Automata and formal languages

A direct scaffold for even palindromes

The independent FPRD-T89/T90 transfer route already places binary even palindromes in PEG. The direct route uses persistent typed receipts and one simultaneous record batch per input symbol. Its current theorem is conditional on the complete Draft 5 Section 11.1 sequence contract. The receipt and compiler arguments survive; the concrete sequence implementation still has open source-contract obligations, and the numerical radius and distance remain withdrawn.

The proof has four separate obligations

Factor every prefix into its longest even-palindromic suffix and the context to its left.
Store typed receipts that name the exact old occurrence needed by each next transition.
Stage the persistent sequence work without inspecting a fresh receipt payload.
Encode the resulting bounded graph of fresh records in one physical scaffold node.

The separation matters. Word-level existence of a palindrome does not supply a bounded pointer to its occurrence, and a bounded persistent program does not automatically fit a sequential allocate-then-link model.

FPRD-D36 · machine model

Specify a bounded fresh graph all at once

A bounded simultaneous record transducer has fixed finite control, $s$ current roots, at most $A$ fresh slots per input letter, $q$ pointer fields per record, and old-record observation radius $r$ . From that bounded old observation it chooses the next control, roots, active slots, finite labels, and complete fresh adjacency table.

Each new root or field may target:

the missing pointer;
an old address reached from an old root by at most $r$ field steps; or
any active fresh slot, including itself, a later slot, or one side of a mutual cycle.

The transition specifies a finite labelled graph; it does not inspect a fresh record while deciding that graph and does not invoke fixed-point semantics. This repairs an earlier topologically ordered source model that could not express the owner-to-rope-to-owner cycle used below.

FPRD-T125 · receipt dynamics

The longest suffix and its left context update exactly

For a prefix $S$ , let $P$ be its longest even-palindromic suffix and write $S=CP$ . Store the reversed left context $\ell=C^R$ . For an even palindrome $P$ and a letter $a$ , let $D_a(P)$ be the longest proper even suffix $Q$ for which $P=ZaQ$ , and put $\omega_a(P)=Z^R$ .

After reading $a$ , the exact update is

(P',\ell')= \begin{cases} (aPa,\ell_0),&\ell=a\ell_0,\\ (aD_a(P)a,\omega_a(P)\ell),&\ell\notin a\Sigma^*,\ D_a(P)\text{ defined},\\ (\epsilon,aP\ell),&\ell\notin a\Sigma^*,\ D_a(P)\text{ undefined}. \end{cases}

Acceptance is already visible in this factorization: $S\in\mathsf{EPAL}_2$ exactly when $\ell=\epsilon$ .

Receipts make the recurrence local

A record represents a historical occurrence, not merely a palindrome word. Its table entry for each input letter stores a direct/reset tag, a typed transition receipt naming the occurrence selected by $D_a(P)$ when present, and a headered persistent receipt rope. Mirror receipts and the bridge-shadow recurrence transport the necessary old pointers through prepend and reset operations without rewriting retained tails.

Over a fixed alphabet, the fresh occurrence record, all direct/reset table entries, and the new live context are obtained by a fixed number of head, tail, singleton, inject, and catenation operations.

The failed interfaces stay part of the result

A raw historical endpoint can hide the required occurrence arbitrarily deep in a suffix-link chain.
An immutable type-birth record cannot name transitions whose targets first occur later.
The same raw rope cell can require different typed receipts under different anchors.
Bounded bridge chasing fails on an explicit family with arbitrarily many wrong bridge tests.

These are failures of named representations, not a language lower bound and not a theorem against arbitrary recursive DAG or scaffold encodings.

Draft 2 contains two mathematical repairs

The first draft was not merely under-explained. It applied the bridge-shadow lemma where one longest-suffix hypothesis failed, and it later used the record for $D_a(P)$ but lacked a bounded selector receipt naming that occurrence.

Draft 2 adds a separate mirror-prefix lemma for the final receipt and adds one typed transition receipt to every direct table coordinate. The selector recurrence is local: the bridge coordinate takes the existing suffix-link receipt, while every off-bridge coordinate copies the corresponding selector from that suffix-link record. A later cold read confirmed the repaired interfaces. The public finite checks corroborate them; they do not replace the written proof.

