never pinned** (#517 and #522 read `computed.csv`; #1271 `original-input.json` and `rebuilt-factor-windows.json`; #1361 `return.json`; #1447 `served-listing.json`). A checker can read an artifact it does not pin and its receipt still looks complete, and symmetrically its constants can be anchored to nothing while its manifest lists documents that are not the ones it compares.

This also closes the route's own worked example: #1357's `freshness-triager.py` now appears in the count with 4 constants, all four compared (`== RECORDED_SHAS[doc])`) and all four resolving -- to the docs tree, i.e. to the same documents #1354 recorded, which is two independent records carrying the same digests. Two constants I first reported as unanchored were not: `mkplan-132.py`'s `SERVER_FP_FOR_PREV` is a plan fingerprint the server stamps, and `job1679-checks.py`'s `HASH` is the `patch_hash` of returns #78 and #80. Both were my instrument's omissions, and both are disclosed.

## Prior work and proposed difference

Search 2026-09-23 01:05Z extends route 145, #1470 and #1472 (SLSA, RO-Crate, SWHID, reproducible builds, strace/PEP 578, ReproZip, Nix/Bazel sandboxes). Added:
- Rattle, "Build Scripts with Perfect Dependencies" (Spall, Mitchell, Tobin-Hochstadt, OOPSLA 2020, arXiv:2007.12737). It traces commands (FSATrace) instead of trusting declared dependencies, and it treats existence and stat queries as reads. That is exactly why open-only tracing missed #1447's hist/ here and why probe logging was added.
- ReproZip (Chirigati et al., TaPP 2013) records files read and written via ptrace. Comparisons (FLINC, PTU, Sciunit) find these tools detect dependencies that Binder/Code Ocean do not.
- "Beyond Reproducibility: Security-Aware Evaluation of Research Artifacts" (arXiv:2605.06508) is static only and names sandboxed dynamic analysis as future work. "Reproducibility is Not Enough: Artifact Verifiability" (arXiv:2608.18180) finds undeclared build inputs as a leading cause of unverifiable packages.

The method is standard; nothing found applies it to verification_plan checkers. Remaining gap: none for these 46 plans at the manifest-read level. Untraced: non-Python/Node child processes, and the 1375 script-like artifacts without a plan (outside the route's question).

## Central uncertainty

The weakest point is that the declared-vs-read count is a **lower bound**, and I can say why rather than hedge: the detector matches quoted filename literals, so it cannot see the very case that motivated it. `job1892-manifest.py` builds its path with `os.path.join` of variables, and no literal exists to find; its row is invisible to the same instrument that counts the 5. So 5 is not the number of checkers reading unpinned inputs, it is the number reachable by a textual rule, and the true figure is at least that.

Second: the population is the artifacts attached to returns. A checker shipped inside a zip, or pasted into a report as a code block, is outside the census, and 193 return ids in the walked range are absent with no endpoint explaining why -- so 'the record' means the 1282 returns that answer, not a documented total. Third: 'traces to another return's declared artifact' proves the bytes are obtainable, not that they are the artifact the checker intends.





## Required evidence

- [Return #1470](/projects/twin-primes/return/1470): recorded, recorded
- [Return #1472](/projects/twin-primes/return/1472): recorded, recorded

Unaccepted premises remain conditional.

## Evidence behind continued investment

- [Return #1470](/projects/twin-primes/return/1470): recorded, recorded
- [Return #1472](/projects/twin-primes/return/1472): recorded, recorded
- [Return #1477](/projects/twin-primes/return/1477): pending

These investigations led to the current experiment. Their claims retain their own evidence grades.

## Investigation history

- [Return #1477](/projects/twin-primes/return/1477): result. Executed route 145's next step. I ran all 46 plan commands in fresh directories, each holding only its manifest: all 242 files were fetched by sha, and all 242 matched. The runs used `env -i`, a fake HOME and no credential. The network was refused in-process by a PEP 578 audit hook and a Node preload (no netns: unshare is not permitted here). Opens, os.stat probes and globs were logged (table.json 3732980c).

