A working log of what changed in the Lupine research program — not just what we did, but\nwhy, what the results were, and the suggested next steps to extract more value.\nThis is meant to be read: it is the narrative spine of the corpus, and it is published on\nlibrary.lupine.science.
\nFormat for every entry:
\nNewest first. Dates are absolute.
\nUniversalCorrection/Empirical/Registry.lean gains\nCorrectionGatePolicy with B0 -> deny/contradicting_evidence and\na0 -> allow/scope_matched_same_class_a0.registry/claims/correction.b0.v1.json and\nregistry/claims/fcc.b0.anticorrelation.v1.json rewritten to describe\ncontradicting evidence rather than licensed improvement.data/discovery_gates/licenses.v1.json gains a correction_gate deny\nfor B0.tools/check_assumption_links.py + assumption-links verify job:\nassurance-exported theorems must have @[requires(contract_id)],\npremises must have valid bundle references or explicit unsupported tags.tools/atlas_theorem_sync.py --compile-gates compiles locked\nClaimContracts into a provenance-bearing runtime gate manifest.python/tests/test_d1_migrations.py updated to expect the intentional\n0011_atlas_schema_reconciliation.sql reapplication guard.lake build green (3732 jobs). 115 focused B0/license/Round-3\nPython tests pass; 14 assumption-link tests pass; 56 evidence-formal bridge\ntests pass.t_64d423d6 atlas-sync contract compiler (EvidenceBundle\nresolution, duplicate gate-ID guard, premise-policy semantics), then run\nthe end-to-end QA replay (t_163d358b).tools/generate_assumptions.py to derive\nregistry/assumptions.v1.json and registry/snapshots/current.lock.json\nfrom the contracts/bundles.0011_claim_evidence_contracts.sql with append-only\nstatus_event and evidence_bundle_id FK so D1 status changes can be\ntied to receipts.0004_claims.sql so it applies cleanly on both\nfresh and production-shaped databases.tools/check_status_evidence.py +\n.github/workflows/anti-laundering.yml) that rejects status/assurance\nchanges unless a new EvidenceBundle hash appears.OpenDistillationFactory.UniversalCorrection.Empirical.Registry\n(172 theorem inventory entries across 17 active correction modules) plus\nActiveSampling.lean, SubspaceCorrectionScheme.lean, and\nUniversalCorrectionScheme.lean. Excluded quarantined\nAlloyResidualTransfer from the registry.lake build green (3675 jobs, 0 sorry). Python contract tests\n(40) pass, tools/generate_assumptions.py --check passes, and the\nanti-laundering checker accepts/rejects as expected.t_9d49164c,\nt_223ee397, t_64d423d6) and then run the end-to-end QA integration test\n(t_163d358b) to prove Round-3 propagates with zero manual touches.Evidence Index and Evidence Index Nightly workflows were exceeding\nthe GitHub runner disk quota because sentence-transformers pulled the\nfull CUDA torch distribution; and the Verify diff-whitespace check was\nfailing on generated LAMMPS log files inside data/lammps_validation/**/work/.torch install step to\n.github/workflows/evidence-index.yml and\n.github/workflows/evidence-nightly.yml before pip install -e ., so\nsentence-transformers reuses the CPU wheel instead of downloading\nseveral gigabytes of NVIDIA CUDA packages.data/lammps_validation/**/work/ to .gitignore so generated\nLAMMPS run artifacts (which contain trailing whitespace by design) are\nexcluded from the diff-hygiene gate.wip/statics-discovery-gates still needs its\ncommitted work/ directory removed and rebased to pick up the .gitignore\nchange.data/lammps_validation/2026-07-13-ni-eam-elastic/work/\ndirectory from wip/statics-discovery-gates and re-run Verify.Validation/NonCO2ClimateConcerns.lean (9 theorems, T259–T267):\nan inductive EnvironmentalConcern for the six non-CO₂ concerns;\nper-concern strings for mechanism, governing theory, correction path, and\ndata status; linkage back to ClimatePortfolio.MaterialClass for the\nfive concerns that map to the existing portfolio; and invariant witnesses\nthat restate existing theorems from SorptionStability,\nBarrierArrhenius, RankingIntegrity, ScalingVolcano, and\nDefectStability.Vision.lean with #check locks and bumped the\ntheorem-inventory count from 262 to 271.lake build green (3665 jobs, 0 sorry). Python unit tests\n(67) and Rust check pass. The status board now prints 271 formally proven\ntheorems.layoutReadyPending concerns\ninto bound portfolio witnesses.AnchoredField.lean claims in prose that the clamped\nstep field is "the conservative envelope of the measured data … with no\nextrapolation freedom" — but no theorem said what the anchors actually\ndetermine about the unknown true field, when a corrected value or\nranking may be trusted (the promotion gate's core operation), or\nwhether the 49 kernel refusals rule out only our step constructor or\nevery softening field.Theory/AnchorBracket.lean (54 theorems, T197–T250): existence ↔\nadmissibility iffs per layout with scaled-integer bridges (refusal\ncompleteness — a refused cell is consistent with no ErrorField\nat all); the one-scalar reduction — on in-range configurations any\nconsistent field's sum is the step-field sum plus\ncount_gap · (P(gap) − p_lo) with P(gap) forced into the neighboring\nanchor interval (fcc gap c = 10, bcc c = 5, diamond and rocksalt none); deep/shallow\nenvelope extremality; certified correction brackets\n(E_ref ≤ corrected ≤ E_ref + count·width; diamond: exact recovery even\nat the measured tier); the two-point certification test — corrected\norder holds for every consistent field iff it holds at the two\nenvelope fields — plus the interval-separation margin rule;\ncertified Arrhenius rate caps (exp(width/kT) factor bounds via the\nexact amplification identity); honest non-identifiability (below the\nlowest anchor every value v ≤ p_lo is realized, and at the measured\ntier even the gap is free — the tier-2 axioms are what buy finite\nbrackets); and FieldDomain → InRange glue making explicit that the\ndefault [4, 