{
  "schema": "litholab.sprint252.succinct-certificate.v1",
  "sprint": 252,
  "title": "Succinct reticle-scale certificate \u2014 O(1) receipt, O(log n) fold-verified openings",
  "status": "implemented_model_relative",
  "preregistration_sha256": "2a6bc30da8f67b977d5d71d3eee14d9a1118d9ed5bb031462917455b5453d91e",
  "format": "LCERT-SUCCINCT-1",
  "pfail_quantum": 8.881784197001252e-16,
  "monoid_associative": true,
  "monoid_identity": true,
  "scaling": [
    {
      "n_tiles": 64,
      "receipt_bytes": 1347,
      "opening_hashes": 6,
      "flat_lcert_bytes": 12864,
      "compression_x": 9.55,
      "verified": true,
      "build_seconds": 0.0008
    },
    {
      "n_tiles": 1024,
      "receipt_bytes": 1361,
      "opening_hashes": 10,
      "flat_lcert_bytes": 205824,
      "compression_x": 151.23,
      "verified": true,
      "build_seconds": 0.0111
    },
    {
      "n_tiles": 16384,
      "receipt_bytes": 1367,
      "opening_hashes": 14,
      "flat_lcert_bytes": 3293184,
      "compression_x": 2409.059,
      "verified": true,
      "build_seconds": 0.2123
    },
    {
      "n_tiles": 262144,
      "receipt_bytes": 1373,
      "opening_hashes": 18,
      "flat_lcert_bytes": 52690944,
      "compression_x": 38376.507,
      "verified": true,
      "build_seconds": 3.1958
    },
    {
      "n_tiles": 1048576,
      "receipt_bytes": 1379,
      "opening_hashes": 20,
      "flat_lcert_bytes": 210763776,
      "compression_x": 152838.126,
      "verified": true,
      "build_seconds": 12.276
    }
  ],
  "receipt_is_O1": true,
  "opening_is_log_n": true,
  "tree_fold_equals_flat_fold": true,
  "one_bad_tile_flips_region_verdict": true,
  "tamper_battery": {
    "clean_verifies": true,
    "payload_value": true,
    "sibling_digest": true,
    "sibling_fold": true,
    "sibling_yield_mass": true,
    "salt": true,
    "index": true,
    "published_region_verdict": true
  },
  "tamper_all_rejected": true,
  "reticle_projection": {
    "n_tiles": 2442000000000,
    "opening_hashes": 42,
    "succinct_receipt_bytes": 1365,
    "flat_lcert_terabytes": 490.8,
    "compression_x": 359591208791.2088,
    "escape_bound_1bad_1k_samples": 0.9999999995905497,
    "sampling_is_useless_at_this_scale": true,
    "sampling_caveat": "Random spot-checking is WORTHLESS at reticle scale: 1000 uniform challenges against 2.44e12 tiles catch a single corrupted tile with probability ~4e-10. Catching a rare bad tile by sampling alone would need on the order of n/2 challenges. The value of this construction is therefore the O(1) receipt and the BINDING it provides \u2014 anyone who recomputes any tile they care about (the fab checking its own critical cells, an auditor checking a disputed region) gets an O(log n) proof that the published aggregate is consistent with it. It is emphatically NOT a claim that sampling a few tiles assures a reticle."
  },
  "design_defects_caught_by_own_controls": [
    "Odd-arity duplication (inherited from zk.commit.merkle_levels) DOUBLE-COUNTS a fold-annotated node: AND and max are idempotent but pfail_sum and n_tiles are sums. Caught by the build-time associativity assertion; fixed by padding with the monoid IDENTITY under a distinct domain tag, never by duplicating a node.",
    "Float addition is NOT associative, so a float yield sum makes the tree fold and the flat fold disagree in the last bits and the committed node digests ill-defined. Caught by the same assertion; fixed by carrying the yield leg as an exact integer count of 2**-50 quanta, rounded UP so the union bound stays sound.",
    "Hashing only the PARENT's fold leaves a sibling's claimed fold unbound to its digest, so a sibling fold could be altered undetected whenever the change did not happen to move the running max. Caught by the tamper battery; fixed by hashing BOTH children's (digest, fold) pairs into their parent."
  ],
  "headline": "All four admission legs are monoids \u2014 MRC and deterministic-PW fold under AND, eps(R) and worst-EPE under max, stochastic yield under a union sum \u2014 so a region verdict can be aggregated over a binary tree and committed at every internal node. The resulting receipt is O(1): 1365 bytes measured flat across 64..1048576 tiles, with openings of exactly ceil(log2 n) hashes. Projected to a reticle (2.44e+12 tiles) the flat LCERT would be 491 TB; the succinct receipt is ~1365 bytes with 42-hash openings.",
  "scope": "OPTIMISTIC / FRAUD-PROOF soundness, the model the estate already states in litholab/zk/__init__.py. An opening proves the challenged tile is bound to the root AND that its value is correctly folded along its path; it does NOT prove an unchallenged tile is correct, so this is NOT a succinct proof of the whole certification (that needs recursive proof composition, named as future work). The sampling escape bound is reported rather than assumed. This makes the CERTIFICATE succinct, NOT the certification cheap, and it does not touch the dense-raster memory ceiling (~20 PB for a reticle in float64), which remains the first blocker for true reticle scale. Simulator/model-relative; NOT silicon.",
  "determinism_bit_identical": true,
  "sacred_spine_rc": 0,
  "readonly_files_unchanged": "6/6",
  "check_numbers_rc": 0
}