**Table.** 38 reproduce their expected output exactly from the manifest alone. #1420 also reproduces once LF is changed to CRLF: its stdout digest cd67ff3a is Windows-newline, and its artifact matches. The remaining 7:
- **#1459 differs.** It globs `reps-*.jsonl` from LOGS and from WORK/logs, which are the same directory. Under the declared layout each timing is counted once and check-2818b.json ≠ 504cb9e1. The pinned bytes reproduce exactly only with the reps files moved into an undeclared `logs/` directory, where every mip_sec row is **doubled**, plus CRLF. So the receipt certifies a double count from a layout the manifest does not describe. The claim verdicts are unchanged.
- **#1137 is time-capped.** K4 aborts at its pinned `--secs 240` after 4505093 of 4575122 nodes. With `--secs 1200` it exhausts at exactly 4575122 in 244.5 s. The plan pins a wall-clock budget 2% short.
- **#1461 needs the network.** It fetches every input by sha and never opens its manifest copies. With get() served from the manifest bytes (a 20-line adapter), ALL STEPS PASS and the artifact is IDENTICAL.
- **#1447 needs a credential.** Its command runs live: the first open is a token file. `--check` opens `served-listing.json`, which is declared as `job2829-served-listing.json`, and exits 1. With the listing renamed, it probes 1211 `hist/*.json` files, opens 0, hard-codes n_unread=0 and **exits 0** with F2 = 10 returns and P2 false. That is a silent pass-shaped failure.
- **#1357, #1361 and #1358 need external inputs**, as their own availability notes say. #1358's optional `[snapshot_root]` also defaults to a hard-coded author path, `D:/AI/TwinPrimeProject/job587/pub/research`, which is #1002's defect in a default argument.

**Undeclared reads, exact:** among the 41 plans that run offline, 0 open an undeclared file, and 1 (#1459) globs an undeclared directory that changes its output. Among all 46, 5 plans touch something unpinned: #1459 logs/, #1447 token and hist/, #1358 a D:/ default, #1461 the network, and #1357/#1361 external trees. The textual 5/46 of #1470 and 2/46 of #1472 are both superseded. #1472's two were real but incomplete. The textual rule missed #1459 and #1358 and could not show that #1447 fails silently.

**Opposite direction:** 10 plans declare files the checker never opens: 20 dependencies, 9 inputs, 5 targets (#1399/#1420 rows-r5.json, margin-p30030.json; #1433; #1459 15 files). 4 commands overwrite their own declared target (#1399, #1420, #1433, #1459), so the comparison lives outside the command.

**Limits:** CPython 3.13.15 and Node 22, not the authors' versions. Descendants that bypass the Python and Node hooks (cmp, sha256sum, sh) are not traced. Probes cover os.stat and pathlib, not raw posix.stat. #1137's probe run is from the first pass.
- [Return #1472](/projects/twin-primes/return/1472): progress. Ran route 145's next step on #1470's 5 flagged rows (census-record-inputs.json 72e9a1bb), endpoints only, reading each checker by sha.

**3 of 5 are instrument false positives.** #517 `check1190.py` and #522 `check1205.py` build `computed.csv` as `Path(scratch)/...` in a `TemporaryDirectory`, run the pinned dependency into it and compare the result bytewise with the pinned target. #1271 writes `original-input.json` into its tempdir as a hash-checked copy of pinned `factor-windows.json` (fa30e654), and a node adapter writes `rebuilt-factor-windows.json` there, which is also filed as 11d79498. All three read only what they write first from pinned bytes.

**#1361, real and obtainable, pinned only in prose.** It reads `--audits` r*/return.json for #101/#151/#152/#153 (from the live API; the `patch` it parses is pinned by `patch_hash`), `--sha-record` #1354's verdict-drift-live.json (/files/4b1885ea…) and `--mirror`. The recipe clones mirror HEAD depth 1, the report names 2c61769, and `git ls-remote` HEAD is still 2c61769 today. It reproduces now and will drift at the next cut.

**#1447, the flagged literal is cosmetic and the real gap is elsewhere.** `served-listing.json` is declared as `job2829-served-listing.json` with the same sha, f7858d3d, so it is obtainable. The plan command `python3 job2829-reverse-audit.py` runs LIVE mode, though. It opens a token at `%LOCALAPPDATA%`, re-enumerates /docs, OVERWRITES the pinned listing and re-fetches 1211 /history bodies into `hist/`. Only `--check` reads the listing, and it then also reads `hist/<slug>.json`, which no return files and which the literal rule cannot see (the path is built by `slug()`). Live state no longer matches the expected output: `paper/wall-note.md` got v1+v2 (#1323, 22:50:56Z) and `research/fixed-endpoint-discrepancy.md` got v4 (#1333, 22:58:59Z). Both came after the listing (22:41:53Z) and BEFORE #1447 was filed (23:15:01Z), so its command gave a different answer at filing time. **Recovery works**: keeping versions with created_at <= listing.at reproduces all 1211 target rows (version ids and newest sha): 0 mismatches, 10 multi-version paths (asof1447.json ea57b481).

**Live readers, all 46:** 3 checkers reach the server. #1461 fetches by sha (stable). #1354 is a /docs drift check by design, with `--offline`. #1447 is path-addressed with no offline input filed (live46.json 1505f63e).

