dsh-aris-panel 0.1.0

package/skills/proof-checker/SKILL.md

@@ -0,0 +1,866 @@
+---
+name: proof-checker
+description: Rigorous mathematical proof verification and fixing workflow. Reads a LaTeX proof, identifies gaps via cross-model review (external reviewer backend, ultra reasoning), fixes each gap with full derivations, re-reviews, and generates an audit report. Use when user says "检查证明", "verify proof", "proof check", "审证明", "check this proof", or wants rigorous mathematical verification of a theory paper.
+argument-hint: "[path-to-tex-file or proof-description] [--deep-fix] [--restatement-check]"
+allowed-tools: Bash(*), Read, Grep, Glob, Write, Edit, Agent, mcp__codex__codex, mcp__codex__codex-reply, mcp__manual_review__review, mcp__manual_review__review_reply
+---
+
+# Proof Checker: Rigorous Mathematical Verification & Fixing
+
+> 🔒 **Do not wrap this skill in `/loop`, `/schedule`, or `CronCreate`.** It is
+> verdict-bearing — it judges proof validity across rounds, threading the
+> reviewer's memory from Phase 1 → Phase 3 via `codex-reply` so the reviewer can
+> check whether a fix actually closed the gap it flagged. An external timer
+> re-enters from the top each tick, starting a fresh thread and losing that
+> memory. Schedule the *external wait that precedes it*, not the verdict. See
+> [`shared-references/external-cadence.md`](../shared-references/external-cadence.md).
+
+Systematically verify a mathematical proof via cross-model adversarial review, fix identified gaps, re-review until convergence, and generate a detailed audit report with proof-obligation accounting.
+
+## Context: $ARGUMENTS
+
+## Constants
+
+- MAX_REVIEW_ROUNDS = 3
+- REVIEWER_MODEL = `gpt-5.6-sol` — Default model for the Codex backend, reasoning effort `ultra` (deep-audit tier; capability fallback `gpt-5.6-sol`+`xhigh` → `gpt-5.5`+`xhigh` per `shared-references/reviewer-routing.md`, capability errors only — never below `xhigh`). Manual backend uses a model the user chooses, **but it must be a non-Claude model ARIS can classify** (OpenAI, Google, DeepSeek, Moonshot/Kimi, Qwen) — the executor is Claude, so routing the proof review into any Claude product makes Claude judge Claude and voids the cross-model invariant (see `shared-references/reviewer-routing.md`).
+- **REVIEWER_BACKEND = `codex`** — Default: Codex MCP (ultra). Override with `— reviewer: oracle-pro` for Oracle MCP, or `— reviewer: manual` for Manual Review MCP. If manual-review MCP is unavailable, stop and print the install command; do not fall back to Codex. See `shared-references/reviewer-routing.md`.
+
+## Reviewer Calling Convention
+
+When calling the reviewer, branch on REVIEWER_BACKEND:
+
+**If REVIEWER_BACKEND = `codex`:**
+  Use `mcp__codex__codex` for new review threads
+  (`model: gpt-5.6-sol`, `config: {"model_reasoning_effort": "ultra"}`).
+  Use `mcp__codex__codex-reply` for follow-up rounds (reuse threadId).
+
+**If REVIEWER_BACKEND = `manual`:**
+  Use `mcp__manual_review__review` for new review threads with:
+    prompt: [exact same prompt that would go to Codex]
+    config: {"model_reasoning_effort": "xhigh", "executor_model": "<actual executor model>", "require_reviewer_model": true}
+  Save the returned `threadId`.
+  Use `mcp__manual_review__review_reply` for follow-up rounds with:
+    threadId: [saved manual-review threadId]
+    prompt: [follow-up prompt]
+    config: {"model_reasoning_effort": "xhigh", "executor_model": "<actual executor model>", "require_reviewer_model": true}
+
+Prompt fidelity: the manual prompt must be exactly the same text that Codex would receive.
+Review tracing applies equally to both backends.
+
+- AUDIT_DOC: `PROOF_AUDIT.md` at the paper directory root, alongside `main.tex` (cumulative log; when invoked via `/paper-writing`, this is `paper/PROOF_AUDIT.md`)
+- REPORT_TEX: `proof_audit_report.tex` (formal before/after PDF)
+- STATE_FILE: `PROOF_CHECK_STATE.json` (for recovery)
+- SKELETON_DOC: `PROOF_SKELETON.md` (micro-claim inventory)
+- **RENDER_HTML = true** — When `true` (default), auto-render `PROOF_AUDIT.md` to HTML at workflow end via `/render-html`. Uses **full Codex review gate** (audit-class artifact — math-heavy content; render-fidelity check protects against MathJax breakage and matches the skill's cross-model audit invariant). Set `false` to skip, or pass `— render html: false`.