FPRD-T126 · compiler theorem

One scaffold node tuple-packs one fresh batch

Compiler correction: fixed initial records are virtual

Integrated 10 September 2026. Draft 2 allowed a fixed finite initial heap but its proof only supplied a missing-root base case. Charging that heap to the first fresh batch would not justify the advertised bound. The corrected construction instead keeps the fixed, immutable, pointer-closed initial graph in a finite decoder table.

d=\max\{1,s+Aq\},\qquad k=r+1.

Why initialization adds no new resource charge

Logical pointers are tagged missing, virtual-initial, or dynamic. Virtual pointers name the fixed decoder table and use no physical scaffold edge. Dynamic pointers use the ordinary root or field port plus the finite slot tag already used by tuple packing.

A rooted address with at most $r$ field dereferences is determined by the physical $(r+1)$ -neighbourhood. Each dynamic continuation adds one edge. Once a path enters the fixed table it cannot return to later dynamic storage, because the initial graph is immutable and pointer-closed.

An initialization flag and fixed initial-root table decode the full source configuration at time zero and copy empty-input acceptance. The first transition reads the fixed table directly, creates only its at-most- $A$ dynamic records, and clears the flag. Later transitions use the same address lemma.

Application update. In the direct palindrome construction, the empty occurrence, the empty owner's two reset ropes, and the initial live empty rope are virtual from time zero. Reset ropes belonging to nonempty owners remain dynamic. Initialization therefore adds no slots or radius. Allocation $A_*=8838$ and record width $q=7$ remain supported, but a later adversarial mutation showed that the old-address checker accepts meaningless repeated selector lists. The advertised $R_*=1750$ and distance 1751 are therefore withdrawn pending a path-sensitive provenance certificate. Under its complete source-record hypotheses, Theorem 11.3 gives a bounded simultaneous plan. The direct application additionally assumes every Draft 5 Section 11.1 sequence clause; the implementation evidence does not certify that premise or a numerical distance corollary.

Provenance evidence. The OCaml 4.14.1 interprocedural IR now records all 3,912 expressions, 3,764 immediate child edges, qualified formals, 646 cases, 2,342 complete pattern nodes, 454 ordered calls, 437 return leaves, 928 builds, and 1,397 pattern bindings. It resolves the public cat alias and an 81-body callback-specialized static closure. A fail-closed admission gate binds the exact archived source and CMT bytes and checks every reached build slot against its expression edge. Source declarations fix 405 source sites as structural and 73 as control; 474 polymorphic sites across 42 bindings remain. Those 474 are not a finite list of semantic instances: recursive Packet carriers require a context-indexed symbolic type scheme that preserves arbitrary Pair^k(alpha) depth. Forty-two callback applications and two assertion obligations also remain before old/fresh interpretation and contiguous witnesses, so this does not replace the withdrawn radius certificate.

Evidence boundary. Two separate AI review passes attacked the encoding and its application, but they share model dependencies and are not external expert review. This correction is not a full receipt, Kaplan–Tarjan, allocation, or palindrome-proof audit.

Read the current conditional Draft 5 · Loff–Moreira–Reis, Definitions 10–15

With a fixed, finite, immutable, pointer-closed initial graph, an FPRD-D36 transducer compiles exactly and letter-synchronously into a finite scaffolding automaton with

d=\max\{1,s+Aq\}, \qquad \operatorname{distance}\le r+1.

A decoded logical pointer is a physical scaffold node plus a finite slot tag. Ports $0,\ldots,s-1$ encode the new roots, and port $s+iq+j$ encodes field $j$ of logical slot $i$ . Old targets become bounded raw scaffold paths. Every fresh target uses physical $\mathsf{SELF}$ , while the source node's finite label says which fresh slot is intended.

Fixed initial records are separate logical values in a finite decoder table. They use virtual tags rather than fresh slots or physical edges. An initialization flag supplies the empty-prefix configuration and acceptance; the first input transition reads the table directly before emitting its ordinary bounded dynamic batch.

The decoder compares finite labelled adjacency tables. It never recursively unfolds a cycle, so self-loops, forward references, and mutual cycles need no special fixed-point case. The one-step commuting square preserves the complete fresh batch and roots; induction preserves the run and accepted language.