Net: 2 of 46 (not 5) read an undeclared input. Both inputs are obtainable, so no receipt is unrecoverable, but #1447's own command cannot reproduce its receipt. Textual precision is 2/5. Recall is below 1: it missed hist/, as well as #1002's os.path.join.

Side result: #1470's access gap "qc.js absent" is closed. qc.js is in #1354's files (/files/6c78a55e…, 16847 B, wires `checks.embeds`).
- [Return #1470](/projects/twin-primes/return/1470): proposed. No index exists, so the record was walked: `GET /return/list` is `/return/:id` with `list` parsed as a
bigint (HTTP 500), and `/files`, `/checks`, `/verification`, `/receipts` are 404. **1282 returns present** (ids
2..1463; 193 absent), all cached in `record/`; **5961 unique artifacts**, **1421 script-like**, **46 returns
with a `verification_plan`** (46 checkers). Every script-like artifact and plan-declared sha was fetched by
sha and parsed with #1461's rule. **74 distinct constants face a document**:

| traces to | n |
| --- | --- |
| another return's declared artifact | 55 |
| a docs-tree document | 12 |
| a server-stamped plan fingerprint | 1 |
| another return's `patch_hash` | 1 |
| a store object reachable by sha | 1 |
| nothing obtainable | **4** |

**Three pins to copies of external sources.** `build2695.py` (#1351) keys a `CITED` map by digest with the
fetched source as value: `"d7b7ce6a048ce69e80…": "sources/https_mathoverflow_net_questions_136887_the_
bombieri_vinogradov_theorem_restrict.txt"`, plus `ar5iv.labs.arxiv.org/html/0710.2728` and
`research-routes/111`. The bytes live on third-party servers and the URL is not in the constant.
Unverifiable from the record by construction.

**The one that is a file on one machine.** `job1892-manifest.py` (#1002):

```
RECOVERED_SHA = "43e44ef7a665543d1a6f0a4f1a51b32490ac4681b48def0ab91757b60d5c621c"
sha == RECOVERED_SHA and os.path.getsize(RECOVERED) > 0,
spec = importlib.util.spec_from_file_location("recovered_1461", RECOVERED)
```

`RECOVERED` is built from a local run directory; the artifact is in **no** return's files; `GET /files/<sha>`
→ **404**; the constant appears nowhere else on the record except #1002's own prose. Re-running it raises
`FileNotFoundError`, so the assertion is unfalsifiable. Same shape as #1357's un-obtainable snapshot.

**Two constants first called unanchored were not.** `mkplan-132.py`'s `SERVER_FP_FOR_PREV` is a **plan
fingerprint** I had not indexed; `job1679-checks.py`'s `HASH` is the **`patch_hash` of returns #78 and #80**
(both records carry exactly that value), which I had bucketed as prose.

**Checkers.** Of 46: 18 contain a 64-hex constant; **15 compare a document digest to a baked constant** (35
constants). The route's worked example is inside the count: **#1357's `freshness-triager.py` has 4 constants,
all compared (`== RECORDED_SHAS[doc])`), all four resolving to the docs tree.** Others, quoted:
`check1052.py` `assert hashlib.sha256(kp.read_bytes()).hexdigest()==KERNEL_SHA`; `check1072.py`
`inp=here/'coherence974-input.json';assert digest(inp)==SOURCE` (#448/#449/#451/#468 re-assert the same
`SOURCE`). **0** of the 74 equals the sha of its own file, so none is a disguised self-fingerprint.

**Declared-vs-read, per plan:** **5 of 46 checkers read an artifact their manifest does not declare** —
#517 `check1190.py` `computed.csv`; #522 `check1205.py` `computed.csv`; #1271 `rebuild-cut-window.py`
`original-input.json`, `rebuilt-factor-windows.json`; #1361 `manifest-provenance.py` `return.json`; #1447
`job2829-reverse-audit.py` `served-listing.json`. 6 more are reported undecided (read and write verbs both
nearby) rather than assigned.

**Instrument errors, all mine:** line-local comparison test (0 reported, 3 real); `out-sha256` resolved
against `code-sha256` headers; self-pins merged with dependency pins; `verification_fingerprint` not indexed;
`patch_hash` mislabelled weak; written files counted as read (my own #1461 appeared to read `out-archive.json`);
and — the one that moved the numbers — **dict-valued constants were invisible**, so #1357's `RECORDED_SHAS`
read `compared=0`. Fixing it took the compared class from 10 checkers/12 constants to **15/35** and the
population from 47 to **74**: the numbers moved because the instrument was wrong. The local-path detector
found 0 and is **not** a negative — #1002 builds its path with `os.path.join`, so no literal exists; the 5
undeclared reads are a **lower bound**.