+
+### Acceptance Gate (objective, replaces subjective scoring)
+
+The proof passes when ALL of the following hold:
+1. Zero open FATAL or CRITICAL issues
+2. Every theorem/lemma has: (i) explicit hypotheses, (ii) proof with all interchanges justified, (iii) every application discharges hypotheses in the ledger
+3. All big-O/Θ/o statements have declared parameter dependence and uniformity scope
+4. Counterexample pass executed on all key lemmas (log candidates even if none found)
+
+## Issue Taxonomy (20 categories, 4 groups)
+
+### Group A: Logic & Proof Structure
+
+| Category | Description | Example |
+|----------|-------------|---------|
+| **UNJUSTIFIED_ASSERTION** | Claim stated without proof or reference | "The Hessian splits into Gram blocks" |
+| **UNPROVEN_SUBCLAIM** | "Clearly" / "it follows" hides a nontrivial lemma | "By symmetry, the cross-terms vanish" without checking |
+| **QUANTIFIER_ERROR** | Wrong order ∀/∃, missing "for sufficiently small κ" | "For all π, there exists ε" vs "there exists ε for all π" |
+| **IMPLICATION_REVERSAL** | Uses (A⇒B) as (B⇒A), or claims equivalence with only one direction | |
+| **CASE_INCOMPLETE** | Misses boundary/degenerate cases | Singular covariance, zero weight, non-unique argmin |
+| **CIRCULAR_DEPENDENCY** | Lemma uses theorem that depends on it | |
+| **LOGICAL_GAP** | A step is not justified by what precedes it | B=Θ(1) → β_K=0 without analyzing W |
+
+### Group B: Analysis & Measure Theory
+
+| Category | Description | Example |
+|----------|-------------|---------|
+| **ILLEGAL_INTERCHANGE** | Swaps limit/expectation/derivative/integral without DCT/MCT/Fubini | Differentiating under E without domination |
+| **NONUNIFORM_CONVERGENCE** | Pointwise convergence used as uniform | sup and limit swapped |
+| **MISSING_DOMINATION** | DCT cited but no dominating function given | |
+| **INTEGRABILITY_GAP** | Uses E|X|^p without proving/assuming finite moments | |
+| **REGULARITY_GAP** | Differentiability/Lipschitz/convexity used but not established | |
+| **STOCHASTIC_MODE_CONFUSION** | Mixes a.s./in prob./in L²/in expectation | |
+
+### Group C: Model & Parameter Tracking
+
+| Category | Description | Example |
+|----------|-------------|---------|
+| **MISSING_DERIVATION** | A quantity is used but never derived from the model | Risk functional with undefined B, W |
+| **HIDDEN_ASSUMPTION** | Proof silently uses a condition not in the theorem | Gaussianity assumed but not stated |
+| **INSUFFICIENT_ASSUMPTION** | Hypotheses too weak for proof (counterexample exists) | Moment conditions admitting 2-point distributions |
+| **DIMENSION_TRACKING** | Parameter dependence (d, n, K, ...) not explicit | d enters only through κ |
+| **NORMALIZATION_MISMATCH** | Coordinate/scaling conventions inconsistent | Rescaled vs raw coordinates |
+| **CONSTANT_DEPENDENCE_HIDDEN** | "C" depends on d,n,K but treated as universal | |
+
+### Group D: Scope & Claims
+
+| Category | Description | Example |
+|----------|-------------|---------|
+| **SCOPE_OVERCLAIM** | Conclusion stated more broadly than proof supports | "β_K=0" with only generic overlap |
+| **REFERENCE_MISMATCH** | Cited theorem's hypotheses not verified at point of use | |
+
+## Two-Axis Severity System
+
+### Axis A — Proof Status (what is wrong)
+
+| Status | Meaning |
+|--------|---------|
+| **INVALID** | Statement false as written (counterexample exists or contradiction) |
+| **UNJUSTIFIED** | Could be true, but current proof does not establish it |
+| **UNDERSTATED** | True only after strengthening assumptions |
+| **OVERSTATED** | True only after weakening conclusion / adding qualifiers |
+| **UNCLEAR** | Ambiguous notation / definition drift (not wrong per se) |
+
+### Axis B — Impact (how much breaks)
+
+| Impact | Meaning |
+|--------|---------|
+| **GLOBAL** | Breaks main theorem or core dependency chain |
+| **LOCAL** | Affects a side result but not the main theorem |
+| **COSMETIC** | Exposition only |
+
+### Severity Labels (derived)
+
+| Label | Definition |
+|-------|------------|
+| **FATAL** | INVALID + GLOBAL |
+| **CRITICAL** | (INVALID + LOCAL) or (UNJUSTIFIED + GLOBAL) |
+| **MAJOR** | (UNJUSTIFIED + LOCAL) or (UNDERSTATED/OVERSTATED + GLOBAL) |
+| **MINOR** | Clarity / notation / dimension bookkeeping that doesn't change claims |
+
+## Side-Condition Checklists for Common Theorems
+
+When the proof invokes any of the following, require explicit verification of ALL listed conditions:
+
+| Theorem | Required Conditions |
+|---------|-------------------|
+| **DCT** (Dominated Convergence) | Pointwise a.e. convergence + integrable dominating function |
+| **MCT** (Monotone Convergence) | Monotone increasing + non-negative |
+| **Fubini/Tonelli** | Product measurability + integrability (Fubini) or non-negative (Tonelli) |
+| **Leibniz integral rule** | Continuity of integrand + dominating function for derivative |
+| **Implicit Function Theorem** | Continuous differentiability + non-singular Jacobian |
+| **Taylor with remainder** | Sufficient differentiability + remainder form (Lagrange/integral) |
+| **Jensen's inequality** | Convexity of function + integrability |
+| **Cauchy-Schwarz** | Correct inner product space + integrability of both factors |
+| **Weyl/Davis-Kahan** | Symmetry/Hermiticity + perturbation bound conditions |
+| **Analytic continuation** | Domain connectivity + identity theorem conditions |
+| **WLOG reduction** | Invariance under claimed symmetry + reduction is reversible |
+
+## Workflow
+
+### Phase 0: Preparation
+
+1. **Locate the proof**: Find the main `.tex` file(s).
+2. **Read the entire proof**: Extract list of all theorems/lemmas/propositions/corollaries/definitions/assumptions.
+3. **Read reference materials**: Reference papers, prior results.
+4. **Build a section map**: Structured list with line numbers and key claims.
+5. **Identify the main theorem**: Central result, assumptions, claims.
