\section{The helium interior certificate}\label{sec:10-helium-interior-certificate} This appendix proves the interior bound that Section~\ref{sec:05-helium-monoanion} uses for the helium monoanion. \begin{lemma}[Helium interior gaps]\label{lem:he3-interior} Assume Set-up~\ref{setup:execution} for the specified original S134/P41 computations. Let $B_7=\{x\in\mathbb R^3:|x|<7\}$, $K_7=(B_7)^3$, and $z=-2903724372/10^9$. For antisymmetric $v\in H^1(K_7;\mathbb C^8)$ define \[ q_<[v]=\frac12\sum_{i=1}^3\int_{K_7}|\nabla_i v|^2+ \int_{K_7}\left[-2\sum_{i=1}^3\frac1{|x_i|} +\sum_{i-2.0004. \] This proves $h>-2.0004I$. The trial $e^{-2r}$ has energy strictly below $-2$, since its boundary correction is $-15/16$ times its positive boundary norm. There is precisely one spatial level below $B_*=-47881/87500>-11/20$. Here are comparison functions which verify this assertion without a numerical spectral assumption. For $\ell\ge1$, apply \eqref{eq:helium-interior-certificate-ground-transform} at $\ell=1$ to $r^2e^{-r}(1+41r^7/(15\,7^7))$ and then use monotonicity in $\ell$. Its local energy is at least $-1/2-41\,25^5/(3\,42^6)>-21/40>B_*$. In the $\ell=0$ channel impose $w(1)=0$, a single linear condition. On $(0,1)$ use $r(1-r)e^{-r}$, of local energy $-1/2$. On $(1,7)$ use $r(r-1)e^{-r}(1+17(r-1)^6/(7\,6^6))$. Its logarithmic derivative at seven is $1/56$, and its local energy is bounded below by $-1/2-4131/87500=B_*$: with $s=r-1$, the negative correction is at most $6[17/(7\,6^6)]s^4(9/2-s)_+$, whose maximum is $4131/87500$. The negative spectral subspace below $B_*$ thus has dimension at most one. Together with the trial above, this isolates the simple core shell $s=(0,1)$ with $-2.0004\frac1{100},\qquad h_5>\frac1{10},\qquad h_9>\frac45. \] For these four comparisons take respectively \[ r^4e^{-r/2},\quad r^5e^{-2r/5}(1-83r^2/7987),\quad r^6e^{-r/3}(1-85r^2/6517),\quad r^{10}e^{-r}(1-23r^2/1911). \] All are positive on $(0,7]$. The last three have logarithmic derivative $1/56$ at seven, and the first leaves boundary coefficient $3/112$. For the middle two the local-energy lower bounds are $-2/25+747/7987>1/100$ and $-1/18+1020/6517>1/10$. For the last, the bound is $9/14+115/637>4/5$. These inequalities follow by completing the square in, respectively, $1-2r/5+(9/2)(83/7987)r^2$, $1/2-r/3+6(85/6517)r^2$, and $3-r+(15/2)(23/1911)r^2$. Also $h_\ell\ge h_5+[\ell(\ell+1)-30]/98$ for $\ell\ge5$. Every shell in the S deficit has energy below $18/5$, since $18/5-2(2.0004)>C_S$. No degree $\ell\ge9$ occurs: with no core its configuration energy exceeds $4/5-11/10>C_S$; with one core, angular momentum zero requires the other two degrees to agree, giving energy $>-2.0004+8/5>C_S$; with two cores the remaining degree is zero. With no core every shell is below $C_S+11/10$. With one core and common nonzero degree $\ell$, use the lower bounds just proved for its partner. The resulting sufficient cutoffs and exact counts are in Table~\ref{tab:helium-interior-certificate-counts}. For P, $3B_*>C_P$ forces a core. Angular momentum one and odd parity then require adjacent remaining degrees $\ell,\ell+1$. The bounds for $h_4,h_5$ exclude $\ell\ge4$, since $-2.0004+1/100+1/10>C_P$. The partner bounds $-11/20$ and $h_3\ge-1/8$ give precisely the P cutoffs in the table. \begin{table}[ht] \centering \begin{tabular}{c|rrrrrrrrr} $\ell$&0&1&2&3&4&5&6&7&8\\ \hline S cutoff&$18/5$&$43/20$&$43/20$&$69/40$&$8/5$&$3/2$&$11/8$&$5/4$&$43/40$\\ S count&7&5&4&3&3&2&2&1&1\\ P cutoff&$13/20$&$21/10$&$13/20$&$13/20$&$9/40$&--&--&--&--\\ P count&4&5&3&2&1&--&--&--&-- \end{tabular} \caption{Complete radial support cutoffs and eigenvalue counts.} \label{tab:helium-interior-certificate-counts} \end{table} For precision about the finite spectral checks, the regular solution at energy $E$ is \[ y_{\ell,E}(r)=(r/7)^{\ell+1}\sum_{k\ge0}a_k(r/7)^k,\qquad a_{-1}=0,\quad a_0=1,\quad a_k=-\frac{28a_{k-1}+98Ea_{k-2}}{k(k+2\ell+1)}. \] The Robin expression is $\mathcal B_\ell(E)=(\ell+7/8)\sum a_k+\sum k a_k$. The singular independent solution fails the form condition at zero, so its zeros are precisely the simple channel eigenvalues. At truncation 260, let $T=\max(|a_{259}|,|a_{260}|)$. For all test energies, $-3\le E\le41/8$, each subsequent pair of coefficients is bounded by a quarter of its predecessor pair. The series tail is at most $T$ on $[0,1]$, and the differentiated tail at one is at most $520T$. Thus strict signs are certified by the truncated values with these explicit allowances. At a cutoff, evaluate the regular series at $k/56$, $1\le k\le56$. In physical radius the spacing is $1/8$. There is no zero in the first cell and at most one in any later cell. Indeed integration of the equation between zeros, followed by Cauchy--Schwarz in the first cell or the Dirichlet inequality in later cells, gives contradictions to $4/8+(41/8)/64<1$ and $(2(41/8)+32)/64<\pi^2$, respectively. Consequently the count of interior zeros is the number of sample sign changes, starting with the positive sign at zero. The number of eigenvalues below $E$ is this count plus one when $\mathcal B_\ell(E)/y_{\ell,E}(7)<0$. For an elementary justification of the last rule, impose zero traces at the interior zeros in \eqref{eq:helium-interior-certificate-ground-transform}. This bounds the negative index by the number of imposed traces, with one more trace at seven if the boundary coefficient is negative. For the reverse inequality use the disjoint nodal pieces of $y_{\ell,E'}$ for $E'10^{13}$ and $>8\cdot10^{15}$, the latter before division by $8\cdot10^{24}$. For P use $15^k/k!