12] runtime domain does not discharge the fcc bracket\nprecondition (needs cmin ≥ 8).Validation/AnchorBracketCertificates.lean (8 theorems, T251–T258):\ncorpus-bound certificates — impossibility for the flagship refusals\n(composed through the generated field_refused_* theorems, so corpus\nregeneration desync breaks the build), gap/width certificates\n(chgnet/Ni 537×10⁻⁴ eV/atom, chgnet/Fe 256×10⁻⁴), the cross-model\ncomparison (on Ni, mace-mp-medium's bracket is provably more than 6×\ntighter than chgnet's), and chgnet/Si exactness over any consistent\nmeasured field.lupine_distill.odf.field_certificates): every\nAnchorCertificate now carries the identification payload\n(gap_coordination, bracket_width_scaled, identification_ref), and\ncheck_bracket_separation mirrors the separation rule (strict\ninequality, budget on the higher candidate only, float-boundary and\nuniform-bias caveats documented). 12 new mirror tests pin the semantics\non the same corpus witnesses the Lean locks use.Vision.lean: T197–T258 checks, four corpus width #guard locks,\ntheorem count → 262 (merged atop the climate-portfolio push).lake build green at 3663 jobs, zero sorry, zero new\naxioms (flagships checked: propext/Classical.choice/Quot.sound\nonly); 35/35 field-certificate mirror tests pass; evidence manifest check\ngreen. An independent adversarial audit (vacuity, inequality directions,\nboundary strictness, cast traps, prose-vs-formal, corpus numerals)\nreturned "survives with fixes"; all findings fixed — notably the flagship\ndiamond certificate was strengthened from a degenerate self-instantiation\nto quantification over any consistent measured field.bracket_width_scaled inside the promotion\ngate's ranking path so cross-model cell preference (e.g. Ni) is applied,\nnot just certified.Validation/ClimatePortfolio.lean: an inductive MaterialClass for\nthe five targets (cobalt-free LMR cathodes, halide solid electrolytes,\nMOF DAC sorbents, electrochemical ammonia catalysts, lead-free perovskites);\nper-class strings for governing theory, uMLIP failure mode, and correction\npath; decidable portfolio-envelope certificates; rocksalt-layout-existence\nand halide-unbound-pending-defect-runs certificates; and per-class\nscreening invariants restated as witnesses backed by existing theorems in\nRankingIntegrity, BarrierArrhenius, SorptionStability,\nScalingVolcano, and DefectStability.ClimatePortfolio into Vision.lean with #check locks and bumped\nthe theorem-inventory count from 190 to 200.lake build green (3,662 jobs, 0 sorry). Python unit tests\n(55) all pass. The status board now prints 200 formally proven theorems.ClimatePortfolio with measured-field witnesses for the halide\n electrolyte class.ClimateSeries validation pack\nand the rocksalt/halide family. Only the anchor-admissibility gate was\nactually reaching production: check_field_domain, check_ranking_pair, and\nBarrierArrhenius.softened_barrier_underestimates were tested but never\ncalled by the runtime policy engine or promotion gate. Meanwhile the\nrocksalt cells were recorded as unbound_structures rather than having an\nexplicit layout ready for charge-balanced slab/defect data.Theory/AnchoredField.lean: added the rocksalt/halide layout —\nstepFieldRocksalt (single c=5 anchor, bulk pin at c=6),\nmkAnchoredFieldRocksalt : ErrorField 6, mkMeasuredFieldRocksalt, and\ndecidable scaledAnchorRocksaltValid — plus the evaluation theorems\n(_at_vacancy, _at_bulk, _clamped_below, _toMeasuredField,\nscaledAnchorRocksaltValid_example). The layout is ready for MgO/NaCl and\nthe Li–M–Cl halide electrolytes once their slab/defect observables are\nmeasured. Zero sorry, zero new axioms.lupine_distill.odf.field_certificates: added BarrierCertificate and\ncheck_barrier_conservatism, mirroring\nBarrierArrhenius.softened_barrier_underestimates and\nsoftening_never_hides_conductor; added rocksalt to\nANCHOR_COORDINATIONS / _ANCHOR_REF_KEYS and the corresponding theorem\nrefs.lupine_distill.odf.climate_series (new): Python mirror of\nValidation.ClimateSeries with typed certificates for all 10 headline\nclaims (synthesis funnel, A-Lab novelty, kernel-rejected zero margin,\ncorrected strict improvement, blind residuals, Ni/Cu error reductions,\nportfolio envelope, inventory floor), theorem refs, and pass/fail checks.\nInventory-floor defaults and the Lean proof_pack_inventory_floor theorem\nupdated to the current build state: 51 modules, 190 build-locked theorems,\n~640 declarations, zero sorry.lupine_distill_runtime.policy_engine: _domain_action now calls\ncheck_field_domain when a prediction or context carries\nfirst_shell_coordinations; out-of-domain atoms trigger a\nskip_correction action backed by FieldDomain.refusal_has_witness and\nstrip the support model before any correction is applied.lupine_distill.odf.promotion_gate: added reference_ranking and\nmodel_ranking metadata fields; evaluate now checks every adjacent pair\nwith check_ranking_pair. A machine-checked inversion downgrades\npromote → review or review → reject, because no monotone\nrecalibration can rescue it.python/scripts/bind_env_field_instances.py: generalized _bind_cell to\nhandle layouts with no facets and optional vacancy blocks; cells missing\nall bindable observables are skipped with a warning instead of crashing.\nAdded the rocksalt layout (MgO, NaCl, LiCl, Li3YCl6, Li2ZrCl6) and moved\nlayered oxides to unbound_structures with a clear data requirement.