+
+### Phase 0.5: Proof-Obligation Ledger
+
+> **Fan-out (Tier-aware) — build the ledger in parallel; never judge in
+> parallel.** For a large multi-theorem paper, ledger *construction* is breadth
+> over independent sections. **Tier 1** (Workflow): spawn one Claude subagent
+> per section/theorem to extract that unit's symbols, assumptions, micro-claims,
+> and local quantified statements, each returning a structured ledger fragment.
+> **Tier 2**: the same subagents via the Agent tool. **Tier 3**: walk the
+> sections sequentially. This follows
+> [`shared-references/fan-out-pattern.md`](../shared-references/fan-out-pattern.md).
+>
+> Two hard rules:
+> 1. **The shards EXTRACT, they do not ADJUDICATE.** Building the ledger
+>    (inventorying obligations, typing symbols, restating with explicit
+>    quantifiers) is structural extraction. Whether a proof step is *valid* —
+>    whether an obligation is actually discharged — is a Type-B correctness
+>    verdict reserved for the cross-model jury in Phase 1 / Phase 3 (codex or
+>    manual, `ultra`). A Claude shard MUST NOT mark a micro-claim "proved" or
+>    "sound"; it only records the obligation and where the paper claims to
+>    discharge it. See [`acceptance-gate.md`](../shared-references/acceptance-gate.md)
+>    — the loop may self-verify *that the ledger is complete*, never *that the
+>    proofs are correct*.
+>    - **This governs the ledger spec wording below.** Where the artifacts say
+>      "WHERE each is verified", "or mark UNVERIFIED", or "where conditions are
+>      proven", a shard records a **location pointer** (`file:line` the paper
+>      claims discharge) — never its own judgment that the discharge is
+>      mathematically valid. A shard's `UNVERIFIED` means *"the paper cites no
+>      discharge location"*, NOT *"the shard checked the math and it fails"*.
+>      Soundness is the jury's verdict, not the shard's.
+>
+> **Shard output** (extraction schema, per
+> [`fan-out-pattern.md`](../shared-references/fan-out-pattern.md)): each shard
+> returns `{shard_id: "<section/theorem id>", entries: [...]}` — the typed
+> ledger items (symbols, assumptions, micro-claims, canonical statements,
+> limit-order facts) for that unit, each carrying its canonical id (e.g.
+> `MC-17`, the symbol name) as `dedup_key`. Never prose-only; never a validity
+> verdict field.
+> 2. **Global artifacts are a barrier, computed on the merged ledger, not
+>    per-shard.** The Dependency DAG and its cycle detection (incl. semantic
+>    circularity), and cross-section symbol-type consistency, require the whole
+>    paper in view. Merge all shard fragments first, then compute these on the
+>    union — a per-shard DAG would miss exactly the cross-section cycles this
+>    phase exists to catch.
+
+Build formal accounting artifacts. Save to `PROOF_SKELETON.md`:
+
+#### 1. Dependency DAG
+Nodes = Definitions / Assumptions / Lemmas / Theorems. Edges = "uses". **Detect cycles** (including semantic circularity where Lemma A uses a corollary that quietly depends on A).
+
+#### 2. Assumption Ledger
+For each theorem/lemma, list every hypothesis with WHERE each is verified — i.e. the **location pointer** the paper claims discharges it (`file:line`), not a judgment that the discharge is valid; mark "UNVERIFIED" when the paper cites no discharge location (not when you believe the math fails — that is the jury's call). Track **usage-minimal assumption sets** — which assumptions were actually used vs merely stated.
+
+#### 3. Typed Symbol Table
+Each symbol must have a **type signature**:
+```
+κ : scalar ∈ (0,1), depends on (d, α_t, Σ, μ)
+u* : vector ∈ ℝ^d, u* = C^{-1}m
+B^even : matrix ∈ ℝ^{(L+1)×(L+1)}, symmetric PSD
+Ψ_v : function ℝ → ℝ, analytic in (ζ,κ), parity determined by v
+```
+Flag any symbol whose meaning changes or whose type is inconsistent across uses.
+
+#### 4. Canonical Quantified Statements
+For each theorem/lemma, rewrite the statement with **explicit quantifiers, domains, and limit order**:
+```
+∀K ≥ 3, ∀π ∈ Π_K^{ms,∘} \ E_K, ∃κ_0 > 0 such that ∀κ ∈ (0, κ_0):
+  h_act^{(K,π)} = Θ(κ^{α_K^act})  [uniform in π on compact subsets]
+```
+If you cannot restate a theorem this precisely, mark it **UNCLEAR — needs disambiguation**.
+
+#### 5. Micro-Claim Inventory
+Every nontrivial step becomes a numbered micro-claim in **sequent form**:
+```
+MC-17: Context: [Lemma 3.1, κ < κ_0, Z_κ has bounded moments up to order 2m+2]
+       ⊢ Goal: P̂_0 is positive definite
+       Rule: monomials linearly independent on support of continuous distribution
+       Side-conditions: positive density near origin — claimed discharge: §B.2 (paper argues via GMM weak convergence; validity is the jury's call, not the shard's)
+```
+Each micro-claim has: justification rule name + required conditions + where conditions are proven (a location pointer to where the paper claims to discharge them, not a validity judgment).
+
+#### 6. Limit-Order Map
+Track every asymptotic statement's **limit order and uniformity scope**:
+```
+h_act = Θ(κ^α)  [as κ→0, uniform in π on compact subsets of Π_K, for fixed K]
+τ_act ~ (b/a)n   [as n→∞, for fixed κ,K,π with x_K ≪ 1]
+```
+Flag any statement where limit order is ambiguous or uniformity is unclear.
+
+### Phase 1: First Review (reviewer backend, ultra reasoning)
+
+Submit the **complete proof content** with the checklist below, using the selected backend.
