Physics Hinge Motor Report Contract

#1179 adopted hinge motor/report consumer — ROOT BEFORE-CODE contract

Root selects this contract BEFORE implementation. Priority: ROOT decisions here, cross-contract corrections, exact wire schema, API key table, independent reference stages, fixed14 input/literals, previous proposal. Later headings called proposed/draft remain historical text; the choices below are now selected. Actual new outputs are UNMEASURED. Parent1349 native93detachedoutputsGO and original1279/1309NO-GO remain immutable. Native1399 completeWorldNO-GO/handoffb774fbe2 is separate; its UI/adoption is not a dependency for this already-adopted1349 consumer.

ONLY NEW examples/physics-rigid-hinge-motor-reference/** in isolated codex/physics-hinge-motor-1179 at c8bb228130069d0597cd575d551862de460af9b5. Existing tracked paths/modes/blobs and sharedroot/lock/package/Integration/Viewer remain unchanged. Exact adopted provider71files/modes/blobs/nativerange checked BEFORE code. No archived1349worktree dependency, solver injection or patch to parent. Preserve pinned original1279source0de27c51574e2da6b09966c7ef0c28435d9c9592. Original1349measured49cd64c2 differs from adoption527a4407/native0e296d1e.

Selected model and error decisions

1. Parent finite-only incoming report; motor authority EXACT previous accepted report, not raw angle or extra range check. Outgoing exact parenttarget, raw geometry separate. Per-call originalcommands, originalangular/motor/free order, ONE adoptedprojection. Source cursor/time remain; no newWorld/acceptedstore/queue/restore/dispose in detached API.
2. Options safely admitted AFTER parent+commands. No callback for any admission/reflection/options refusal. Known later calculationerror may produce one copied completed-stage attempt. Unknown received value is propagated identically without serializing it. Report-ready copiedcallback once BEFORE strictcap, observerthrow wins, cap never calls again or mutates savedattempt.error. No unreachablestage fabricated.
3. Preserve inherited typedPhysicsError-like Proxy bridge sideeffects explicitly. Own wrapper preserves the actual value received from provider; it cannot strengthen prior-parent code/message getter identity. Ordinary unknown Error/object/null/string and observer/reflection markers are independent nativeidentity checks, not a blanket typed-proxy guarantee. Do not patch parent or inspect unknown thrownpayload for diagnostics.
4. Exactreport contains ONLY selected eightkeys. J/K baseline FREE; J_B/K_B report, motorj separate. K=parsedbinaryIdeltaOmega newlydeclaredscalarreport, not KKT multiplier/calibratedforce or oldinertia bitparity. Norm>.01 Nm*s strictly refuses, equalitypasses; no linearcap. Signed finitework/DeltaK/residual/momenta valid; nonnegative onlyKE/parentobjective. Motor signed midpoint versus spinmidpoint1e-12J; no conservation/dissipation guarantee.
5. Exactly14named stagedcases in selected order: genuinefirst mandatoryexpectedCAP; other12RETURNexpected; mandatory .1overloadCAP. Expectations are BEFORE-trial, not observedfacts. Any earlier independent/native numericrefusal staysactualfirstcode/nullstages and means stagedNO-GO, never recodedCAP. Stop first mismatchedphysicalcase; sameprefixsource/repeat/genuinecompiled. No case/input/cap/gate tuning/replacinggenuine. +.9/-.9 are separatelycounted parent+originalmotor helpercontrols, projection0, not hidden15th/16thstagedcalls.
6. Missing command.bodyId error is original 'command 0 has unsupported fields'; present absent/nullbodyId is originalunknown-target error. Two newmessages only: INVALID_CONFIG 'private hinge motor options are invalid'; NUMERIC_LIMIT 'private hinge motor diagnostics are invalid'. Other originalmessages/classes/precedence remain. Nonfinitework isdiagnosticserror, notfakeworkfield onreport. Remove unsupportedworktamperphysicalinjection; pure actualinternaldiagnosticsvalidator only ifusedandlabelledDATA.
7. Producerkeys follow API table. Wire uses exact EIGHT-key envelope includingerror; rawFrameslabels explicitlymap selected fiveBodykeys. Independent input-only binary64 leaforder/signs, ownroundedFREE then unchanged parent independentpose/fullrows/Fractionoptimum. No candidateFREE/frame/report/basis/oldoptimum expectedseed, no final-onlyDecimalrounding; separate raw/normalized/native/geometric/scalartrig/Decimal layers. Exactprotocol/input/resourceunresolved=>EXECUTION_FAILURE; validresolvedphysical/report/expectationmismatch=>NO-GO. No unknownpayload JSON coercion. Parentfractionformat and exactnestedkeys follow finalwiretable.

Modules and agent ownership

A owns candidate.ts (publicprivatefunction stageorchestration), motor-stages.ts, report.ts, diagnostics.ts, options.ts, copy.ts, types.ts, errors.ts, entry.ts. Use smallfunctions/modules, one class onlyifstateownership actuallyneeds it. No allfeaturesonefile. B owns fixtures.mjs, controls.mjs and consumer.mjs plus exactraw serializers ifneeded. Controls count actualmotor/projection/native calls separately from14casecalls, parser/pureguards and parent93history. Genuine+overloadknowncaprefusals mayqualifyreportmeaning; accepted-output count staysdifferent. Distinctsource/repeat/emitted workflows genuine. C owns reference.py, reference-controls.mjs only. Reuse parentindependentfunctions/algebra/gates byrelativepath or sourcepurecopywithprovenance, notcandidate imports/expectedseeds. Rootowns all docs/metadata/typesconfig/freeze/bundle/emitledger/runner/nativeproof/execution/commit/Issue/Wiki. Workers are notalone, must preserveothers. NO imports/parser/AST/test/build/type/model/numerical/ref/solver/World beforeROOTfullactualsourcefreeze. Author source only; root first reviews then hashesallactual source/reference/error/input/literals before any firstbuild/trial. Root newactualCAD/Physicsbuild and strictprivateTS once, actualownednonemptyemittedledgerbeforefirstnativeflow; anyfirstfailurepreserved andrepaironlywithspecificcontract. MJS checkJs limitation explicit.

First measurement and later World

Root runs ONE source/distinct-repeat/genuinecompiled stagedconsumer afterfullsource+actualemitsfreeze andpostedprovenance. Prior93provider outputs are historical proof, not rerun. Fixed14steps plus separatelycounted boundedhelper/control/ref protocols; stop firstphysicaldifference, compare fullJSON and rawframes/commands includingzeros. Preserve source failures/logs/before/attempt/body/knownerror/independentreply exactly. Sufficientstoragecheckbeforetrial; report storedvslogicalaliases separate. No wallclock/solverthroughput/Box3D or calibratedforces claims fromthisflow.

If selected stagedsemanticsGO, SAMEexisting1179 mayproceed to original4spheres/twoZ0/Z1HINGE2World undera separatelycompleteBEFORE-CODE Worldtransaction/contact/joint/referencefreeze. Originalcontacts8passes; removeoldper-passjointcorrection onlybyexplicitlaw, postcontactpairprojection/reportonce, originalcommands/motor/freeonce, no doubledadvanceAPI. Incomingreportauthorityaccepted; projection/reportbaselinePOST-CONTACT vsFREE distinct. NominalWorld caprefusal=>NO-GO, allstate/clock/contact/joint/event/cache/ledger/counters retained. Original1200/10s/2mm/1degree/crosscontact/P-L/work/reference/parity firstfailuregates remain. NoWorldcode/trial fromplannedtext alone. UI #674/#1254 separate. Issue1179/parent660notclosed bythisstage. No productpush/PR/deploy/npm/release.

---

Original selected proposal

#1179 — 다음 hinge motor/report 계약 제안

SOURCE-ONLY. 새 계산·모델·reference·World·build/type/parser/AST 실행은 없다. 진행 중 #1399 output은 읽지 않았다. root가 아래 선택을 BEFORE-CODE로 승인·고정한 뒤에만 구현한다. #1349의 실제 93 detached outputs GO와 #1279/#1309의 실제 NO-GO를 유지한다. 새 조합과 1200-step World는 UNMEASURED다.

1. 네 가지 선택

선택	한 가지 제안
incoming report memory	부모 finite-only admission 유지. 추가 [-.8,.8] 범위나 raw-angle agreement admission을 넣지 않는다. 모터는 incoming carrier.joints[0].angleRad를 그대로 읽는다. 기억된 값과 raw geometry 차이는 진단만 한다.
outgoing report/observer	angleRad는 adopted projection.poseReport.targetAngleRad다. rawFinalAngle은 별도 진단이다. snap/slop/reclamp는 없다. copied observeAttempt는 최대 한 번이며 report-ready에서 cap enforcement 전에 호출한다.
genuine/overload disposition	두 named case의 예상은 CAP_REFUSAL. 정확한 독립 pipeline 예측과 실제 동일한 code/message·report·cap을 비교한다. 이 예상은 새 실행 결과가 아니다. 올바른 예상 cap 거절은 REPORT/CAP 의미 검증의 통과이고 accepted simulation step GO가 아니다.
work convention/gates	motor work는 입력/출력 상대속도의 midpoint와 실제 j로 정의한다. 별도 spin-only midpoint Δω work와 비교한다. translation energy와 projection objective를 motor work로 섞지 않는다. 아래 고정 operation order와 단위별 gate를 쓴다.

2. 최소 시작 범위와 API

ONLY NEW examples/physics-rigid-hinge-motor-reference/**. adopted #1349 source527a4407/native0e296d1e를 그대로 사용한다. #1349 worktree는 future runtime dependency가 아니다. 새 lane의 adopted own copies를 상대 import한다. 원래 #1279의 native0de27c archive/hash와 physical NO-GO는 별도 역사 증거다. 부모·package·Integration·Viewer 파일을 바꾸지 않는다.

advanceDrivenHingePairReference(config,carrier,dt,commands=[],{observeAttempt?}={}) → {bodies,jointReport,diagnostics}.

이 API는 detached 한-step 조합이다. World·snapshot import·accepted-store·dispose·queue API를 만들지 않는다. 입력은 부모의 two1kg/.1m spheres, +Z axis, anchors±.1, limits±.8, motor target .5/maxImpulse .0001/maxReaction .01, gravity0, dt1/120이다. group0 Z0, 원래 group1 Z1 또는 명시한 canonicalZ0 parent case만 사용한다. 새 axis/mass/inertia override/coherence admission은 없다.

부모 prepareInput으로 rest metadata를 파싱한 뒤 copied raw13을 복원한다. moving body에 resting-scene admission을 다시 호출하지 않는다. carrier cursor/time/기존 joint report는 그대로 남긴다. 이후 adopted projection 내부 admission 호출은 그대로 두며 physical law 호출 수로 세지 않는다.

3. 정확한 단계 순서

1. 부모 dt → 구조/profile/raw/finite remembered report admission. copied sourceBodies/config/carrier 확보.
2. 원래 parseCommands와 admitDynamicHingeCommands. per-call commands만 사용한다. 선형 명령 또는 원래 perpendicular threshold 초과는 기존 오류로 거절한다.
3. 원래 angular update: inverseInertia(angularImpulse + torque*dt)를 기존 add/scale 순서로 적용. angularBodies 저장.
4. driveDynamicHingeMotor 한 번. 각도 인자는 incoming remembered report다. geometry/normalized q/clamped raw 값으로 대체하지 않는다. motorBodies와 실제 scalar j를 저장한다.
5. 원래 angular bounds → advanceOrientation → 원래 linear update와 위치 적분/이동 bounds. freeBodies 저장. 추가 position/angle 보정은 없다.
6. projectHingePoseVelocityReference 한 번에 copied FREE carrier를 공급한다. P/L targets는 실제 FREE 입력이다. 이전 초기값이나 예상 결과로 바꾸지 않는다. parent one-clamp pose와 0/1/2 velocity choices를 유지한다.
7. projectedBodies, 보고, work 및 finite checks를 만든다. report-ready copied attempt observer → strict reaction cap → copied complete output 순서다.

원래 source report .8과 raw .7999999999999999는 모터의 서로 다른 입력이다. positive .5 motor는 remembered .8에서 차단된다. lower −.8은 이 positive target의 lower-block 조건에 해당하지 않는다. adopted velocity stop eligibility는 FREE raw에서 나온 exact target을 계속 사용한다. 이 두 권위를 합치지 않는다.

