R12 ETTR Isolated Learnability v2 Semantic Generator Specification

Protocol: R12-ETTR-IL-v2-semantic-generator
Status: Phase-1 executable architecture contract; no fitting, job submission, scored opening, or capability claim is authorized Scope: this document replaces only the underspecified semantic-generation clauses implicated by audit blockers 1-10 and 14. It does not repair the ontology-to-tensor materializer, control-arm derangement, confirmation custody, overlap-audit implementations, or source inventory.

1. Normative language and hostile decisions

MUST, MUST NOT, SHALL, and SHALL NOT are requirements. An implementation that cannot satisfy a quota or invariant MUST stop without emitting a split. There is no fallback sampling, quota relaxation, retry with a new seed, or post-hoc replacement.

The following v1 requirements are impossible or scientifically indefensible and are replaced:

1. The v1 split and fold hashes have no specified preimages. They are retired. V2 derives all identities from the literal master seed and schemas below. Dataset hashes may be published only after literal files exist.
2. A 16-row object cannot be one ETTRCausalRectangle, whose geometry is exactly four rows. V2 defines three distinct units: semantic_core, semantic_rectangle, and causal_rectangle.
3. ABSTAIN and REJECT cannot satisfy ETTR's requirement that every WORLD and COMMAND edge change the matched query label. V2 causal rectangles contain only ANSWER(false) or ANSWER(true). ambiguity_deleted_twin remains score-only on the already frozen seven-variant boards and is not inserted into the v2 causal population.
4. Zero semantic command-template overlap at resource depth 1 is impossible: there are three primitive symbols, while two disjoint commands are needed per split rectangle. V2 requires disjoint world-bound command instances, not disjoint primitive templates. Primitive-template overlap is measured and reported, never called leakage.
5. Literal-byte disjointness between all renderer alphabets is impossible for ASCII integers, opaque symbols, and line termination. V2 requires disjoint renderer-reserved structural delimiters and exact byte inequality, not disjoint ordinary characters.
6. The resource production helper's depth-3 guard is not semantic law. V2 defines a separate bounded assessor oracle through depth 6 without changing the existing helper.
7. Rewrite challenge terms of at most four nodes cannot support six dependent decreasing rewrites. V2 uses the existing factorial command action: each operation wraps the current term and then normalizes it. It does not pretend that six decreasing steps exist in the old four-node challenge space.

These replacements are protocol changes, not interpretations of v1.

2. Frozen roots and canonical bytes

The master seed preimage is the ASCII byte string:

R12_ETTR_ISOLATED_LEARNABILITY_V2|2026-07-26|semantic-generator

master_seed is the raw 32-byte SHA256(preimage) digest. Its lowercase hexadecimal display is:

f6edaccd75ba80763540b990fcd0d1c85016e2d62a79cc3bbe328a206db925dd

Implementations MUST recompute it and require this equality. Every || in this document means raw byte concatenation. A displayed integer concatenated into a hash preimage is its canonical unsigned ASCII decimal representation. uint64 means the unsigned big-endian interpretation of the first eight digest bytes; first_bit is the most significant bit of the first digest byte.

Selection and split-local naming use the split_key and exact PRF(K,label,context) construction in R12_ETTR_IL_V2_CUSTODY_SPEC.md, not master_seed. Train and development keys are publicly reconstructible; each confirmation key remains with the independent custodian until the one authorized opening. The public master_seed determines only the finite candidate universe, canonical ordering, and split-disjoint public world ownership. It never ranks selected confirmation cases.

The tokenizer is the immutable 2,309,567-byte JSON artifact with SHA-256:

87532df5c121753de3b29194e1f9e3de47986d3f5359548fdf93606773a233d4

Tokenization is strict UTF-8 loading, candidate bytes are strict ASCII, add_special_tokens=false, right padding, and pad token ID 0. The answer byte strings are exactly 0 and 1; under the frozen tokenizer they MUST encode as the singleton token IDs 28 and 29. A mismatch is fatal.

Canonical JSON is RFC 8259 JSON constrained as follows:

• strict ASCII output;
• keys sorted by Unicode code point, which equals byte order for admitted keys;
• separators , and : with no whitespace;
• no duplicate object keys;
• integers only, no floats, exponent notation, NaN, or infinity;
• booleans and null use lowercase JSON literals;
• one trailing LF byte (0a);
• SHA-256 is over literal bytes including that LF.

For a value x, CJ(x) denotes those bytes. For byte strings, metadata JSON uses lowercase hex and never base64.

3. Ontology-neutral surface AST

Candidate-visible WORLD, COMMAND, and QUERY objects are instances of one generic tree. No node contains an ontology, family, theory, split, stratum, renderer, presentation, oracle, target, or disposition field.