+
+For `codex`, call `mcp__codex__codex` and always pin `model: gpt-5.6-sol` + `config: {"model_reasoning_effort": "ultra"}` (deep-audit tier). For `manual`, call `mcp__manual_review__review` with the identity-bearing config from the Reviewer Calling Convention above — `model`, `sandbox` and `cwd` are Codex-only.
+
+Use this exact prompt for both backends:
+
+```
+    You are performing a rigorous mathematical proof review. For EVERY theorem,
+    lemma, and proposition, check ALL of the following:
+
+    ## MANDATORY CHECKS
+
+    A. DEFINITIONS: List any symbol whose meaning is ambiguous or changes.
+    B. HYPOTHESIS DISCHARGE: For each lemma/theorem APPLICATION (not statement),
+       list each hypothesis and whether it was verified, with location.
+    C. INEQUALITY AUDIT: For each inequality chain, verify direction, missing
+       absolute values, missing conditions (convexity, PSD, integrability).
+    D. INTERCHANGE AUDIT: Flag every limit/derivative/expectation/integral
+       interchange. State which theorem justifies it (DCT/MCT/Fubini/Leibniz)
+       and which conditions are verified/missing.
+    E. PROBABILITY MODE: Track whether claims are a.s./in prob./in expectation/
+       w.h.p. Ensure transitions are justified.
+    F. UNIFORMITY & CONSTANTS: For every O(·), o(·), Θ(·), ≲, state whether
+       it is uniform over all parameters. List hidden parameter dependence.
+    G. EDGE/DEGENERATE CASES: Attempt to break each key lemma with a 1D,
+       low-rank, or extreme-parameter construction.
+    H. DEPENDENCY CONSISTENCY: Detect cycles or forward references to unproven
+       results.
+
+    ## OUTPUT FORMAT (per issue)
+    For each issue found, provide:
+    - id: sequential number
+    - status: INVALID / UNJUSTIFIED / UNDERSTATED / OVERSTATED / UNCLEAR
+    - impact: GLOBAL / LOCAL / COSMETIC
+    - category: [from taxonomy]
+    - location: section/equation/line
+    - statement: what the proof claims
+    - why_invalid: why this is wrong or unjustified
+    - counterexample: YES (describe) / NO / CANDIDATE (describe attempt)
+    - affects: which downstream results break if this is wrong
+    - minimal_fix: how to fix it
+
+    [FULL PROOF CONTENT HERE]
+```
+
+#### Phase 1 addendum — `--deep-fix` opt-in
+
+If the user passed `--deep-fix` on invocation, append the following block to the reviewer prompt **after** the OUTPUT FORMAT block above (do **not** modify the original block; the new fields are additive). Default invocations skip this block entirely and emit the original output schema unchanged.
+
+```
+    ## DEEP-FIX OUTPUT (opt-in, only when --deep-fix is set)
+
+    For EACH issue listed above, additionally provide a `deep_fix_plan`
+    that is repair-grade — sufficient for an executor to apply the fix
+    in one Edit pass without spawning a follow-up review thread:
+
+    - issue_id: same as the issue id above
+    - corrected_statement: the theorem/lemma statement as it should
+      read after the fix, with explicit quantifiers, regime conditions,
+      and uniformity scope (LaTeX, paste-ready)
+    - changed_equations: list of {before: <LaTeX>, after: <LaTeX>}
+      pairs for each equation that needs replacement
+    - downstream_labels: list of \label{...} keys whose statements or
+      proofs depend on this fix and must be re-checked or rewritten
+    - minimal_tex_patch_plan: ordered list of concrete edits, each as
+      {file: <path>, anchor_old: <unique LaTeX snippet to find>,
+       replacement_new: <LaTeX to insert>}; the executor will pass
+      these directly to its file-editing tool
+    - closure_tests: 2-5 sanity checks the executor must run after
+      applying the fix (e.g., "verify constant_dependence_diff matches
+      computed value", "limit case γ→0 reduces to identity",
+      "dimension count matches before/after")
+
+    ## ALGEBRA / TYPE SANITY PASS (opt-in, only when --deep-fix is set)
+
+    If any issue invokes Schur test, Young's inequality, Cauchy-Schwarz,
+    Hölder, quadratic form, operator norm, or power counting, the
+    deep_fix_plan for that issue MUST also include an `algebra_sanity`
+    object:
+
+    - dimension_table: map of {symbol: type_signature}, e.g.
+      {"K(i,α)": "scalar ≥ 0",
+       "‖K‖_{2→2}": "scalar ≥ 0",
+       "Σ_i V_i^rem": "scalar quadratic in w"}
+    - power_count: number of times each operator-norm or Schur factor
+      appears on each side; flag mismatch as INVALID
+    - zero_coupling_check: evaluate the expression at γ=0 (or the
+      analogous degenerate point); confirm it reduces to the expected
+      identity / vanishing case
+    - constant_dependence_diff: list of constants whose dependence on
+      (d, K, n, ...) changes between BEFORE and AFTER, with the new
+      explicit dependence written out
+
+    Be precise. The executor will apply this plan literally; vague
+    prose ("strengthen the bound", "redo the Schur step") is not
+    acceptable in deep-fix mode. If you cannot produce a precise plan
+    for an issue, omit that issue's deep-fix block and signal the
+    deep-fix path is unavailable — do NOT emit a vague plan, and do
+    NOT add a deep-fix-only category (e.g. UNCLEAR_DEEP_FIX) into the
+    standard issue list, since that contaminates default-call output.
+```
+  A verdict-bearing manual response MUST begin with
+  `Reviewer-Model: <exact-model-id>` — pass the model THIS session is actually
+  running as in `executor_model`. Missing, unknown, or same-family identity
+  cannot acquit; emit `REVIEW_UNAVAILABLE` rather than guessing. If the executor
+  model cannot be named, manual review's cross-family claim is unprovable — say
+  so in the report instead of asserting it.
