# Independent proof arithmetic

The 65 scenario inputs and literal financial/status expectations were materialized before the proof implementation. The authoring script imports neither matcher nor proof runtime. It preserves fixed expected amounts, statuses, residuals, selected control versions and visibility boundaries; it does not regenerate them by calling the implementation.

At corrected receipt K = 2026-10-22T09:00:00.000Z:

| Exact USD-cent fact | Internal | External |
|---|---:|---:|
| Opening | 10000 | 10000 |
| Inflow | 5000+1200 = 6200 | 5000+1200 = 6200 |
| Outflow | 1200+700 = 1900 | 1200 |
| Net | 4300 | 5000 |
| Expected closing | 14300 | 15000 |
| Reported closing | 14300 | 15000 |
| Local residual | 0 | 0 |

Without an investigated item, closing difference and adjusted residual are −700. An internal-only outflow item derives signed amount −700, so adjusted internal close = 14300 + 0 − (−700) = 15000. Zero adjusted residual explains the arithmetic; the item is unresolved and the aggregate remains indeterminate.

Before that receipt, the external selected movements are +5000−1100+1200−700 = 4400. Its independently versioned closing is 14400, selected at the same K. Future closing 15000 is unavailable. Raw closing difference is 14300−14400 = −100.

With an incorrect internal closing 14301, local residual = 14301−14300 = +1. That known failure remains fail even when the external source or closing-control history is incomplete.

Opening-discrepancy example: internal opening 9300 plus net 4300 closes at 13600; external 10000 plus net 4300 closes at 14300. Both local residuals are zero. Internal item signed −700 makes the adjusted closing residual zero, but raw opening difference remains −700 and aggregate must fail.

Negative-asset example: −10000 + 4300 = −5700. Both controls may be negative; no zero floor is applied. Zero-net original/reversal example: 0−1200+1200 = 0; the two booked movements both remain in the trace.

The 120-digit maximum opening plus 4300 produces a derived value exceeding the input control bound. Keep that exact derived value and compare it with the supplied bounded close; do not overflow, clamp or silently accept a 121-digit input control.

The equal-net/different-history case uses internal inflow/outflow 6200/1900 and external 6300/2000, both net 4300. Arithmetic pass does not assert row identity or matching.

The forged-head/control case removes the internal 700 outflow, supplies a reduced trusted head and closing 15000, and passes arithmetic. Its trust-boundary note explicitly identifies forged host claims. No algorithm can authenticate assertions merely because they arrived as JSON.