The exact JSON Schema is:

{
  "$id":"r12-ettr-il-v2-surface-ast.schema.json",
  "$schema":"https://json-schema.org/draft/2020-12/schema",
  "$defs":{
    "node":{
      "oneOf":[
        {
          "additionalProperties":false,
          "properties":{"i":{"maximum":2147483647,"minimum":0,"type":"integer"}},
          "required":["i"],
          "type":"object"
        },
        {
          "additionalProperties":false,
          "properties":{"s":{"pattern":"^x[0-9a-f]{16}$","type":"string"}},
          "required":["s"],
          "type":"object"
        },
        {
          "additionalProperties":false,
          "properties":{
            "a":{"items":{"$ref":"#/$defs/node"},"maxItems":256,"type":"array"},
            "h":{"maximum":15,"minimum":0,"type":"integer"}
          },
          "required":["a","h"],
          "type":"object"
        }
      ]
    }
  },
  "$ref":"#/$defs/node"
}

Head codes have renderer-independent meanings:

h=1 and the pair collection under h=2 are semantically unordered. Everything else is ordered. Semantic canonicalization sorts unordered children by CJ(child) after resolving aliases. Renderers preserve surface order; parsers do not silently sort.

Opaque symbols are assigned in canonical semantic-symbol order. For symbol ordinal j, try counters k=0,1,... and choose the first unused:

x || first16hex(
  PRF(
    split_key,
    "opaque-name",
    CJ({
      "cell_salt": cell_salt,
      "counter": k,
      "fold": fold,
      "presentation": presentation,
      "semantic_core_id": semantic_core_id,
      "split": split,
      "symbol_ordinal": j
    })
  )
)

cell_salt is world-0, world-1, command-0, command-1, or shared-query. This collision-resolution rule is total.

The numeric suffix is the opposite factorial-cell index, not the semantic factor index. At corner (w,c), the WORLD source for semantic world Ww uses cell_salt="world-<c>", and the COMMAND source for semantic command Cc uses cell_salt="command-<w>". Consequently each fixed semantic WORLD and COMMAND has two byte-distinct, independently opaque-renamed surface variants. The assessor must parse and semantically canonicalize each pair to the same factor object; byte distinction alone is insufficient.

4. Assessor-side semantic schemas

The surface tree has no domain tag. The assessor record does, and is never candidate-visible. The following schema is the canonical union for WORLD and COMMAND semantics:

{
  "$id":"r12-ettr-il-v2-semantics.schema.json",
  "$schema":"https://json-schema.org/draft/2020-12/schema",
  "$defs":{
    "atom":{
      "additionalProperties":false,
      "properties":{
        "arguments":{"items":{"maximum":5,"minimum":0,"type":"integer"},"maxItems":2,"minItems":1,"type":"array"},
        "predicate":{"maximum":4,"minimum":0,"type":"integer"}
      },
      "required":["arguments","predicate"],
      "type":"object"
    },
    "term":{
      "additionalProperties":false,
      "properties":{
        "children":{"items":{"$ref":"#/$defs/term"},"maxItems":2,"type":"array"},
        "constructor":{"maximum":7,"minimum":0,"type":"integer"},
        "type":{"maximum":2,"minimum":0,"type":"integer"}
      },
      "required":["children","constructor","type"],
      "type":"object"
    },
    "world":{
      "oneOf":[
        {
          "additionalProperties":false,
          "properties":{
            "evidence_id":{"pattern":"^[0-9a-f]{64}$","type":"string"},
            "initial":{"items":{"$ref":"#/$defs/atom"},"type":"array"},
            "ontology":{"const":"horn"},
            "policy":{"enum":["persistent","derived_only"]},
            "theory_index":{"maximum":19,"minimum":0,"type":"integer"}
          },
          "required":["evidence_id","initial","ontology","policy","theory_index"],
          "type":"object"
        },
        {
          "additionalProperties":false,
          "properties":{
            "evidence_id":{"pattern":"^[0-9a-f]{64}$","type":"string"},
            "initial":{"$ref":"#/$defs/term"},
            "ontology":{"const":"rewrite"},
            "policy":{"enum":["contextual","root_only"]},
            "theory_index":{"maximum":14,"minimum":0,"type":"integer"}
          },
          "required":["evidence_id","initial","ontology","policy","theory_index"],
          "type":"object"
        },
        {
          "additionalProperties":false,
          "properties":{
            "evidence_id":{"pattern":"^[0-9a-f]{64}$","type":"string"},
            "initial":{"items":{"maximum":3,"minimum":0,"type":"integer"},"maxItems":4,"minItems":4,"type":"array"},
            "ontology":{"const":"resource"},
            "policy":{"enum":["atomic_deadlock","skip_blocked"]},
            "theory_index":{"maximum":59,"minimum":0,"type":"integer"}
          },
          "required":["evidence_id","initial","ontology","policy","theory_index"],
          "type":"object"
        }
      ]
    },
    "command":{
      "additionalProperties":false,
      "properties":{
        "depth":{"maximum":6,"minimum":1,"type":"integer"},
        "operations":{"items":{},"maxItems":6,"minItems":1,"type":"array"}
      },
      "required":["depth","operations"],
      "type":"object"
    }
  },
  "additionalProperties":false,
  "properties":{
    "command":{"$ref":"#/$defs/command"},
    "world":{"$ref":"#/$defs/world"}
  },
  "required":["command","world"],
  "type":"object"
}

The operations item type is selected assessor-side:

• Horn: an atom.
• Rewrite: integer 0 or 1, naming nullary constructor 0 or 1.
• Resource: integer 0, 1, or 2, naming the theory-local operator symbol.

evidence_id is SHA256(CJ(canonical evidence)). Candidate WORLD bytes contain the evidence, not this digest or the theory index.