4. report와 work의 고정 정의

baseline은 projection input FREE다. 각 body i에 대해 원래 sub 먼저, scalar scale 다음 순서로

• J_i = (1/inverseMass_i) * (v_projected_i - v_FREE_i) — N*s.
• K_i = parsedScalarI_i * (ω_projected_i - ω_FREE_i) — Nms.
• jointReport는 기존 {id,kind,aId,bId,angleRad,linearImpulseNs,angularImpulseNms,motorImpulseNms}만 쓴다. linearImpulseNs=J_B, angularImpulseNms=K_B, motorImpulseNms=실제 j. motor를 correction에 다시 더하지 않는다.
• angular report norm >.01만 거절, equality는 통과한다. .01에 tolerance를 더하지 않는다. 선형 report는 기존처럼 finite만 요구하며 새 cap을 만들지 않는다.
• scalar I는 원래 .4*mass*radius**2의 parsed binary 값이다. K 계산은 새 명시된 scalar report이며 원래 inertia(body,delta)의 bit parity를 주장하지 않는다. KKT 승수·force/dt·calibrated reaction으로 바꾸지 않는다.

motor before는 angularBodies, after는 motorBodies다. sBefore=dot(ωBbefore-ωAbefore,axis), sAfter=dot(ωBafter-ωAafter,axis). motorWorkJ = (j(sBefore+sAfter))*.5* 순서로 계산한다.

spin-only 비교는 A 다음 B 순서다: 각 i에 대해 sub로 Δω, add로 ωbefore+ωafter, xyz dot, (.5*I_i)*dot(Δω,sumω)를 만들고 두 body 값을 더한다. 큰 total KE 두 값의 차이로 work를 정의하지 않는다. source→angular external work, motor work, free-integration energy, projection ΔK, parent objective를 각각 기록한다. energy는 finite/nonnegative 검사만 하며 자동 conservation/dissipation을 약속하지 않는다.

5. 첫 cap 예상의 근거와 한계

genuine orbital input은 원래1309 orbitalLossCandidateControl.input을 그대로 쓴다. remembered .8 때문에 j=0이고 source ω0이므로 free q는 유지된다. 반대의 vY와 대칭 위치에서 FREE COM/P와 L targets가 유지된다는 source 대수, one-clamp/held-orientation centre 재구성, physicalX0가 같은 점을 근거로 기존1349의 high common spin correction이 이 조합에서도 cap을 넘을 것으로 예상한다. 이미 관측한 detached ωB=8.010552430977992는 .01/parsedI의 허용 Δω보다 크다. 이 값은 기존 detached 결과이며 새 pipeline 관측값으로 이름을 바꾸지 않는다.

overload는 rest/B의 원래 angularImpulse[0,0,.1]이다. 예상 CAP_REFUSAL은 독립 angular-command/motor/free/pose/velocity 조합의 입력-only symbolic/rational 예측으로 먼저 고정한다. 새 projection 호출로 예상 값을 채우거나 old World refusal을 새 cap 증거로 쓰지 않는다. 첫 허용 flow에서 예상과 다르면 첫 불일치를 NO-GO로 저장하고 cap·입력·각도·row·budget을 수정하지 않는다.

overload 예측의 작은 대수 근거: 동일한 r/I의 planar 쌍에서 ℓ=.1, 실제 motor j, FREE 상대각 θ를 두면 S0=ℓ/I, D0=(ℓ+2j)/I다. 닫힌 anchor/COM/P/L rows의 독립 식은 C=I+(r²/2)*(1+cosθ), S=ℓ/C, D=I*D0/(I+(r²/2)*(1-cosθ))다. 이 literal은 θ가 작은 양수이고 D0>0이므로 |K_B| >= (ℓ/2)*(1-I/C)라는 cap 방향 예측을 준다. cosθ>0에서 얻는 보수적 bound도 .01보다 크다. 이는 source 수식 추론이며 새 solve/관측값이 아니다. reference는 binary I와 raw/normalized geometry로 별도 검증하고, 이 ideal 식을 candidate frame seed로 쓰지 않는다.

positive cases는 rest/signedzero, exact endpoint memory, 네 stop directions, A/B angular impulse.001, B torque.001+impulse.001, namedZ1이다. parser/cursor/copy/reflection/cap-equality guards는 별도다. 93 parent cases를 새 pipeline으로 반복하지 않는다. genuine과 overload를 제외하거나 더 낮은 입력으로 교체하지 않는다.

6. atomic refusal과 exact errors

우선순위: 부모 dt→structural/profile/raw/reportfinite→commands→original angular/movement bounds→parent projection/body/certificate errors→finite new report/work→copied observer→reaction cap→complete return.

finite report 오류는 기존 PhysicsError/NUMERIC_LIMIT/unsafe joint reaction, cap 오류는 ${joint.id} exceeded motor reaction limit을 사용한다. 원래 command message와 parent exact class/code/message bridge를 유지한다. finite-only를 선택했으므로 새 memory range 오류는 없다. unknown Error/object/null/반사 오류는 같은 값으로 전파한다.

stage 계산 중 실패하면 이미 copied된 reached fields와 safe error metadata를 observer에 한 번 전달하고 원래 오류를 던진다. 성공적으로 report-ready가 되면 observer를 catch 밖에서 한 번 호출하고 그 뒤 cap을 검사한다. 따라서 cap refusal에서 observer를 다시 부르지 않는다. observer exception은 후속 cap보다 먼저 이기며 같은 값이 전파된다.

attempt의 source/angular/motor/free/projected frames, projection/report/work는 미도달 시 null이다. report-ready에는 실제 norm/cap/exceedsCap을 저장하되 아직 accepted output은 아니다. 원래 입력 config/carrier/commands/raw bytes/cursor를 바꾸지 않는다. 진단을 복사하다 원래 예외를 덮지 않는다. 성공 반환 body/report/frames/parent diagnostics는 서로 분리된 copy다.

source→FREE는 원래 빈 add 연산으로 -0를 +0로 바꿀 수 있다. 입력 raw bits와 각 출력 raw bits를 따로 보존한다. source→projected identity를 새로 주장하지 않는다. parent identity일 때의 FREE→projected v/ω bit retention만 유지한다.

7. 독립 proof와 시작 gate

Python은 original config/carrier/commands에서 remembered-motor decision, 실제 command update, motor/free frames, parent pose/independent rows/Fraction optimum을 먼저 만든다. candidate frame·report·lambda는 expected 초기값이 아니다. native parsed binaryI와 ideal geometricI, raw/normalized q geometry, scalar trig repeat와 Decimal algebra를 분리한다.

parent1349의 모든 선택·gate를 유지한다: p/q1e-12, coefficient relative1e-12, exact nativeI/order/scales/stop tags, velocity1e-10m/s, angular1e-9rad/s, objective1e-10J, dimensionless certificate1e-10, anchor/angle/report/limit/q1e-9, P/L1e-7 SI, COM1e-12m, kinematic1e-9, raw/normalized1e-12, Decimal80/1201e-25, scalar repeat1e-12. 새 j/J/K 비교1e-12의 각 impulse 단위, motor work1e-12J, freev/ω1e-10, freep/q1e-12를 추가한다. unresolved/protocol는 EXECUTION_FAILURE, valid physical/report mismatch는 NO-GO다.

actual adoption/provider blobs, parent archive/raw hashes, exact API/attempt/error/literal/reference와 전체 source graph를 고정한다. 이후 root만 한 build/strict types, 실제 emitted ledger, ONE source/repeat/genuinecompiled staged flow를 실행한다. 예상 cap refusal도 reached projected raw/report/reference와 입력 불변을 모두 보관한다. REPORT/CAP 의미 qualification을 World GO로 표시하지 않는다.

8. 뒤의 named HINGE2 World boundary

이 gate가 정확히 통과한 뒤에만 기존 #1179에서 원래 네 spheres/two separated hinges/Z0·Z1/dt1/120/gravity0/motor metadata로 World를 구현한다. 한 body 한 hinge, exact translated pair, chain 없음. 기존 연결쌍 collision 제외와 네 cross-group pair 검사, 원래 contact8 passes를 유지한다. contact pass 안의 old joint correction은 제거하고 contact 뒤 pair당 adopted projection/report substage 한 번으로 명시적으로 바꾼다.

World는 commands→motor once/joint→free integration once/global bodies→contacts8→projection/report once/pair→finite/caps/outer bounds→single commit이다. full advance API를 World에서 호출해 motor/free를 두 번 수행하지 않는다. World projection targets/report baseline은 실제 POST-CONTACT pair이며 FREE와 분리해 이름을 붙인다. accepted angle authority는 오직 마지막 accepted jointReport.angleRad다.

failure는 모든 body/contact/event/joint/counter/ledger/cache/cursor/time을 이전 accepted 값으로 유지하며 per-call commands를 버린다. nominal World의 cap refusal은 expected-report guard가 아니라 실제 World NO-GO다. original1200steps/10s anchors2mm/axes1degree/no-cross-contact/finite/repeat/genuinecompiled/독립 P-L·motor-work·cap/transaction gates를 그대로 고정한다. #1399 UI나 저장 진행을 기다리는 선행조건은 없다.

root에게 남은 결정: 이 제안의 네 선택을 채택할지 여부, exact attempt/diagnostics key table와 소유 파일 배정이다. 수치 law/cap/권위 선택을 실행 후로 미루지 않는다. 이 문서는 implementation·새 numerical GO·World/Viewer/public/release GO가 아니다.

---

Fixed14 input and literal table

#1179 staged hinge input and literal contract

SOURCE-ONLY input plan. No numeric output, raw encoding, parser, module, model, reference, solver, World, build or test was run. Only source and existing metadata were read. Root selects the final ABI/ownership and freezes complete inputs/errors/reference before execution. Current #1399 work is unchanged.

Provider and exact input recipe

Adopted provider: #1349 at527a4407207e32a801365f1b59c071469948aa19, native0e296d1e75c837e767329634f6a2ac6f5832e54f. Read current adopted examples/physics-rigid-hinge-velocity-reference/{profile.ts,candidate.ts,literal-cases.mjs,archive.mjs} and original packages/barocss-physics/src/{joint-motor.ts,dynamic-hinge-joint.ts,math.ts,validation.ts}. Old #1279 immutable archive is at /Users/user/.codex/worktrees/physics-multi-hinge/barocss, native0de27c51574e2da6b09966c7ef0c28435d9c9592. New runtime consumes relative adopted source copies, not a #1349 worktree path. No93-parent-case replay.

For the table below, use a copied input assembled from literal data, not a parent output. Exact source recipes are physics-rigid-coupled-hinge-reference/reference-controls.mjs:10–15,26–59, physics-rigid-hinge-limit-diagnostic/reference-controls.mjs:35–82,108–112 and physics-rigid-hinge-velocity-reference/literal-cases.mjs:1–12. Those are existing data authors; this plan does not import them.

R0: metadata and full carrier

Config: fixedStepSeconds=1/120 (binary literal .008333333333333333), gravityMps2=[0,0,0]. Two dynamic spheres, radiusM=.1,massKg=1,restitution=0,friction={static:1,dynamic:.7}; no inertia override. Config IDs pairA0/pairB0; positions[-.1,0,0]/[.1,0,0]; config velocities[0,0,0]. One joint hinge0,kindhinge,aIdpairA0,bIdpairB0,anchors[.1,0,0]/[-.1,0,0],axisWorld[0,0,1],limitRad[-.8,.8],motor{targetSpeedRadps:.5,maxImpulseNms:.0001,maxReactionNms:.01}.

Carrier: stepIndex=0,timeSeconds=0,contacts=[],events=[],ccdHits=[],pairStats={eligiblePairs:0,candidatePairs:0,aabbTests:0}; two public-style body records with the same IDs/kind/shape, positions as config,velocity[0,0,0],orientation[0,0,0,1],angularVelocity[0,0,0]. Joint report{id:'hinge0',kind:'hinge',aId:'pairA0',bId:'pairB0',angleRad:0,linearImpulseNs:[0,0,0],angularImpulseNms:[0,0,0],motorImpulseNms:0}.

Use the original rest parser metadata plus exact copied raw13. Parsed I retains the original binary 0.4*massKg*radiusM**2; no nominal .004 replacement. All table edits below change only carrier raw fields/report or the stated command array. They never change the admitted rest config, except named Z1 changes both config/carrier translation and IDs as specified.

U/L and OU/OL raw input templates

U uses R0, carrier pA[-.09210609940028851,0,0],pB[.09210609940028851,0,0]; qA[0,0,-.19866933079506122,.9800665778412416],qB[0,0,.19866933079506122,.9800665778412416]; remembered angle+.8. L changes only qA.z to+.19866933079506122,qB.z to-.19866933079506122, remembered angle-.8. Velocities/spins stay zero.

OU uses R0, carrier pA[-.09210609920557934,0,0],pB[.09210609920557934,0,0]; qA[0,0,-.19866933324522766,.9800665773445683],qB[0,0,.19866933324522766,.9800665773445683]; remembered+.8. OL changes qA.z positive/qB.z negative and remembered-.8. No trig recomputation or normalization of these literals.

Raw-before authority

Exact raw order is bodyA then bodyB, each positionM3,velocityMps3,orientation4,angularVelocityRadps3, Float64LE; total208B. Metadata/report/commands are stored separately. Each signed-zero recipe retains its source -0 paths before any JSON serialization. Root's input freeze must bind each authored recipe, original provider/input hashes, the208B raw-before bytes/hash and negative-zero flags before the first model call. This document supplies exact fields and sign edits, not invented hex.

