Verification hardening and matched TEM ports

[HunterSpence]

Summary

• harden measurement, repeat-noise, TSVD, provenance, schemas, and no-clobber behavior
• replace the ambiguous FEM surface-current port path with explicit matched TEM definitions and power normalization
• add analytical coax, FEM form/port, malformed-input, mismatch, and audit-artifact regression coverage
• add strict package/static CI and truth-state documentation

Verified locally

• Ruff 0.12.3: passed
• non-heavy pytest with warnings as errors: 109 passed, 11 deselected
• wheel and sdist build/install/CLI checks: passed
• Compose, Bash, CFF, local-link, and Gitleaks checks: passed

Still gated by this PR CI / remote evidence

• pinned DOLFINx/PETSc heavy runtime and MPI
• manufactured/PML/port end-to-end evidence
• 3M DoF convergence and same-problem memory ratio
• real VNA POM/PLA imaging (no raw repeat bundle supplied)

[HunterSpence]

Checkpoint 2026-07-13:

• Exact PR head: 3c6272cb0aaf952b96e4843128875781db21e4ed
• Exact-head CI: https://github.com/HunterSpence/Scatter3D-Codex/actions/runs/29214982981 — PASSED across all eight jobs
• Deep continuation handoff: https://github.com/HunterSpence/Scatter3D-Codex/blob/codex/verification-release-20260712/docs/CONTINUATION_HANDOFF_2026-07-13.md
• No dedicated Scatter3D benchmark runner is active.
• Next execution is the public handoff's Linux lifecycle/wrong-DoF canaries, immutable eight-run 86k/471k pMG sweep, full evidence archival, and immediate runner deletion on every stop path.

Historical truth remains unchanged: one-level 86k PASSED; one-level 471k FAILED; 0.826 same-problem memory gate FAILED; new pMG 86k/471k NOT RUN; >=3M NOT RUN; real POM/PLA VNA acceptance BLOCKED.

[HunterSpence]

Exact-head checkpoint update for e8f9a679a115178b06c775854eeb80f2bf0589cf:

• Hardened the registered scaling executor to fail closed on incomplete or self-asserted FEM evidence, non-finite/negative residuals, over-cap iterations, incomplete effective pMG hierarchy evidence, OOM event counters, and inconsistent FEM/Docker exit parity.
• Bound ambiguous Docker-create cleanup to a unique attempt identity, refuse foreign containers, and require a full post-attempt absence observation window.
• Strengthened the wrong-DoF canary contract so it must prove a genuine preflight mismatch with no completed-solve evidence.
• Added focused regression coverage and corrected the portable registration-hash procedure in the committed handoff.
• Local pure suite: 203 passed, 2 skipped, 23 deselected.
• Exact-head CI: all eight jobs PASSED in run 29218100397.
• Downloaded exact-head heavy and MPI artifacts; both manifests verify 8/8.

The registered 86k/471k remote pMG campaign remains NOT RUN. Provisioning is intentionally deferred until isolated capacity is available; no Codex benchmark runner has been created. This comment does not change any solver-scaling, 3M, memory-ratio, or physical-validation claim.

[HunterSpence]

Exact-head packaging checkpoint for f975a2223381e49727c8497e068f993f778e1661:

• Fixed the source distribution so it contains the immutable validation/scaling_sweep_v1.json alongside the registration and executor scripts.
• Added a fail-closed sdist gate that requires one safe archive root, rejects absolute/traversal paths and duplicate/non-regular substitutions, and byte-compares all three experiment-contract files with the checkout.
• Exact-head CI run 29219064989: all eight jobs PASSED, including the new distribution-contract gate.
• Downloaded the exact-head artifacts. Heavy and MPI manifests each verify 8/8; the downloaded sdist contains the immutable sweep specification exactly once.
• PR remains open and mergeable at this exact head.

The remote pMG campaign remains NOT RUN. No Codex benchmark runner has been provisioned while separate protected capacity is active, so no evidence is bound to a superseded source revision.

[HunterSpence]

Exact-head safety checkpoint

• Commit: 5393e4494a5f63bdca24defba18eb7af7ffa5bf4
• Exact-head CI: https://github.com/HunterSpence/Scatter3D-Codex/actions/runs/29222225396
• Result: all eight jobs PASSED
• Fix: multi-entry scaling execution now preserves the first non-passing result and stops before launching another registered run; later unstarted IDs require explicit --run-id after operator review.
• Regressions cover both BLOCKED launch prevention and unsafe cgroup-OOM FAILED evidence.
• Remote scaling campaign: NOT RUN. No Codex benchmark runner has been provisioned.

The registered 86k/471k pMG sweep, 3M convergence, and 3M memory ratio remain unproven until instrumented remote evidence exists.