5. Exact command sequence semantics, depths 1-6

All command sequences have exactly depth operations. S[0] is the initial state. S[i] is the state after operation i, one-indexed. The execution record contains all S[0..depth], the per-operation outcome, and terminal disposition.

5.1 Horn

The rule library, object types, predicates, theory ordering, grounding, and least-fixed-point closure are exactly those in pipeline/cross_ontology_horn_board.py.

For operation atom a[i]:

S[i] = least_fixed_point(theory, sorted_unique(S[i-1] union {a[i]}))

Admission requires:

• a[i] is well typed;
• a[i] is absent from S[i-1];
• S[i] != S[i-1];
• for i > 1, least_fixed_point(theory,S[0] union {a[i]}) != S[i].

The last clause makes each later operation causally dependent on its prefix, not merely concatenated.

5.2 Rewrite

Constructors, rules, matching, contextual occurrence order, and normal-form set equality are exactly those in pipeline/cross_ontology_rewrite_board.py. Let c[i] be 0 or 1 and let wrap(t,c) be constructor 5 with children (t, GroundTerm(type=0, constructor=c, children=())).

For policy=contextual, NF is exhaustive contextual normal forms. For policy=root_only, only root redexes may be traversed. Then:

N[i] = NF(theory, policy, wrap(S[i-1], c[i]))

If |N[i]|=0, disposition is REJECT. If |N[i]|>1, disposition is ABSTAIN. Otherwise S[i] is the singleton member. Causal-rectangle admission requires singleton N[i], S[i] != S[i-1], and for i>1:

NF(theory,policy,wrap(S[0],c[i])) != (S[i],)

This defines all depths 1-6 without enlarging or misdescribing the old four-node decreasing-rewrite challenge set.

5.3 Resource

Places, capacities, resource kinds, operator library, and theory ordering are exactly those in pipeline/cross_ontology_resource_board.py. V2 removes only the helper's length-3 validation guard. For each symbol, guards and consumption are checked against the pre-step marking; production is applied atomically.

Under atomic_deadlock, a blocked operation returns the unchanged marking, cursor i-1, status deadlock, and stops. Under skip_blocked, it returns the unchanged marking for that step and continues. Successful completion returns cursor depth and status halt.

For base, alpha, alias, reification, and type presentations, rectangle admission requires every operation enabled, every successful operation changes the marking, and for i>1 applying operation i to S[0] does not produce S[i]. For an execution_semantics_twin bundle, at least one operation MUST be prefix-dependently blocked, the base must deadlock, the twin must skip it, and a later operation must change the twin state. This is the only admitted exception to "all operations succeed"; the disclosed depth still counts operations actually evaluated by the twin policy.

5.4 Snapshot and ETTR transaction bound

Semantic operations are not ETTR transaction steps. This generator emits the canonical assessor-side S[0..depth] snapshots and command atoms only. R12_ETTR_IL_V2_MATERIALIZATION_SPEC.md is the sole authority for fixed slot, type, relation, value-code, status, and generic transaction projection. The generator MUST invoke that mapper during feasibility admission and retain its replay receipt, but MUST NOT implement a second slot allocator or packet difference compiler.

The materialized trace includes all command-register, ontology-state, cursor, outcome, and final-disposition edits and has exactly 64 target positions with a right-padded valid-step mask. Its valid prefix MUST contain 1-64 generic transactions and replay exactly to every projected boundary and terminal packet. A candidate whose materialized trace exceeds 64 valid transactions is inadmissible; truncation or an alternative projection is forbidden.

6. Four exact byte renderers and parsers

Each stage renders one surface AST. A parser MUST consume the entire byte string, produce exactly one AST, validate the schema, and satisfy render(parse(bytes)) == bytes. Noncanonical but parseable input is rejected.

6.1 Renderer 0: canonical JSON

Bytes are CJ(ast). The parser is strict JSON with duplicate-key rejection, then schema validation and canonical re-render equality.

6.2 Renderer 1: prefix S-expression

Grammar is ABNF:

document = node LF
node     = integer / symbol / call
integer  = "#" ("0" / DIGIT1-9 *DIGIT)
symbol   = "@" "x" 16HEXDIG-LOWER
call     = "(" head *(" " node) ")"
head     = "0" / "1" / "2" / "3" / "4" / "5" / "6" / "7" /
           "8" / "9" / "10" / "11" / "12" / "13" / "14" / "15"

call maps to {"a":[children...],"h":head}. No tabs, CR, leading/trailing spaces, uppercase hex, or empty document are legal.