For the genuine first input only, root can authenticate the existing #1349 evidence/native-49cd64c2/source-before.f64le first208B and its firstPhysicalCase report record as the original BEFORE authority. Do not use its after frame or parent optimum as a staged seed. The other table raw values come directly from the exact literals below. No old-producer law is executed to obtain them.

Fourteen named first staged cases, in fixed order

RETURN_EXPECTED_UNMEASURED means the chosen positive case is expected to return under the selected contract, but this composed pipeline has not run. Independent input-only prediction and every original/new gate are required. CAP_REFUSAL_EXPECTED_UNMEASURED is root's selected report/cap semantic expectation, not a successful simulation step. A different outcome is the first mismatch and must be saved without tuning.

# / name	Exact before recipe and commands, in array order	Source-defined decision / expected disposition
01 genuine-orbital	U q/report, but pA[-.1,0,0],pB[.1,0,0],vA[0,-1,0],vB[0,1,0],bothomega0. Original orbitalLossCandidateControl.input; commands[].	Remembered+.8 blocks positive motor, even though original raw angle differs. Mandatory CAP_REFUSAL_EXPECTED_UNMEASURED; observe projected frame/report once before cap. Do not relabel old detached spin result as new output.
02 rest	R0,commands[].	Motor is eligible. RETURN_EXPECTED_UNMEASURED. Rest INPUT does not imply zero outgoing angle, identity velocity or zero correction after motor/free.
03 rest-signed-zero	R0 with carrier A.velocityMps[1]=-0 and B.angularVelocityRadps[0]=-0; commands[].	RETURN_EXPECTED_UNMEASURED. Preserve input bits. Original empty additions may change output zero signs; only provider FREE→projected identity is a bit-retention claim.
04 remembered-upper-endpoint	U,commands[].	Memory+.8 blocks positive motor exactly. RETURN_EXPECTED_UNMEASURED. Outgoing angle must equal new projection.poseReport.targetAngleRad exactly; do not assert literal+.8 by the case name.
05 remembered-lower-endpoint	L,commands[].	Positive motor is not lower-blocked. RETURN_EXPECTED_UNMEASURED. FREE raw angle, target and stop branch are independently derived, not copied from old no-integration expectations.
06 upper-outward	OU,omegaA[0,0,-1],omegaB[0,0,1],commands[].	Upper memory blocks motor. RETURN_EXPECTED_UNMEASURED; fresh FREE projection chooses the stop. Do not reuse old upper/activeStop=true as the new branch assertion.
07 upper-inward	OU,omegaA[0,0,1],omegaB[0,0,-1],commands[].	Upper memory still blocks motor. RETURN_EXPECTED_UNMEASURED; do not copy the old upper/inactive branch after free integration.
08 lower-outward	OL,omegaA[0,0,1],omegaB[0,0,-1],commands[].	Lower memory does not block positive target. RETURN_EXPECTED_UNMEASURED. Signed motor work is finite and may be negative; no nonnegative-work gate.
09 lower-inward	OL,omegaA[0,0,-1],omegaB[0,0,1],commands[].	Lower memory does not block motor; target-versus-current-rate decides actual signed j. RETURN_EXPECTED_UNMEASURED; signed midpoint work, no absolute value or clamp.
10 angular-impulse-A	R0; [{kind:'angularImpulse',bodyId:'pairA0',angularImpulseNms:[0,0,.001]}].	RETURN_EXPECTED_UNMEASURED. Route to A before motor. No off-axis .001 vector substitution.
11 angular-impulse-B	R0; [{kind:'angularImpulse',bodyId:'pairB0',angularImpulseNms:[0,0,.001]}].	RETURN_EXPECTED_UNMEASURED. Route to B before motor.
12 torque-plus-angular-impulse-B	R0; first {kind:'torque',bodyId:'pairB0',torqueNm:[0,0,.001]}, then {kind:'angularImpulse',bodyId:'pairB0',angularImpulseNms:[0,0,.001]}.	RETURN_EXPECTED_UNMEASURED. Preserve original inverseInertia(angularImpulse+torque*dt) order; do not turn the torque into another impulse command.
13 translated-Z1	Existing Z1-pair-origin input: R0 with config AND carrier body IDs pairA1/pairB1,positions[-.1,0,1]/[.1,0,1],joint IDs hinge1/pairA1/pairB1; report0,commands[].	RETURN_EXPECTED_UNMEASURED. Exact translation; no recentering or new axis/group profile.
14 angular-overload-B	R0; [{kind:'angularImpulse',bodyId:'pairB0',angularImpulseNms:[0,0,.1]}].	Mandatory CAP_REFUSAL_EXPECTED_UNMEASURED. Keep the actual original command, projected frame/report and independent cap prediction. No smaller replacement input.

Each named call has one original motor call and one adopted projection call if its reached stages permit them. The provider keeps its original internal pose evaluation and0/1/2 velocity choices; those are not extra composed stage calls. Raw source/angular/motor/free/projected frames are saved at reached stages. P/L targets and J/K report baseline use actual FREE. MotorWorkJ uses (j*(sBefore+sAfter))*.5 in that order and is signed. Separate original external command work, spin-only midpoint motor comparison, free integration energy and projection change/objective. No total-energy conservation or calibrated-reaction claim.

Separately counted admission, fault and copy controls

Controls below do not replace the14 named staged cases and never inject a physical solver/law. Use R0 unless a named case is specified. Each mutation is one fixed authored edit; root must freeze exact data/receipt priority before execution.

Original input/error routing

• dt=1/100 plus a malformed config/command: first INVALID_STEP / private hinge velocity step must equal 1/120. Valid dt with bad config retains original structural message. No new memory range error.
• Config.body0.massKg=2, explicit inertia override, gravity[0,-9.81,0], changed original material or+X hinge axis: exact private profile bridge INVALID_CONFIG / private hinge velocity profile is unsupported, after any earlier original structural error.
• Carrier angleRad=null,NaN,Infinity or undefined; cursor stepIndex=-1/3601 or timeSeconds=.1 with stepIndex0; missing/sparse body/joint array; null rawposition; q[0,0,0,0]; mismatched IDs: exact parent profile/pose route. Source copyCarrier rejects nonfinite report/cursor as NUMERIC_LIMIT / private hinge velocity archived pose is invalid; wrong IDs can map through the same raw-pair bridge. Do not blanket-map original body-bound errors.
• Memory-only+.9 and-.9, with unchanged raw rest bodies: finite-only admission, not profile refusal or raw-coherence repair. Record remembered value and raw geometry separately. Positive target is blocked at+.9 and unblocked at-.9 by original motor conditions. Final target/report remains actual FREE-derived, not the remembered value.
• Per-call commands[] versus omitted commands use original empty-input semantics. No queue/store/cursor advancement API. Copy all caller input bytes before and after every outcome.
• Commands null/array hole/65entries => INVALID_COMMAND / commands must be a dense array of at most 64; commandnull => command 0 must be a plain object; wrong kind/extra key/accessor descriptor => command 0 has unsupported fields; missing bodyId => command 0 targets an unknown or unsupported body; duplicate B angularImpulse => duplicate angularImpulse command for pairB0.
• B linear force[0,0,0] or impulse[0,0,0] is still prohibited because the action field exists: INVALID_COMMAND / dynamic hinge admits axis-aligned angular commands only. B angularImpulse[.001,0,0] uses that same original message.
• Command vector length2/sparse => command 0.angularImpulseNms must be a dense 3-vector; a null/nonfinite/out-of-limit component => command 0.angularImpulseNms must have finite components within ±100000. Perpendicular boundary1e-12 is an original admission-helper guard; vector[1e-12,0,0] is not rejected by strict >, while[1.0000000000000002e-12,0,0] is rejected. Do not claim a completed staged physical output from this helper-only boundary test.

Reflection and error identity

• Own command accessor for kind/bodyId/vector increments a canary and throws if invoked: descriptor admission must reject without invoking it. Config's original structural reads differ: a getter throwing Error('1179-config-marker'),object{marker:'1179-config-marker'} ornull must propagate the same thrown value. Do not promise getter-zero behavior for all original config reads.
• Carrier joint.angleRad own record accessor is rejected by original own-data copy admission without invoking it. Do not extend that claim to every array index: the unchanged parent dense-array/data helpers read array elements. Reflection Proxy.ownKeys/getOwnPropertyDescriptor throws a fixed Error/object/null marker: unknown reflection retains original identity. Use those inputs, not a solver injection.
• Preserve exact original PhysicsError class/code/message for known bridges and ordinary unknown messages. Safe error-record reflection and copy failures must not replace the primary thrown value.
• Source-boundary choice for root: adopted profile/admission bridges directly read caught PhysicsError.code/message. An Error-like proxy whose code/message getter itself throws can be replaced inside that unchanged provider before the new wrapper sees it. Do not claim this stronger identity case passed from ordinary Error/object/null controls. Root must select an explicit boundary/guard before final ABI; no parent edit is proposed here.

Observer/copy/strict-cap helper controls

• Call with an observer that mutates source/angular/motor/free/projected arrays, actions, report and nested projection matrices/certificates in its copied attempt. Actual returned result must remain the same input-only expected result. Returned bodies/report/diagnostic frames are separate copies; mutate one returned copy and prove others and caller remain unchanged without another law call.
• Observer throws fixed Error('1179-observer-marker'),object{marker:'1179-observer-marker'} ornull. Use rest AND genuine expected-cap input. Observer call count is exactly one. At report-ready its error wins before cap; unknown identity and complete caller raw/config/commands/cursor remain unchanged. A cap rejection never invokes observer twice.
• A pre-report original input/reflection refusal produces one copied reached attempt, with unreached frames/projection/report/work null; never fabricate a report-ready payload. Parent projection errors stay their exact original class/code/message.
• Freeze one owned pure finite-report/cap helper that the composed function actually calls. Test its angular report vectors[0,0,.01],[0,0,-.01] => equality passes;[0,0,.010000000000000002] => strict-cap refusal;[0,NaN,0] or nonfinite J/j/work => NUMERIC_LIMIT / unsafe joint reaction. Cap message is hinge0 exceeded motor reaction limit (hinge1 for Z1). Test finite J with magnitude above.01 passes this helper: no new linear cap. These are helper-only report controls, not fabricated projection outputs or a tuned physical equality case.
• No physical solver/law/result injection is authorized by this stage API. Any malformed-output/finite-helper fixture stays a separate pure guard and cannot be counted as a named staged law evaluation.

Disposition and before-code gates

Genuine/overload are required expected refusals. A correct predicted class/code/message, actual reached projected raw/report/cap, independent expectation and immutable input can qualify report/cap semantics only. RETURN cases require complete finite copied outputs and all original/new gates. Any unexpected physical/report/cap difference is NO-GO; unresolved reference/protocol or execution exception is EXECUTION_FAILURE. Keep first failures without coefficient/axis/material/cap/tolerance/branch tuning. No 1200-step World, public engine, Viewer, performance or release claim.

Root must finish exact attempt/diagnostic keys, the pure helper name/schema and inherited error-reflection boundary; pin current full provider graph and old compressed/decoded archives, all literal bytes/zero paths/errors/reference, then actual source commit/build/types/emitted ledger before one source/repeat/genuinecompiled staged flow. This document does not generate frozen raw bytes or future expected numeric outputs.

---

Producer API keys

#1179 hinge motor/report — proposed API key contract

SOURCE ONLY. Root selected the four model choices. This file fixes the proposed keys and module boundaries. No candidate, parser, reference, build, types or World was executed. The detached motor/report composition remains unmeasured. Expected genuine/overload CAP_REFUSAL is a reporting test, not an accepted World step.

1. Scope and providers

Only NEW examples/physics-rigid-hinge-motor-reference/**. Reuse the adopted #1349 provider in the new lane by relative imports. Do not use its archived worktree as a runtime dependency. Preserve original #1279 evidence and its physical NO-GO.

One original command admission; one original angular update; one original dynamic motor call; one original FREE integration; one adopted #1349 projection. No contacts, World, accepted-store, clock increment, queue, snapshot restore, disposal, solver injection or extra projection in this detached API. The later HINGE2 World consumer is a separate gate.

