The recovery chart

Fatten the growth machine — moves multiply the modulus, depths monotone, still no decrement — and upgrade its tests from presence reads to three-way depth comparisons sign(α·v_p − β·v_q − γ). The purchase is quantized: nothing, then everything. All tests reading one comparison direction v₂ − v₃ (any offsets, presence reads elsewhere) leave the machine bisimilar to a one-counter machine: halting stays decidable. A second independent comparison — across three or more windows; disjoint pairs behave the same — is Minsky-complete: with X = v₂ − v₃, Y = v₃ − v₅, increments and two equality reads run a two-counter Minsky machine step-exactly — every move a multiplication, no depth ever lowered, halting transfers — so the door opens onto full universality, not merely an undecidable question. The borrow synthesis: no ladder is ever lowered, but on the derived counter v₂ − v₃ the move INC₃ is a value-reading down-move — two increments plus a comparison equal one destruction, at zero archimedean import. The mirror: exact-configuration reachability stays decidable (monotone runs to a fixed target are bounded) while halting goes undecidable.

Scope. The bisimulation and the step-exact simulation are run-verified; one-counter decidability and Minsky universality are cited. Depth beyond 1 means local rings, not residue fields — the door re-imports the depth axis the construction truncates. At exactly two places the linear route is closed (the cone lemma) and the nonlinear gadgets — gated rational multiplication, counters in a register's exponents — fail off the lattice by an exact affine debris; whether that two-place cell admits a universal compile is open (a generalized-Collatz family, Kurtz–Simon).

verifier: explore_second_ruler.py

A borrow grants power only if it is value-reading. Reset — clear a whole window, the general overflow — zeroes a counter reading nothing on the descent, so paired with the native zero-test (no decrement) the machine collapses past decidable to finite-state: (control, zero-pattern) is a bisimulation quotient, halting is finite-graph reachability, decided exactly even for reset oscillators whose naive forward simulation never ends. Restore a plain decrement and the same quotient goes unsound — v → v−1 flips the sign iff v was exactly 1, the read that un-quotients the value. Safe destruction is real and total: a window can be wiped freely without importing one bit of undecidability. The dangerous borrow is the remembering one — the danger is the reading, not the destruction.

Scope. Generalizes to bounded-threshold tests (invariant min(v, T), quotient Q × {0..T}^k). Reset-net undecidability (increment + decrement + reset, no zero-test) is a joint effect, cited (Dufourd–Finkel–Schnoebelen 1998); this corner removes the decrement, which is exactly why it falls to finite-state.

verifier: explore_reset_corner.py

The blueprint's error correction is a height cut — codewords are the elements below a data bound D — and the cut is not dynamics-invariant, so any state-evolution use must re-derive parity per step: base extension, setting a window from the CRT lift of the synced others. That re-derivation, taken as a machine primitive, is a borrow, and the machine equipped with it runs full universality — though with the bare class universal (the frontier rider, below), what the door itself sells is per-step exactness: an O(1) lift certificate against the rider's unary time. On element registers over a growing squarefree window set, subtraction and the zero-test are already native; what is missing is exactness — a window adjoined mid-run is born offset, and the unsynced zero-test lies in both directions (a false zero at the wrap, a false nonzero from the freeze). Base extension is exactly the missing sync: grow-and-extend before each increment keeps every register's lift equal to its counter, the zero-test reads true integer zero, and a two-counter Minsky machine runs step-exactly — on residue fields, no depth axis. The keystone lemma: base extension is not computable by state-independent ring operations — every such composite is channel-local by CRT, so on a window born with a constant it returns a constant, while lift(x) mod p is not constant in x. A program can still rebuild a lift residue from any window source it can name — bounded-source extension is native; what no fixed program reaches is extension from an unboundedly growing source (the addressing wall: finitely many window names and handle registers against unboundedly many windows). The contrast with dictionary codes (the snap-back guarantee) is operational, not informational: the height-cut syndrome is the aperiodic predicate lift < D, its re-derivation non-ring-computable, while a dictionary syndrome is channel-local and preserved by binding itself — self-checking is free on the decidable side; self-locating is the whole tax.

Scope. The step-exact simulation and the two lies are run-verified; Minsky universality is cited. The keystone lemma is proved for state-independent ring-op composites (any polynomial map, any register count). The door-free machine — growth, ring ops, channel reads, no base extension — is settled universal: the frontier rider, next.

verifier: explore_ecc_borrow.py

The door-free element machine — growth, ring operations, channel reads, no base extension — is Turing-universal with no import at all. The construction is sparse: a counter lives as a residue in one pointed window and as literal zero everywhere else, the pointer an idempotent register re-seated on the growth frontier at every increment. One increment = one grow, so the pointed prime — the (3+g)-th after g grows, hence ≥ g+4 — always exceeds the count: the value stays strictly below every prime that reads it, and the native zero-test never gets the chance to lie. Two exact Minsky counters run bare this way. Born-at-zero — the no-door clause itself — is the encoding's free sync: an unpointed window's intended content is zero, so fresh windows are born correct. The candidate lemma that once guarded this cell — periodic reads cannot assemble an aperiodic borrow — is false as stated: a periodic read is exact below its period, and growth mints periods (the prime staircase p_n > n) faster than any native count climbs. And the tower is incidental to all of this: the identical protocol asks only for an unbounded supply of fresh writable registers born at zero, each new one outrunning the running count (m_g > g). Primality, coprimality, the fields, the CRT reading all go unused — the same two counters run step-exact on the even tower (every window composite, no field) and on the plain successor supply 2, 3, 4, …; the prime staircase is one instance of the supply condition, not its source. The borrow that buys universality is the allocator, not the arithmetic.

