tools(verify): fast/medium/full verification tiers with a compiled-in source stamp (L39); research R6

BuildLinux.sh hashes a sorted manifest of compiled inputs into VOXELFORGE_SOURCE_STAMP, printed first by
every executable; Standalone/Tools/verify/verify.py checks it before and after each tier and records
binary/input hashes and the resolved recipe, style map and layout. Fast (163 s) runs on the canonical owner
world only and asserts FI Style 2 / SW Style 1; medium (8 min) and full (26 min) add the style matrix,
GCC, determinism and cost. Controls: stale source, mislabelled style-0 owner, all-black capture, L30/L31,
L35/L36 and the L38 step are all rejected. No geometry change; owner hashes identical to L37.
Research R6: leak table, generator contract and a 10-step metre-native migration plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016dhxM43dnWvUu2B5Ph1iG1

Standalone/Research/WorldAssemblerM3/Research6/shared-notes.md

@@ -0,0 +1,14 @@
+# Shared notes (researcher R6 <-> implementer L39), newest at bottom
+
+
+## R5 read-only architecture findings (2026-10-23)
+
+Inspected `Standalone/BuildLinux.sh`, `Build.ps1`, `Core/core_sources.txt`, `Source/StreamBenchmarkHeadless.cpp`, `Source/LinuxOffscreenCapture.cpp`, `data/owner_world.json`, the L37 passage/invariant/legacy/ring/capture/crease/fragment runners, `Saved/Linux/l37/mouth-curves-run/layout-owner-fi.json`, and the R5/L37 reports. No source was changed and no binary was run.
+
+- `BuildLinux.sh` reads `Core/core_sources.txt`, generates wrapper translation units under `Standalone/Build`, compiles the Core and compatibility objects, then links `VoxelForgeCoreHeadless-$VARIANT`. It separately compiles `LinuxOffscreenCapture.cpp` into `VoxelForgeOffscreenCapture-$VARIANT`. The generated wrappers/objects are build outputs; the stamp manifest should hash the listed original source paths, `core_sources.txt`, both standalone executable sources, and the build scripts. No stamp exists today. The script already enforces `taskset -c 0-11` plus `prlimit --as=6442450944` and rejects `--jobs` above 12.
+- There are two executable entry points to stamp. `StreamBenchmarkHeadless.cpp` parses options before its first current log (`[HeadlessConfig]`); `LinuxOffscreenCapture.cpp` checks `argc` before logging. Print the source stamp at the start of both `main`s, before parse/validation. A cheap stamp-only option on each binary would let the shared runner reject stale binaries before expensive work.
+- The canonical JSON contains FI `PassageConfig.Style=2` and SW `PassageConfig.Style=1`. The checked-in L37 capture and passage runners label `linux25-owner-*-style0.json` as `owner-*`; those are style overrides. In an existing resolved snapshot, each `strates[]` entry has `generator_kind`, `recipe_id`, and IDs, while `passages[]` has geometry, but neither exposes the effective style. The requested style assertion cannot be made from the current snapshot: add the resolved passage style per strate to its serialization, then assert FI=2/SW=1. `stable_identity` is the existing layout ID (`resolved-layout-v3-fnv64:…`); the recipe audit log reports recipe but not style.
+- The L37 runners each create their own subprocess wrappers and summaries. A shared helper can centralize the constrained invocation, stamp-only preflight, expected-stamp recomputation, binary/input SHA-256, resolved-layout extraction, and a common summary row (stamp, binary hash, input hash, actual recipe/style/layout ID, elapsed time). Recompute the manifest after the tier. Resolve the canonical layout once per owner case and use that same snapshot for all gates/captures.
+- `CapturePassageStandardSetL37.py` and `CaptureMouthOverviewL37.py` only check JPEG size. An all-black JPEG therefore passes. Add decoded-pixel variance/coverage validation (without PIL, which the earlier research could not import) and include a black-image negative control.
+- `RunMouthCreaseAuditL37.py` imports the fragment audit. For each candidate it reads the mesh once in `BASE.audit`, then `visible_crease` reads it again for the near view and again for overview. A combined analyzer can decode once, then share triangles/buckets for fragment, crease, and both views. Existing overview check matters: L37 passed near at 4.40° but measured 25.54° against 20° at overview.
+- `RunRingAuditsL37.py` already keeps the L30 terrace and L31 flat meshes as live controls; the full LOD0–8 work is separate from targeted LOD0 checks. The R5 split can reuse `AuditRingTerraceL32.py` directly for fast LOD0 plus those controls.