2. TypeScript public surface

import type {Body, Joint, PhysicsState, PhysicsWorldConfig,
  PhysicsStepCommand, PhysicsErrorCode, Vec3} from '../../packages/barocss-physics/src/types.js';
import {projectHingePoseVelocityReference} from '../physics-rigid-hinge-velocity-reference/candidate.js';
import {measureBodies} from '../physics-rigid-hinge-velocity-reference/diagnostics.js';

type PairBodies = [Body, Body]; // admitted A then B; not ID-sorted
type ProjectionOutput = ReturnType<typeof projectHingePoseVelocityReference>;
type PairMetrics = ReturnType<typeof measureBodies>;
type Stage = 'admitted' | 'angular-ready' | 'motor-ready' |
  'free-ready' | 'projection-ready' | 'report-ready';
type KnownErrorRecord = {name:'PhysicsError'; code:PhysicsErrorCode; message:string};

interface HingeMotorOptions {
  observeAttempt?: (attempt:HingeMotorAttempt) => void;
}
interface HingeMotorJointReport {
  id:string; kind:'hinge'; aId:string; bId:string;
  angleRad:number; linearImpulseNs:Vec3; angularImpulseNms:Vec3;
  motorImpulseNms:number;
}
interface ActionRecord {
  bodyId:string;
  torqueNm:Vec3|null;
  angularImpulseNms:Vec3|null;
}
interface Frames {
  sourceBodies:PairBodies; angularBodies:PairBodies;
  motorBodies:PairBodies; freeBodies:PairBodies; projectedBodies:PairBodies;
}
interface ReachedFrames {
  sourceBodies:PairBodies;
  angularBodies:PairBodies|null; motorBodies:PairBodies|null;
  freeBodies:PairBodies|null; projectedBodies:PairBodies|null;
}
interface MotorDiagnostics {
  inputAngleRad:number; targetSpeedRadps:number;
  limitRad:[number,number]; maxImpulseNms:number;
  blocked:boolean; impulseNms:number;
  relativeSpeedBeforeRadps:number; relativeSpeedAfterRadps:number;
}
interface BodyCorrection {
  bodyId:string; linearImpulseNs:Vec3; angularImpulseNms:Vec3;
}
interface ReportCap {
  angularReactionNormNms:number; maxReactionNms:number;
  exceedsCap:boolean;
}
interface EnergyByPhase {
  sourceJ:number; angularJ:number; motorJ:number; freeJ:number; projectedJ:number;
}
interface WorkDiagnostics {
  externalAngularByBodyJ:[number,number]; externalAngularTotalJ:number;
  motorMidpointJ:number; motorSpinMidpointJ:number; motorResidualJ:number;
  freeDeltaKJ:number; projectionDeltaKJ:number; projectionObjectiveJ:number;
}
interface Calls {
  motorCalls:0|1; projectionCalls:0|1;
}
interface HingeMotorAttempt {
  stage:Stage;
  sourceStepIndex:number; sourceTimeSeconds:number;
  acceptedReportAngleRad:number;
  parsedActions:[ActionRecord,ActionRecord];
  frames:ReachedFrames;
  motor:MotorDiagnostics|null;
  projection:ProjectionOutput|null;
  jointReport:HingeMotorJointReport|null;
  bodyCorrections:[BodyCorrection,BodyCorrection]|null;
  energyByPhase:EnergyByPhase|null;
  work:WorkDiagnostics|null;
  reportCap:ReportCap|null;
  calls:Calls;
  error:KnownErrorRecord|null;
}
interface HingeMotorDiagnostics {
  sourceStepIndex:number; sourceTimeSeconds:number;
  acceptedReportAngleRad:number;
  rawSourceAngleRad:number; rawFreeAngleRad:number; rawFinalAngleRad:number;
  parsedActions:[ActionRecord,ActionRecord];
  frames:Frames;
  metrics:{source:PairMetrics; angular:PairMetrics; motor:PairMetrics;
    free:PairMetrics; projected:PairMetrics};
  motor:MotorDiagnostics;
  projection:ProjectionOutput;
  bodyCorrections:[BodyCorrection,BodyCorrection];
  energyByPhase:EnergyByPhase; work:WorkDiagnostics; reportCap:ReportCap;
  calls:{motorCalls:1;projectionCalls:1};
}
interface HingeMotorOutput {
  bodies:PairBodies; jointReport:HingeMotorJointReport;
  diagnostics:HingeMotorDiagnostics;
}

declare function advanceDrivenHingePairReference(
  config:PhysicsWorldConfig, carrier:PhysicsState, dt:number,
  commands?:PhysicsStepCommand[], privateOptions?:HingeMotorOptions
):HingeMotorOutput;

// Pure DATA guards for the literal report/cap boundary controls only.
// The physical API uses the same helpers; these do not call motor/projection.
declare function validateHingeMotorReport(
  value:unknown, identity:{id:string;aId:string;bId:string}
):HingeMotorJointReport; // finite/schema check; detached copy; no cap check
declare function enforceHingeMotorReactionCap(
  jointId:string, angularImpulseNms:Vec3
):void; // finite vector first, then fixed .01 N*m*s strict cap

entry.ts exports these three functions, their owned types, original PhysicsError, and ERRORS. It does not export a World factory. Joint in internal helpers must be the original admitted metadata; no consumer-supplied alternate motor/axis/cap.

3. Key rules

Object	Required rule
config/carrier	Same original structure/profile/raw admission as #1349 prepareInput. Rest metadata parse precedes exact copied raw13 restoration. No blanket accessor ban or changed original error. No new report-angle range/coherence gate.
dt	Exact 1/120, checked by unchanged parent preparation before commands/options.
carrier memory	Finite incoming carrier.joints[0].angleRad is the sole motor authority. Parent cursor integer 0..3600 and exact timeSeconds=stepIndex*(1/120) remain unchanged. Output does not increment them.
commands	Default absent/undefined is []. Original parseCommands then admitDynamicHingeCommands. Preserve dense length≤64, original descriptor/vector/bound/duplicate/target rules. A then B is calculation order, regardless of command order. Linear commands are refused even if their vector is zero.
parsedActions	Always two records, A then B. Each has exactly bodyId/torqueNm/angularImpulseNms; missing action vectors are explicit null, never undefined. Only copied admitted values. No Map/function/proxy in trace.
privateOptions	After parent and command admission: ordinary or null-prototype record; zero keys or exactly own enumerable DATA observeAttempt whose value is a function. Own undefined, null, accessor, symbol, non-enumerable or extra field refuses. Do not read an accessor. Unknown reflection trap throws the identical value. No callback on admission refusal.
frames	Internal Body copies retain original shape/inertia/material metadata. Each completed stage is copied only after both bodies finish that stage. If body A changed and B fails, that stage frame remains null; no invented complete frame. Source is a safe admitted copy.
projection	Complete detached original parent output. Body array order is A/B. Parent pose/rows/stop eligibility/scales/solver branch/certificates are unchanged. Targets are actual FREE P/L.
jointReport	Exactly the eight shown keys, kind hinge, admitted IDs; all numeric/vector values finite. angleRad=projection.poseReport.targetAngleRad exactly. No raw-final replacement, snap, slop or second clamp.
bodyCorrections	A then B, baseline FREE only. Original sub then scalar scale: J=m*(vProjected−vFree), K=parsedBinaryI*(omegaProjected−omegaFree). KB/JB are the report. They need not cancel KA/JA when pose changes orbital L.
reportCap	Norm from actual KB, threshold exactly .01; exceedsCap = norm > .01. Equality passes. No linear report cap. Motor j is separate, not included in KB.
diagnostics	Exact shown own keys; no missing/undefined/symbol/accessor fields. Finite numeric values. Only EnergyByPhase values and projectionObjectiveJ are nonnegative; work, residuals, angular/linear momenta and DeltaK are signed.
attempt	Exact shown keys. Reached fields are copied, unreached fields are null. A report-ready attempt has error=null, all frames/report/work/cap reached, but no accepted flag. It may show exceedsCap=true.
guard report	Exact eight-key own enumerable DATA object; IDs match safe three-key identity; dense finite vectors. Any malformed identity/report uses original unsafe-joint-reaction error. Guard identity must contain exactly id/aId/bId string data; it is not a source of physical coefficients.
guard cap	Safe string jointId and ordinary dense own enumerable DATA finite length3 vector; malformed data uses unsafe-joint-reaction. The only threshold is .01. No arbitrary threshold parameter.

Arrays produced by this layer are ordinary, dense, exactly length+1 own keys with enumerable DATA numeric entries. Objects produced by this layer are ordinary plain own DATA objects with exactly the schema keys. Safe deep copy uses those admitted/constructed fields only. Shared references between returned bodies, frames, parent projection, metrics and report are not allowed. Caller mutation of any one branch must not change another branch, input, later invocation or observer copy.

Do not use recursive clone/serialization on an unknown thrown value. Parent config retains its original getter behavior. Parent carrier rejection rules remain unchanged. Reflection on unknown Proxy input may throw; propagate the exact thrown Error/object/null/string without recoding it.

4. Phase order and authority

1. Unchanged parent prepareInput: dt → original config structure → profile → copied carrier/raw/finite report. No safe observer exists yet.
2. Original parseCommands → original dynamic-hinge angular-only admission. Then admit options and register its safe callback. No callback for any failure through these steps.
3. Source copies and parsedActions; stage admitted; counters zero. Original angular-command update on working copies; angular-ready only when A and B finish.
4. Increment motorCalls immediately before the ONE original motor call. Incoming accepted memory is passed exactly. Store returned j and measured before/after relative speeds; motor-ready after both resulting bodies are captured. Original bound test decides blocked. No new angle test.
5. Per-body original angular bound → advanceOrientation → original linear update and displacement test → position update, in A/B order. Free-ready after both finish. Preserve every original binary64 operation and zero sign. Do not silently add another body-result validation before the unchanged parent projection.
6. Build FREE carrier by copying admitted carrier, replacing only its two body raw fields with actual FREE fields and preserving metadata/cursor/time/joint memory. Increment projectionCalls before ONE adopted projection call. Parent parsing inside that call remains unchanged. projection-ready only after its complete output is safely copied.
7. Build metrics, signed work, report and cap data. Finite/schema checks precede report-ready. Deliver one independently copied report-ready attempt before enforcing cap. No callback after cap, no second callback on cap refusal.
8. Strict cap then detached output. No caller or accepted state changes occur in this operation.

Raw source/free/final angles come from original q measurement helpers. Motor memory and projection eligibility are different authorities. The source .8 report can block the positive motor even when source raw angle is .7999999999999999. Parent velocity stop eligibility still uses its own exact clamped FREE target.

5. Work and rounding

Motor relative speed uses original sub then xyz dot before/after motor. motorMidpointJ=(j*(sBefore+sAfter))*.5 in that order. Spin-only midpoint for each body uses original sub/add/dot; (.5*I)*dot(deltaOmega,omegaBefore+omegaAfter); sum A then B. externalAngularByBodyJ uses source→angular in that same midpoint order. externalAngularTotalJ sums A then B. motorSpinMidpointJ sums angular→motor A then B. motorResidualJ=motorSpinMidpointJ−motorMidpointJ is signed.

EnergyByPhase uses unchanged parent measureBodies at a fixed original config origin. freeDeltaKJ=freeJ−motorJ and projectionDeltaKJ=projectedJ−freeJ are signed diagnostics, not automatic work/conservation assertions. projectionObjectiveJ is parent cost, not energy loss. No full-total-KE subtraction defines motor work.

Independent expected FREE starts from original input/config/commands and rounds binary64 after EACH original multiply/add/sub/divide operation in original order, including signed zeros. Python precision arithmetic must not carry extra precision across those native stage boundaries. Scalar trig repeat and Decimal80/120 geometry/algebra remain separately labelled. Candidate FREE is only an actual comparison frame; it never seeds expected FREE or parent optimum. Raw13 before/each-stage/output hex is retained by consumer to prove signs that JSON cannot retain.

6. Exact error table and priority

All PhysicsError rows use the original class/name. Known mapping requires BOTH actual code and exact message. No generic NUMERIC_LIMIT remapping. This layer introduces only the two NEW messages below.

Priority	Source/code	Exact message or verbatim provider rule
1	parent INVALID_STEP	private hinge velocity step must equal 1/120
2	original config/parseBody/parseJoints INVALID_CONFIG	Original exact messages/order unchanged. Includes world must be an object, world must be a plain object, world has an unsupported field, duplicate IDs and original vector/shape/joint errors. No broad catch.
3	parent INVALID_CONFIG	private hinge velocity profile is unsupported
4	parent NUMERIC_LIMIT	private hinge velocity archived pose is invalid
5	original INVALID_COMMAND	Table below; parser first, axis-only admission second.
6	NEW INVALID_CONFIG / ERRORS.options	private hinge motor options are invalid
7	original NUMERIC_LIMIT	${body.id} exceeded angular movement limit; ${body.id} exceeded step displacement limit in original A/B integration order.
8	parent projection NUMERIC_LIMIT	Original ${body.id} position/velocity/angularVelocity exceeded bounds, ${body.id} orientation exceeded tolerance, and exact parent result/pose/linear/system/certificate messages. Preserve actual first error; never turn it into cap refusal.
9	original NUMERIC_LIMIT / ERRORS.reaction	unsafe joint reaction for malformed/nonfinite report, J/K/j/angle or cap vector.
10	NEW NUMERIC_LIMIT / ERRORS.diagnostics	private hinge motor diagnostics are invalid for finite/schema/counter/energy/work diagnostic inconsistency. Signed negative work/DeltaK is valid.
11	observer	Unknown thrown value wins before cap; preserve identity. No catch followed by a second callback.
12	original NUMERIC_LIMIT	${joint.id} exceeded motor reaction limit iff actual KB norm>.01.