6.3 Renderer 2: record-delimited infix

Bytes begin V2 followed by RS (1e). AST nodes are numbered in preorder from 0. Each record ends RS:

I<id>=<decimal>
S<id>=x<16-lower-hex>
N<id>=<head>%<arity>%<child-id-0>%...%<child-id-n-1>
R=0

IDs and integers are canonical unsigned decimal. % is US-equivalent within a record and the literal byte is 25; RS is the actual control byte 1e. Records MUST appear in increasing ID order, every child ID MUST exceed its parent ID, every nonroot node has exactly one parent, and R=0 is last. The infix = and framed records are normative; no LF is appended.

6.4 Renderer 3: reverse-child postfix

Grammar:

document = token *(" " token) " !" LF
token    = integer / symbol / close
integer  = "#" canonical-unsigned-decimal
symbol   = "$x" 16HEXDIG-LOWER
close    = "^" head "/" canonical-unsigned-decimal

For a call, render children in reverse semantic order, then ^head/arity. The parser uses a stack: an integer or symbol pushes a leaf; a close pops arity nodes, reverses the popped list, and pushes the call. Before ! the stack MUST contain exactly one node.

The reserved structural sets are respectively JSON punctuation, ()@#, RS plus =%, and $^/!. Ignoring LF and characters inside opaque symbols or decimal integers, these sets are pairwise disjoint.

7. Semantic adapters and presentations

The canonical evidence constructors and exact fit/score theory pools remain:

The fit-safe rewrite constructor is defined by generalizing the existing _build_parts transform to any valid rewrite theory only for base, alpha_reorder, and alias_split. The held-out-only guard remains mandatory for the four score-only transforms. No challenge or oracle from a score-only family enters fit.

Presentation transforms are deterministic:

• base: canonical declarations and evidence order.
• alpha_reorder: reverse every semantically unordered list; alpha-rename all local symbols using the presentation namespace; preserve ordered command operations.
• alias_split: choose the lowest SHA256(CJ(symbol-definition)) symbol with at least two occurrences, create one alias, emit h=11, and replace occurrences 1,3,5,... in canonical preorder with the alias. Semantic decoding quotients the pair.
• relation_reification: replace each direct n-ary application by a fresh relation node and one h=12 incidence per ordered role.
• type_twin: split one actually referenced type symbol into two surface symbols and emit an explicit h=11 assessor quotient. This is a structural typing presentation and MUST preserve the terminal observation after quotienting. It is not required to manufacture a terminal-separating witness; semantic separation belongs to execution_semantics_twin.
• execution_semantics_twin: Horn uses derived-only closure, rewrite root-only reduction, and resource skip-blocked execution. It MUST have a separating terminal witness in the selected core.
• ambiguity_deleted_twin: remove the first evidence item in deletion-index order whose removal leaves at least two behavioral classes and a separating challenge. It is never a causal-rectangle view.

For each causal rectangle, equivalent WORLD factors must have identical initial packet targets but distinct raw bytes. Let b = first_bit(SHA256(semantic_rectangle_id || "|layout")). WORLD layout for command column c is b xor c; COMMAND declaration layout for world row w is b xor w. Layout 0 is canonical order and layout 1 reverses only semantically unordered declarations. Thus equivalent factors differ in bytes without changing operation order or inserting inert padding. QUERY bytes are identical across all four cells through the answer read position.

8. Query grammar, evaluator, and paraphrases

Queries are assessor-side Boolean expressions with the exact schema:

{
  "$id":"r12-ettr-il-v2-query.schema.json",
  "$schema":"https://json-schema.org/draft/2020-12/schema",
  "additionalProperties":false,
  "properties":{
    "args":{"items":{"type":"integer"},"maxItems":3,"type":"array"},
    "op":{
      "enum":[
        "horn_has","horn_count_ge",
        "rewrite_root_is","rewrite_contains","rewrite_nodes_ge","rewrite_child_root_is",
        "resource_place_ge","resource_cursor_ge","resource_halt"
      ]
    }
  },
  "required":["args","op"],
  "type":"object"
}

Candidate enumeration order is exactly:

1. Horn: horn_has(predicate,args) in all_ground_atoms() order, then horn_count_ge(k) for k=1..27.
2. Rewrite: rewrite_root_is(c) for c=0..7; rewrite_contains(c) for c=0..7; rewrite_nodes_ge(k) for k=1..16; rewrite_child_root_is(position,c) for position 0 then 1 and c=0..7.
3. Resource: resource_place_ge(place,k) for place 0..3, k=1..3; resource_cursor_ge(k) for k=1..6; then resource_halt().

Evaluation is literal:

• horn_has: membership in sorted terminal closure.
• horn_count_ge: closure cardinality at least k.
• rewrite_root_is: root constructor equals c.
• rewrite_contains: any node constructor equals c.
• rewrite_nodes_ge: recursive node count at least k.
• rewrite_child_root_is: false if the child position is absent; otherwise its root constructor equals c.
• resource_place_ge: terminal multiplicity at place is at least k.
• resource_cursor_ge: terminal cursor is at least k.
• resource_halt: terminal process status is halt.