$, $15^{59}/59!<10^{-10}$ and $e^{15}<4\cdot10^6$. The errors are $<10^{-9}$ and $<10^{-7}$. The integers exceed $10^9$ and $8\cdot10^{11}$ in magnitude. The finite recurrence, remainder and strict-sign tests involve every listed cutoff, every bracket endpoint and every sample. They give the counts in Table~\ref{tab:helium-interior-certificate-counts}. The disjoint brackets exhaust those counts, so each contains exactly one eigenvalue. \begin{table}[ht] \centering\small \begin{tabular}{c|l} $\ell$&ordered noncore eigenvalue brackets\\ \hline 0&$(-.505,-.504),(-.240,-.239),(.206,.207),(.923,.924), (1.865,1.866),(3.022,3.023)$\\ 1&$(-.503,-.502),(-.247,-.246),(.123,.124),(.753,.754),(1.602,1.603)$\\ 2&$(-.246,-.245),(.003,.004),(.518,.519),(1.258,1.259)$\\ 3&$(-.113,-.112),(.271,.272),(.898,.899)$\\ 4&$(.023,.024),(.543,.544),(1.283,1.284)$\\ 5&$(.177,.178),(.830,.831)$\\ 6&$(.350,.351),(1.136,1.137)$\\ 7&$(.544,.545)$\\ 8&$(.759,.760)$ \end{tabular} \caption{Radial brackets for S; P uses the initial numbers of levels specified by its row of counts, including the core in degree zero.} \label{tab:helium-interior-certificate-brackets} \end{table} \smallskip\noindent \emph{Physical bases and orbital transport.} Write $a=(\ell,k)$ for a shell, $e_a$ for its eigenvalue, $f_a$ for a real normalized radial eigenfunction, and $m_a$ for its fixed rational midpoint. Let \[ \widehat f_a(r)=2^{-96}\sum_k q_{a,k}T_k(2r/7-1), \qquad T_0=1,\quad T_1(x)=x,\quad T_{k+1}(x)=2xT_k(x)-T_{k-1}(x). \] All 28 rows are used for S, and P uses the common first $4,5,3,2,1$ rows in degrees $0,1,2,3,4$. The maximal polynomial degrees are 37 for S and 32 for P. The following certified bounds hold with a common phase on shared rows: \begin{equation}\label{eq:helium-interior-certificate-orbitals} \|f_a-\widehat f_a\|_2<10^{-15}+\sqrt7\,10^{-17}, \qquad |e_a-m_a|<41\cdot10^{-18}. \end{equation} Here is the residual certificate underlying these bounds. The release supplies auxiliary denominator-$2^{120}$ Chebyshev polynomials $p_a$ and rational centers $\mu_a$. Put $x=r/7$, expand $p_a(7x)=\sum_k \mathsf P_kx^k/2^{120}$, and set $d_a=\min(\ell+1,2)$. Define the corrected polynomial by \[ g_a(x)=2^{-120}\left[ \sum_{k\ge d_a}\mathsf P_kx^k -\frac{x^{d_a}}{8d_a-1} \sum_{k\ge d_a}(8k-1)\mathsf P_k \right]. \] It has a factor $x^{d_a}$, and differentiation gives $8g_a'(1)-g_a(1)=0$. Thus the radial function $r\mapsto g_a(r/7)$ vanishes at zero and satisfies the Robin condition at seven. Its second derivative and potential term belong to $L^2(0,7)$: for $\ell=0$ the centrifugal term is absent, and for $\ell\ge1$ the factor $r^2$ cancels its singularity. Integration by parts in \eqref{eq:helium-interior-certificate-radial} therefore puts this function in the radial operator domain. Its residual, expressed in $x$, is \[ -g_a''/98+\ell(\ell+1)g_a/(98x^2)-2g_a/(7x)-\mu_a g_a. \] Exact coefficient arithmetic and $|T_k|\le1$ certify \[ \begin{aligned} \|p_a-g_a(\cdot/7)\|_{L^2(0,7)}&<2\cdot10^{-16},\\ \|(h_\ell-\mu_a)g_a(\cdot/7)\|_{L^2(0,7)}&<2\cdot10^{-17},\\ \left|\|g_a(\cdot/7)\|_{L^2(0,7)}^2-1\right|&<2\cdot10^{-16}. \end{aligned} \] The norm evaluation uses $T_iT_j=(T_{i+j}+T_{|i-j|})/2$ and $\int_0^1T_{2k}(2x-1)\,dx=(1-4k^2)^{-1}$, with odd integrals zero. All other channel eigenvalues are farther than $1/10$ from $\mu_a$, as follows from the adjacent coarse brackets and cutoffs. Expanding $g_a(\cdot/7)$ in the radial eigenbasis therefore bounds its orthogonal component by ten times the residual. Its target component has magnitude greater than $1/2$. This gives $\|p_a-f_a\|_2<10^{-15}$ and $|e_a-\mu_a|<4\cdot10^{-17}$. Finally the complete coefficient comparisons satisfy \[ 2^{-120}\sum_k|2^{24}q_{a,k}-p_{a,k}|<10^{-17}, \qquad |m_a-\mu_a|<10^{-18}, \] where $p_{a,k}$ are the auxiliary Chebyshev integers. This proves \eqref{eq:helium-interior-certificate-orbitals}. It uses no presumed accuracy of the narrower stored energy endpoints. For S, order shells by $m_a$ and retain lexicographic triples $a\le b\le c$ with midpoint sum below $C_S$, even degree sum, the triangle inequalities, and not all three labels equal. Move a repeated first pair to the last two positions. For P, order shells by $(\ell,k)$ and retain $\{s,a,b\}$ with $a=(\ell,k)$, $b=(\ell+1,j)$, $0\le\ell\le3$, and midpoint sum below $C_P$. Addition of the coarse