\nRegenerated EnvFieldInstances.lean and env_field_binding_report.json;\ncorpus remains 68 cells → 19 instances + 49 refusals, now with a\nrocksalt structure entry at 0 cells.python/tests/test_climate_series.py,\npython/tests/test_bind_env_field_instances.py, rocksalt/barrier/ranking\ntests in test_field_certificates.py, and domain-gate tests in\ntest_certificate_gate.py.lake build green (3,661 jobs, 0 sorry). Python test suite\nnow contains 55 tests, all passing. The field-domain gate, ranking\ngate, and barrier-conservatism certificate are now wired into production\npaths. Rocksalt layout exists but cannot bind until charge-balanced slab +\nvacancy runs are added; the binder documents this explicitly rather than\nfailing silently.ranking_inverted and field_domain skip events in the\n Phoenix flywheel dashboards; expose climate_series certificates in the\n promotion packet renderer and website article footnotes.Theory/AnchoredField.lean: the diamond layout — stepFieldDiamond\n(single vacancy anchor: each diamond vacancy exposes 4 first-shell atoms\nat c=3, bulk pin at the diamond coordination c=4),\nmkAnchoredFieldDiamond : ErrorField 4 / mkMeasuredFieldDiamond, and\nthe decidable scaledAnchorDiamondValid — 9 new theorems (T182–T190),\nzero sorry, zero new axioms. One anchor is enough for both tiers: the\nmeasured tier unconditionally, the directional tier iff p3 ≤ 0.bind_env_field_instances.py generalized to variable-anchor layouts\n(targets now also read beyond_metals.json) and bound the 4 Si diamond\ncells. Corpus: 68 cells → 19 instances + 49 refusals.CertificateGate +\nCertificateGatedPolicyEngine in lupine_distill_runtime.policy_engine\nindex the binding report's refusals (via the shared\ncertificates_from_binding_report mirror in\nlupine_distill.odf.field_certificates) and decide refused cells\nWITHOUT the support model — the correction is never applied, not\napplied-then-flagged. Decisions carry a skip_correction action naming\nthe refusal theorem, exact scaled anchors, and corpus hash;\nDistillSession wires the gate by default ("auto": repo report when\npresent), surfaces it in the runtime summary, and the cell runner\nexposes --env-field-report / MLIP_DISTILL_ENV_FIELD_REPORT. The\nfinite/explosion guards still run on gated cells, and the prediction\nitself is not refused — only its correction is withheld.sorry, lake build green. Gate behavior pinned\nby tests: chgnet/Pt (fcc) and chgnet/Ta (bcc) predictions pass through\nuncorrected with the Lean refusal in the decision record; chgnet/Ni still\ncorrects; unbound models are untouched. Notable negative result: the\nrocksalt cells (MgO, NaCl) measure no anchor observables — their statics\nruns carry only EOS + lattice results — so no rocksalt layout is possible\nfrom the existing corpus; the binder now records this as\nunbound_structures in the report instead of silently skipping them.skip_correction events in the Phoenix flywheel dashboards alongside the\npromotion-packet certificate spans.tools/mlip_local_promotion.py → Phoenix).Theory/AnchoredField.lean: the bcc layout — stepFieldBcc (clamped\nstep interpolation of γ₁₀₀ → c=4, γ₁₁₀ → c=6, E_vac → c=7, bulk pin at\nthe bcc first-shell coordination c=8, the unanchored c=5 gap held at the\ndeeper (100) value, exactly as the fcc field holds c=10),\nmkAnchoredFieldBcc : ErrorField 8 / mkMeasuredFieldBcc : MeasuredField 8, and the decidable scaledAnchorsBccValid predicate —\n11 new theorems (T171–T181), zero sorry, zero new axioms.python/scripts/bind_env_field_instances.py: generalized over structure\nlayouts (per-atom facet areas: fcc a₀²/2 and √3a₀²/4; bcc a₀² and\na₀²/√2; vacancy shells 12 vs 8) and extended to the 28 bcc cells; report\nschema bumped to lupine.env_field_binding_report.v2 (per-structure\nlayout + counts, nested anchors). Fcc literals verified byte-identical\nacross the refactor.lupine_distill.odf.field_certificates: check_anchor_admissibility\ntakes a structure argument, mirrors scaledAnchorsBccValid for bcc\ncells, and stamps certificates with structure + anchor coordinations;\nthree new theorem refs (mkAnchoredFieldBcc, mkMeasuredFieldBcc,\nscaledAnchorsBccValid) resolve-checked against the Lean sources.tools/mlip_local_promotion.py loads the binding\nreport, re-checks every bound cell of the run's models through the Lean\nmirror, merges the certificates into the ODF gate's candidate metadata\n(they satisfy the formal-spec requirement without manual\n--atlas-theorem-refs flags), and carries a field_certificates block\nin the packet; tools/mlip_phoenix_trace.py emits it as\nmlip.field_certificate child spans (per-cell tier, exact scaled\nanchors, refusal witnesses, theorem ref) plus root-span rollups.\nNew tests: tools/test_mlip_local_promotion.py,\ntools/test_mlip_phoenix_trace.py (restores the justfile\nflywheel-telemetry-check target lost in the 2026-07-01 cleanup), both\nadded to the CI tools-smoke job.sorry.\nEnd-to-end smoke: a chgnet promotion packet now carries 16 per-cell\ncertificates (10 tier-2, 6 refusals) into its Phoenix spans, and the ODF\ngate promotes on certificate-backed formal fields alone.Theory/AnchoredField.lean: the measurement bridge — clamped step\ninterpolation of the three fcc anchors (γ₁₀₀ → c=8, γ₁₁₁ → c=9,\nE_vac → c=11, bulk pin c=12) with generic monotonicity/softening proofs,\nso per-cell instances are one-liners with norm_num side goals; plus the\ndecidable scaledAnchorsValid admissibility predicate for kernel-checked\nrefusals.MeasuredField (bulk pin only — closure, bulk-invariance, transfer, and\nnew measured-tier ranking-recovery laws) vs ErrorField (softening +\nmonotone — the directional barrier laws). Non-monotone cells (Ca/Sr\nanchor anomalies; MACE stiffening/noise-floor cells) keep certified\ncorrection semantics while the directional layer provably refuses them.python/scripts/bind_env_field_instances.py: binds the 36 fcc Y-matrix\ncells (model-relaxed geometry + DFT-PBE targets) into per-atom anchors\n(Δγ · area-per-atom; ΔE_vac/12), emits\nDistillAtlas/EnvFieldInstances.lean (36 MeasuredField instances, 8\nErrorField instances, 28 refusal theorems, all provenance-stamped,\ncorpus sha256 1f244b71846b) and a telemetry report\n(data/y_matrix_runs/env_field_binding_report.json).python/lupine_distill/odf/field_certificates.py: the promotion-gate\nsurface — domain-gate admits/refusals with witness atoms, anchor\nadmissibility