For each presentation bundle, a query is admissible only if every included view is ANSWER and its labels on (W0C0,W0C1,W1C0,W1C1) change on all four edges. Thus each vector is necessarily 0110 or 1001 and is exactly 2/2 balanced.

Select query slot 0 as the admissible query minimizing:

SHA256(master_seed || "|query|0|" || CJ(query))

Select slot 1 similarly among queries with a distinct AST and a denotation signature over the frozen ontology terminal-witness universe that is neither equal to nor the Boolean complement of slot 0's signature. If none exists, the semantic core is inadmissible.

The terminal-witness universe is exact and split-independent. For one ontology, enumerate every theory in frozen theory order, every initial state in the Section 12 domain, and every one-operation command in canonical operation order under the base execution policy (persistent, contextual, or atomic_deadlock). Execute with dependency admission disabled, require primary/replay byte-identical assessor results, and retain only ANSWER outcomes. Quotient duplicate terminal observations by the following CJ value:

Horn:
  {"facts":sorted_terminal_facts,"ontology":"horn"}
Rewrite:
  {"normal_forms":sorted_terminal_normal_forms,"ontology":"rewrite"}
Resource:
  {"cursor":cursor,"marking":terminal_marking,
   "ontology":"resource","status":status}

Order the distinct retained observations by their CJ bytes. This ordered tuple is the sole universe passed to query-denotation selection. It is deliberately a fixed primitive witness domain rather than the selected fit or score rows; therefore query identity cannot depend on split contents, candidate ranking, presentation, renderer, or target labels.

Paraphrase 0 renders h=9(query-expression). Paraphrase 1 renders h=10(query-expression, integer(1)). Their evaluator meanings are respectively q and q == true; bytes MUST differ and labels MUST agree.

The query prefix is the rendered query AST followed by the renderer's ordinary stage terminator and the ASCII bytes R=. The next byte is exactly 0 or 1. The token before that answer is the shared query_read_index.

9. Outcome, target, and disposition projection

Let V be the evidence-consistent theory set under the presented execution policy and let B be the number of distinct bounded behavior signatures in V.

V empty                         -> REJECT, target null
V nonempty and B > 1            -> ABSTAIN, target null
V nonempty and B = 1, q false   -> ANSWER, target false
V nonempty and B = 1, q true    -> ANSWER, target true

ETTR status bits are:

ABSTAIN and REJECT are excluded from the binary denominator. Every admitted causal rectangle is independently 2 false / 2 true for each query slot and paraphrase. Therefore balance is exact per fold/split/ontology/stratum/query_slot/paraphrase without target-conditioned sampling.

Structured terminal outcomes remain assessor records. They are never replaced by the Boolean target. Primary joint scoring still requires packet, transactions, disposition, and answer independently.

10. Rectangle units and expansion

A semantic_core contains one theory/evidence instance, worlds W0/W1, commands C0/C1, one depth, two query ASTs, and canonical outcomes for four cells. It is the indivisible split, leakage-audit, and statistical-bootstrap cluster.

A semantic_rectangle is one presentation/renderer view of one core. It has four packet cells and 16 rows.

A causal_rectangle is one (query_slot,paraphrase) slice of one semantic rectangle. Its row tensor is:

[[W0C0,W0C1],[W1C0,W1C1]]

It has exactly four rows and is one ETTRCausalRectangle.

Expansion order is:

query_slot 0 paraphrase 0: W0C0,W0C1,W1C0,W1C1
query_slot 0 paraphrase 1: W0C0,W0C1,W1C0,W1C1
query_slot 1 paraphrase 0: W0C0,W0C1,W1C0,W1C1
query_slot 1 paraphrase 1: W0C0,W0C1,W1C0,W1C1

Admission requires all four terminal packets distinct, equal packet support masks, W0 initial packets equal across commands, W1 initial packets equal across commands, distinct W0/W1 initial packets, distinct equivalent-factor raw bytes, identical query prefixes, and all four packet and label edge contrasts.

11. Exact split and presentation quotas

Folds retain v1 leave-one-ontology-out membership.

11.1 Training, per fit ontology

For each depth 1, 2, 3:

• 96 semantic cores;
• every core emits these four distinct views:

pair 0 left:  base          renderer 0
pair 0 right: alpha_reorder renderer 1
pair 1 left:  base          renderer 1
pair 1 right: alias_split   renderer 0

• both pairs must pass the identity-map equivariance admission in the materialization specification; and
• therefore each depth has 192 invariant pairs, 384 semantic rectangles, 1,536 causal rectangles, 1,536 packets, and 6,144 rows.

Per fit ontology this is 288 cores, 1,152 semantic rectangles, 4,608 packets, 4,608 causal rectangles, and 18,432 rows. Per fold totals remain 2,304 semantic rectangles, 1,152 invariant pairs, 9,216 packets, and 36,864 rows.