+
+
+**Save the threadId.** Parse into structured issue list. Write to `PROOF_AUDIT.md`.
+
+### Phase 1.5: Counterexample Red Team
+
+For each CRITICAL or MAJOR issue, and for every key lemma that introduces:
+- a new inequality bound
+- an identifiability/uniqueness claim
+- a curvature/PSD/strong convexity assertion
+- a uniform-in-parameter claim
+- a convergence mode upgrade (pointwise → uniform, in prob → w.h.p.)
+
+Systematically attempt to construct counterexamples using:
+
+| Strategy | Description |
+|----------|-------------|
+| **Dimensional collapse** | Set d=1 or 2, K=2, n small |
+| **Degeneracy** | Singular covariance, tiny weight, overlapping means, identical components |
+| **Extremal distributions** | Two-point ±a, bounded non-subGaussian, heavy tails |
+| **Adversarial parameter scaling** | Pick parameters making neglected terms dominate |
+| **Numeric falsification** | Translate lemma to a function, brute-force optimize over small domain |
+
+**Rule**: Label "counterexample found" ONLY if algebraically verified. Otherwise log as "candidate counterexample — needs verification."
+
+Record all attempts (successful or not) in `PROOF_AUDIT.md`.
+
+### Phase 2: Fix Implementation
+
+For each issue, ordered by severity (FATAL → CRITICAL → MAJOR → MINOR):
+
+#### Step 2a: Choose fix strategy
+For each issue, explicitly choose one of:
+- **ADD_DERIVATION**: Write missing proof steps
+- **STRENGTHEN_ASSUMPTION**: Add conditions to theorem statement
+- **WEAKEN_CLAIM**: Reduce conclusion scope
+- **ADD_REFERENCE**: Cite known result + verify its conditions apply
+
+Log this choice — it is a scope-changing decision when it alters theorem statements.
+
+#### Step 2b: Derive the fix mathematically
+- Complete mathematical derivation, not just a claim
+- If new proposition/lemma needed, write in full theorem-proof style
+
+#### Step 2c: Implement in LaTeX
+- Edit the `.tex` file
+- Preserve existing `\label` references where possible
+
+#### Step 2d: Record the fix
+```markdown
+### Fix N: [SHORT TITLE]
+**Issue**: [id] [CATEGORY] — [description]
+**Severity**: FATAL / CRITICAL / MAJOR / MINOR
+**Status**: INVALID / UNJUSTIFIED / UNDERSTATED / OVERSTATED
+**Impact**: GLOBAL / LOCAL / COSMETIC
+**Fix strategy**: ADD_DERIVATION / STRENGTHEN_ASSUMPTION / WEAKEN_CLAIM / ADD_REFERENCE
+**Location**: Section X, Lines Y-Z
+
+**BEFORE**: [what the proof originally did]
+**WHY WRONG**: [mathematical problem, with counterexample if applicable]
+**AFTER**: [what the fix does]
+**KEY EQUATION**: [central new equation]
+**PROOF OBLIGATIONS ADDED**: [new conditions/lemmas introduced]
+**DOWNSTREAM EFFECTS**: [which results now need re-checking]
+```
+
+#### Step 2e: Compile check
+```bash
+pdflatex -interaction=nonstopmode <file>.tex 2>&1 | grep -E "Error|Warning|undefined"
+```
+
+### Phase 3: Re-Review (reviewer backend, ultra reasoning)
+
+Continue with the selected backend. For `codex`, use `mcp__codex__codex-reply` with the saved threadId. For `manual`, use `mcp__manual_review__review_reply` with the saved threadId. Include fix summaries. Request the same mandatory checklist.
+
+Check acceptance gate. If not met, repeat Phases 2-3 (up to MAX_REVIEW_ROUNDS).
+
+### Phase 3.5: Global Closure & Independent Verification
+
+#### Global closure checks
+After all fixes, verify the proof as a whole:
+- **Statement–conclusion match**: Does the proof end with EXACTLY what the theorem claims (quantifiers, constants, uniformity)?
+- **All obligations discharged**: Every node in the obligation DAG is proven or explicitly assumed (and the theorem statement includes it).
+- **Case analysis coverage**: Cases partition the domain AND include boundary/degenerate cases.
+- **Induction correctness** (if applicable): Base case, inductive step, correct use of IH, induction measure strictly decreases.
+- **WLOG reductions**: Each "without loss of generality" spawns a micro-claim proving the reduction is lossless.
+- **No silent assumption strengthening**: Any fix that strengthened assumptions has propagated to the main theorem statement.
+
+#### Independent second review for FATAL/CRITICAL fixes
+For any fix that resolved a FATAL or CRITICAL issue, submit the **fixed section alone** (without showing the previous critique) to a **fresh reviewer thread** using the selected backend. Do NOT use a reply tool — this step must be blind.
+
+*For codex:* start a fresh `mcp__codex__codex` thread.
+*For manual:* start a fresh `mcp__manual_review__review` thread.
+
+The blind review prompt:
+
+```
+[Codex:]
+mcp__codex__codex:
+  model: gpt-5.6-sol
+  config: {"model_reasoning_effort": "ultra"}
+  prompt: |
+    Blind review of the following proof section. You have NOT seen any prior
+    review or discussion. Check every step for correctness, hidden assumptions,
+    illegal interchanges, and counterexamples.
+    [FIXED SECTION ONLY]
+```
+
+If the blind reviewer finds new issues, re-enter Phase 2.