tiers, ranking-inversion impossibility certificates, each\nnaming its lean-spec theorem; merge_into_candidate_metadata feeds them\ninto promotion_gate.evaluate_promotion so decisions and telemetry carry\nmachine-checkable provenance. Tests\n(python/tests/test_field_certificates.py, 17 passing) pin the Python\npredicates to the same witness values the Lean modules lock and verify\nevery theorem reference resolves in the Lean sources.lake build green at 3661 jobs; 170 build-locked theorems,\n376 theorem declarations in Materials/, 0 sorry. Of 36 bound cells, 8\nexhibit monotone softening end-to-end (six chgnet cells — Ag, Al, Au, Cu,\nNi, Pd — plus Ni and Pt on mace-mp-medium); 28 carry kernel-checked tier-2\nrefusals — consistent with the proof pack's own account of noise-floor\nMACE-MPA-0 cells. Notable negative result: Ca and Sr break anchor\nmonotonicity for every model (DFT γ₁₁₁ ≈ γ₁₀₀ for these soft alkaline\nearths), a genuine limit of the smooth-decay idealization now recorded as\nrefusal certificates rather than silent misfits.field_certificates outputs into the live flywheel\n(tools/mlip_local_promotion.py telemetry spans), and extend the binder\nbeyond fcc — the bcc anchor set ((100) → c=4, (110) → c=6, vacancy → c=7,\nbulk 8) needs its own stepField layout and admissibility predicate.lean-spec\n(Theory/EnvironmentField, Theory/BarrierArrhenius,\nTheory/RankingIntegrity, Theory/ScalingVolcano,\nTheory/DefectStability, Theory/SorptionStability,\nValidation/ClimateSeries), 73 new theorems, all wired into the\nVision.lean build locks (T78–T150) with six new #guard contracts.\nHighlights: the environment error field's seven structural laws (softening,\nbulk invariance, closure, family transfer, dominance, boundedness,\nzero-parameter blind continuation); the mechanism theorem\n(under-coordinated transition states ⇒ provably underestimated barriers);\nexact Arrhenius amplification identities with kernel-checked\nroom-temperature brackets (100 meV ⇒ 32–64× rate error; 180 meV ⇒ >10³×\nconductivity error, riding Mathlib's log 2 decimal bounds); the\nmonotonicity impossibility lemma with a concrete cathode inversion witness;\nSabatier-volcano laws including non-monotonicity of activity in the\ndescriptor and breaker-flag soundness; the decidable metastability window\nhull-only screening provably misses; competitive-Langmuir humidity laws;\nand the first-shell domain gate with witnessed refusals.lake build green at 3659 jobs, 150 build-locked theorems,\n257 theorem declarations in Materials/, 0 sorry, 0 new axioms. The\nproof pack's quantitative claims (0.2% funnel, A-Lab novelty collapse, the\nkernel-rejected 27→26 episode, blind-prediction improvements, portfolio\nenvelope) are now decidable certificates in\nValidation/ClimateSeries.lean.ErrorField instances (the generated-evidence rung L2), so\ncorrected_recovers_reference_order and the barrier theorems certify each\n(model, material) cell's screening output; then surface the domain-gate and\nimpossibility certificates through promotion_gate.py so refusals carry\ntheir Lean witness into runner telemetry.docs/**, root *.md), the\npublished Library sourced from the deployed lupine-ledger repo (with a\npending-vs-deployed publication-drift record), live-site llms.txt guides,\nand agent-run traces pulled back from Phoenix telemetry — one index spanning\nwhat agents did, what the program believes, and what we published.eval_retrieval.py).\nA/B'd embedders and adopted bge-small-en-v1.5 (384-dim); replaced SQL-LIKE\nkeyword search with FTS5/BM25; added hybrid (BM25+vector RRF) as the default\nmode. Activated the vec0 KNN sidecar that existed in code but was never built.evidence-index service to the same\nbge-small model so the offline and live tiers share one embedding space.cocoindex/** change; a nightly\nworkflow that refreshes all sources, rebuilds, and publishes retrieval\nmetrics + publication drift as tracked signals.EvidenceChunk metadata column so\n--kind claim --status refuted is a query). Edge-tier Vectorize memory is\nspecced and deferred (docs/rfc-evidence-edge-memory.md); the GCP redeploy to\nbge-small requires the re-embed backfill in gcp/evidence-index/DEPLOY.md.atlas-view@0.3.0: mobile-first controls,\nlarger touch targets, TanStack Query saved-view caching, improved social\nshare metadata, picnic/cinematic sharing, first-class Lupi Studio 360 world\nbackgrounds, background grading controls, and optimized environment media.lupine.science, lupi.live, library.lupine.science, and the remaining\nscience/control-plane repo.scripts/export_library_content.mjs and generated the first\nexports/library-content/latest bundle for the Library extraction path.exports/ in the root ownership ledger so generated public\nartifacts have an explicit owner.pnpm audit:nomenclature: 55 gallery entries, 24 nomenclature records, 0\nerrors, 8 non-blocking provenance warnings for older procedural/synthetic\nexamples.pnpm --filter @atlas/ui test -- src/backgroundPresets.test.ts src/store.test.ts src/gallery-data.test.ts: 44 tests passed.pnpm --filter @atlas/ui build: passed.pnpm --filter @atlas/web build: passed and generated 8 static SEO routes.pnpm verify:gallery --no-screenshot: 20/20 checks passed, including real\ndataset load.pnpm verify:controls --no-screenshot: desktop controls smoke passed.pnpm verify:controls:mobile --no-screenshot: mobile controls smoke\npassed.VERIFY_URL=http://127.0.0.1:5174/#/mcp pnpm verify:mcp-bridge: passed\nagainst the built web output served locally.npm --prefix library-site run build: built 55 articles.lean-spec lake build (2891 jobs, 77 build-locked theorems in Vision.lean, 0 sorry, 0 new axioms).paper2/projection-law.pdf, paper2/immi/projection-law-immi.pdf) and submission bundles.docs/reviews/academic-review-projection-law-2026-06-16.md and surfaced it as a first-class article on library.lupine.science via library-site/scripts/catalog.js.library-site/src/assets/papers/ and updated working-papers.html to serve them from the site instead of a stale GCS URL.paper2/cover-letter.md, replication/error-geometry/.zenodo.json, and updated ZENODO_DEPOSIT.md.paper2/python quality_gate.py --lean passes.git diff --check clean./#/read/academic-review-projection-law.TARGETING.md and incorporate any findings.lupine.science marketing page (source not in this repo) to point to the new versioned PDF.pnpm verify:controls, that starts Vite on a\nfree local port, loads a real C60 molecule, checks all four control tabs, validates there is\nonly one close affordance per embedded panel, and exercises resize plus collapse/expand.pnpm --filter @atlas/web build.pnpm verify:controls -- --no-screenshot.https://lupi.live\nagainst the same controls harness via VERIFY_URL.distiller/, lupine-distill/, atlas-distill/) and a maze of docs that made it hard for new developers and research scientists to find the right entry point. The one-root-one-owner rule was being violated, and stale paths were still referenced by active code.atlas-distill/ is the single Rust engine, python/ is the single home for active Python packages, and retired material moved to archive/ (distiller-kb/, lupine-distill-rust/, lupine-dspy/, tools-retired/).python/.docs/ONBOARDING.md, docs/ARCHITECTURE.md, docs/GLOSSARY.md, docs/FAQ.md, CONTRIBUTING.md, docs/HANDBOOK.md, and per-root READMEs for python/, gcp/, data/, atlas/, mlip_immi/, lean-spec/, glim-think/, library-site/, paper/, and tools/.scripts/bootstrap.ps1 / bootstrap.sh, extended the justfile with verify, bootstrap, bootstrap-heavy, and docs-serve recipes, and created GitHub issue/PR templates..github/workflows/verify.yml (Python unit tests, Rust check, tools smoke, diff hygiene) and hardened python/pyproject.toml with realistic dependency extras matching the MLIP backend images.docs/ for stale/provisional files and added honest banners with redirects to current sources.just verify passes locally: Python unit tests (92 passed), Rust check, tools smoke tests (18 passed, 4 skipped), and git diff --check clean.cargo test --manifest-path atlas-distill/Cargo.toml --bin atlas-distill passes (100 tests).lupine-distill / distiller references in historical docs.lean-spec first-build cost is acceptable.mlip_immi/ logic into python/lupine_distill/ with tests.lupine-system-architecture skill + docs/science/objects.md.RibbonProjection.lean) — withdrawn. That\nmodule is a generic scalar operative-value lemma (the same parabola already in\nContextSpecificProof), not a formalization of the hyper-ribbon (model manifold), the\nparticipation-ratio measure, or the keystone configuration-space core. Its docstring is\ncorrected to say so; it does not "generalise the ribbon."broad_commitment_is_open is TRUE under per-backend policy selection" — bounded to\nnear-meaningless. That campaign measured energy-MAE on MPtrj DFT rows, a different lane\nfrom the OpenKIM/NIST elastic-constant corpus the ribbon is built on; the distill "win" is an\nenergy-block recalibration that leaves forces/stress/elastic unchanged, so it does not\nimprove the potential for any force-driven use. Not a model improvement. See the banner on\ndocs/glim-m3-upgrade/runs/live-campaign-results.md.docs/science/keystone-reconciliation.md): the repo's PR-of-error-covariance is the standard\nsloppy-model effective-dimensionality measure, not an elementary mistake.docs/navigation.md, docs/science/objects.md, ADR-0002); and\nthe reusable analysis tools (they were just pointed at the wrong data).docs/science/keystone-reconciliation.md), plus the first direct empirical test of the paper's\nload-bearing assumption A6 ("common-spatial-mode separability") — tools/a6_alignment_test.py,\nrun on the force-error field (3 MLIPs × 5 shared structures = 107 atoms, 5000 stratified\npermutations), with three statistics vs a within-structure permutation null.manifold.rs:43-112, 3×3 over C11/C12/C44) and calls it a low-dimensional "error manifold." The\npaper's theorem is about a configuration-space core H ⊂ ℝᵐ; its error boundary is dimension\nm−1, not low; and a measure-theoretic concentration must not be called a manifold. The\nbridge between the two (A6) was assumed, never stated — including in my own\nRibbonProjection.lean, which formalizes the wrong (toy) object. (2) A6 has real but\nconditional support. All three MLIPs concentrate force error on the same atoms\n(mag_corr 0.70–0.86, p≤0.0002, well above the stratified null ~0.34) and err in correlated\ndirections (atom_cos 0.2–0.3, sig) — first force-level evidence for shared structure. But it's\nheterogeneous: CHGNet is a partial outlier (whole-field alignment with MACE n.s., p=0.09),\nindependently echoing that CHGNet is the backend distill regressed. So it's the paper's\nperturbative/conditional regime, not the unrestricted ribbon claim.δ_M (CHGNet largest); and formalize the\npaper's actual exact_tubular_universality skeleton (reach + 1-D monotonicity) instead of the\nRibbonProjection toy.broad_commitment_is_open.shed-489901 L4 jobs (mlip-cell-{mace,chgnet,sevennet}),\n3 tiers × 3 backends × {energy_volume, forces}, plus global-tuned and per-backend-tuned\nre-runs. Scored by tools/mlip_sim_matrix.py (Lean cellValue). Surfaced + fixed a real\nbug (runner wants catalog id mace-mp-0, not mace). Cost ≈ $2. Full table:\ndocs/glim-m3-upgrade/runs/live-campaign-results.md.maceEnergyDistill to 4 decimals, same\npolicy hash. The harness is faithful. (2) Distill is energy-only: on forces the\ncorrection changes the error by 0.0% for all three backends — an exact confirmation of\nthe pre-registered local-Opus hypothesis T4-H2 (energy/mechanical orthogonality).\n(3) Distill is policy-gated, not automatic: a generic policy regresses the\nalready-accurate CHGNet (0.1035 → 0.1429, −38%); the global tuned policy still regresses it\n(−28%); but CHGNet's own signed-orientation policy flips it to +6.1% (0.0971).