bracket endpoints exhaustively tests these finite lists: S has $6,72,56$ fixed-spin states with two, one and zero core electrons, respectively. P has five repeated-core and eighteen distinct-shell occupations. Included deficits exceed $13/250$ in S and $69/1000$ in P. Excluded finite comparisons have margin $>28/1000$ and $>29/1000$, respectively. The sorted midpoint energies are separated by $>1/2500$. Thus the error in \eqref{eq:helium-interior-certificate-orbitals} and the $<10^{-13}$ error in the source's three-term binary64 selection cannot change either list. To specify normalization, let $A_{\ell_1\ell_2\ell_3}$ denote the real scalar tripolar harmonic in the Condon--Shortley convention, of norm one for $\prod_i d\omega_i/(4\pi)$. For S define $[abc]=f_a(r_1)f_b(r_2)f_c(r_3) A_{\ell_a\ell_b\ell_c}$. For P start with $[sab]=f_s(r_1)f_a(r_2)f_b(r_3)\mathbf V_\ell(\boldsymbol n_2,\boldsymbol n_3)$, where $P_\ell(1)=1$ is the Legendre polynomial and \[ \mathbf V_\ell(\boldsymbol a,\boldsymbol b)= \frac{P'_{\ell+1}(\boldsymbol a\cdot\boldsymbol b)\boldsymbol b -P'_\ell(\boldsymbol a\cdot\boldsymbol b)\boldsymbol a} {\sqrt{\ell+1}} . \] Every assignment permutes the entire radial and angular expression. Put $F_{abc}=([abc]-[bac])/\sqrt2$. For distinct shells take \[ \frac{F_{abc}+F_{acb}}{\sqrt2},\qquad \frac{F_{abc}-F_{acb}-2F_{bca}}{\sqrt6}; \] for a repeated S occupation take $F_{abb}$, and for a repeated P core take $F_{sbs}$. Convert a P vector to $\sqrt3$ times its third component. Divide each resulting reduced scalar by $(4\pi)^{3/2}r_1r_2r_3$, calling the result $w$, and give the spinor the three nonzero components \[ \frac{w(x_1,x_2,x_3)}{\sqrt3},\quad -\frac{w(x_1,x_3,x_2)}{\sqrt3},\quad \frac{w(x_2,x_3,x_1)}{\sqrt3} \] at $\uparrow\uparrow\downarrow,\uparrow\downarrow\uparrow, \downarrow\uparrow\uparrow$, respectively. These formulas give isometries $F_J$ onto the entire fixed magnetic subspaces of $\operatorname{ran}D_J$, of dimensions $134$ and $41$. For completeness, tensoring degree-$i$ and degree-$j$ angular representations gives each degree $|i-j|,\ldots,i+j$ once: subtract the multiplicities of adjacent weights in the product to obtain this count. Thus an S angular invariant is unique exactly for a triangle. Its exchange sign is $(-1)^{i+j+k}$, as is seen by exchanging the factors of the invariant $\Delta_{12}^{i+j-k}\Delta_{23}^{j+k-i}\Delta_{31}^{k+i-j}$ in the homogeneous-polynomial representation, where $\Delta_{ij}=\mathsf u_i\mathsf v_j-\mathsf v_i\mathsf u_j$ are the determinant polynomials in the two formal variables of each factor. For distinct shells the three first-two-antisymmetric assignments are orthonormal. Spin raising annihilates precisely the coefficient plane orthogonal to $(1,-1,1)$, with the two orthonormal vectors displayed above. Repeated shells leave one vector. Three equal S shells leave none. The P vector is the negative gradient of $|\boldsymbol y|^{-\ell-1}P_\ell(\boldsymbol a\cdot \boldsymbol y/|\boldsymbol y|)/\sqrt{\ell+1}$ on the unit sphere. Its separate degrees are $\ell,\ell+1$, and \[ \int|\mathbf V_\ell|^2= \frac1{\ell+1}\left\{\frac{(\ell+1)^2}{2\ell+1} +\frac{\ell(\ell+1)}{2\ell+1}\right\}=1. \] This gives the unique permitted P angular copy. The spectral cutoff and finite lists above therefore exhaust the deficit, rather than select a trial subspace. The radial factors cancel the Cartesian Jacobians, the three spin components preserve inner products, and rotational invariance gives $3\int B_{\alpha,3}B_{\beta,3}=\int\boldsymbol B_\alpha\cdot \boldsymbol B_\beta$, also with an invariant multiplier inserted. These identities account for every physical measure and magnetic factor. Let $\widehat F_J$ replace $f_a$ by $\widehat f_a$ in these formulas, let $W_J$ be diagonal with entries $\sqrt{C_J-\sum_{a\in\alpha}m_a}$, and put $X_J=D_JF_J$, $\widehat X_J=\widehat F_JW_J$. At most seven radial functions occur in a channel, so \eqref{eq:helium-interior-certificate-orbitals} bounds the one-electron map error by $3\cdot10^{-15}$. Telescoping the third tensor power, then restricting to its antisymmetric subspace, gives error $(1+3\cdot10^{-15})^3-1<9.1\cdot10^{-15}$. All deficits exceed $1/20$. Hence the error in their exact square roots is $<3.1\cdot10^{-16}$, using $|\sqrt a-\sqrt b|=|a-b|/(\sqrt a+\sqrt b)$. The core capacity and noncore floor give $\|X_S\|<3$, $\|X_P\|<2$, and therefore \begin{equation}\label{eq:helium-interior-certificate-transport} \|\widehat F_J\|0$, the weight is enclosed by \[ \frac1{(1-a^2)d_+^2},\qquad \frac1{(1-b^2)d_-^2}. \] Their outward integer bounds must lie inside the supplied weight row. The complete tests cover all 563 rows of the eight rules. There are then $N$ distinct simple roots, so all roots are covered. Rodrigues' formula gives orthogonality of $P_N$ to lower degrees. For a root $z_i$ its cardinal polynomial $P_N(x)/((x-z_i)P_N'(z_i))$ has integral $2/((1-z_i^2)P_N'(z_i)^2)$, by the telescoping