FPRD-T127 · staging theorem

Build the sequence skeleton before tying the receipt knot

Kaplan and Tarjan's Theorem 5.1 supplies worst-case constant-cost push, pop, inject, and catenation on regular steques, with regular results. The FPRD staging theorem needs a stronger implementation interface: the sequence program may inspect its own finite constructors and structural fields, but must treat every stored cell as an opaque base element—no comparison, hashing, identity test, destructuring, or pointer traversal through that element. A cell has fixed shape and may contain the symbolic fresh-owner receipt.

Replace the fresh owner pointer temporarily by a symbol. A uniform bound on strict $\mathsf{car}$ , $\mathsf{cons}$ , and $\mathsf{cdr}$ steps determines a finite acyclic structural allocation graph from old structure alone. Add the fresh owner as another slot, substitute its slot for the symbol, and compile the whole graph with FPRD-T126. The newly created cycle crosses an opaque element field, so it does not change the sequence branch, denotation, or work bound.

The conditional substitution lemma is proved under the complete Draft 5 Section 11.1 contract: list semantics, persistence, opacity, finite signatures and inspected data, uniformly bounded strict evaluation and field selection, complete old/fresh pointer origins, and no escaping temporary control values. Appendix D and the OCaml source analyses remain informal implementation evidence and Needs work. Kaplan-Tarjan's abstract operation bound does not certify that interface. The separately encoded Rocq program does not verify the concrete OCaml variant.

FPRD-T128 · conditional direct theorem

The complete sequence contract yields one scaffold step

Assume a persistent sequence implementation satisfies every clause of Draft 5 Section 11.1. FPRD-T125 supplies the exact abstract receipt update; opaque-atom staging and whole-client normalization supply a legal bounded simultaneous plan under their hypotheses; FPRD-T126 compiles it into one native scaffold step per input symbol. Acceptance is emptiness of the live reversed context, including the empty input.

\text{complete Section 11.1 contract} \quad\Longrightarrow\quad \mathsf{EPAL}_2\in\mathsf{SA} \quad\Longrightarrow\quad \mathsf{EPAL}_2\in\mathsf{PEG}.

The last implication is the Loff-Moreira-Reis scaffold-to-PEG direction, which recognizes the reversal. Binary even palindromes are reversal-invariant. The direct route uses symbolic finite resource bounds; it does not certify a concrete sequence implementation or the withdrawn cat 55/56, uncons 874/875, client radius 1750, or scaffold distance 1751. Archived allocation counts remain implementation evidence rather than a new numerical theorem.

This conditional route uses no real-time multitape or Slisenko palindrome premise. The independent FPRD-T89 andFPRD-T90 transfer route retains its existing status.

The source bridge, made testable

Four operations and an exact receipt adapter

The current direct theorem assumes every Draft 5 Section 11.1 clause. The records below preserve source analyses and finite checks; Appendix D remains informal implementation evidence and Needs work. They do not certify the complete implementation premise. Numerical old-address radii and scaffold distance remain withdrawn.

The rope header is not part of the sequence. The sequence stores opaque receipt cells, and its meaning is a list of those exact historical tokens, not merely a list of equal mathematical values.

Operation	Required meaning
`empty`	Represents the empty list.
`single(x)`	Represents the one-element list containing the same opaque token `x`.
`uncons(S)`	Returns `none` exactly for empty; otherwise returns the exact first token and a persistent tail while leaving `S` valid.
`cat(L,R)`	Represents the list of `L` followed by the list of `R`, even when roots are old, fresh, shared, identical, or from different histories.

The complete client schedule

Branch	Sequence calls	Acceptance
External	`3 uncons + 2 single + 3 cat`	A second `uncons` on the returned live tail decides whether the new body is empty.
Internal	`2 uncons + 2 single + 4 cat`	False: the retained direct-rope body on the left is nonempty.
Reset	`1 uncons + 1 cat`	False: the retained reset-rope body on the left is nonempty.

The external acceptance read is essential. A one-cell live body must accept after removal; a two-cell body with the same first cell must not. Internal and reset updates retain the entire old body after inspecting its head—not the tail returned by that inspection. The source-rope uncons is allowed to be total, but its none branch must be proved unreachable from the receipt invariant.