\nNet: distill beats baseline on all three backends iff each uses its own policy — TRUE\nunder per-backend selection, FALSE under any single global policy.lean-spec/.../Theory/RibbonProjection.lean. Rather than encode the campaign as per-backend\ncases (the exception handling we explicitly avoid), it proves all three findings as corollaries\nof one model-independent geometry: error = ribbon-parallel par ⟂ orthogonal orth, a scalar\ncorrection κ acts only on par, and ribbonGain = κ·(2·par − κ) (the orthogonal sector\ncancels). Corollaries: orthogonal_error_gain_nonpos (energy-only / forces 0%),\nribbonGain_neg_of_antialigned (CHGNet regression = misaligned κ, same parabola — no model\naxiom), ribbonGain_strictly_valuable (MACE/SevenNet), and the capstone\nbroad_value_no_model_exception (two backends, same par, aligned κ ⇒ equal positive gain).\nAll proofs are ring/nlinarith over arbitrary reals; algebraic identities independently\nverified in sympy (all green) and the module is kernel-verified locally — lake build\ngreen, 0 sorry, after fetching the Mathlib cache. A second live result sharpened "energy-only"\nto "support-set-only": a stress-targeted policy also left stress ≈ unchanged, and the\nelastic_constants distill cell refused (requires ≥6 cases; found 0) — the correction can\nonly move a property the support manifold covers, exactly RibbonProjection's\northogonal-sector law. Open: accelerate speed axis on elastic_constants with the\nelastic-covering train-plus-elastic-v1 support (re-running).api.minimax.io/v1\nroute. But a model swap is only trustworthy if the quality lift is measured against a fixed\nresearch target, not assumed. The worker could pin a provider but not a specific MiniMax model,\nso M2.7-vs-M3 was not even expressible.selectDeepRoute({modelOverride}) →\ngenerateResearchText({modelOverride}) → miniMaxModel(env, id); /ops/experiment-generate\naccepts body.model; ab-oracle.ts --axis model. Default flips to MiniMax-M3 with\nMINIMAX_BASELINE_MODEL = "MiniMax-M2.7" kept as the canonical A/B baseline (rollback = a\nMINIMAX_MODEL secret change, no redeploy). (2) Pinned the ribbon target theorem set\n(T1 hyper_ribbon_bound_3d, T2 empirical_hyper_ribbon_holds, T3 ParameterBound, T4\nbroad_commitment_is_open, the cellValue bridge) and a per-theorem research strategy.\n(3) Built the eval harness: glim-ribbon-theorems dataset + tools/glim_model_eval.py\n(generate→compare→report, mirrors ab-oracle's adopt/reject) with a local-Opus rubric.\n(4) Configured the 3-tier Cloud-Run sim matrix (policies/model-sim-matrix.yml +\ntools/mlip_sim_matrix.py) — baseline / distill-accuracy / distill-accuracy+speed, cost-bounded\nand cellValue-scored. Full process in docs/glim-m3-upgrade/.lint:fast clean. The local Opus agent,\nrun for real, generated rigorous competing hypotheses for T1/T3/T4 and — judging blind — scored\nthem 10/10 against a deliberately weak fixture at 0/10 (rubric discriminates). The sim driver,\nscored on the committed MACE-energy artifacts, returns cellValue 1.238 for distill_accuracy\n(50.5% MAE cut, speedup 1.025) and reproduces the AccuracyCommitment.lean constants from the raw\nartifact. No M2.7/M3 generation numbers were fabricated (this checkout has no MiniMax key).INTERNAL_TASK_TOKEN + a live key, run the M2.7→M3 generation and let the same\nlocal-Opus judge emit the real verdict. (2) Launch the canary sim matrix on Cu_fcc/Si_diamond/\nFe_bcc to test the T4 "where does distill fail?" hypotheses and bound broad_commitment_is_open.atlas_theorems from the\nphysics, not by hand.python/scripts/neural_symbolic/):\nNode 1 pits MACE-MP-0 vs CHGNet on a pure-shear C44 strain sweep of FCC Ni (the curvature\nobservable) on the A4500; Node 2 relays T3-REJECT breaches as OpenInference spans (the Python\nflywheel pattern — entirely off the glim-think tsc path; live OTLP when PHOENIX_OTLP_RELAY_URL\nis set, durable local artifact otherwise); Node 3 authors import-free core-Lean theorems\n(by decide, 0 sorry) encoding the empirical failure as a verified negative constraint, plus an\natlas_theorems seed.mace_mp_0_curvature_reject : 323*4 > 1247 := by decide and independently verified by a fresh\nlean compile (rc 0, 0 sorry). 4 theorems synthesized, 4 atlas_theorems seed rows\n(status='verified'). Report: docs/neural-symbolic-curvature-loop.md.glim-ledger D1.python/scripts/run_ni_gpu_loop.py — the GPU runner the Track B stub\ndefers to. It benchmarks MACE-MP-0 on the sealed Ni FCC EAM fixture via TorchSim, fits the\nzero-point distill correction on the non-overlapping support set, computes real elastic\nconstants + distill_v_uplift, and drives the ATLAS formal gate. Also filled\nTorchSimBenchmarkBackend.run() for real (70 Track-B tests still green; CI-safe without torch_sim).distill_v_uplift 76.0% — independently reproducing the cloud material-family\nresult. Real elastic constants: MACE-MP-0 C11=262.9 (+6.7%), C12=166.6 (+13%), C44=92.4\n(−26%) GPa vs literature (the EAM-reference recovery returned 246.5/147.3/124.7 exactly,\nvalidating the fit). Formal gate, full range on real numbers: in-support certified →\nPROMOTE; out-of-support (the proved T3 negative-transfer regime) → REVIEW;\nmarginal+uncertified → REJECT. The formal layer demonstrably gates real GPU compute.\nReport: docs/mlip-gpu-ni-distill-formal-gate.md.atlas_theorems + emit lupine.proof.status spans so this gate\ndecision flows into Phoenix.torch-sim.