Original command receipts, copied from validation.ts and dynamic-hinge-joint.ts:

Condition	INVALID_COMMAND message
Sparse/extra/over64/not-array	commands must be a dense array of at most 64
Invalid record/prototype	command ${index} must be a plain object
Unknown kind/extra/accessor/non-enumerable/missing command field	command ${index} has unsupported fields
Missing/unsupported body	command ${index} targets an unknown or unsupported body
Duplicate same kind/body	duplicate ${kind} command for ${body.id}
Malformed vector	command ${index}.${valueKey} must be a dense 3-vector
Nonfinite/out of original bound	command ${index}.${valueKey} must have finite components within ±${bound}; torque bound1000000, angularImpulse bound100000
Linear command or perpendicular magnitude>1e-12	dynamic hinge admits axis-aligned angular commands only

Reuse parent result strings verbatim: private hinge velocity result is invalid, private hinge velocity linear data is invalid, private hinge velocity system is singular or unsafe, private hinge velocity certificate is invalid. Do not call old projectDynamicHingeJoint or its planar-axis/project-anchor solver to obtain a new result.

7. Failure callback and atomic copy rules

After safe options registration, a recognized calculation PhysicsError can deliver one copied reached attempt with a known error record, then rethrow that SAME error. The callback is outside the calculation catch. If that callback throws, propagate its identical value; never callback again. Cap is outside the calculation catch, because report-ready already ran once. Admission failures have no callback.

Unrecognized thrown values from calculations/reflection/copy propagate identically without constructing an error record or invoking a failure callback. This avoids inspecting an unknown getter/payload and satisfies the maximum-one rule. No attempt key contains the thrown payload. A consumer can separately capture its own thrown identity marker. Never fabricate a PhysicsError from unknown data.

A stage failure may internally leave a partially modified WORKING body, but cannot mutate input or return partial success. Only completed copied frames enter the attempt. All source config/carrier/commands bytes, original cursor/time and remembered angle remain unchanged. Parent identity promises FREE→projected v/omega bit retention only; the whole pipeline does not promise source→output bit identity because original zero additions may change -0.

8. Ownership and imports

Module	Responsibility / owner lane
motor-types.ts, profile.ts	Schema, new exact errors, options, parent admission bridge, safe trace/error metadata. Model/schema owner. Original errors are reused, not restated as alternative logic.
pipeline.ts	Original command/angular/motor/FREE sequence; one parent projection; actual call counters and stage capture. Model owner. Import existing math/parseCommands/admitDynamicHingeCommands/driveDynamicHingeMotor/prepareInput directly.
report.ts	FREE-baseline J/K, report-data guard, fixed strict cap helper, signed midpoint work and diagnostics. Model owner; no solver or World.
candidate.ts, entry.ts	Thin assembly/exports only; callback maximum once and priority. Model owner. No injected law.
reference.py, reference-controls.mjs	Independent input-derived binary operation sequence, motor, FREE, independent pose/rows/optimum, signed budgets/report/cap. Independent owner only. No candidate helper imports.
controls.mjs, observer.mjs, consumer-entry.mjs	Named positive cases and genuine/overload expected CAP_REFUSAL; own-data/reflection/copy/signed-zero/original exact errors, observer identity, report norm equality/greater controls. Consumer owner.
runner.mjs, bundle.mjs, freeze.mjs, tsconfig.json	Actual source/repeat/genuinecompiled graph, raw13, first mismatch persistence, authentic adopted/archive pins, strict types and emitted verification. Harness owner. Root executes.
CONTRACT/provenance/results/evidence/commits/Issue/Wiki	Root only. Complete source/inputs/reference first; actual build/types and emitted freeze precede one consumer. No helper execution before root authorization.

Pure report guards are DATA tests. They do not count as physical motor/projection calls. Consumer labels direct guards versus actual staged cases. Genuine and overload must remain unchanged and expect exact CAP_REFUSAL, with reached projection/raw/report before cap independently compared. Any mismatch is first NO-GO; no input/cap/report/branch tuning. A correctly matched refusal can qualify report semantics, never an accepted World step.

Later World must reuse projection/report SUBSTAGE on actual POST-CONTACT pairs. It must not call this full advance again, which would repeat motor/FREE. Motor memory is previous accepted report; both pair reports/caps/outer checks must pass before one atomic World commit. Original named four-body1200-step/10s, anchor2mm/axis1°/no-cross-contact/finite gates remain a future unmeasured consumer.

9. Source evidence and frozen validation units

Read current adopted files in /Users/user/.barocss-ai/v3/integration/:

• examples/physics-rigid-hinge-velocity-reference/profile.ts:8-16,42-55: exact private messages/bridge/dt.
• examples/physics-rigid-coupled-hinge-reference/admission.ts:9-42 and profile.ts:9-20: original structure precedes private admission; carrier own-data/cursor and parse-rest→raw restoration.
• packages/barocss-physics/src/validation.ts:153-200: unchanged command parser/descriptor rules.
• packages/barocss-physics/src/dynamic-hinge-joint.ts:37-47: original axis-only command rule.
• packages/barocss-physics/src/joint-motor.ts:19-35: accepted report motor input, blocked rule, actual j/angular update.
• packages/barocss-physics/src/world.ts:117-166,281-289: original angular/motor/FREE order, finite reaction and strict cap.
• packages/barocss-physics/src/math.ts:10-25,36-38: zero-speed orientation copy, scalar vector operation order and rotated inverse inertia.
• examples/physics-rigid-hinge-velocity-reference/candidate.ts:11-41: unchanged adopted one pose/velocity call, original bounds, parent identity, objective and copied output.
• examples/physics-rigid-hinge-velocity-reference/diagnostics.ts:4-23: metric/energy/raw angle fields.

Retain all parent gates. Added comparisons: actual j/J/K1e-12 in Nms/Ns/Nm*s; midpoint motor work1e-12J; FREE v/omega1e-10; FREE p/q1e-12; independent P/L budgets1e-7 SI; Decimal algebra80/120 difference≤1e-25 and scalar repeat≤1e-12. Protocol/unresolved reference is EXECUTION_FAILURE, not physical cap refusal. Exact cap .01 has no tolerance. Native binaryI versus ideal geometricI, raw versus normalized q and exact expected certificate versus rounded actual residual remain separate.

No remaining model choice is deferred to trial. Root can rename owned schema modules or assign agents before the complete before-code freeze, but arithmetic/authority/cap/error precedence above must remain explicit.

---

Independent scalar and parent law

#1179 staged hinge 독립 참조 계약 초안

SOURCE-ONLY. root가 채택한 네 선택과 두 수정사항을 반영한다. 새 코드·계산·parser/import/reference/solver/World/build는 실행하지 않았다. 부모 #1349의 실제 93 outputs GO는 재실행하지 않는다. 새 staged cases의 전체 source/input/error/schema freeze 후 root만 실행한다.

1. 예상의 입력과 수치 표현

예상의 유일한 입력은 original config, carrier, dt, 이 호출의 commands와 이 입력의 raw 증거다. candidate angular/motor/FREE/projected frame, 보고, lambda, cap 결과 또는 기존 detached 결과로 예상을 시작하지 않는다.

세 층을 분리한다.

1. Original scalar stage: 일반 Python float의 binary64 +,-,*,/를 원래 괄호/XYZ/A→B 순서로 개별 적용한다. 각 leaf 연산 결과를 다음 연산에 넘긴다. Decimal/Fraction로 합친 뒤 마지막에만 반올림하지 않는다. FMA, sum, fsum, 재정렬 또는 식 단순화를 사용하지 않는다. dot은 literal +0.0에서 XYZ 순서로 multiply 한 번, add 한 번씩 수행한다.
2. 부모 예상 law: 독립적으로 얻은 rounded FREE를 부모 independent pose/rows/Fraction optimum의 입력으로 준다. 부모 candidate TS나 solver를 호출하지 않는다. #1349 independent helpers와 그 기존 algebra/gates를 유지한다.
3. Physical observation: source/angular/motor/FREE/projected를 decoded binary 입력으로 Decimal80/120에서 raw와 normalized q 둘 다 관측한다. raw를 normalized로 덮지 않는다. ideal geometric I와 parsed native binary I를 따로 기록한다.

math.hypot, sin, cos, atan2는 별도 scalar binary 함수다. V8의 마지막 비트와 같다는 일반 보증 또는 Decimal transcendental 증명은 없다. scalar 반복/관측 gate는 1e-12; branch 차이는 숨기거나 native output으로 맞추지 않는다. 기존 numeric gates는 고정된 첫 flow의 gate이며 모든 admitted 값에서 통과한다는 주장은 아니다.

2. 입력 admission과 raw zero

부모 dt→config 구조/rest metadata→pair profile→carrier/raw/finite remembered-report 순서를 유지한다. preparePair의 rest metadata를 먼저 만들고 original raw13으로 p/v/q/ω를 복원하는 의미를 독립적으로 재현한다. moving FREE를 resting-scene 검사의 입력으로 바꾸지 않는다. remembered angle에는 finite만 요구한다. raw-angle agreement 또는 [-.8,.8] admission은 추가하지 않는다.

Native parsed I는 original expression .4 * mass * radius**2와 reciprocal 1/I의 binary operation order에서 입력만으로 만든다. ideal I=(2/5)*mass*radius²의 Decimal 값은 별도 관측이다. supplied output inertia를 expected I로 사용하지 않는다. 두1kg/.1m sphere, original +Z axis/anchors±.1/limits±.8/motor metadata와 Z0/Z1 부모 profile을 유지한다.

raw13 순서는 body A 다음 B, 각 body [positionM3,velocityMps3,orientation4,angularVelocityRadps3]다. frame당 208B/416hex다. JSON의 0은 raw의 ±0을 모두 나타낼 수 있다. numeric correspondence를 확인한 뒤 decoded raw로 입력 부호를 복원한다. raw의 nonfinite, 길이/ID/order 불일치는 거절한다. command 3-vector도 입력 순서의 24B/48hex를 별도로 보존한다. absent command와 supplied [-0,...]를 같은 입력으로 바꾸지 않는다.

source→FREE의 빈 add가 -0를 +0로 바꿀 수 있다. 이 변화는 source와 actual/expected stage raw로 기록한다. source→projected bit identity는 요구하지 않는다. 다음 hold/copy는 exact raw bit gate다: angular stage p/q/v/meta, motor stage p/q/v/meta, speed0 orientation copy, parent identity의 FREE→projected v/ω. named signed-zero controls에서 각 actual zero 부호도 독립 scalar stage 예상과 비교한다. scalar trig의 nonzero last-bit 차이에 전체 frame bit equality를 주장하지 않는다.

3. 독립 단계: 원래 scalar 순서

R은 한 binary scalar 연산의 결과다. 벡터 add/sub/scale도 component마다 한 leaf 연산씩이다. quaternion inverse는 conjugate만 사용한다. rotate는 original polynomial t=2*cross(q.xyz,v)와 v+(q.w*t+cross(q.xyz,t))의 중첩 순서를 유지한다. raw q를 사전에 정규화하지 않는다.

단계	입력-only expected operation order
commands	original command 구조/종류/ID/중복/한계와 dynamic-hinge perpendicular threshold를 검사한다. 현재 호출의 admitted actions만 만든다. queue 또는 이전 호출 command를 넣지 않는다.
angularBodies	각 A→B: torqueDt=scale(torqueOrPositiveZero,dt); delta=add(angularImpulseOrPositiveZero,torqueDt); local=rotate(conjugate(q),delta); 각 local component를 parsed inverseInertiaLocal과 multiply; world=rotate(q,local); ω=add(sourceω,world). p/q/v와 metadata는 복사한다.
motor decision	incoming remembered report로 original lower/upper와 target-speed 부호 조건을 비교한다. blocked이면 literal +0 j와 unchanged motor ω다. raw angle/clamped target/normalized q로 이 결정을 대신하지 않는다.
motorBodies	원래 inverseInertia(axis)와 순차 dot으로 A/B inverse-axis 값을 만들고 둘을 add한다. speed=dot(sub(ωB,ωA),axis); needed=R(R(target-speed)/inverseSum); original clamp를 적용한다. JS min/max의 signed-zero tie 의미도 명시적으로 유지한다. A=sub(ωA,inverseInertia(A,scale(axis,j))), B=add(ωB,inverseInertia(B,scale(axis,j))). impulse 적용 전의 두 ω를 기준으로 계산한다. motor 호출은 한 번이다.
orientation	original angular component/norm*dt bounds를 먼저 검사한다. speed0이면 q raw copy. 그 밖에는 half=R(R(speed*dt)/2), factor=R(sin(half)/speed), delta quaternion component multiply와 cos, original multiplyQuaternion(delta,q)의 각 leaf 순서, scalar norm, 각 component divide를 수행한다.
linear/FREE	orientation 다음 A→B/XYZ: v_i=R(v_i+R(impulse_i*inverseMass)); v_i=R(v_i+R(R(gravity_i+R(force_i*inverseMass))*dt)). original step displacement bound를 확인한 뒤 p_i=R(p_i+R(v_i*dt)). 선형 hinge commands는 이미 admission에서 거절하되 absent zero 연산을 생략하지 않는다. FREE raw와 unchanged carrier cursor/report를 기록한다.
pose/velocity	own rounded FREE carrier/raw를 부모 independent pipeline에 공급한다. own raw twist→one clamp/weighted pose→COM/anchors/held q→own centered full11 rows/H/X0/scales/native I→exact Fraction branch/optimum/KKT. upper/lower stop은 부모 exact target equality다. identity는 own FREE v/ω raw copy; 그 외에는 exact y의 binary conversion과 column-scale multiply를 구분한다. native basis/lambda/output은 expected seed가 아니다.