The price is time, and its size is exact: moving a counter of value v is a transfer loop of v passes, so counting to N costs N(N−1)/2 against the door's N — the speed-up unbounded, the gap quadratic (bare ≤ door², tight). Quadratic is polynomial, so every coarse class — decidable, P, NP, PSPACE — is closed under it: the door sells efficiency, not possibility. A quadratic factor is still a real fine-grained separation — the deterministic time hierarchy sees it — so the purchase is a genuine cost, just never a class jump. And one blow-up sits above the door, shared by both models: a two-counter machine that Gödel-simulates a Turing machine pays the encoding's cost (Schroeppel) whether or not its carrier is synced; the door removes only the per-step carrier-sync layer.

Scope. The simulation is step-exact on a seed battery and a 2000-operation random schedule; a wrap control exhibits the periodic lie the pointer discipline prevents; Minsky universality is cited. The substrate-free protocol is checked step-exact on the even and successor supplies; the quadratic price is measured directly (counting to N, bare against door) — both rule tier. The constructions that had to die first — popcount factors through the lift, static masks stop at the program text, dense marks die at the wrap — are the walls the rider dodges rather than breaks (explore_bare_class.py); the keystone lemma is untouched — the rider never rebuilds a lift residue.

verifiers: explore_frontier_rider.py, explore_minimal_carrier.py, explore_unary_price.py

A bounded supply is finite-state. With every window of size at most C, read the state by column: with r registers, a window is an r-tuple over a fixed alphabet, every native operation acts identically on every column, and the sole readout — the zero-test — sees only whether some column carries a bit. The whole configuration is the control state plus the set of present column-tuples: finitely many states, ultimately periodic, decidable. The unbounded-width register vectors are a mirage — bounded alphabet, no addressing beyond the frontier singleton, no multiplicity read — and the registers here reset, so this is a sibling of the growth machine's decidability (monotonicity), not a rung below it: that machine is decided by well-structure, this one by boundedness. A linear supply is universal. A carry across two addressed windows is already native — increment, then let the zero-test read the wrap — and a positional counter with frozen lower base W_d has capacity at most W_d·m_frontier, the frozen base times the freshest window's modulus (the cap lemma: only the top digit migrates to fresher windows; migrating a lower digit rescales the higher weights by an unknown ratio, which is not in the class). The base W_d is a free program constant, so any m_g = Ω(g) supply clears the bar — verified at m_g = ⌈g/3⌉, where the single rider wraps — and m_g > g is the one-digit corner of the universal side. A sublinear supply is capped. On m_g = ⌈√g⌉ the same counter caps at exactly W_d², and every scheme tried dies the same way, by born-at-zero: a fresh window carries no value information, and the only native load into it is the unary transfer, bounded by one modulus, so no construction grows exact capacity online — the residue-vector counter (value held as residues across all windows) dies at the lcm freeze, a grown window being born 0 rather than the value's residue.

The capped side is a third decidable class, matching neither pole: its moduli grow without bound (not finite-state) and its registers reset (not monotone). The mechanism under born-at-zero is bandwidth: every arithmetic operation is componentwise, so value crosses windows only through the zero-test — one bit out — and the frontier singleton — one unit in. Two consequences, both measured: an addressed live value is bounded by a program constant, and a faithful register's zero-test fires at a period fixed by the program — growing extends the period, and a data-dependent freeze is the very counter it was meant to build.

Scope. Bounded ⇒ finite-state is run-verified through an exact bisimulation quotient (abstract trace = concrete trace on a program battery; window sizes 2, 3, 4). On the universal side the single-rider corner is proved; the linear extension exhibits one multi-digit counter running uncapped on m_g = ⌈g/3⌉, and the two-counter step is by composition with the rider's mechanism, not a separately re-run battery (Minsky universality cited); the cap lemma, the carry gadget, and the lcm freeze are proved by construction. That no construction counts on a sublinear supply — general decidability of the o(g) class — is conjectured on the born-at-zero principle, argued from the operation semantics, not machine-checked over all machines.

verifiers: explore_bit_supply.py, explore_sqrt_supply.py, explore_decidable_side.py

A capped counter riding the frontier still fires its zero-test, at growing gaps — the modulus creeps as the supply grows. Call a zero-test currently false whose next true lies in the future a pending fire. On every sublinear supply a pending fire lands at a computable time: the count advances by exactly one per pass while the modulus is non-decreasing, so the wrap cannot be skipped — at the first pass where the count reaches the modulus, equality holds — and the landing is read off the supply directly. On a linear supply the same fire can hang pending forever: the faithful counter never re-zeros. The o(g)/Ω(g) boundary is the same line a third time — capacity cap, class placement, fire landing.