Legendre kernel identity. Polynomial division by $P_N$ proves exactness through degree $2N-1$ and positivity of the weights. Furthermore $|P_N'|\le N(N+1)/2$ gives node distance at least $1/(N(N+1))$ from either endpoint in $[0,1]$ and weight at least $4/(N^2(N+1)^2)$. The certified boxes for $N\le122$ therefore have node lower endpoints $>2^{-15}$ and weight lower endpoints $>2^{-27}$. For each actual radial rule, compare every binary64 node and weight as an exact dyadic number with both endpoints. Let $E_i$ be the largest absolute node distance, and $R_i,V_i$ the largest such node and weight distances divided by their positive lower endpoints. The completed exact comparisons give $E_i<5\cdot10^{-16}$, $R_i,V_i<1$ and actual nodes and weights in $(2^{-35},1)$. S uses the repeated tridiagonal-rule outputs; P converts the exact dyadic interval midpoints at precision 256 before binary64 rounding. The latter conversion adds at most $2^{-192}+2^{-53}(1+2^{-192})$ to midpoint error, which is within the same absolute node cap. The independent angular reconstruction uses integer intervals at scale $F=2^{110}$. Addition, four-corner multiplication and positive division round outward by integer floor and ceiling. Square roots use integer square roots of the scaled endpoints. For every noncentral azimuth proposal $a_k^{\mathrm{az}}$, the integers defined by \[ S_0=1,\quad S_1=A,\quad S_j=2AS_{j-1}-F^2S_{j-2} \] have opposite nonzero signs at $A=a_k^{\mathrm{az}}-2,a_k^{\mathrm{az}}+2$ for $j=n_a$. The central box is zero, and all boxes are strictly descending and disjoint. Since $S_j=F^jT_j(A/F)$, these tests identify all the exact azimuthal cosines without assuming cosine-library accuracy. The angular reconstruction evaluates the normalized tripolar polynomial and the two direction coefficients of $\mathbf V_\ell$. For specificity let $\lambda=(\ell_1,\ell_2,\ell_3)$ and $0\le k\le\min(\ell_2,\ell_3)$. Let $\mathcal I_{\lambda k}$ be the integers from $\max(0,\ell_2-\ell_3,\ell_1+k-\ell_3)$ to $\min(\ell_1+\ell_2-\ell_3,\ell_1,\ell_2+k)$. Define the factorial denominators and coefficients by \begin{align*} D_{\lambda kj}={}&j!(\ell_1+\ell_2-\ell_3-j)!(\ell_1-j)! (\ell_2+k-j)!\\ &\times(\ell_3-\ell_2+j)!(\ell_3-\ell_1-k+j)!,\\ p_{\lambda k}={}&(-1)^{\ell_1-\ell_2+k} \sum_{j\in\mathcal I_{\lambda k}}\frac{(-1)^j}{D_{\lambda kj}}, \end{align*} \[ s_{\lambda k}= \frac{(\ell_1+\ell_2-\ell_3)!(\ell_1-\ell_2+\ell_3)! (-\ell_1+\ell_2+\ell_3)!}{(\ell_1+\ell_2+\ell_3+1)!} (\ell_1!)^2\prod_{i=2}^3(\ell_i+k)!(\ell_i-k)! . \] With $x=c_{12},y=c_{13},z'=c_{23}$, define $R_0=1$, $R_1=z'-xy$ and $R_{k+1}=2(z'-xy)R_k-(1-x^2)(1-y^2)R_{k-1}$. The scalar value is \[ A_\lambda=\sum_k p_{\lambda k}(-1)^k(2-\mathbf1_{\{k=0\}}) \sqrt{s_{\lambda k} \prod_{i=1}^3(2\ell_i+1) \prod_{i=2}^3\frac{(\ell_i-k)!}{(\ell_i+k)!}}\, P_{\ell_2}^{(k)}(x)P_{\ell_3}^{(k)}(y)R_k . \] For a zero degree this reduces to $(-1)^\ell\sqrt{2\ell+1}P_\ell$ of the opposite pair cosine. The exact identity $(2\ell_1+1)\sum_k(2-\mathbf1_{\{k=0\}})p_{\lambda k}^2s_{\lambda k}=1$ is checked for every used label. Pairing the positive and negative magnetic indices in the Condon--Shortley expansion gives the displayed polynomial, so this reconstruction has the same normalization as the physical basis. Derivatives are evaluated by \[ P_k^{(k)}=(2k-1)!!,\quad P_{k+1}^{(k)}=(2k+1)x(2k-1)!!,\quad (\ell-k)P_\ell^{(k)} =(2\ell-1)xP_{\ell-1}^{(k)}-(\ell+k-1)P_{\ell-2}^{(k)}. \] After directed conversion of interval endpoints to binary64, every product is enclosed by the predecessor of the smallest rounded corner and the successor of the largest. Sums are treated the same way. For an exact value in $[a,b]$ and computed value $y$, the larger of the upward-rounded differences $y-a,b-y$ bounds the absolute error. Add these nonnegative bounds with an upward successor after every addition. Apply this to every weighted surface pair and every angular tuple; for P expand each dot product into all four direction-coefficient products. Denoting the production weighted pairs by $\widehat P_{ij\nu}$, the resulting complete outward sums give \begin{equation}\label{eq:helium-interior-certificate-angular-input} \sum_\nu|\widehat P_{ij\nu} -w_\nu(B_\nu^{\mathsf T}B_\nu)_{ij}|<\zeta_J . \end{equation} There are $15625$ tuples and $1128$ pairs for S, and $4913$ tuples and $231$ pairs for P. Their recorded maximum outward sums are respectively $1.8458901975602706\cdot10^{-14}$ and $5.242822235381616\cdot10^{-15}$. The current-angular errors are bounded by $8\cdot10^{-14}$. All three computed cosines lie in $[-1,1]$ and their errors are $<5\cdot10^{-15}$. The successor comparisons with the exact rational caps establish the strict values $\zeta_J$ in the table below. This is an error summed over all tuples, not a pointwise sample bound. The audit and production arrays coincide entry by entry in their ordered indices. This correspondence includes the orbital coefficients, energy means, selected