+
+#### Regression proof-audit
+After fixes, re-run:
+- DAG acyclicity check (no new cycles introduced)
+- Counterexample suite on all DOWNSTREAM lemmas of modified results
+- Assumption-delta report: what became stronger/weaker due to fixes?
+
+### Phase 3.6: Theorem Restatement Regression (opt-in)
+
+**Default**: skipped. Existing callers see no change.
+
+**Opt-in**: pass `--restatement-check` on invocation. The skill then runs a cross-location consistency pass after Phase 3.5 (Global Closure) and before Phase 3.9 (Unrecoverable Protocol).
+
+This phase catches a specific class of bugs that Phase 3.5's "Statement-conclusion match" check does NOT catch: **drift between the canonical theorem statement and its restatements elsewhere in the paper** (summary tables, "Key Contributions" / "Summary" sections, abstract, discussion, captions). Common drift patterns observed in practice:
+
+- Main theorem makes a partly-conditional claim (e.g., "regime A unconditional, regime B conditional on assumption X") but a later summary cites it as the fully unconditional version.
+- Main theorem κ exponent is `O(d²K²)` but a constants table writes `O(K²)`.
+- Main theorem regime condition is squared envelope, but a remark elsewhere still shows the first-order envelope.
+- Restatement quietly drops a quantifier ("for $n \ge n_0$") that the proof relied on.
+
+#### Algorithm
+
+1. **Build canonical statement table.** Scan all `*.tex` files in the paper for `\begin{theorem}` / `\begin{lemma}` / `\begin{proposition}` / `\begin{corollary}` blocks with a `\label{...}`. For each: record `(label, full_statement_text, file:line_range)`.
+
+2. **Collect restatement candidates.** For each canonical label `thm:foo`:
+   - Every `\Cref{thm:foo}` / `\ref{thm:foo}` / `\cref{thm:foo}` invocation, with the surrounding 2 sentences as candidate restatement context.
+   - Rows in tables (`\begin{tabular}` … `\end{tabular}`) that mention the label, the theorem's informal name, or its constants.
+   - Bullets in "Key Contributions" / "Summary" / "Main Results" lists.
+   - Sentences in the abstract and introduction that paraphrase the theorem.
+
+3. **Normalized diff.** For each (canonical_statement, restatement_context) pair:
+   - Strip `\,` `\;` `\!` `~`, normalize whitespace, normalize math-mode delimiters (`$..$`, `\(..\)`, display vs inline).
+   - Detect drift signatures (one or more):
+     - **conditional_loss** — canonical says "under \Cref{ass:X}" or "for w=1"; restatement omits the conditional.
+     - **scope_change** — big-O exponent or rate differs (`O(K^2)` vs `O(d^2K^2)`; `√n` vs `n`).
+     - **quantifier_loss** — quantifier present canonically (e.g. "for $n \ge n_0$", "for sufficiently small $\gamma$") absent in restatement.
+     - **regime_envelope_change** — first-order leakage `Cγ/(1-Δγ)` vs squared envelope `(Cγ/(1-Δγ))²` (or analogous).
+     - **constant_change** — different numeric constant or different parameter dependence stated.
+     - **variable_rename** — same role in argument played by differently-named symbol with no explicit alias.
+
+4. **Emit findings.** Each detected drift becomes an entry in `details.restatement_drift` (see "Submission Artifact Emission" below). Severity defaults to **MAJOR** (UNDERSTATED/OVERSTATED + GLOBAL); reviewer may downgrade to MINOR if drift is purely cosmetic (e.g. `\,` placement) and upgrade to CRITICAL only if the restatement is used downstream as if it were the canonical (e.g. another proof cites the restated version).
+
+#### What this phase does NOT do
+- It does **not** fix drift automatically. The output is advisory; the executor or a follow-up `--deep-fix` run handles the rewrite.
+- It does **not** alter `details.issues`; restatement drift is reported as a sibling field, so existing consumers reading `issues[]` see no schema change.
+- It does **not** alter the top-level `verdict` decision rule. A paper with non-empty `restatement_drift` may still emit `PASS` if all proof obligations are otherwise discharged; the drift is independent of proof correctness. (The reviewer may at its discretion mirror a **CRITICAL**-severity drift into the `issues` list as a regular issue — typically when the restated version is used downstream as if it were canonical — but that is a per-issue judgment, never an automatic rule. MAJOR or MINOR drift never mirrors into `issues`.)
+
+#### Failure mode
+If `--restatement-check` is set but the cross-location scan cannot complete, emit `details.restatement_drift: []` plus `details.restatement_check_status: "unavailable"` with a one-line note explaining why. Verifier gates and downstream skills MUST treat `"unavailable"` identically to the field being absent: not blocking. Phases 1 / 1.5 / 2 / 3 / 3.5 / 3.9 / 4 / 5 still run normally. Cases that trigger this fallback include:
+- Unreadable `.tex` (parser / encoding error on a file that contains a theorem block).
+- Ambiguous label resolution (e.g., the same `\label{thm:foo}` appears more than once with no clear canonical pick).
+- **No labeled canonical theorem-like block found** (the algorithm only inspects `\begin{theorem|lemma|proposition|corollary}` blocks with an explicit `\label{...}`; if there is no such block, there is nothing to compare restatements against).
+
+### Phase 3.9: Unrecoverable Proof Protocol
+
+If acceptance gate is not met after MAX_REVIEW_ROUNDS, output a **Proof Unrecoverable Report**:
+1. Minimal set of blocking FATAL/CRITICAL issues that could not be resolved
+2. Salvage options ranked: (a) weaken claim, (b) strengthen assumptions, (c) add missing lemmas, (d) restructure argument
+3. Which parts of the proof are likely still reusable
+4. Recommended next steps for the author
+
+Do NOT silently declare success. The report must be honest.