The call counts alone are not a pointer-resource certificate. The later fixed-layout certificate supplies the allocation side in an explicit abstract record model; the whole-client normalization theorem now composes the sequential calls into one old-dependent plan. A later adversarial review showed that the old-address proof object checks arithmetic and vocabulary but not path coverage or provenance, so its numerical radius is withdrawn.

A concrete source and the assurance we still need

Viennot et al. v3 provide both explicit OCaml code and a Rocq development. They are valuable for different reasons, but they cannot be combined as though one verified program had both sets of properties.

Artifact	What it contributes	What remains open here
Handwritten OCaml	Explicit, immutable, nonrecursive operation branches over fixed-arity constructors; base elements are parametric and never inspected.	The deque-core list laws now have a source-level proof. An OCaml 4.14.1 typed-tree inventory checks the relevant calls and written arms; constructor-slot provenance remains open.
Rocq	Machine-checked list equations for the separately encoded Rocq operations.	The paper states that there is no formal connection to the handwritten OCaml code; the extracted program is not worst-case constant time.
FPRD adapter	`empty`, `single(x)=push x empty`, `uncons=pop`, and binary `cat=append`, now exposed through a sealed OCaml module.	The semantic, assertion-safety, fixed-layout, and whole-client normalization arguments close in the abstract source model. Typed syntax now checks the error-prone endpoint recurrences; the old-address envelopes remain semantic lemmas, not an OCaml runtime theorem.

Remove the counters; do not merely cap them

The restricted facade can erase its public total length without changing a core branch. Inside the kernel, reversal is always false by construction. The remaining length questions ask only whether a private buffer crosses one of a few fixed thresholds, so they can be answered by at most eleven persistent endpoint operations.

Metadata	Responsible treatment	Why
Public total length	Erase it from the sealed four-operation facade.	It never chooses a core branch for these operations.
Private reversal flag	Specialize it to false.	All buffer roots start false, endpoint operations preserve it, and no buffer caller can reverse it.
Private buffer length	Replace each fixed threshold test with bounded persistent probes.	The largest observer distinguishes 8, 9, 10, or at least 11, requiring at most eleven endpoint removals.

A capped counter is not enough. Lengths 11 and 12 have the same at-least-11 label, but one removal must produce 10 in the first case and at-least-11 in the second. The structural probe is what makes the finite treatment sound. The working OCaml variant type-checks, and a separately authored differential harness matches the pinned original at every observer boundary and across a 4,001-version persistent sharing DAG. These finite tests alone are not a proof; the next section states the two source arguments and their remaining resource boundary.

Removing the counter is also safer than retaining it. A counter-review constructed Deque.make max_int 0 through the original public API and found that one further push silently wrapped its cached length to min_int on the reviewed 64-bit runtime. The length-free facade has no such field. This is a wrapper counterexample, not a failure of the underlying deque-core sequence laws.

Two source proofs, with a visible boundary

The phantom index certifies a lower bound, not an exact length. An adversarial review used that distinction to reach an assertion in the unused private two helper, so the helper was removed. Only the centralized Buffer.pop and Buffer.eject guards remain.

The unchanged Deque_core laws are now proved directly from its handwritten source. A buffer/packet/chain denotation expands nested pairs from left to right. Exhaustive constructor reduction proves every helper equation, including all nine make_small combinations and all three green_of_red shapes, before proving the five endpoint operations.

Substituting those laws into the earlier lower-bound induction proves the two Buffer guards unreachable. The earlier branchwise simulation then proves exact token order and retained-root behavior for every finite history through the documented four-operation facade, including shared roots and cat(q,q). A separate structural interpreter also checked every operation history through depth ten: 38,480,541 nodes, with no semantic or persistence mismatch.

The constructor proof is rigorous informal mathematics, not a checked refinement. The bounded run corroborates it but cannot prove arbitrary histories. The separately encoded Rocq program still does not verify this OCaml. The deque-core theorem covers every finite well-typed core value; the composed Buffer theorem is deliberately scoped to values reachable through the documented facade. Dune internal module names can bypass cached metadata in the original wrappers, which is another reason not to make a whole-library safety claim. The complete attributed working artifact and checks include the cleaned source and static guard; the deque-core checker includes its source, exact input, license, and run boundary.

A literal source audit now supplies conservative ceilings in one explicit immutable record model. The exposure column bounds old pointers returned or installed at a fresh-to-old boundary; it does not mean the full transitive closure of a retained subtree.