11.2 Development and confirmation, non-all_axes

Each of the seven strata has 32 semantic cores. Every core has base, alpha_reorder, and alias_split, producing exactly 96 semantic rectangles.

If composition is not shifted, core depth counts are 11, 11, 10 over depths 1,2,3. If shifted they are 11,11,10 over depths 4,5,6. Rotate which depth gets 10 by uint64(SHA256(CJ(cell_key))) mod 3.

Non-renderer-shift cells assign 16 cores to renderer 0 and 16 to renderer 1. Renderer-shift development assigns 16 to renderer 2 and 16 to renderer 3. Renderer-shift confirmation assigns all 32 to renderer 3.

11.3 Development and confirmation, all_axes

There are 24 semantic cores. Every core has exactly four views:

base
relation_reification
type_twin
execution_semantics_twin

This yields 96 semantic rectangles, with 24 per presentation. Depths 4,5,6 receive eight cores each, hence 32 rectangles each. Development assigns 12 cores to renderer 2 and 12 to renderer 3. Confirmation uses renderer 3 only.

ambiguity_deleted_twin receives no row in this population for the impossibility stated in Section 1. Its ABSTAIN evidence remains on the frozen seven-variant score board.

Consequently each scored ontology/stratum still has 96 semantic rectangles, 384 packets, 384 causal rectangles, and 1,536 rows. Each scored split still has 2,304 semantic rectangles, 9,216 packets, and 36,864 rows.

11.4 Theory allocation

For a cell with Q cores and ordered theory pool P of size m, let q=floor(Q/m), r=Q mod m, and o=uint64(SHA256(master_seed || "|theory-offset|" || CJ(cell_key))) mod m. Every theory gets q cores; the first r theories in cyclic order starting at o get one more. Core selection is then performed independently per theory quota. This is the only remainder rule.

12. Candidate domain and deterministic selection

Initial state domains are exactly:

• Horn: the 378 challenge_initials() values.
• Rewrite: the 46 type-zero values from challenge_terms() accepted by the frozen RewriteWorld root contract. The remaining 18 typed child terms are part of the term library but are not legal WORLD roots.
• Resource: the 81 input_markings() values.

World ownership prevents cross-split semantic-world reuse. For canonical world bytes w, compute owner = uint64(SHA256(master_seed || "|world-owner|" || fold || ontology || CJ(w))) mod 3; owners 0,1,2 mean train,development,confirmation. A world may appear repeatedly inside its owner split but nowhere else.

For each theory/depth/owned unordered world pair, construct commands by beam enumeration:

1. Start with the empty sequence and both initial states.
2. Extend every surviving prefix by the complete operation alphabet in the exact ontology order.
3. Reject extensions violating typing, execution, or dependency in either world, except the explicit execution-twin rule.
4. Deduplicate by command semantic AST.
5. Rank by SHA256(master_seed || "|beam|" || fold || split || ontology || theory || depth || CJ(world_pair) || CJ(sequence)).
6. Retain the lowest 64 after each depth; ties use CJ(sequence) bytes.

At target depth, enumerate unordered pairs of the surviving commands in lexicographic CJ order. Combine them with the world pair, compute all bundle views and queries, and apply every admission rule.

The implementation uses a deterministic constructive stopping certificate, not an unnecessarily exhaustive traversal after feasibility is already proved. Within one exact quota cell it scans owned WORLD pairs and COMMAND pairs in the order above, records every emitted and rejected ordinal, and may stop only after it has found the exact required quota plus the frozen surplus margin. A cell with insufficient candidates must exhaust its finite domain and fail. Re-running with the same sources and keys must produce byte-identical selected cores and accounting. This replaces the earlier requirement to spend CPU proving counts for the unused suffix of a domain that can contain billions of Horn executions; it does not permit sampling, reranking, rerolling, quota borrowing, or post-hoc replacement.

The exact candidate tuple schema is:

{
  "$id":"r12-ettr-il-v2-candidate.schema.json",
  "$schema":"https://json-schema.org/draft/2020-12/schema",
  "additionalProperties":false,
  "properties":{
    "commands":{"items":{"pattern":"^[0-9a-f]{64}$","type":"string"},"maxItems":2,"minItems":2,"type":"array"},
    "depth":{"maximum":6,"minimum":1,"type":"integer"},
    "fold":{"maximum":2,"minimum":0,"type":"integer"},
    "generator_ordinal":{"maximum":9223372036854775807,"minimum":0,"type":"integer"},
    "ontology":{"enum":["horn","rewrite","resource"]},
    "opaque_seed":{"maximum":9223372036854775807,"minimum":0,"type":"integer"},
    "presentations":{"items":{"enum":["base","alpha_reorder","alias_split","relation_reification","type_twin","execution_semantics_twin"]},"type":"array","uniqueItems":true},
    "queries":{"items":{"pattern":"^[0-9a-f]{64}$","type":"string"},"maxItems":2,"minItems":2,"type":"array"},
    "renderer":{"maximum":3,"minimum":0,"type":"integer"},
    "schema":{"const":"r12-ettr-il-v2-candidate"},
    "split":{"enum":["train","development","confirmation"]},
    "stratum":{"enum":["seen_id","rule","composition","renderer","rule_composition","rule_renderer","composition_renderer","all_axes"]},
    "theory_instance":{"pattern":"^[0-9a-f]{64}$","type":"string"},
    "theory_pool_index":{"minimum":0,"type":"integer"},
    "worlds":{"items":{"pattern":"^[0-9a-f]{64}$","type":"string"},"maxItems":2,"minItems":2,"type":"array"}
  },
  "required":["commands","depth","fold","generator_ordinal","ontology","opaque_seed","presentations","queries","renderer","schema","split","stratum","theory_instance","theory_pool_index","worlds"],
  "type":"object"
}