The naive halting test — declare a loop at the first repeated signature — is phase-blind, and doubly unsound: a plain frozen pulse of period 60 already draws a false loop against a true halt, and a riding signal's growing gaps fool it unboundedly. The sound replacement is a three-verdict decider — HALT with the halt time; LOOP with a certificate, a never-fires proof or one round of self-simulation; or SUPPLY-ARITHMETIC with the question extracted. Signals are classified constant, frozen-periodic, riding, or growing-uniform; the walk predicts every fire from the descriptor and checks itself against the concrete machine at each step; a branch that consults another signal's phase has its question handed over rather than guessed. Zero false verdicts on the full battery, both killers of the naive rule included.

The third verdict is the law's other half, not a weakness of the procedure. Each landing hands the machine one bit of the supply's fine structure — on a smooth track every wrap lands at the same clock phase; switch the supply's residue class once, late, and the first post-switch wrap trips a detector — so a computable sublinear supply can encode an arbitrary halting fact in a tail switch, and halting over such supplies is undecidable with every capacity cap intact: reading a planted bit builds no counter, and universality does not reopen. Decidability on the sublinear side is therefore rate plus supply tameness: the rate caps the machine's own arithmetic and forces every fire to land; the supply's own arithmetic is the one channel left open.

Scope. The landing dichotomy is derived and run-verified — landings on ⌈√g⌉ and ⌈log₂ g⌉ supplies within the derived bound, the linear hang exhibited over 4000 passes. The decider's verdicts are exact on the signal fragment named above, bisimulation-checked per call, battery-verified. The supply-oracle refutation is by construction. Two conjectures remain: that every sublinear program's signals reduce to the four kinds (on the bandwidth principle), and that the canonical ⌈√g⌉ supply is itself tame — its wrap word is quasi-Beatty (gaps non-decreasing, multiplicity ≤ 2), in the Sturmian neighborhood, conjectured decidable.

verifier: explore_pending_fires.py

Add an external hand pushing the growth between machine steps — a policy graded by its read set: blind (a fixed schedule), machine-grade (the machine's own read kinds), door-grade (anything determining the true value: depth comparisons, lift reads, or full watching since birth). On the depth face pushes are absolutely inert: depths never decrease, so every depth-face read atom (presence, threshold) flips at most once per run — a program with k atoms receives at most k flag-flips from any hand, omniscient or uncomputable, over its whole run, and the fate map over all hands factors through a finite branch tree; both hand-game questions (does some hand, does every hand, make it halt?) are decidable. The comparison door cannot be smuggled through move-only pushes: the hand can know the comparison stream, it cannot tell it — the read-side twin of the addressing wall. Bandwidth is the read surface's property: the same publishing protocol that dies at flag exhaustion on the depth face runs forever through one element-face mailbox, channel reads being periodic and re-readable. A door-grade hand runs full universality through a door-free machine — the watching hand syncs each grown window by one native add whose parameter carries its knowledge: base extension performed by the intervener, re-priced like the door itself — with the bare class universal, the sync sells O(1) exactness, not possibility. Below the door nothing moves: a blind hand mints no exactness the machine's own repertoire lacks, and a finite-state machine-grade hand composes away into the machine's own control. Pushes program the basin, never the class; the hand's reads are the whole purchase.

Scope. The monotonicity argument is general for the modelled class — finite control, finite-state hands below the door, arbitrary blind schedules; on ratchet-only read surfaces the inertness holds for any hand whatsoever. The deciders, the flag budget, and the step-exact simulation are run-verified; Minsky universality is cited.

verifier: explore_interactive_hand.py

Couple a finite-control machine to a genuinely universal core — a two-counter program on the frontier rider — through k one-shot flags: at most k boundary events ever cross, and both boundary-quantified fate questions (does some, does every, boundary behavior halt the machine?) are answered by enumerating a finite branch tree with zero core steps, while which leaf the core realizes is the core's own reachability, undecidable in general. Through one re-readable mailbox the same core leaks whole: a two-state machine mirrors its parity stream, one boundary event per step. The crossing has an exact toll: carrying value v across the boundary bare costs v transfer passes — quadratic cumulative over a run — against the door's one synced write per step. And the read grammar alone does not confine: a flip's timing is boundary information, and one flag carries the halting problem into any machine unbounded enough to store the clock — a waiting counter transcribes the flip time, a budgeted simulation turns it into a halting witness, so the some-schedule question equals the halting problem while every frozen-boundary question about the same machine stays decidable. Ratchet boundaries confine machines of finite timing resolution — finite-control (the branch tree) or flag-word-driven (timing-blind) — and any class closed under product with a finite lattice of one-shot flags; the timing construction shows they do not confine in general.

Scope. The confinement enumeration is exhaustive for flag-word-driven machines and the toll is checked at every step of every run, over a battery of cores with known behavior; the timing construction is a theorem given Minsky's halting theorem, its mechanics run-verified exhaustively at probe scale.

verifiers: explore_read_surface.py, explore_flip_timing.py