Locked R release profile

The locked certificate producer and bundle validator require 43 core cases plus 23 source-domain cases for a new same-attempt release certificate. The additional 18 core cases bind the frozen three-fixture optimized LOVE declaration by its exact input hashes, case IDs, API/mode, prospective tolerance, axes, wrapper replay exact coordinates and nonfinite/refusal behavior. Missing or substituted cases cannot pass by retaining the old 25-case total.

The original 25-case certificate remains verifiable for its historical source commit without an expected CI run. It cannot meet the new same-attempt release gate. The current native R result ran all 43 + 23 cases and preserved raw output, but its macOS R runtime is distinct from the locked source-built Linux release runtime. The new gate requires the source-built Linux runtime and complete private library file inventory, current committed source identity, matching GitHub run/attempt and exact artifact bytes. No current Linux release certificate is claimed here.

The release check also requires a successful native/live-R parity job from that same run attempt. It retrieves the parity artifact by provider digest and verifies its 43 case IDs, input and Python expectation hashes, source lock, and live-R certificate hash against the certified R bundle. A successful R job alone cannot satisfy this release check. The parity receipt is retained beside the release evidence for an accepted candidate.

The focused certificate and release-gate selection passed 56 tests in 1.12 seconds. The full lra_reference test package then passed 90 tests in 1.03 seconds. Strict mypy passed for the changed source/test files; Ruff check and formatting passed after formatting the adjacent R comparison reporter. The tests cover old-certificate preservation, a complete 43-case synthetic validator fixture, missing prospective cases, changed input declaration, missing exact-coordinate evidence, missing bundle members and stale/forged release artifacts. Synthetic fixtures are validator tests; only an actual locked CI R execution can create a release certificate.