\nThe ATLAS_Lean_Integration_Review laid out a 7-phase plan to (a) put lean-spec on a shared,\nreproducible Mathlib by pinning to ATLAS's revision, (b) make the MLIP benchmark/distill loop\nmeasurable, and (c) thread formal foundations through glim-think, Phoenix, the ODF promotion\ngate, and dspy.v4.29.0 and Mathlib to 8a178386…,\nadded facebookresearch/atlas-lean as a Lake dependency at c5a10f1a. Added 6 ATLAS-backed\ntheorems (Jacobian rank ≤ P / ≤ N / ≤ min(P,N) — the formal core of the Parameter-Bound\nconjecture — plus ℝ-level hyper-ribbon corollaries) to Analysis.Manifold and\nTheory.ParameterBound.TorchSimBenchmarkBackend (lazy import + Mock fallback), the\n8-benchmark suite, the canonical BenchmarkResult/BenchmarkMetrics schema, and the\ndistill_v_uplift calculator with promote/review/reject gates; 70 tests.pyproject.toml + matrixed Dockerfile/cloudbuild, scheduled-run policies, and an OpenInference\npatcher + loop connector; legacy files retained with a DECOMMISSION.md map.atlas_theorems D1 migration (0010), per-facet ATLAS context loader,\nOpenInference span-kind + ATLAS-attribute telemetry helpers, and three Phoenix eval runners.TheoremGuidedHypothesis dspy signature +\nformal-provenance persistence migration; 40 tests.lake build green (1502 jobs, 96 theorems, zero sorry) under the\naligned/downgraded Mathlib — every existing proof survived the pin. 110 Python tests pass across\nB/E (independently re-run). Key finding: ATLAS's autoformalized modules elaborate at ~7–9 min\neach; importing a whole subject (Atlas.RealAnalysis, ~85 modules) is ≈80 min and twice\nexhausted the dev machine's memory. ATLAS does compile cleanly in-workspace (71/85 modules built\nwith zero errors before a reset), so the dependency is wired and viable — but whole-subject imports\nare cost-prohibitive, so the new theorems build on the shared cached Mathlib that ATLAS pins to.0010 to the LEDGER D1 and seed real theorem rows from lean-spec.\n(3) Wire distill_v_uplift into the ODF promotion gate on a real model pair. (4) Resolve the ORB\ncu118 / UMA numpy-2 stack split flagged in the GCP DECOMMISSION.md before deleting legacy reqs./immi_paper.pdf is in fact The Causal Geometry of Prediction Errors\nin Interatomic Potentials (Welcing, Lupine Science). Corrected the\nhome.preprint.* strings (EN + ZH) in i18n.js to the real title/abstract; the link was\nalways correct.paper-build.yml proved a gap: a push made with a\nworkflow's GITHUB_TOKEN does not trigger other workflows (GitHub's recursion\nguard), so the rebuilt PDF landed on main but deploy-library-site never fired —\nit needed a manual nudge.actions: write permission and an explicit\ngh workflow run deploy-library-site.yml --ref main after the push (skipped on the\nbyte-identical no-op path).gh workflow run paper-build.yml is now genuinely one command:\ncompile → quality gate → commit → deploy. Verified the first run's PDF live (fresh\nrecompile from the newer .tex; abstract now carries the foundation-MLIP transfer\nresult; 0 raw-LaTeX leaks)..github/workflows/paper-build.yml, workflow_dispatch only\n(never on push). Run it with gh workflow run paper-build.yml. It compiles\npaper/immi-paper.tex with the committed figures (optional regenerate_figures\ninput), enforces a quality gate that fails the run if the PDF text layer leaks\nraw LaTeX (\\textbf, \\noindent, $C_{) or mojibake or is < 5 pages — the exact\nimmi-paper-local class of bug — and, when deploy=true (default), commits the\nfresh PDF to main so the existing Library deploy publishes it. deploy=false\nbuilds an inspectable artifact only.atlas-distill\nJSON inputs are present in CI./immi_paper.pdf was the stale immi-paper-local.pdf build: the\nabstract contained raw, unrendered LaTeX (\\noindent\\textbf{Purpose:}, <!--MATH0-->,\n\\texttt{atlas-distill}) and mojibake separators — an unreadable artifact.pdftotext: the served file (1.92 MB, Apr 29) leaked LaTeX\nmarkup and replacement characters. paper/immi-paper-latest.pdf (1.14 MB, May 5) is\nthe correct render — 0 LaTeX leaks, 0 mojibake, full references [1]–[29], and current\nscience (includes the d-band sample-size-confounder result). No LaTeX engine in this\nenvironment to recompile the 1-day-newer .tex, so swapped in the clean -latest\nbuild as library-site/src/immi_paper.pdf.dist/immi_paper.pdf has 0 raw-LaTeX leaks.paper/immi-paper.tex via make in a LaTeX environment if the\none-day-newer source has changes worth shipping; wire the paper build into CI so a\nbroken local PDF can't be the served one again.margin:0 16px that\noverrode the column's margin:0 auto.<dialog> from\nindex.html, the force-graph <script>, the whole graph section in app.js\n(~150 lines incl. the CDN fallback), the SW precache entry, the build.js\nvendoring step, the graph CSS, and the graph i18n strings. Added real .status-filter\n/ .callout / .callout-box classes that use the same max-width:720px; margin:0 auto; padding:0 20px container as .shelf/.hero, and removed the conflicting\ninline margins; callout text now uses theme variables instead of hardcoded #fff./vendor/, no force-graph in the build; app.js\nsyntax-clean. The filter pills and both callouts now align flush with the shelves in\nevery theme.force-graph dependency from package.json\n(left in place now to keep npm ci lockfile-in-sync; needs a lockfile regen).references.bib) but a\nreader had nowhere to see the intellectual lineage — what we build on and why.docs/references.md: an annotated bibliography of all 35 works,\norganized by thread (sloppy-model theory → potentials → Simpson's/ecological fallacy →\nmeta-analysis → benchmark infra), each with citation, DOI, and a one-line why we cite\nit. Added a References & Lineage shelf and moved the existing literature review\ninto it so external papers live in one place.references.md in sync with paper/references.bib as the paper's\nbibliography grows.All · N chip plus one\ncolor-coded chip per status actually present in the corpus, each with a live count.