부모의 independent algebra는 변경하지 않는다. actual parent coefficient/certificate/frame 검사에는 별도 actual 검증 경로를 쓴다. actual rounded final에서 재계산한 certificate가 expected optimum을 정의하지 않게 한다.

4. 보고, cap, work

보고 baseline은 FREE다. A→B 순서에서 original sub 뒤 scalar scale로 J_i=m_i*(vProjected_i-vFREE_i)와 K_i=I_i*(ωProjected_i-ωFREE_i)를 만든다. report는 J_B, K_B, actual scalar j, parent target angle이다. K는 새로 고정한 scalar body correction report다. j를 K에 재가산하거나 KKT 승수/force/dt로 변환하지 않는다.

capNorm=Math.hypot(...K_B), exceedsCap=(capNorm>.01). equality 통과이며 epsilon/slop은 없다. observer의 copied report-ready attempt에는 norm/cap/boolean을 저장한다. 아직 accepted output은 아니다. actual cap 결정도 actual FREE/projected/report에서 검증하되 expected decision은 own input-only pipeline에서 따로 만든다. tolerance 안의 값이라도 cap boolean이 다르면 NO-GO다. cap equality control은 고정된 report-policy guard이며 fabricated parent solution으로 표시하지 않는다.

sBefore=dot(sub(ωBangular,ωAangular),axis), sAfter=dot(sub(ωBmotor,ωAmotor),axis).

motorWorkJ=R(R(j*R(sBefore+sAfter))*.5).

독립 spin midpoint는 각 A→B에 대해 sub Δω, add sumω, 순차 XYZ dot, R(R(.5*I_i)*dot)를 계산하고 두 값을 add한다. command work, motor work, free ΔK, projection ΔK는 signed finite다. nonnegative gate는 각 KE와 부모 objective에만 적용한다. 전체 큰 KE 두 값의 차이를 motor work의 정의로 쓰지 않는다. translation energy/objective를 motor work에 합치지 않는다. 에너지 보존이나 일반 소산을 약속하지 않는다.

5. JSON line proposal

root가 아래 exact keys를 BEFORE-CODE 최종 ABI와 함께 고정한다.

Request: {op:'evaluate',config,carrier,dt,commands,commandsRawHex,outcome,attempt,output,error,rawFrames}.

• rawFrames exact keys {source,angular,motor,free,projected}. source는 필수 hex. 실제 미도달 stage는 null이다. 실제 stage만 증거를 주며 예상 frame으로 채우지 않는다.
• commandsRawHex: admitted command-vector input order의 concatenated hex. empty commands는 빈 문자열이다. raw 대응이 불가능한 malformed command/proof는 protocol control로 거절한다.
• outcome=prediction|returned|refused. prediction에서는 attempt/output/error와 source 외 rawFrames가 모두 null이며 expected-only다. 반환 성공에서는 error=null. 거절에서는 output=null과 frozen safe error record를 받는다. attempt의 exact key table/stage/nullable 규칙은 root의 producer ABI와 동일하다.
• actual attempt/output은 own expected pipeline을 만든 뒤에만 읽는다. known expected cap refusal는 독립 norm/decision·reported error·copied frames로 검증한다. unknown exception을 임의 known cap/parent error로 분류하지 않는다.

Reply exact top-level: {ok,resolved,executionFailure,referenceStatus,metrics,reference,violations}. reference에는 own expected stages/raw, parent expected pose/rows/Fraction certificate, before/after raw+normalized physical observations, report/work/cap prediction과 reachedStage를 구분해 담는다. finite exact Fraction이 Float64 밖이면 authoritative exact 문자열과 overflow flag를 남기고 numeric null을 0으로 비교하지 않는다.

Malformed JSON: REFERENCE_JSON / 'hinge motor reference line must be valid JSON'. Missing/extra/null numeric/boolean numeric/nonfinite/invalid raw/field/ID/proof schema: REFERENCE_INPUT / 'hinge motor reference input is invalid', unresolved executionFailure=true, metrics=null. Known producer admission/profile/parent errors는 원래 class/code/message 표에서 비교한다. protocol/ref precision/resource unresolved는 EXECUTION_FAILURE다. valid resolved branch/report/physical mismatch는 NO-GO다. unknown error는 그대로 보존하며 새 known error를 만들지 않는다.

Expected CAP_REFUSAL과 실제 같은 refusal는 staged report/cap qualification일 수 있지만 acceptedOutputGO=false, worldGO=false다. predicted return의 실제 refusal 또는 predicted cap의 실제 return은 첫 NO-GO다. nominal World cap refusal는 expected guard 통과가 아니라 World NO-GO다. 첫 불일치를 저장한 뒤 입력·cap·법칙·gate를 바꾸지 않는다.

6. 고정 gate와 증거

항목	gate
own FREE v/ω	1e-10 m/s, rad/s
own FREE p/q	1e-12 m / quaternion component
j/J/K	각 Nms / Ns / Nm*s 단위로 1e-12
motor signed work와 spin midpoint	1e-12 J
parent p/q·rows/native I·scales/stop/order	p/q1e-12, coefficient relative1e-12*max(1,abs(ref)), I/scales/order exact native bits/declared tags
parent velocity/objective/certificate	v1e-10 m/s, ω1e-9 rad/s, objective1e-10 J, dimensionless residual/KKT1e-10
physical	anchor/angle/report/limit/qnorm1e-9, axis1degree, COM1e-12m, P/L1e-7 SI, kinematic1e-9
raw/normalized and precision	raw/norm1e-12, Decimal algebra80/1201e-25 per stated unit; scalar repeat1e-12 separately
authority/branch/cap/raw holds	exact booleans/labels and declared bit gates, no tolerance

genuine original orbital input와 B .1 overload를 그대로 포함한다. ideal overload 식과 기존 detached spin은 pretrial 방향 근거만 된다. expected frame/optimum은 반드시 original input에서 새 independent staged pipeline으로 만든다. 작은 positive cases, exact memory endpoints/stop directions/signed zeros/Z1, typed command/reflection/copy/observer/cap-policy guards를 root의 literal table로 고정한다. 부모 93 전체를 새 pipeline으로 다시 호출하지 않는다.

Source/repeat/genuine compiled는 각각 실제 staged 실행이다. 입력/commands/source raw와 reached raw/parent projection/report/work/error, original input/cursor 불변, imported blob/build/type/emitted/source graph hashes를 보관한다. JSON은 -0를 잃으므로 raw/zero witness 없이 decoded JSON deep equality를 signed-zero parity로 사용하지 않는다. source/ref expected를 다른 graph의 실제 결과 대신 복사하지 않는다. 새 World, Viewer, public engine 또는 release qualification은 별도다.

---

Consolidated corrections (override earlier text)

#1179 — three-draft corrections before code

SOURCE ONLY. Read the API, reference and input/literal drafts plus the inherited bridge/command source. No imports, parsing of product input, numerical/reference/World/build execution or repository change. Root's latest choices supersede older draft text.

1. Confirmed receipt defect: missing command bodyId

Input draft line65 currently gives missing bodyId the target error. Original validation.ts:183-186 first checks key count and own enumerable DATA descriptors. A deleted bodyId has only two keys and fails BEFORE target lookup.

Freeze these distinct literals:

Input at command0	INVALID_COMMAND exact message
Delete bodyId from {kind:'angularImpulse',bodyId:'pairB0',angularImpulseNms:[0,0,.001]}	command 0 has unsupported fields
Keep all three DATA keys but bodyId='absent'	command 0 targets an unknown or unsupported body
Keep all three DATA keys but bodyId=null	command 0 targets an unknown or unsupported body

Do not fix this by changing the original parser. API error table already has the right missing-field priority.

2. Callback timing: replace the conflicting input clause

Input draft line80 says a pre-report original input/reflection refusal produces one attempt. That conflicts with Root's selected registration order and API §§3/4/7.

Replace it with:

Parent dt/config/profile/carrier/remembered-report and original command admission run BEFORE options admission. Any refusal in those stages has callback count0 and no producer attempt. Options own-data refusal also has callback count0. After safe callback registration, a recognized calculation PhysicsError may deliver one copied reached attempt. An unrecognized thrown value propagates identically without building an error record or callback. A report-ready callback runs once before cap; cap never causes a second callback.

Keep stage labels exactly admitted, angular-ready, motor-ready, free-ready, projection-ready, report-ready. They mean the LAST complete A/B stage. No refused, accepted, final, projected-ready aliases. A partly updated stage remains null; sourceBodies is always reached once the observer is safely registered. Calls increment immediately before the motor/projection invocation, not only on return.

For late recognized calculation refusal, request.error and attempt.error contain the same safe known class/code/message. For cap refusal, request.error is the actual cap error while attempt.error remains null and attempt.stage remains report-ready. This is intentional: the callback occurred BEFORE cap. Do not rewrite the saved attempt afterward.

3. Inherited typed-proxy boundary: do not overstate identity

Add the following qualification to ALL three drafts' generic unknown/error statements:

Ordinary unknown Error/object/null/string values thrown by original config reads, new-layer reflection/copy or observer are preserved at the boundary where the new wrapper receives them. The inherited #1349 bridge remains unchanged: profile.ts:44-47 directly reads code/message on values passing instanceof PhysicsError. Typed Error-like Proxy/property-getter side effects inside that provider are not strengthened, blocked, replaced by a descriptor-only bridge, or claimed to retain the earlier value. The wrapper preserves the actual value that emerges from the inherited provider. This caveat is source-defined; ordinary identity controls do not prove a stronger typed-proxy guarantee.

Safe known-error trace creation uses own DATA descriptor values only. Unknown payloads never enter attempt.error. Do not inspect .message, call String/JSON.stringify on an unknown thrown payload, or silently map a generic NUMERIC_LIMIT to CAP_REFUSAL. Parent changes are outside scope.

4. Exact producer key alignment

Use the API draft as the producer key authority. The reference draft's prose names are labels, not alternate JSON keys.

Concept	Frozen producer field
frame container	diagnostics.frames / attempt.frames
frame keys	sourceBodies, angularBodies, motorBodies, freeBodies, projectedBodies
authority	acceptedReportAngleRad; motor.inputAngleRad
raw angles	diagnostics.rawSourceAngleRad / rawFreeAngleRad / rawFinalAngleRad
j	motor.impulseNms and jointReport.motorImpulseNms
report norm/cap	reportCap.angularReactionNormNms / maxReactionNms / exceedsCap
motor signed midpoint work	work.motorMidpointJ
independent-form native spin midpoint	work.motorSpinMidpointJ
signed work difference	work.motorResidualJ
command work	work.externalAngularByBodyJ / externalAngularTotalJ
signed energy changes	work.freeDeltaKJ / projectionDeltaKJ
cost	work.projectionObjectiveJ
complete parent output	projection: {bodies,poseReport,diagnostics}; no diagnostics-only substitution
report	exactly id/kind/aId/bId/angleRad/linearImpulseNs/angularImpulseNms/motorImpulseNms
body correction	bodyId/linearImpulseNs/angularImpulseNms, A then B
calls	motorCalls/projectionCalls only; parent solveAttempts stays inside projection.diagnostics.projection.result

No motorWorkJ, motorImpulseNms directly under diagnostics, capNorm, sourceCursor, reachedStage, rawFinalAngle or frames.free alias is a producer key. A reference-only field may use another name only if its separate exact reference schema is frozen.

Complete output, its embedded parent output, its frame copies and the copied observer attempt are independent objects. Raw parity checks use copied scalar fields and independent archive bytes; JSON equality alone does not prove signed-zero equality.

5. Guard split and nonfinite work receipt

Input draft line81 proposes one combined report/cap helper and puts nonfinite work under unsafe-joint-reaction. API instead has TWO separate data guards so physical flow can run its observer between finite report and cap. Use these exact boundaries:

1. validateHingeMotorReport(value,identity) — exact report schema/IDs/finite numbers and vectors, returns detached report; does NOT enforce cap.
2. enforceHingeMotorReactionCap(jointId,angularImpulseNms) — malformed/nonfinite data → NUMERIC_LIMIT / unsafe joint reaction; actual Math.hypot norm>.01 → ${jointId} exceeded motor reaction limit; equality passes.