Operation	Persistent records	Read radius	Output exposure
`empty`	0 per call	0 from user roots	none
`single`	exactly 7	no caller-payload read	retains its opaque cell
`cat`	at most 450	finite; exact ceiling withdrawn	finite; exact ceiling withdrawn
`uncons`	at most 2,490	finite; exact ceiling withdrawn	finite; exact ceiling withdrawn

The allocation values are intentionally loose source-level bounds, not measured OCaml heap costs or least constants. The allocation audit charges persistent constructor blocks, intermediate persistent versions, and recursively stored pairs. The address audit follows immutable algebraic-constructor fields while treating base tokens as opaque. The field-path review corrected an undercount: semi_concat can make 20 endpoint calls, and agreen_of_red_only path can open two stored Big values. An OCaml 4.14.1 typed-tree extractor now checks the four-operation aliases, all written relevant match arms, the V0-through-V6 fold coefficient, and the endpoint-call recurrences through uncons ≤ 118. The earlier 55/874 old-address numbers depended on separately stated constructor-slot and old/fresh provenance lemmas. A mutation replacing every selector witness by the same selector still passed the old checker, so those numbers and their client consequences are no longer certified. A separate executable harness searched bounded and generated persistent histories; its much smaller observations corroborate exercised paths but do not prove the ceilings.

One layout, one checkable composition

The fixed client uses one flattened occurrence owner with seven pointer fields, one two-field live-rope wrapper, and one-field cell records. Entry tags and bridge letters are finite payloads. The sequence stores opaque cell pointers. This costs four client records in either nonreset branch and one on reset; only the empty owner and its initial ropes are virtual. The unused old live-header read has been removed.

Client branch	Calls	Fresh records	Old-address radius
External	`3U + 2S + 3C`	8,838	finite; 1,750 withdrawn
Internal	`2U + 2S + 4C`	6,798	finite; 989 withdrawn
Reset	`U + C`	2,941	finite; 876 withdrawn

Allocation sums over calls in one feasible branch. Radius is the longest max-plus pointer-dependency path. The old checker reproduced the proposed arithmetic but did not connect its selector lists to constructor slots, feasible branches, or old/fresh origins. The interprocedural OCaml 4.14.1 IR now adds complete child edges, qualified formals, 646 cases, and 2,342 pattern nodes to the earlier 3,912-expression inventory. It resolves the exact public cat alias and its callback-specialized static closure: 42 named Cadeque/Buffer helpers, the entry and two finite folds, plus 36 Deque-core bodies. That 81-body result is reachability evidence, not an old/fresh interpretation. A strengthened admission gate now binds the exact source and CMT inputs and checks every build-slot identity against its expression edge. Source declarations fix 405 source sites as structural and 73 as control; the remaining 474 are genuinely context-sensitive. A further audit found that these are polymorphic source sites across 42 bindings, not 474 monomorphic semantic instances. The Deque Packet carrier can reach symbolic Pair^k(alpha)depth, so a finite flat label table would be unsound. Forty-two callback applications, two assertion obligations, and a context-indexed symbolic type analysis remain open. See the superseded field-path certificate, checker, and reviews and the typed-tree inventory, extractor, and checker, plus the constructor-slot prototype and adversarial mutation, and the current typed-flow frontier, fail-closed design, and reproducible checks, and the newer cat-only typed IR, closure reconciliation, and negative tests, and the current exact slot-admission table, input manifest, and adversarial reviews, and the newer context-specialization contract and fail-closed tests.

Each callback needs the preceding result

A finite fold now has an executable value-dependency plan for each of its fourteen constructor branches. For V2(a,b), folding push from the right first produces [b], then passes that result to push a to produce [a,b]. Reversing the callback order reverses the sequence; giving both calls the original empty accumulator loses a token.

The archived typed IR contains 42 callback sites across the two fold bodies. One invocation selects one branch and makes at most six callback applications. The new check derives their exact argument and intermediate-result links. Fourteen branch tests preserve token and fresh-result identity; eighteen malformed-plan or IR mutations reject. A separate traversal using the IR edge and pattern-binding tables confirms the same plans.