states, surfaces, nodes, weights, current angular arrays and weighted pairs. The S production and radial audit use precision 192 for their energy conversion. Current plans can be made at 192 or 256. P production and radial audit use 256, while its angular audit uses 192. For coefficients of denominator $2^{96}$ and absolute sum below two, conversion at either precision is exact before the final binary64 rounding. For the non-dyadic energies, all 28 midpoint rounding cells have distance $>10^{-24}$ from their rational inputs. The precision-192 conversion error is $<16\cdot2^{-192}$. For the 109 coefficients in the 42 current plans, the exact factorial tables give either zero or a squared coefficient in $(2^{-32},2^{12})$ with reduced denominator $<2^{32}$. Its positive square root is farther than $2^{-180}$ from any binary64 rounding midpoint in the relevant range: the squared midpoint has denominator between $2^{92}$ and $2^{140}$, so the nonzero difference of squares is $>2^{-172}$. The precision-192 coefficient evaluation error is $<2^{-183}$. Thus the 192- and 256-bit computations round identically, including the exact zero. The 34 P angular node and weight midpoints have certified distance $>2^{-77}$ from their binary64 rounding midpoints, whereas their high-precision conversion error is $<2^{-192}$. They too give identical binary inputs. The same ordered constructors and the repeatability assumptions then identify the actual arrays. Equality of dimensions alone would not establish this correspondence. \smallskip\noindent \emph{Local radial and spectral-diagonal errors.} Put $\varepsilon=2^{-53}$, $\tau=2^{-1074}$, $\epsilon_{\mathrm{abs}}=10^{-190}$, $\gamma(k)=k\varepsilon/(1-k\varepsilon)$ and $\operatorname{rnd}(s)=\varepsilon s+\tau$ for $s\ge0$. A finite rounded operation admits the representation \begin{equation}\label{eq:helium-interior-certificate-rounding} \operatorname{RN}(x)=x(1+\theta)+e,\qquad |\theta|\le\varepsilon,\quad |e|\le\tau . \end{equation} This follows from half the normal-binade spacing or half the subnormal spacing and also holds for a fused multiply-add. Here is the exact radial error ledger, including coefficient conversion. For one orbital write its unit-interval coefficients as $c_0,\ldots,c_{d_{\mathrm{Cl}}}$, $d_{\mathrm{Cl}}\le37$, and their actual dyadic values as $\widehat c_k$. Initialize $b^{\mathrm{Cl}}_{d_{\mathrm{Cl}}+1}=b^{\mathrm{Cl}}_{d_{\mathrm{Cl}}+2}=0$. Descending from $k=d_{\mathrm{Cl}}$ to 1 compute rational bounds \[ s_k^{\mathrm{Cl}}=\operatorname{rnd}(|\widehat c_k|+b_{k+2}^{\mathrm{Cl}}), \qquad m_k^{\mathrm{Cl}}=\operatorname{rnd}(2b_{k+1}^{\mathrm{Cl}}), \] \[ a_k^{\mathrm{Cl}}=\operatorname{rnd} (2b_{k+1}^{\mathrm{Cl}}+m_k^{\mathrm{Cl}}+|\widehat c_k| +b_{k+2}^{\mathrm{Cl}}+s_k^{\mathrm{Cl}}), \] \[ e_k^{\mathrm{Cl}}=s_k^{\mathrm{Cl}}+m_k^{\mathrm{Cl}}+a_k^{\mathrm{Cl}}, \qquad b_k^{\mathrm{Cl}}=\sum_{j=k}^{d_{\mathrm{Cl}}}(j-k+1)(|\widehat c_j|+e_j^{\mathrm{Cl}}). \] Set \[ p^{\mathrm{Cl}}=\operatorname{rnd}(b_1^{\mathrm{Cl}}),\qquad a_0^{\mathrm{Cl}}=\operatorname{rnd} (|\widehat c_0|+b_1^{\mathrm{Cl}}+p^{\mathrm{Cl}}), \] \[ s_0^{\mathrm{Cl}}=\operatorname{rnd} (|\widehat c_0|+b_1^{\mathrm{Cl}}+p^{\mathrm{Cl}} +a_0^{\mathrm{Cl}}+b_2^{\mathrm{Cl}}), \] \[ E_{\mathrm{Cl}}=\sum_{k=0}^{d_{\mathrm{Cl}}}|\widehat c_k-c_k| +\sum_{k=1}^{d_{\mathrm{Cl}}}e_k^{\mathrm{Cl}} +p^{\mathrm{Cl}}+a_0^{\mathrm{Cl}}+s_0^{\mathrm{Cl}}, \qquad D_{\mathrm{Cl}}=\sum_{k=0}^{d_{\mathrm{Cl}}}k^2|c_k|. \] The implemented Clenshaw step is $(B,A)\leftarrow(A,\operatorname{muladd}(2t,A, \operatorname{RN}(\widehat c_k-B)))$, starting at zero, with $t=\operatorname{RN}(2x-1)$. Its return is $\operatorname{RN}(\operatorname{RN}(\widehat c_0+ \operatorname{RN}(tA))-B)$. Let $\mathcal U_j$ be the second-kind Chebyshev polynomials, defined by $\mathcal U_0=1$, $\mathcal U_1(t)=2t$ and $\mathcal U_{j+1}=2t\mathcal U_j-\mathcal U_{j-1}$. The bound $|\mathcal U_j(t)|\le j+1$ on $[-1,1]$ shows by descending induction that $b_k^{\mathrm{Cl}}$ bounds each computed recurrence value. The final identity $t\mathcal U_{k-1}-\mathcal U_{k-2}=T_k$, with $\mathcal U_{-1}=0$, gives error $E_{\mathrm{Cl}}$ at fixed $t$. Since $|T_k'|\le k^2$, the radial product arguments give \[ \Delta_t=2(E_1+E_2+E_3+2\operatorname{rnd}(1)) +\operatorname{rnd}(1),\qquad A_*=\max_a\sum_k|c_{a,k}|,\quad e_*=\max_a(E_{\mathrm{Cl},a}+D_{\mathrm{Cl},a}\Delta_t). \] Thus every computed orbital value differs from its exact-node polynomial value by at most $e_*$ and has magnitude at most $A_*+e_*$. Every cell of $T_\kappa$ is a sum of at most six terms. Their spin factors belong to \[ \left\{\pm1/\sqrt2,\ \pm1/2,\ \pm1/\sqrt{12},\ \pm2/\sqrt{12}\right\}. \] The source uses the divisions by rounded $\sqrt2$ and $\sqrt6$. Their relative error is $<5\varepsilon$. Each term has three left-associated orbital multiplications and at most six summation rounds. Consequently \begin{align} \mathcal