\nClicking filters every shelf to that status (spanning shelves, not just Conjectures —\ne.g. proven surfaces the Formal Proof Ledger), hides empty shelves and blurbs, and\nAll restores. Pure client state, no manifest change.supported → 3, refuted → 2, self-corrected → 1, proven → 1,\nopen → 2, All → 46. The refutations are now one click from the front door.status and group as first-class catalog/manifest/reader axes with a\ncolored lifecycle badge (proposed / supported / open / refuted / self-corrected /\nproven). Authored Tier 1: a Conjectures & Proofs shelf (the hypothesis ledger +\n8 per-hypothesis entries, each Claim/Evidence/Confounder/Formal-cross-check/Next), a\nPartnerships shelf (MIIT-67 mapping under the public/gated convention), and a Formal\nProof Ledger mapping claims to Lean verdicts. Authored Tier 2: Data & Provenance,\nMethodology (matched-n / contamination-gating / ecological-fallacy), and Reproduce Our\nResults.library.lupine.science\nstill showed no content and a white-square graph. "Green build, stale site" is the most\ndeceptive deploy failure there is.run.app URL — both served the\nApril-28 build. gcloud run services describe showed the smoking gun: the library-site\nservice had traffic pinned 100% to revision library-site-00013-kfj. Every deploy\nsince (we were at 00027) created a healthy new revision that received 0% traffic.\nVerified 00027 served the correct build via a temporary verify traffic tag, then\nmigrated traffic with --to-latest (which also sets latestRevision: true, so future\ndeploys auto-route). Hardened cloudbuild.yaml with an explicit step 6\ngcloud run services update-traffic --to-latest so a re-pin can never silently hide a\ndeploy again.library.lupine.science now serves the new build live: 26 articles, 8\nshelves incl. Changelog & Progress, changelog.json 200, force-graph 200, SW\nKILL=k1. The graph code/CSS in the recovered source was never broken — the white\nsquare was the same stale revision. Service traffic config is now\n{latestRevision: true, percent: 100}.KILL token, so it\ncan't self-evict — only the new SW can). After that, the network-first + KILL design\nprevents recurrence. Then Phase 2.library.lupine.science showed "no content ever since the Chinese\nexperiment." Diagnosis: the server is not the problem — it returns 24 articles and\n200s. The break is a frozen Cloud Run image plus a cache-first service worker\nthat pins returning visitors to a stale/empty manifest forever, with no in-repo deploy\npath to ship a fix (the workflow was deleted with the source).app.js/i18n.js already fall back to EN safely\n(no logic bug to fix). Switched the service worker's /data/*.json from cache-first to\nnetwork-first (fresh content wins; cache is the offline fallback) and added a KILL\ntoken to the cache namespace so any future bad build self-evicts on activate. Recreated\nthe deploy as committed IaC: .github/workflows/deploy-library-site.yml driving the\nrecovered cloudbuild.yaml, which replaces the frozen image on the existing\nlibrary-site Cloud Run service.main.main to restore library.lupine.science; verify the SW takes over\nfor previously-bricked visitors; then Phase 2 (status/group facets + corpus-generated\nConjectures & Proofs / Partnerships shelves).library.lupine.science had been dark since a half-finished bilingual (EN/中文)\nexperiment; its source was deleted from the repo and the Cloud Run service was frozen on a\nstale, contentless build. The research corpus (reports, hypotheses, proofs, partnerships)\nhad no single public home and no changelog, so recent work — e.g. wiring Phoenix — was not\npointable-to.library-site/ static-site generator from git\n(54e61f3^). Rewrote the root README for external readers. Created this changelog in a\nwhy/what/results/next format. Deferred multi-language (keeping the {en, zh}-shaped\ncatalog so the door stays open) to focus on organization: category, group, and status\nas first-class axes so the Library is a place to think about the work, not just read it.status and group to catalog entries + build manifest + reader facets\nso hypotheses can be browsed by lifecycle stage. (2) Promote the hypothesis lifecycle and\npartnerships to public shelves generated from the corpus. (3) Fix i18n to fall back to EN\nsafely, then redeploy over the frozen service.glim-think produced no observability: the hourly evaluation\nworkflow and the Worker trace export were two disconnected halves, neither configured by\ndeploy automation, so 0/300 spans reached Phoenix Cloud. We could not measure whether the\nloop was actually improving hypotheses.glim-think to a\nsingle AI-SDK-native LLM path, deleting a dead second path that produced no spans.200. The Phoenix key was valid all along.deploy-otlp-relay.yml) so Worker spans\nreach Phoenix; then use the lifecycle-trace + scientific-throughput evals as the loop's\nfitness function.|pred| > 1500 / ≤ 0. Honest residual: a modest\nBCC > FCC tendency, no Cauchy relation. The real contribution is the B → C2 → C3′ → C4\nself-correction arc — the same matched-n method that refuted the d-band hypothesis.refuted (by us), with the confounder\nnamed.The Library froze on the 2026-04-28 build. ~355 commits landed before it was revived.\nThese are the arcs that matter, reconstructed so the corpus reflects current reality.\nNot every commit — the ones that changed what we believe or what the system can do.
\n/ops/experiment-generate (the Evolver activation prereq).\nClosed the eval→routing loop so model selection is eval-aware.refuted (by us) entries on the Conjectures & Proofs shelf\n(Phase 2), each with the confounder named. The self-correction method is the\ncontribution.glim-think had two LLM paths; the gateway one was dead (0/300 Phoenix spans),\nso half the telemetry was fiction and routing decisions were blind.ai.telemetry.functionId)..glimbin\nstreaming pipeline + cluster-splat LOD + device-tier atom caps; bond/shader polish (flat\n2-tone bonds, isotropic atom shader, killed light flicker/shimmer); rebuilt the gallery\nto a curated 18-entry set; added a pre-merge CI and a Playwright UI harness.Append at the top of the newest section. Keep Why/What/Results/Next. Prefer naming the\nconfounder, the null result, or the limit you hit — those are the entries that compound.\nThis file is wired into the Library catalog under the Changelog & Progress shelf.
\n"}