These are value plans for pure, total callbacks, not chronological traces of arbitrary effectful OCaml functions. General callback bodies, symbolic type equations, assertion admission, and old/fresh origins still need interpretation. Two reviews share model and source dependencies; no external validation or numerical radius is added. Read the example, composition argument, and reproducible checks in the fold value-plan package.

Following the actual structure

A small interpreter now follows the actual callback bodies from the archived typed code, starting with an empty sequence and inserting up to eight opaque tokens. It preserves each intermediate result and shared parent. The sixth insertion splits the inner buffer into two groups of three; the seventh consumes that chain and changes its regularity state; the eighth executes the first red repair. Across all 256 eighth endpoint choices, the repair reaches three written make_small arms: 64 left-overflow cases, 64 right-overflow cases, and 128 cases where both endpoints overflow. Exact token identity and order survive in each case.

These are fourteen small, concrete cases with a source-level argument, not the general type or pointer-provenance analysis. The empty-seed inject example tests the callback on its own: the actual concatenation branch requires a nonempty seed. The repair constructs concrete pair payloads at the first established carrier depth, but it does not check arbitrary symbolic Pair^k(alpha) substitution or any ninth operation. Thirty-five tests include all 511 mixed histories through depth eight plus alias, tuple-let, overflow-pair, and nested-Packet mutations. The two reviews share source, interpreter, and model-family dependencies. The numerical distance remains withdrawn. Read the worked structure example, interpreter, tests and reviews.

Checking the seed in concatenation

The interpreter now executes the actual concatenation branch with a seven-token left operand and an empty or singleton right operand. All 256 cases preserve the exact token order and the original input chain. The fold receives a fresh wrapper around that chain; its empty-vector case returns the wrapper, and its singleton case calls inject once.

A final-output check misses a subtle failure: this branch discards an intermediate conversion. A separate check now verifies that conversion’s saved five-token prefix and final pair. Explicit correspondence between two Buffer implementation constructors and their sealed signature counterparts also keeps identically named type families distinct.

Nineteen targeted tests pass, alongside the prior insertion tests. This covers the stated small inputs. General symbolic type substitution, arbitrary-heap assertion obligations, and pointer provenance remain open; no numerical distance is added. Two separate reviews share model and project dependencies. Read the nonempty concatenation example, source argument and reproducible checks.

In this abstract source model, A*=8,838 and q=7remain supported, giving the deliberately nonminimal degree bound 61,868. These archived allocation counts do not certify the complete sequence contract. Under every Section 11.1 hypothesis, the conditional direct theorem uses symbolic finite resource bounds. The former numerical radius 1,750 and compiler distance 1,751 remain withdrawn until contiguous old-root paths and output frontiers are derived by a fail-closed analysis. Temporary vectors and result packages are compiled into finite control; literal OCaml can allocate an eight-pointer tuple, so these are not runtime-heap constants. The whole-client theorem symbolically partial-evaluates the external tail test and later catenations, producing one old-dependent Definition 10.1 plan under its stated hypotheses. The direct consequence additionally assumes the complete Section 11.1 contract. Read the normalization proof, manifest, and separate reviews and the preceding audit, checker, and separate review reports. The paper-pinned benchmark commit is 444358e. The relevant operation code is unchanged in the last repository snapshot before v3 and, apart from private type constructors, in the inspected current snapshot. The attributed working variant and checks were built with OCaml 4.14.1 and Dune 3.14.0. Rocq was not rerun, and its separate implementation does not verify this variant.

Evidence, assurance, and limits

The proved components rest on written proofs. Five public programs provide separate regression evidence for occurrence contexts, mirror receipts, receipt closure, simultaneous compilation, and the catenable-sequence interface. Their recorded runs include 262,142 exhaustive word updates, 250,000 randomized compiler squares, and more than five million decoded typed-address checks.

The source and reader audits distinguish the repaired Draft 2 from the defective first draft, inherited theorems from FPRD arguments, and finite corroboration from proof. A 10 September 2026 source and allocation audit corrected the scope of the Kaplan–Tarjan citation. The later Viennot source audit identifies a concrete finite-control kernel. Later source-level arguments and certificates are retained as implementation evidence; they do not discharge the complete Section 11.1 premise. No literal OCaml runtime proof, Rocq correspondence, full mechanization of this paper, novelty determination, or documented external specialist review is claimed.