\section{Reproducibility and assurance boundary}\label{app:replay}

All theorem proofs are contained in the preceding sections.  The companion
repository supplies exact-arithmetic, symbolic, manuscript and package audits.
They detect transcription, routing, endpoint, convention and software errors;
no finite replay is used to infer a statement for all primes.

\begin{table}[ht]
\centering
\small
\begin{tabularx}{\textwidth}{@{}lY@{}}
\toprule
Layer & Audited object\\
\midrule
Unit and local audits & Unit-support quotients, the UAG presentation, seven
CRT boxes, connector coverage and endpoint cases.\\
Skeleton audits & Symbolic Cubic and Quartic reductions, exact failure sets
and nine encoded mutations, with no sampled prime as a proof premise.\\
Binary audit & The $C_6$ slice obstruction, all 21 deep-support rows at
$n=30,42,70$, the Keleti--Kolountzakis lower-bound pair and four scope
mutations.  This is bounded assurance, not the uniform proof of
Section~\ref{sec:set-reconstruction}.\\
Repository gate & Required paths, source and license boundaries, Section 11,
the four reconstruction sources and six semantic mutation controls.\\
Manuscript gate & Title/PDF identity, bibliography closure, deck conventions,
claim boundaries, unresolved references and source isolation.\\
Isolation gates & Manifest-only and synthetic Git-index trees repeat the core or
full route without undeclared inputs.\\
\bottomrule
\end{tabularx}
\caption{Assurance layers and their roles.}\label{tab:assurance}
\end{table}

From the repository root, the reviewer first selects independently controlled
absolute Python and Git executables.  In a POSIX shell the standard routes are
\begin{verbatim}
PYTHON_ABSOLUTE=/absolute/path/to/python
GIT_ABSOLUTE=/absolute/path/to/git
trusted() {
  target=$1
  shift
  "$PYTHON_ABSOLUTE" -I -S -B scripts/runtime_bootstrap.py \
    --git-executable "$GIT_ABSOLUTE" --target "$target" -- "$@"
}
trusted scripts/verify.py --profile manifest
trusted scripts/verify.py --profile core
trusted scripts/verify.py --profile full
"$PYTHON_ABSOLUTE" -I -S -B -O scripts/runtime_bootstrap.py \
  --git-executable "$GIT_ABSOLUTE" --target scripts/verify.py -- \
  --profile full
trusted scripts/verify_manifest_only.py
trusted scripts/verify_git_checkout.py --profile full
\end{verbatim}
The equivalent PowerShell invocation and the exact runtime trust boundary are
recorded in \texttt{REPRODUCE.md}.  The displayed commands are the actual
bootstrap route: direct execution of a verifier is intentionally rejected.
The core route runs the unit, UAG, CRT, Skeleton and bounded binary checks.
Individual scripts write runtime JSON under \texttt{results/} and generated
presentations under \texttt{certificates/}; the stable aggregate is
\texttt{results/public\_package\_verification.json}.  The source manifest and
release attestation bind the distributed inputs and title-named PDF.

\subsection{Build and visual verification}

The title-named distributed PDF is produced from a clean source-only copy by
the repository's locked builder:
\begin{verbatim}
TOOL_CACHE_PARENT=/absolute/path/to/TectonicProject
TECTONIC_CACHE_ROOT="$TOOL_CACHE_PARENT/Tectonic/bundles"
trusted scripts/build_locked_pdf.py \
  --tectonic-executable /absolute/path/to/tectonic \
  --tectonic-release-archive /absolute/path/to/release.zip \
  --tectonic-cache-root "$TECTONIC_CACHE_ROOT" \
  --source-dir /absolute/path/to/clean/source \
  --output-dir /absolute/path/to/empty/output
\end{verbatim}
The resolved cache-root argument must end literally in
\path{TectonicProject/Tectonic/bundles}; the builder rejects any other
layout before compilation.
The tracked \texttt{pdf\_toolchain.\allowbreak lock.json} binds the Tectonic release asset,
executable and resource-bundle identity.  The tracked
\texttt{tectonic\_cache\_\allowbreak payloads.lock.json} enumerates a canonical closed
cache of 535 payloads by relative path, byte count and SHA-256; it contains
every resource read by a clean build, plus a conservatively retained locked
superset.  The wrapper rejects missing or extra payloads, symlinks,
junctions and other reparse points; verifies the closed payload tree both
before and after compilation; and then passes the locked bundle explicitly
together with \texttt{--only-cached}.  An empty cache can first be materialized
with \texttt{scripts/materialize\_locked\_tectonic\_cache.py}; in the current
freeze the clean build fetches 393 resources and the materializer explicitly
adds the other 142 locked entries.  That one online bootstrap must be followed
by the complete payload check, while accepted release builds are offline.  A
different executable, payload tree, bundle or
command fails closed.  A conventional
pdf\LaTeX/Bib\TeX{} build remains the independent cross-engine lane:
\begin{verbatim}
job=Autocorrelation_Phase_Lattices_on_Cyclic_Groups
pdflatex -halt-on-error -jobname="$job" main.tex
bibtex "$job"
pdflatex -halt-on-error -jobname="$job" main.tex
pdflatex -halt-on-error -jobname="$job" main.tex
\end{verbatim}
Two clean locked Tectonic builds are compared byte for byte.  The final PDF is
rendered independently and every page is inspected for clipping, overflow,
overlap, broken tables and unintended blank pages.  Extracted text is scanned
for unresolved references.  Every cited key must occur in the repository-local
\texttt{refs.bib}, every bibliography entry must be cited, and the four
reconstruction sources must retain their checked identifiers.

\subsection{Package and claim boundary}

The repository contains only manuscript source, verification code, generated
certificates and review documentation.  It redistributes no third-party paper
PDFs.  The bounded binary audit does not replace the all-prime exclusion proof.
The optional translation/reflection corollary keeps the analytical deck
oriented and changes only the output quotient.  Reproduction establishes
author-operated package coherence; it does not establish priority, independent
external reproduction, publication, journal acceptance or a DOI.