Freeze equality literals [0,0,.01] and [0,0,-.01], greater literal [0,0,.010000000000000002], and a nonfinite vector. A large finite linearImpulseNs passes report validation; no linear cap is invented.

Report has no work property. Therefore do not pass a fake work field to the finite report guard and claim it measured the work check. Nonfinite work/energy/diagnostics belongs to NEW NUMERIC_LIMIT / private hinge motor diagnostics are invalid, not unsafe joint reaction. If Root retains a separate diagnostic-data control, it must use its actual internal diagnostic validator and be labelled DATA ONLY; no fabricated parent output or extra physical injection. Otherwise remove that unsupported work-tamper control. All signed finite work/DeltaK values remain valid; only KE and objective have nonnegative checks.

6. Reference wire: missing exact error slot and payload rules

Reference draft §5 claims an exact seven-key reply but also promises REFERENCE_JSON/REFERENCE_INPUT code/message without a slot. Consolidate it as this EIGHT-key envelope:

{ok,resolved,executionFailure,referenceStatus,metrics,reference,violations,error}
error = null | {code:'REFERENCE_JSON'|'REFERENCE_INPUT',message:string}

For invalid JSON use exact message hinge motor reference line must be valid JSON. For schema/raw/proof invalid use hinge motor reference input is invalid. Both have ok=false,resolved=false,executionFailure=true, metrics=null,reference=null,violations=[],referenceStatus='UNRESOLVED'. A precision/resource unresolved reply can have error=null, explicit referenceStatus='UNRESOLVED' and nonempty violations; it remains executionFailure=true. Do not make numeric null an implicit zero.

Valid resolved comparison has error=null. Freeze referenceStatus values RETURN, CAP_REFUSAL, PRODUCER_REFUSAL, MISMATCH, UNRESOLVED before implementation. These are reference classification labels, not producer PhysicsError codes. Actual unknown observer/Proxy marker controls are captured natively by identity; do not serialize a thrown object/null into a fabricated known producer error.

Retain the proposed request exactly:

{op:'evaluate',config,carrier,dt,commands,commandsRawHex,
 outcome,attempt,output,error,rawFrames}
rawFrames = {source,angular,motor,free,projected}

The shorter rawFrames names are WIRE labels mapping explicitly to the five producer Bodies keys. Each reached frame is exactly208B/416hex, A then B, raw13 order. Non-reached frames are null. Prediction has output/attempt/error=null and only source raw nonnull. commandsRawHex holds command-array order, not parsedActions A/B order. Empty commands is empty hex. Malformed native command controls that cannot encode a numeric vector stay native admission controls; do not invoke a raw encoder that coerces null/NaN into a plausible vector.

For returned outcome, output is complete and error=null. attempt may be null if no callback was supplied, or report-ready with error=null if one was supplied. The output diagnostics frames supply every reached raw field. If both attempt and output exist, independently require their frame/raw/report correspondence; never choose one and ignore contradiction.

For known late refused outcome, output=null; safe request.error is required, attempt is the actual copied callback payload, and only its completed frames may supply raw evidence. Admission refusal has attempt=null; source raw can be supplied only if an independently valid input raw record exists. Malformed/raw admission receipts are separately counted native controls, not full numeric evaluation cases. Unknown throw is EXECUTION_FAILURE outside this known-error comparison route.

The reference.metrics and reference nested key lists are still prose-only in the reference draft. Root/C must publish those exact lists before executable code. They must bind independently expected stages to the selected producer keys above and distinguish expected-only data from validated actual data. Do not pretend the current vague nested names are already an exact ABI.

7. Expected cap versus earlier parent numerical refusal

The fixed fourteen-case table keeps genuine and overload as expected CAP_REFUSAL. This is a pretrial EXPECTATION, not a guarantee from symbolic ideal algebra or the old93 outputs.

Freeze classification:

• Only original PhysicsError, NUMERIC_LIMIT, exact admitted joint ID plus exceeded motor reaction limit, reached report-ready payload and independently matching strict norm/boolean qualifies the expected cap semantic receipt.
• An earlier angular/FREE/parent pose/system/certificate/body-bound refusal retains its actual class/code/message and actual reached frame/nulls. It is NOT recoded as cap. Do not fill projected/report/cap values from old detached results or expected output.
• If the valid independent pipeline resolves a return/cap expectation but native first refuses earlier, this is first NO-GO of the staged expectation. Stop further named physical cases and preserve the reached prefix. If both pipelines independently resolve an earlier parent refusal, the original mandatory cap expectation still was not achieved: record an honest bounded refusal and staged-qualification NO-GO, not report/cap GO. Do not revise the fourteen-case expectation after trial.
• If reference/protocol/precision is unresolved, classify EXECUTION_FAILURE; do not infer a physical cap outcome. A known numerical refusal is not automatically an execution exception.
• For expected cap that matches, consumer may proceed to later named report cases. It increments attempted physical cases and actual motor/projection calls, not accepted-output count. Genuine first is not excluded to keep positive output GO.

This keeps pure guards, expected refusals, actual accepted outputs and the future nominal1200-step World qualification separate. Correct cap semantics is not accepted World GO.

8. Extra finite-memory calls need honest counts

Input §Original routing also calls +.9 and -.9 remembered-memory inputs. They are valid finite-only physical inputs, not malformed admission cases. Do not add them silently to the fixed14 physical table or label a complete staged call parser-only.

Selected minimal correction: keep them as native parent-preparation + original motor-decision helper controls, labelled admission/control-memory DATA/MOTOR controls. They must not invoke adopted projection or assert a staged report/output. Count the real extra original motor calls separately from the14 staged calls. If Root instead chooses full staged calls, add their exact inputs/dispositions to the physical table BEFORE freeze and report16, not14. No inherited range restriction is added.

9. Ready scope

Model choices, original operation order, selected authority, signed work and strict cap are consistent across the three drafts after these corrections. Remaining pre-code completion is the exact nested independent reply schema and honest registration of any direct helper controls/call counts, owned by Root/C/harness. No new law, tolerance, parent edit, old93 replay or symbolic recalculation is needed.

---

FINAL exact reference wire (override earlier wire text)

#1179 — 독립 참조 exact wire schema

SOURCE-ONLY. Root의 네 선택, binary64/signed-work 수정, B의 cross-contract corrections를 반영한다. 코드·parser/import·계산·reference·solver·World·build는 실행하지 않았다. 이 문서는 이전 참조 초안의 envelope/불명확한 nested 이름을 대체한다. producer 키는 API key contract가 권위다. 부모 #1349는 변경하지 않는다.

1. 공통 타입과 요청

N: 유한한 JSON number; bool/null/string을 숫자로 변환하지 않는다. B: JSON bool. I: safe nonnegative integer. V3=N[3], Q4=N[4]. 배열은 지정 길이의 dense 배열이다. 모든 object는 아래 exact keys만 가진다. T|null은 실제 미도달 또는 실제 비교 증거가 없는 경우만 쓴다. 0/true로 채우지 않는다.

Request exact:

{op:'evaluate',config,carrier,dt,commands,commandsRawHex,
 outcome,attempt,output,error,rawFrames}
outcome: 'prediction'|'returned'|'refused'
rawFrames: {source,angular,motor,free,projected}

입력 config/carrier/command는 기존 admission 표를 따른다. raw.source는 independently valid input의 두 body raw13 208B/416hex다. command array 순서의 numeric vector는 vector당 24B/48hex; empty commands는 빈 hex다. raw의 nonfinite/길이/ID/order/numeric 불일치는 REFERENCE_INPUT이다. malformed command를 raw encoder로 강제 변환하지 않는다. 그런 original admission/proxy controls는 native guard receipts다.

raw wire label→producer frame: source→sourceBodies, angular→angularBodies, motor→motorBodies, free→freeBodies, projected→projectedBodies. 순서는 A→B, 각 position3/velocity3/orientation4/angularVelocity3다. JSON0만으로 -0 parity를 주장하지 않는다.

prediction은 attempt/output/error=null이며 source 외 raw는 null이다. returned는 complete output/error=null이고 attempt는 null 또는 실제 report-ready copy다. refused는 output=null과 실제 safe known error가 필요하다. admitted 이전 거절은 attempt=null/callback0; safe source raw도 independently valid한 경우만 쓸 수 있다. known late refusal는 actual attempt의 완료된 frame만 raw로 준다. cap refusal는 request.error=actual cap error이지만 report-ready attempt.error=null이다. actual attempt/output 둘 다 있으면 서로의 frames/report/parent projection/calls도 검사한다. 모순된 branch 중 하나를 택하지 않는다.

Unknown Error/object/null/string/proxy marker는 이 known-error JSON route에 넣지 않는다. native identity controls로 따로 보존한다. inherited typed PhysicsError-like proxy의 code/message side effect는 원래 #1349 bridge 경계 그대로다. 새 wrapper는 그 provider에서 실제 나온 값을 보존하며, 그 이전 값을 지킨다는 보장을 추가하지 않는다.

2. EIGHT-key 응답과 분류

{ok:B,resolved:B,executionFailure:B,
 referenceStatus:'RETURN'|'CAP_REFUSAL'|'PRODUCER_REFUSAL'|'MISMATCH'|'UNRESOLVED',
 metrics:Metrics|null,reference:Reference|null,violations:string[],
 error:null|{code:'REFERENCE_JSON'|'REFERENCE_INPUT',message:string}}

Invalid JSON: hinge motor reference line must be valid JSON. Invalid schema/raw/proof: hinge motor reference input is invalid. 둘 다 ok/resolved=false, executionFailure=true, status=UNRESOLVED, metrics/reference=null, violations=[]다. precision/resource unresolved는 error=null, metrics=null, partial reference 또는 null, nonempty violations이며 executionFailure=true다. 기존 부모 reply의 executionFailure 표기를 바꾸지 않되, 부모 resolved=false이면 새 outer reply는 EXECUTION_FAILURE다.

Valid comparison은 error=null이다. RETURN/CAP_REFUSAL은 독립 예상과 실제 disposition·완료 frame·보고가 맞는 경우다. PRODUCER_REFUSAL은 실제 첫 known earlier error와 reached proof를 보존한 bounded refusal다. MISMATCH는 유효하게 resolved된 actual/prediction/physical 불일치며 ok=false다. unknown exception을 generic NUMERIC_LIMIT 또는 CAP로 바꾸지 않는다.

Mandatory14 input의 desired disposition은 consumer literal table이 검사한다. genuine/overload에서 양쪽이 같은 earlier PRODUCER_REFUSAL을 기록했어도 mandatory CAP를 달성하지 못했으므로 staged NO-GO다. reference의 bounded refusal 비교 정확성을 staged acceptance 또는 World GO로 올리지 않는다.

3. Metrics exact keys

{
 actualCompared:B,
 checks:Checks,
 frameErrors:FrameErrors,
 motorError:MotorError|null,
 reportError:ReportError|null,
 workError:WorkError|null,
 pairMetricErrors:PairMetricErrors,
 precision:Precision
}

Checks

Exact keys, 전부 B|null:

{sourceRawMatchesInput,commandsRawMatchesInput,parsedActionsMatch,
 sourceCursorRetained,acceptedReportAuthorityMatch,heldFrameBitsMatch,
 namedZeroSignsMatch,outputAttemptCorrespondence,callsMatch,
 jointReportIdentityMatch,targetAngleAuthorityMatch,capDecisionMatch,
 finiteSignedWork,nonnegativeEnergiesAndObjective,
 parentPredictionQualified,parentActualQualified,
 actualErrorMatch,actualOutcomeMatch}

source/commands raw correspondence는 prediction에서도 실제 제공된 original input 검사다. parsedActions와 뒤의 actual flags는 actual 비교 자료가 있을 때만 값이 있다. parentPredictionQualified는 own FREE에서 계산한 expected law proof다. parentActualQualified는 실제 complete projection 검사가 있을 때만 값이 있다. prediction의 부모 default actual...Passed=true를 새 actual proof로 해석하지 않는다. object alias/callback identity는 JSON 참조가 증명할 수 없으므로 native copy/identity controls가 권위다. outputAttemptCorrespondence는 데이터 대응 검사만 뜻한다.

FrameErrors

Exact {source,angular,motor,free,projected}, 각 null|{positionM:N,quaternion:N,velocityMps:N,angularVelocityRadps:N,metadataMatch:B}다. own expected frame과 actual raw-restored frame의 max component agreement다. actual 미도달이면 null이다. angular/motor hold, zero-speed q copy와 provider identity는 Checks의 exact raw bit gate다. 일반 source→FREE bit identity는 없다. FREE p/q1e-12, v/ω1e-10; projected에는 그대로 부모 p/q1e-12, v1e-10, ω1e-9를 쓴다.