C_T={}&6\left\{(A_*+e_*)^3-A_*^3+ [(1+5\varepsilon)(1+\varepsilon)^9-1](A_*+e_*)^3\right\} +64\tau,\label{eq:helium-interior-certificate-cell}\\ \mathcal C_{\mathrm{jac}}={}& \prod_{i=1}^3(1+V_i)(1+R_1)^2(1+R_2) (1+\varepsilon)^{10}-1 \label{eq:helium-interior-certificate-jac} \end{align} bound, respectively, each entry error $|\widehat T_\kappa-T_\kappa|$ and the relative Jacobian error. In \eqref{eq:helium-interior-certificate-cell}, an absolute rounding residue in the first orbital multiplication is amplified by at most four, in the second by two, and in the last by one. With six terms and the summation residues, their total is $<64\tau$ when $A_*+e_*\le2$. The Jacobian uses six positive factors counting the repeated first node, all above $2^{-35}$, so its nonzero partial products are normal and at most ten relative rounds suffice. The exact ledger on every coefficient and every node gives $A_*<1.6$, $e_*<10^{-12}$, and the strict caps $\mathcal C_T0$ with the exact deficit $A>0$ by its rational residual $r=|(d')^2-A|$. If $2d'-r/d'>0$, then \[ |d'-\sqrt A|=\frac{r}{d'+\sqrt A} \le\frac{r}{2d'-r/d'}. \] The tables cover all 90 S occupations, including all three parenthesizations of their three-energy sums, and all 23 P occupations, repeated with their spin multiplicities. They certify $d'\ge l/1000$, $l\ge220$, and residual bounds $r\le v'/10^{19}$ for S and $r\le v'/10^{20}$ for P. The integer margins $4(2l-1)-v'$ and $17(2l-1)-2v'$ have minima 259 and 339, respectively. Since $v'<10^6$, the denominator above exceeds $(2l-1)/1000\ge439/1000$. These comparisons prove \[ \|\widehat W_J-W_J\|10^{-20}$, whereas conversion and square-root errors at precision 192 or higher change the square by $<32\cdot2^{-192}$. Its saved decimal diagonal entries lie in these same cells. Thus both the production diagonal and the audited one are covered, including the positivity of every residual denominator. \smallskip\noindent \emph{The local multiplier ledger and the complete grid.} Put $d_x=5\cdot10^{-16}$, $e_{\mathrm{ang}}=5\cdot10^{-15}$ and $e_{\mathrm{harm}}=8\cdot10^{-14}$. Define $H_p=\lceil\sqrt{\prod_i(2\Lambda_{p,i}+1)}\rceil$ and $\beta_j=2^{-32}\sum_pH_pL^J_{p,j}$. The prior integer bound on $L^J_{p,j}$ ensures that every absolute value and sum is safe in signed 64-bit arithmetic and that conversion of every current coefficient to binary64, then scaling by $2^{-32}$, is exact. The following is the complete rational ledger for one profile. Initialize $t_0'=t_1'=0$ and compute, $1\le\ell\le8$, \[ t_{\ell+1}'=2t_\ell'+t_{\ell-1}' +\gamma(4)(3+2t_\ell'+t_{\ell-1}') +\epsilon_{\mathrm{abs}},\qquad e_{\mathrm{Ch}}=\max_{0\le\ell\le9}t_\ell' +81(2d_x+\varepsilon), \] \[ e_{b,j}=\beta_j\{(1+e_{\mathrm{Ch}})^3 (1+e_{\mathrm{harm}})(1+\gamma(170))-1\} +\epsilon_{\mathrm{abs}}. \] Initialize $a_0'=a_1'=0$ and compute, $1\le\ell1200$), but the bound includes that alternative as well. For a contraction of inner length $k$, the resulting product tree has at most $2k+12$ relative rounds on a leaf-to-output path, including panel accumulation and scaling; for $\alpha=1,\beta=0$ the bound $2k$ suffices. There are at most $20(k+1)$ primitive rounding sites affecting one output. For example ordinary panels use at most $7k+1$ sites, small eight-lane calls at most $2k+24$, and blocked GEMV T at most $11k+2$. Fusion reduces these bounds. Writing \[ N_a=n_a^3,\qquad L=3n_1n_3,\qquad p=(4m+40)(L+1)+2n_2+20, \] the angular path bounds are $2N_a+12=31262,9838$, the radial bounds are $p=5007324,2030314$, and twelve rounds suffice for terminal scaling, symmetrization and decimal replacement. The absolute errors in \eqref{eq:helium-interior-certificate-rounding} must be transported separately. For one contraction, put $q_*=\max(1,|\alpha|,\max|A_{ij}|,\max|B_{ij}|)$. An inserted residue encounters at most one subsequent nonunit factor, bounded by $q_*$, and its later relative inflation is $<2$. Thus its total output allowance is $40(k+1)q_*\tau$. When $\alpha=1,\beta=0$, one may take $q_*=1$. The local radial bounds give $|\widehat T_\kappa|<64$, $0<\widehat j_\kappa<1372$, and the exact angular identity and \eqref{eq:helium-interior-certificate-angular-input} give $\sum_\nu|\widehat P_{ij\nu}|\le1+\zeta$. Consequently angular partial sums and entries have magnitude $<2$. Their additive error has matrix norm $<2^{26}\tau$. In the first radial product the output error is $<2^{11}\tau$ per entry and every partial sum is $<2^{14}$. In the second product new residues total $<2^{25}\tau$, while transported first-product residues total $<2^{35}\tau$. There are fewer than $2^{22}$ radial updates and the old accumulator is never rescaled by the next Jacobian. Its path inflation remains $<2$. Hence the final radial additive error is $<2^{60}\tau$ per entry. Terminal scaling and symmetrization add a symmetric matrix error of norm $<2^{20}\tau$. Each of these three separate bounds is $<\epsilon_{\mathrm{abs}}$. These estimates do not assume finite