Harden empirical branch-golden generation and fixture trust invariants

[siddhss5]

Context

PR #581 introduces the first M7 branch-completeness contracts and a chart-free, multistart-LM reference set. The current five committed goldens are internally consistent: an independent review forced every fixture through the full 8,000-restart budget and recovered exactly the committed sets, with no novel or missing branches.

This follow-up is about making the future generation contract as honest and robust as the current data.

Problem

enumerate_branches currently declares a result stabilized when its branch count repeats over several increasing budgets. Those budgets are deterministic nested prefixes from the same fixed RNG sequence. A plateau over 500, 1,000, and 2,000 starts is useful evidence, but it cannot prove that a small basin will not first be hit at 4,000 or 8,000 starts.

The solver-subset guard also cannot detect a branch missed by both the production solver and the empirical oracle—the exact class of shared omission M7 is intended to expose.

There is no need for a nightly build. Golden generation is an offline, reviewable operation that should run when the fixture or oracle changes.

Scope

• For committed goldens, exhaust the configured maximum search budget instead of stopping at the first count plateau.
• Support several independent RNG sequences and union their converged branch sets. This may require making the LM restart seed injectable or owning seed generation in the oracle.
• Record the seeds, per-seed budgets, total restart count, and discovered-count history in the golden metadata.
• Rename stabilized to an empirical term such as count_plateaued; do not present it as a mathematical completeness certificate.
• Keep the documented distinction between an empirical reference set and a certified algebraic/interval/homotopy root count.
• Assert fixture regularity and known-solution inclusion before accepting a golden.

Required golden invariants

For every finite-branch fixture:

• rank(J(q_star)) == 6 for a 6R fixture.
• The committed set contains the known construction point q_star modulo wrapping.
• Every branch independently FK-closes.
• Every pair of retained branches exceeds the declared deduplication tolerance.
• Every production-solver branch is represented in the empirical set.
• Maximum-budget, multi-seed regeneration reproduces the committed set.

Acceptance criteria

• Golden generation always runs the full configured offline search.
• At least two independent deterministic seed sequences contribute to each committed set.
• Golden metadata makes the empirical search evidence reviewable.
• Generation fails rather than writing an acceptable golden if q_star is absent or the fixture is rank deficient.
• Documentation calls the result an empirical branch reference, not a proof of completeness.
• No nightly or scheduled workflow is required; the regeneration command and review policy are documented.

Related: #573, #571, PR #581.

[siddhss5]

Trust hazard found while diagnosing #597: tests/_branch_oracle.py → lm_multi_restart dedups at policy.subproblem_dedup = 1e-3 (the oracle only overrides subproblem_numerical). Near a fold it would therefore merge genuinely distinct twin branches, exactly as the solver does, so goldens built on it cannot catch that failure mode. The oracle's merge radius should be independent of the solver's.