Hashes in the tuple are SHA-256 of canonical assessor-side semantic ASTs. Within each exact (fold,split,ontology,stratum,theory_pool_index,depth,renderer,presentation_bundle) cell, candidates are emitted before admissibility filtering by ascending canonical WORLD-pair bytes and then ascending canonical COMMAND-pair bytes. generator_ordinal is the zero-based emission counter in that cell and is never compacted after rejection.

opaque_seed is the low 63 bits of:

PRF(
  split_key,
  "opaque-name",
  CJ(candidate_without_opaque_seed)
)

An admissible candidate's selection key is:

PRF(split_key, "candidate-rank", CJ(candidate))

For each exact theory quota, choose the lowest key interpreted as 32 unsigned big-endian bytes, then CJ(candidate) as tie breaker, while enforcing unique semantic core IDs. Selection never reruns after presentation expansion.

theory_instance includes evidence and presentation seed. Underlying law identity is separately recorded as law_signature. Seen-theory strata necessarily reuse law signatures; claiming zero law-signature overlap there would contradict the definition of seen_id. Literal theory-instance bytes and worlds remain disjoint.

Command identities are:

template_id = SHA256(CJ(command semantic AST))
instance_id = SHA256(CJ({law_signature,world_semantic_id,command semantic AST}))

instance_id MUST be disjoint across splits. template_id may overlap and its overlap matrix MUST be reported. This resolves the depth-1 cardinality contradiction without mislabeling primitive reuse as novel composition.

13. Training schedule unit

The indivisible training schedule unit is one admitted invariant pair. A microbatch contains exactly one pair = two semantic rectangles = eight causal rectangles = 32 rows. Four microbatches form one update containing four pairs = eight semantic rectangles = 32 causal rectangles = 128 rows.

The exact five-seed repetition and remainder schedule is Section 4 of R12_ETTR_IL_V2_ARMS_AND_STATISTICS_SPEC.md. It orders all 1,152 fitting pair IDs separately for each (fold,model_seed,epoch), consumes 20 complete epochs plus the first 960 pairs of epoch 20, and exposes 24,000 invariant pairs = 48,000 semantic rectangles over 6,000 updates. All four causal slices of each semantic rectangle and all 16 row alignments of each invariant pair remain in one microbatch. No component spec may substitute an unpaired rectangle or causal-rectangle schedule.

14. Cardinality and feasibility certificate

Before any row file is written, the generator MUST emit and validate a r12-ettr-il-v2-cardinality-report in canonical JSON. For every fold/split/ontology/stratum/theory/depth/renderer/presentation-bundle cell it records:

• world domain count and owned-world count;
• unordered owned-world-pair count;
• operation alphabet size;
• raw template count (27^d, 2^d, or 3^d);
• beam survivor counts after each prefix depth;
• command-pair count;
• dependency-pass count;
• four-distinct-terminal count;
• packet-item and transaction-bound pass count;
• checkerboard-one-query and checkerboard-two-query counts;
• presentation-bundle pass count;
• admissible unique core count;
• required core quota and surplus.

The report passes only if every surplus is nonnegative, every selected core has two query semantics, and all selected IDs are unique. It also proves these static facts:

• legal WORLD-root domain sizes are Horn 378, rewrite 46, resource 81;
• operation-template counts at depth d are 27^d, 2^d, 3^d;
• resource depth-1 semantic-template disjointness across three splits is impossible because each rectangle needs two of only three templates;
• the replacement instance-disjointness test is satisfiable only if owned world domains are disjoint and each selected instance ID is unique;
• every transaction trace is at most 64 steps and packet union at most 64 slots.

The generator MUST NOT assert in advance that dynamic candidate counts are sufficient. Only a validated constructive scan reaching quota plus the frozen surplus, or exhaustion of the bounded beam domain, decides feasibility. If any cell is short, the scientifically valid result is semantic_generator_infeasible_at_<cell>. Increasing beam width, changing a query, or reallocating a quota requires protocol v3.