intermediates circularly. Before any hypothetical first overflow, the same absolute-leaf bounds apply. A radial leaf is bounded by $2^{24}$, and fewer than $2^{34}$ such leaves contribute to an entry. Group partial sums are therefore $<2^{60}$ and terminal values $<2^{70}$, contradicting overflow. For underflow, retaining all relative factors and deleting absolute residues defines a comparison evaluation. Each contraction is affine in its preceding partial sums, so the transported residue bounds remain valid with correlated roundings. In a round-trip print, the exact decimal lies in the rounding cell of the binary entry. Its relative displacement is $\le\varepsilon$ for a normal entry and absolute displacement $\le\tau$ for a subnormal entry. This is the last terminal round and allowance. Reflection in S, and the equal rounded pairwise sums in P, make both the comparison and the residual symmetric. Array ownership also matters to the graph. Each outer-loop iteration owns its accumulator and maximum slot, angular moments, radial matrices, product workspace and writable current workspace. The node, coefficient, angular and state arrays are read-only. Workspaces allocated without initialization are overwritten by beta-zero calls before use. The overlap diagnostics use separate accumulators or fully overwritten temporary arrays and do not feed the certified matrix. Ownership is by iteration, rather than by a fixed operating-system thread, so task migration does not change this argument under (R2)--(R3). \smallskip\noindent \emph{Propagation to the decimal center.} For a product path of length $k$, the product of its rounding factors differs from one by at most $\gamma(k)$: $(1-\varepsilon)^k\ge1-k\varepsilon$ and $(1+\varepsilon)^k\le(1-k\varepsilon)^{-1}$. We now give the full operator-norm budget, so entrywise and operator errors are not interchanged. Write $\lceil\sqrt a\rceil$ for the least integer whose square is at least $a$. With the profile values in Table~\ref{tab:helium-interior-certificate-errors}, define \begin{align*} a_*&=mM[\zeta+\gamma(2N_a+12)(1+\zeta)] +\epsilon_{\mathrm{abs}},\qquad k_*=M+a_*,\\ \Delta&=\lceil\sqrt{343nm}\rceil e_T,\qquad t_*=t_0+\Delta,\qquad t_c=t_0+\lceil\sqrt{343m}\rceil e_T,\\ H_*&=(M+e_f)(2t_0+\Delta)\Delta +(e_f+a_*+\rho k_*)t_*^2,\\ B_*'&=\gamma(p)(1+\rho)t_c^2\lceil\sqrt m\rceil k_* +\epsilon_{\mathrm{abs}},\\ E_*&=k_*(1+\rho)t_c^2+B_*',\\ R_*&=d^2H_*+2d\,d_Dt_0^2(M+e_f) +nd^2[B_*'+\gamma(12)E_*]+\epsilon_{\mathrm{abs}}. \end{align*} All these expressions are rational. The angular identity implies, by Cauchy--Schwarz, $\sum_\nu|w_\nu(B_\nu^{\mathsf T}B_\nu)_{ij}|\le1$. It follows that $\|\widehat A_\kappa\|\le k_*$ and $\|\widehat A_\kappa-A_\kappa\|\le a_*+e_f$. Equation~\eqref{eq:helium-interior-certificate-stack} and the Frobenius bound give stacked radial-map error at most $\Delta$ and individual stacked column norms at most $t_c$. Telescoping the radial maps, angular matrices and weights therefore costs at most $H_*$ before diagonal scaling. Moreover $\||\widehat A_\kappa|\|\le\sqrt m\, \|\widehat A_\kappa\|$, where the inner absolute value is entrywise. The sum of the absolute radial leaves in one matrix entry is therefore bounded by $(1+\rho)t_c^2\lceil\sqrt m\rceil k_*$. The path count gives entrywise radial error at most $B_*'$ and entry magnitude at most $E_*$. Reflection or transpose averaging preserves entrywise error from the symmetric exact comparison. An $n$ by $n$ symmetric matrix with entries bounded by $e$ has norm at most $ne$, which accounts for the factor $n$ in the last term of $R_*$. For the exact unscaled radial matrix $G=\sum_\kappa j_\kappa T_\kappa^{\mathsf T}A_\kappa T_\kappa$, telescoping both diagonal factors in $\widehat W_JG\widehat W_J-W_JGW_J$ gives $2d\,d_Dt_0^2(M+e_f)$. Thus \begin{equation}\label{eq:helium-interior-certificate-center-error} \|\mathcal K_J-M_{0,J}\|\le R_* . \end{equation} The integer square-root ceilings in this order are $(1470,127,7)$ for S and $(544,85,5)$ for P. Evaluating the nonnegative budget with upward rational rounding to $10^{-24}$, and enlarging $\epsilon_{\mathrm{abs}}$ to $10^{-30}$ for this evaluation only, gives the certified upper values \begin{align*} R_{*,S}&\le\frac{1278973577592006297}{62500000000000000000000} <.0000204636,\\ R_{*,P}&\le\frac{22403063932239163}{100000000000000000000000} <.000000224031 . \end{align*} The order of upward evaluation is $\gamma(2N_a+12),\gamma(p), \gamma(12),a_*,H_*,B_*',E_*$, the diagonal term, then $R_*$. Each expression is nondecreasing in the earlier upper bounds. The complete integer numerator/denominator and rounding-remainder tables in the release certify every such rounding. The strict margins to the displayed caps are respectively $1422407993703/62500000000000000000000$ and $36067760837/100000000000000000000000$. \smallskip\noindent \emph{Exact center residuals.