MotorError

Exact {inputAngleMatch:B,blockedMatch:B,impulseNms:N,relativeSpeedBeforeRadps:N,relativeSpeedAfterRadps:N}. producer motor.inputAngleRad/blocked/impulseNms/relativeSpeedBeforeRadps/relativeSpeedAfterRadps에 대응한다. remembered finite value와 blocked branch는 exact; j 오차1e-12 Nms다. relative speed는 motor stage의 ω agreement와 같은1e-10 rad/s다.

ReportError

Exact {angleRad:N,linearImpulseNs:N,angularImpulseNms:N,motorImpulseNms:N,bodyLinearImpulseNs:N,bodyAngularImpulseNms:N,angularReactionNormNms:N}. 각각 actual jointReport, A/B bodyCorrections, reportCap의 own input-only prediction 오차다. impulse/norm 비교1e-12의 표시 단위, angle1e-9다. outgoing report.angleRad가 actual projection.poseReport.targetAngleRad와 exact 같은지도 Checks에서 별도로 본다. strict cap boolean은 tolerance가 없다.

WorkError

Exact {externalAngularByBodyJ:N,externalAngularTotalJ:N,motorMidpointJ:N,motorSpinMidpointJ:N,motorResidualJ:N,freeDeltaKJ:N,projectionDeltaKJ:N,projectionObjectiveJ:N,energyByPhaseJ:N,motorBalanceResidualJ:N}.

앞9개는 frozen producer work/energyByPhase의 own expected agreement다. body 배열은 A/B max error, energyByPhaseJ는 source/angular/motor/free/projected max error다. inherited phase diagnostic agreement 및 selected signed work gate를 그대로 쓴다. motorBalanceResidualJ는 actual abs(motorSpinMidpointJ-motorMidpointJ)이며1e-12 J다. work/motorResidual/freeDeltaK/projectionDeltaK는 signed finite다. EnergyByPhase와 objective만 nonnegative다. projectionObjective 비교는 inherited1e-10 J, 다른 selected work comparison은1e-12 J다. objective를 에너지 손실로 쓰지 않는다.

PairMetricErrors

Exact {source,angular,motor,free,projected}, 각 null 또는 exact:

{positionM,angleRad,quaternion,velocityMps,angularVelocityRadps,
 linearMomentumKgMps,angularMomentumKgM2ps,energyJ} // N

각 producer diagnostics.metrics.phase의 기존 PairMetrics 필드를 own raw observation과 비교하고 해당 SI 단위의 max error로 보고한다. 부모의 phase diagnostic-measurement agreement1e-12를 그대로 적용한다. 이것은 실제 보존 법칙 검사를 대신하지 않는다. projection의 COM/P/L/anchor/rate/axis/limit/energy 물리 gate는 그대로 ParentPhysicalReply가 담당한다. incoming memory/raw residual은 diagnostic이며 before에 새 agreement admission을 만들지 않는다.

Precision

Exact {algebraMaxDifferenceByUnit,scalarRepeatMaxDifferenceRad,algebraResolved,scalarResolved}.

algebraMaxDifferenceByUnit exact {positionM,quaternion,velocityMps,angularVelocityRadps,linearMomentumKgMps,angularMomentumKgM2ps,energyJ,impulseNs,angularImpulseNms}→N이다. own80/120 algebra 차이이며 각≤1e-25; scalarRepeatMaxDifferenceRad≤1e-12다. scalar trig/atan/hypot는 별도 binary scalar seed로 표시한다. Decimal transcendental 증명이나 arbitrary unit 합계0을 만들지 않는다.

4. Reference exact keys: 예상만

{stage,authority,parsedActions,frames,rawFrames,
 motor,jointReport,bodyCorrections,energyByPhase,work,reportCap,calls,
 parent,expectedRefusal}

stage는 마지막 독립적으로 완료된 예상 stage, admitted/angular-ready/motor-ready/free-ready/projection-ready/report-ready 중 하나다. actual callback stage와 섞지 않는다. source는 admitted 후 존재하며 미완료 A/B stage는 null이다. output 또는 saved old after body로 예상 stage를 채우지 않는다.

• authority exact {sourceStepIndex:I,sourceTimeSeconds:N,acceptedReportAngleRad:N,rawSourceAngleRad:N,rawFreeAngleRad:N|null,rawFinalAngleRad:N|null}. remembered angle은 input carrier authority, raw angle은 별도 측정이다.
• parsedActions는 producer exact ActionRecord 두 개, A/B 순서: {bodyId,torqueNm:V3|null,angularImpulseNms:V3|null}.
• frames exact {sourceBodies,angularBodies,motorBodies,freeBodies,projectedBodies}. sourceBodies=ExpectedBody[2], 다른 값은 ExpectedBody[2]|null. ExpectedBody exact keys {id,kind:'dynamic',shape:{kind:'sphere',radiusM:.1},positionM,velocityMps,orientation,angularVelocityRadps,inertiaKgM2,inverseInertiaLocal,inverseMass,restitution,frictionStatic,frictionDynamic,sensor:false}. rest config에서 얻은 metadata와 own stage raw만 사용한다. CCD/filter/sleep/inertia override를 추가하지 않는다.
• rawFrames는 §1의 short keys, own expected raw13 hex|null이다. request.rawFrames는 actual 증거, reference.rawFrames는 own prediction이다.
• motor는 producer MotorDiagnostics exact keys {inputAngleRad,targetSpeedRadps,limitRad,maxImpulseNms,blocked,impulseNms,relativeSpeedBeforeRadps,relativeSpeedAfterRadps} 또는 null이다.
• jointReport는 producer exact eight keys {id,kind:'hinge',aId,bId,angleRad,linearImpulseNs,angularImpulseNms,motorImpulseNms} 또는 null이다.
• bodyCorrections는 A/B {bodyId,linearImpulseNs,angularImpulseNms} 두 개 또는 null이다.
• energyByPhase exact {sourceJ,angularJ,motorJ,freeJ,projectedJ} 또는 null. work exact {externalAngularByBodyJ,externalAngularTotalJ,motorMidpointJ,motorSpinMidpointJ,motorResidualJ,freeDeltaKJ,projectionDeltaKJ,projectionObjectiveJ} 또는 null이다. producer와 다른 alias를 만들지 않는다.
• reportCap exact {angularReactionNormNms,maxReactionNms:.01,exceedsCap} 또는 null이다.
• calls exact {motorCalls:0|1,projectionCalls:0|1}. 독립 단계 진입 예상이며 invocation 직전에 증가한다. parent internal solveAttempts를 이 카운터에 넣지 않는다.
• expectedRefusal는 null 또는 exact {stage,name:'PhysicsError',code,message}의 고정 known tuple다. cap 예측은 report-ready지만 actual attempt.error는 null인 규칙을 유지한다. expectedRefusal는 error identity 증거가 아니다.

parent exact {mode:'unreached'|'prediction'|'comparison'|'refused',reply:ParentPhysicalReply|null,refusal:null|{code:'REFERENCE_SYSTEM',message}}다. 한 개의 원래 parent reply만 보관한다. own rounded FREE에서 unchanged independent pose/rows/Fraction helpers로 예상 projected frame/report/work/cap을 먼저 완성한다. 그 뒤 actual complete projection이 있으면 own FREE와 actual projection/raw를 공급하여 unchanged parent physical evaluator를 호출하고 comparison reply를 보관한다. actual projection이 없으면 own FREE의 expected-only prediction reply를 보관한다. 실제 FREE로 expected input을 바꾸거나 optimum cache를 graph/request 간 재사용하지 않는다. 미도달은 reply/refusal=null, parent known reference refusal는 reply=null과 원래 refusal를 보존한다.

comparison reply.reference.after는 실제 projected observation일 수 있다. 이를 own expected projectedBodies/report의 seed로 쓰지 않는다. 예상은 그 전에 original input과 own FREE로 독립적으로 완성한다. prediction mode의 부모 default actual flags는 새 actual proof가 아니다.

5. 부모 schema는 변경 없이 상속

ParentPhysicalReply는 adopted examples/physics-rigid-hinge-velocity-reference/reference.py의 evaluate_physical 결과 그대로다. 해당 #1349 CONTRACT, measured source49cd64c2/native0e296d1e/adoption527a4407의 exact source pins를 참조한다. 새로 부모 metrics/reference/certificate 하위 키를 복제·확장하거나 다른 float/Fraction 표현으로 바꾸지 않는다.

원래 top-level은 {ok,resolved,executionFailure,metrics,violations,reference,certificate,transcendentals,zeroAuthority}다. 원래 reference는 {before,after,expectedBodies,expectedVelocity,poseReport,projection,geometricInertiaKgM2,nativeInertiaKgM2,objectiveDecimalJ,energyDifferenceJ}, certificate는 {expected,actualFrame,actualOutput}다. 나머지 깊은 schema와 full11/12 rows, exact Fraction pair 표현, raw/normalized/native/geometric 관측, actual certificates, 원래 모든 gate는 그 immutable provider가 권위다. 같은 정보를 별도 넓은 payload로 다시 저장하지 않는다.

prediction mode의 부모 actual flags/zero errors는 actual validation을 뜻하지 않는다. checks.parentActualQualified는 comparison mode와 실제 complete projection 증거가 있을 때만 값이 있다. ParentPhysicalReply가 unresolved이면 outer executionFailure=true로 처리한다. 부모 ReferenceSystemError는 parent.refusal 슬롯과 실제 completed stage에 남기며, mandatory cap 성공으로 바꾸지 않는다.

6. producer 매핑과 호출 수

새 reference의 expected keys는 producer frames/sourceStepIndex/sourceTimeSeconds/acceptedReportAngleRad/motor/bodyCorrections/energyByPhase/work/reportCap/calls/jointReport에만 대응한다. full actual projection={bodies,poseReport,diagnostics}를 parent comparison에 공급한다. diagnostics-only 또는 old after frame 대체는 금지다. actual rawSource/rawFree/rawFinal은 authority의 독립 scalar angle과 비교한다.

14 named staged cases의 disposition을 바꾸지 않는다. +.9/-.9은 separately counted original parent preparation+motor helper controls이고 projectionCalls=0이다. 이 helper만으로 full staged reply/report/World GO를 만들지 않는다. native original callbacks/unknown identity/copy/reflection guards는 independent numeric reference와 별도 receipts다.

원래 typed-proxy provider 경계, commands/options admission callback0, late known completed-stage callback≤1, report-ready callback 뒤 cap과 cap에서 attempt.error=null을 모두 유지한다. protocol/unresolved는 EXECUTION_FAILURE, valid mismatch는 NO-GO, matched CAP는 report/cap qualification만 가능하다. 새 law/gate/bounds 또는 부모 edit를 추가하지 않는다.

---

Root harness/storage decisions BEFORE harness authoring

Root owns harness-entry.mjs separately from producerentry.ts. It reexports EXACTentrythreeAPIs/types-runtimeclasses/errors plus unchanged original helpernames prepareInput/parseCommands/admitDynamicHingeCommands/driveDynamicHingeMotor for separatelycounted Bguard/.9motor calls only. No producerentryextension, alternatelaw or solverinjection. Binterfaces: fixtures literalCases/restInput/fixture(name); runControls(m,{writeRecord?}={}); consumeCases(m,ask,{writeRecord,limit=14}={}) -> {observations,failure,counts,stagedReportSemanticsGO}. Rootwriter persistsfullrecord/rawBuffers before nextcase, rootownsfinish; repeat/compiled useSOURCEfirstprefix only. Oneactualask pernativecase fromoriginalinputplus actualoutput/attempt/safeknownerror/raw. JSON can losezero signs; mandatory208Bbodyframes/24Bcommandvectors retained.

Referencecontrols: bounded RESTprediction +copied-output/repeated-input isolation and exactunknownop/strictshape/raw/boolean/null protocolrefusals. Count everyindependentrequest separately from14nativecases; nativecalls0. No cachedcontroloptimum or prediction seed reused forcases. Preferstrictprotocolguards; do notfabricateactualproduceroutputs tofillunknownphysicalproof. Prediction actualCompared=false, actualparentchecksnull evenifunchangedparent defaultactualflags true.

Normalrecordstored budget64MiB; fixedfullmetadata/build/type/source/emitledger/bundles/control/reference/summary/log/audit reserve8MiB; emergencyfullrecord2MiB. Pretrialavailablecapacity>=normal+fixed+emergency+512MiBoverhead. LosslesssourcefullJSON/raw, repeat/compiled actualcompleteBuffer/raw parity mayalias onlyafterEOF/fullhash/countmatch andactualindependentexecution. Mainbytes andfixedfiledata countdevice+inode/uniquephysical, identicalindependentwrites countedseparately; logicalaliasbytes reportedseparately. No metadatafield omission/keynormalization/budgettuning afterfirstfailure. Unresolvedreference/storage/protocol =>EXECFAILwithtruthfulpartialproof; validphysical/report/expectationmismatch=>NO-GO. Controller printsactualexit/elapsed/logsha BEFOREfilesystemreceipt; allfirstfailures preserved.