14.1 Model-visible token-native transport

The four byte renderers remain assessor-visible conformance objects. The model transport is the source-frozen structural codebook implemented by pipeline/ettr_il_v2_token_native_surface.py:

• one valid tokenizer token per structural codeword;
• exact widths WORLD 192 and COMMAND 96;
• fused encoding of a canonical h=4 application and its ordered h=12 reification incidences, with exact inverse reconstruction;
• no explicit END token or fixed filler token;
• deterministic hash-derived valid cover codewords after the unique parsed document;
• exact document length retained only in the assessor sidecar and never mounted for a candidate; and
• QUERY framing that preserves the one-token Boolean answer boundary at exact width 48.

Parsing must reconstruct the complete presentation AST, enforce all node/depth bounds, verify the exact deterministic cover, and then perform the same presentation inversion and semantic comparison as the verbose renderer. The fixed-width attention mask is all true because every position is a real codeword. Leakage audits therefore operate over the complete codeword sequence, token histogram, parsed node count, and cover boundary; they may not mistake an all-true mask for proof of independence.

15. Canonical selected-row record

Each assessor JSONL row has this exact top-level shape:

{
  "$id":"r12-ettr-il-v2-row.schema.json",
  "$schema":"https://json-schema.org/draft/2020-12/schema",
  "additionalProperties":false,
  "properties":{
    "assessor":{"type":"object"},
    "candidate":{
      "additionalProperties":false,
      "properties":{
        "command_hex":{"pattern":"^(?:[0-9a-f]{2})+$","type":"string"},
        "query_hex":{"pattern":"^(?:[0-9a-f]{2})+$","type":"string"},
        "world_hex":{"pattern":"^(?:[0-9a-f]{2})+$","type":"string"}
      },
      "required":["command_hex","query_hex","world_hex"],
      "type":"object"
    },
    "causal_rectangle_id":{"pattern":"^[0-9a-f]{64}$","type":"string"},
    "command_index":{"maximum":1,"minimum":0,"type":"integer"},
    "fold":{"maximum":2,"minimum":0,"type":"integer"},
    "paraphrase":{"maximum":1,"minimum":0,"type":"integer"},
    "query_slot":{"maximum":1,"minimum":0,"type":"integer"},
    "row_id":{"pattern":"^[0-9a-f]{64}$","type":"string"},
    "schema":{"const":"r12-ettr-il-v2-row"},
    "semantic_core_id":{"pattern":"^[0-9a-f]{64}$","type":"string"},
    "semantic_rectangle_id":{"pattern":"^[0-9a-f]{64}$","type":"string"},
    "split":{"enum":["train","development","confirmation"]},
    "world_index":{"maximum":1,"minimum":0,"type":"integer"}
  },
  "required":["assessor","candidate","causal_rectangle_id","command_index","fold","paraphrase","query_slot","row_id","schema","semantic_core_id","semantic_rectangle_id","split","world_index"],
  "type":"object"
}

The open-ended assessor object is not candidate-visible, but its canonical required schema MUST be versioned by the later materializer. This semantic spec requires it to contain at least ontology, stratum, depth, renderer, presentation, theory/law/evidence hashes, semantic world/command/query ASTs, all intermediate outcomes, packet projections, generic transactions, disposition, Boolean target or null, alignments, and all parent IDs.

row_id = SHA256(CJ(row_without_row_id)). Parent IDs are hashes of their canonical records excluding their own ID field.

16. Required conformance checks

A semantic generator conforms only if all checks pass:

1. Recompute the master seed and tokenizer hash.
2. Validate every internal and emitted object against the schemas above.
3. For all four renderers and all emitted stages, parse, semantic-decode, re-render, and require byte equality.
4. Require renderer byte inequality for the same surface AST.
5. Replay every ontology execution with the production oracle and an independently implemented oracle; require exact intermediate and terminal equality.
6. Replay every generic transaction and require exact packet equality.
7. Validate every causal rectangle with the current ETTRCausalRectangle invariants.
8. Verify exact quotas, expansion factors, row order, 2/2 label balance, and presentation pairing.
9. Verify no withheld ontology or score-only theory/presentation/renderer enters fit.
10. Verify split-disjoint world IDs, command instance IDs, opaque names, and raw rows; report, but do not prohibit, primitive template overlap.
11. Verify the cardinality report before writing split files.
12. Verify that ambiguity_deleted_twin, ABSTAIN, and REJECT are absent from the causal JSONL population.

Failure is terminal and names the first canonical cell and invariant. No partial split has standing.

17. Audit-blocker closure map

18. Remaining blockers outside this specification

This document deliberately does not claim closure of implementation-audit blockers 11, 12, 13, 15, or 16. In particular:

• no CPU materializer currently maps these semantic records into production ETTRContinuationBatch tensors and ETTRVariantAlignment;
• the binding-deranged control remains contradictory until its preserved and changed target components are redefined;
• confirmation encryption, signing, and open-once custody remain unspecified;
• graph-isomorphism, normalized overlap, and metadata-classifier gate implementations remain to be frozen;
• source paths and hashes for a future v2 generator/materializer do not exist.

Therefore this specification makes semantic generation reconstructible but does not authorize data materialization, training, jobs, or a capability claim.