} The complete original execution regenerates both centers from the stated inputs, with the validated S parameters $(7,5/2,10,4;122,98,60,25)$ and P's exact, non-bare branch $(107,83,51,17)$. The selected angular degrees are at most eight, so S's degree-100 filter removes no state. It removes pre-existing working centers before production. The retained new files and the certificate centers have equal complete bytes and equal entrywise parsed binary64 values in the same basis order. Full orbital-table regeneration is likewise compared with the original parsed data. The local audits use the same constructors, inputs and index orders as production, as detailed above. Under the preservation and repeatability assumptions this identifies the decimal-rational $M_{0,J}$ in \eqref{eq:helium-interior-certificate-center-error} with the following residual certificate. Hashes serve only to identify artifacts. Equality of hashes is not used as a mathematical matrix identity. Parse all center fields as exact decimal rationals, allowing an optional sign, decimal fraction and decimal exponent. The parser enforces printable ASCII, tabs and LF or CRLF, exactly $n$ noncomment data rows and exactly $n$ nonempty numeric fields in each row. No columns are skipped. The integer witness has exactly $i+1$ signed integer entries in zero-based row $i$, and is zero above the diagonal. Call it $Y_J$. It is an arbitrary integer matrix. Positivity, invertibility and accuracy of a proposed floating Cholesky factor are unnecessary. Set $g=10^{12}$, $(b_S',b_P')=(99913,99440)$ and \[ A_{ij}'=\operatorname{rne}(gM_{0,J,ij}),\qquad R_{ij}'=(b_J'-1)10^{19}\mathbf1_{\{i=j\}} -gA_{ij}'-\sum_{k=0}^{\min(i,j)}Y_{J,ik}Y_{J,jk}, \] where $\operatorname{rne}$ denotes nearest-integer rounding with even ties. Define $r_*=\max_i\sum_j|R_{ij}'|$ and $e_{\mathrm{dec}}=\max_{ij}|M_{0,J,ij}-A_{ij}'/g|$. Every entry in both triangles participates in the residual calculation. An independent upper-triangle accumulation, adding each off-diagonal residual to both rows, gives the same complete row list and the same exact rational rounding error. The retained exact evaluations are \[ \begin{array}{c|r|c} J&r_*&e_{\mathrm{dec}}\\ \hline S&48147215284892& 249985617507/500000000000000000000000\\ P&15565316152274& 2497913/5000000000000000000 \end{array} \] so all 175 row sums are $<10^{15}$. The symmetry proved above means that the checker's rational symmetrization leaves the center unchanged. Writing $c_J=b_J'/10^5$, the residual identity and row-sum norm bound imply \[ c_JI-M_{0,J}\ge \left(10^{-5}-\frac{r_*}{g^2}-ne_{\mathrm{dec}}\right)I +\frac{Y_JY_J^{\mathsf T}}{g^2}>0. \] The scalar is positive even on replacing $r_*$ by $10^{15}$ and $e_{\mathrm{dec}}$ by $1/(2g)$. This is the triangular-witness simplification: the proof uses integer products and row sums, irrespective of how the witness was found. In particular, \[ M_{0,S}<.999130I,\qquad M_{0,P}<.994400I . \] Combining these ceilings with \eqref{eq:helium-interior-certificate-physical-error} and \eqref{eq:helium-interior-certificate-center-error} gives \[ M_{\mathrm{phys},S}<.9991504646I<.999151I,\qquad M_{\mathrm{phys},P}<.994400224131I<.994401I . \] \smallskip\noindent \emph{The full-sector form inequalities.} The complete fixed magnetic bases transfer these ceilings to $D_JU_JD_J$. The other spin and orbital magnetic components have identical matrices, since $D_J$ and $U_J$ commute with the corresponding rotations. Entries between distinct magnetic components vanish. The magnetic multiplicities are two for S and six for P. On the orthogonal complement of $\operatorname{ran}D_J$ this operator is zero. Thus on the full sectors $D_JU_JD_J\le\mathfrak b_J I$, with $\mathfrak b_S=.999151$, $\mathfrak b_P=.994401$. Put $\mathcal A_J=V+\delta_J$. It is positive with $\mathcal A_J\ge(\delta_J+3/14)I$, because each pair distance in $B_7$ is at most fourteen. Equation~\eqref{eq:helium-interior-certificate-majorant} yields $D_J\mathcal A_J^{-1}D_J\le\mathfrak b_JI$. The bounded operator $\mathcal A_J^{-1/2}D_J$ and its adjoint therefore have norm at most $\sqrt{\mathfrak b_J}$. Applying the adjoint to $\mathcal A_J^{1/2}v$ gives $\|D_Jv\|^2\le\mathfrak b_J\|\mathcal A_J^{1/2}v\|^2$. Spectral calculus gives $H_0-C_J\ge-D_J^2$. Therefore on the Coulomb form domain, \[ q_<[v]+\frac1{16}\|\operatorname{Tr}v\|_{L^2(\partial K_7)}^2 -z\|v\|^2 \ge(1-\mathfrak b_J)\|\mathcal A_J^{1/2}v\|^2 \ge(1-\mathfrak b_J)(\delta_J+3/14)\|v\|^2. \] The Coulomb terms are form bounded on $H^1(K_7)$, so the inequality extends there by form continuity. No operator Robin boundary condition is imposed on $v$. Finally $(1-.999151)(5/2+3/14)=16131/7000000$ and $(1-.994401)(1+3/14)=95183/14000000$. The complete spectral count controls the omitted configurations, the physical transport controls the orbital replacements, and the local and assembly estimates control the passage from exact cubature to the certified centers. These give the asserted inequalities for every vector in the stated full sectors. \end{proof}