+
+### Phase 4: Audit Report Generation
+
+Generate `proof_audit_report.tex` with:
+
+1. **Overview table**: All issues with two-axis severity, category, fix strategy, status
+2. **Before/After logic chain**: Red (BEFORE) → Green (AFTER) comparison
+3. **For each fix**: original proof → why wrong → counterexample (if any) → complete derivation → remaining subtleties
+4. **Proof-obligation diff**: What was unverified before, what is verified now
+5. **Summary**: Now proven / still assumed / open problems
+6. **Colored boxes**: BEFORE (red), AFTER (green), WHY WRONG (orange), KEY INSIGHT (blue), WARNING (yellow)
+
+Compile: `pdflatex proof_audit_report.tex && pdflatex proof_audit_report.tex`
+
+### Phase 5: State Persistence
+
+Write `PROOF_CHECK_STATE.json`:
+```json
+{
+  "status": "completed",
+  "rounds": 2,
+  "threadId": "...",
+  "fatal_fixed": 0,
+  "critical_fixed": 3,
+  "major_fixed": 2,
+  "minor_fixed": 1,
+  "counterexamples_found": 1,
+  "counterexample_candidates": 2,
+  "acceptance_gate": "PASS",
+  "timestamp": "..."
+}
+```
+
+### Phase 5.5: Research Wiki Claim Ledger (additive; only if a wiki is active)
+
+If — and only if — a `research-wiki/` exists, persist each top-level
+theorem/headline as a **claim node** so the wiki's PROVE/JUDGE ledger records what
+was proven and with what honesty. This is the **birth point** for wiki claim nodes
+(`claims/<slug>.md`). It is a **detect-only record, never a verdict**: it never
+changes the audit's `verdict`/`reason_code`, never blocks, and is skipped entirely
+when `verdict == NOT_APPLICABLE` (no theorems) or no wiki is found.
+
+> The claim's `status` is the **PROOF axis only** (`verified` / `sound-modulo-imports`
+> / `refuted` / `unproven` / `drafted` / `retracted`). Empirical experiment support is
+> a **separate axis** carried by `supports` / `invalidates` *edges* from
+> `/result-to-claim` — those words are NEVER written into this `status` field (the
+> `research_wiki.py` validator rejects them).
+
+Resolve the helper via the **canonical resolver** (integration-contract §2). Check
+`NOT_APPLICABLE` first (in cwd, where the audit ran), then run from the project root
+(the wiki sits at root; a paper audit may run from a `paper/` subdir). Every guard
+warn-and-skips — the audit is already complete and is never affected:
+
+```bash
+grep -q '"verdict"[[:space:]]*:[[:space:]]*"NOT_APPLICABLE"' PROOF_AUDIT.json 2>/dev/null \
+  && { echo "verdict NOT_APPLICABLE (no theorems); skipping claim ledger" >&2; exit 0; }
+cd "$(git rev-parse --show-toplevel 2>/dev/null || pwd)" || exit 0
+[ -d research-wiki ] || { echo "no research-wiki/ at project root; skipping claim ledger (audit complete)" >&2; exit 0; }
+if [ -z "${ARIS_REPO:-}" ] && [ -f .aris/installed-skills.txt ]; then
+    ARIS_REPO=$(awk -F'\t' '$1=="repo_root"{print $2; exit}' .aris/installed-skills.txt 2>/dev/null) || true
+fi
+if [ -z "${ARIS_REPO:-}" ] && [ -f "$HOME/.aris/repo" ]; then
+    ARIS_REPO=$(cat "$HOME/.aris/repo" 2>/dev/null) || true
+fi
+WIKI_SCRIPT=".aris/tools/research_wiki.py"
+[ -f "$WIKI_SCRIPT" ] || WIKI_SCRIPT="tools/research_wiki.py"
+[ -f "$WIKI_SCRIPT" ] || { [ -n "${ARIS_REPO:-}" ] && WIKI_SCRIPT="$ARIS_REPO/tools/research_wiki.py"; }
+[ -f "$WIKI_SCRIPT" ] || { echo "WARN: research_wiki.py not resolved; skipping claim ledger (audit unaffected)" >&2; exit 0; }
+```
+
+For each top-level theorem/headline in `PROOF_SKELETON.md` (the main theorem + the
+key lemmas the headline depends on — NOT every micro-claim), map the audit outcome
+to an **honest** claim status:
+
+| Audit outcome (`PROOF_AUDIT.json` verdict + Phase 1.5 counterexamples) | `--status` |
+|---|---|
+| `verdict=PASS` / `all_proofs_complete`, no flagged imports | `verified` |
+| proof closes but rests on a flagged `[unverified-axiom]` / imported result | `sound-modulo-imports` |
+| counterexample found (Phase 1.5) **or** reviewer judged the statement false | `refuted` |
+| open gap (unresolved FATAL/CRITICAL / UNJUSTIFIED, no counterexample) | `unproven` |
+
+Never invent a status: a plain proof gap is `unproven` — never `refuted` (which
+asserts falsity) and never `verified`/`drafted`. Then record (idempotent):
+
+```bash
+python3 "$WIKI_SCRIPT" add_claim research-wiki/ \
+  --slug "<stable-theorem-id, e.g. thm-main-ub>" --name "<theorem headline>" \
+  --status "<mapped status>" --provenance "<trace_path from PROOF_AUDIT.json>" \
+  --statement "<canonical theorem statement>" \
+  --scope "<what it does NOT say; any flagged imports>" \
+  --evidence "<PROOF_AUDIT.json verdict + counterexample / obligation pointers>" \
+  --update-on-exist \
+  || echo "WARN: add_claim failed for <slug> (audit unaffected; fix wiki/status and re-run)" >&2
+```
+
+`--update-on-exist` lets a re-audit refresh a claim's status (an `unproven` claim
+becomes `verified` once the gap closes). `--provenance` is the honesty receipt (the
+`trace_path`); never omit it.
+
+## Deep-Fix Mode (opt-in)
+
+**Default**: disabled. The Phase 1 reviewer emits issues with `minimal_fix` (a 1-2 sentence pointer); existing callers see no change.
+
+**Opt-in**: pass `--deep-fix` on invocation. The Phase 1 reviewer prompt is **augmented** (not replaced) with the "DEEP-FIX OUTPUT" and "ALGEBRA / TYPE SANITY PASS" blocks above, so the reviewer also returns a `deep_fix_plan` per issue: corrected statement, changed equations, downstream label list, minimal LaTeX patch plan, and closure tests. Issues invoking Schur / Young / Cauchy-Schwarz / Hölder / quadratic forms / operator norms / power counting additionally carry an `algebra_sanity` block (dimension table + power count + zero-coupling check + constant-dependence diff).
+
+### Why opt-in
+The default `minimal_fix` prose is intentionally short — it suits the common case where the executor wants high-level pointers and will derive the patch separately. Forcing `deep_fix_plan` on every run would (a) inflate every reviewer call by 2-5×, (b) trigger re-review thrash for issues the executor has already decided to weaken or defer, and (c) change the shape of `details.issues` for every existing caller. The flag preserves zero behavior change for default invocations while letting the executor request repair-grade output when the fix is going to be applied immediately.
+
+### Effect when enabled
+- The Phase 1 reviewer prompt is augmented with the deep-fix and algebra-sanity blocks; nothing in the original mandatory checklist or output format is removed.
+- `PROOF_AUDIT.json` `details` gains a sibling field `deep_fix_plans` (parallel to `details.issues`); see "Submission Artifact Emission" below.
+- The top-level `verdict`, `reason_code`, and `summary` are **unchanged in shape and decision rule**: deep-fix output is advisory tooling for the executor, not a verdict-altering signal.
+- Verifier gates and downstream skills (`paper-writing` Phase 6, `verify_paper_audits.sh`) MUST treat absence of `deep_fix_plans` as the only valid default state and MUST NOT block on its presence or content.
+
+### When opt-in is appropriate
+- The executor intends to apply the fix in the same session and wants to skip a follow-up "give me a concrete patch" thread.
+- A previous default-mode run identified a CRITICAL or MAJOR issue whose `minimal_fix` was too vague to act on (e.g., "redo the Schur step" without specifying the corrected operator-norm bound).
+- Algebra-heavy proofs with Schur / quadratic-form / operator-norm steps where the reviewer's first pass has consistently produced under-specified fixes.
+
+### Failure modes
+
+A deep-fix-only failure must never contaminate the default proof-check output. All of the following paths emit `details.deep_fix_status: "unavailable"` + `details.deep_fix_plans: []` (with a one-line note in `details.deep_fix_note`) and leave the standard issue list, top-level verdict, reason_code, and summary unchanged:
+
+- The reviewer refuses to produce a repair-grade plan because the fix would require choices the reviewer is unwilling to make.
+- The Phase 1 reviewer call returns truncated or malformed deep-fix output (parse failure on the augmented section).
+- The augmented Phase 1 call times out before producing the deep-fix block, but otherwise returned a valid normal proof review.
+
+Verifier gates MUST treat `unavailable` identically to the field being absent: not blocking. Do **not** add a `UNCLEAR_DEEP_FIX` (or any deep-fix-only) entry into `details.issues`, since `details.issues` is the default schema's issue list and adding deep-fix-specific failures to it would change default behavior for callers without the flag.
+
+If the augmented Phase 1 call fails so badly that the normal proof review cannot be recovered (e.g., the reviewer thread itself errored), retry once with the unaugmented prompt **only when the error proves the call never executed** (schema/validation or explicit capability error per the fallback chain in `reviewer-routing.md`); on timeout, rate-limit, transport, or server errors do NOT blind-retry (the review may have run — double-running double-bills), fall through directly to the existing reviewer-failure path that maps to the top-level `ERROR` verdict.
+
+## Key Rules
+
+### Mathematical rigor
+- **Never accept a proof step on faith**. "Clearly" / "it follows" / "by standard arguments" are red flags — each must spawn a micro-claim.
+- **Hypothesis discharge**: Every time a lemma is APPLIED, verify EACH of its hypotheses at that point. Use the side-condition checklists above.
+- **Interchange discipline**: Every swap of limit/expectation/derivative/integral must cite a theorem (DCT/MCT/Fubini/Leibniz) and verify its conditions with explicit dominating function or integrability proof.
+- **Uniformity discipline**: Every O(·)/Θ(·) must declare what parameters it is uniform over. "O(1)" that secretly depends on d,n,K is a CONSTANT_DEPENDENCE_HIDDEN issue.
+- **Quantifier discipline**: Check ∀/∃ order. "For sufficiently small κ" must specify: does κ₀ depend on K? On π? On d?
+- **Counterexample-first**: Before trying to fix a gap, first try to break it.
+- **WLOG prohibition**: Every "without loss of generality" must have an explicit micro-claim proving the reduction. No free WLOGs.
+- **No silent assumption strengthening**: Any fix that adds conditions must propagate to the theorem statement.
+
+### Cross-model protocol
+- **Executor analyzes, reviewer critiques**: Claude reads proof, formulates questions, implements fixes. The external reviewer provides adversarial review.
+- **Reviewer reasoning always ultra** (deep-audit tier): never below `xhigh` — only the capability fallback chain in `reviewer-routing.md` may step down, and only on explicit capability errors.
+- **Send full content**: Don't summarize — send actual math for line-by-line checking.
+- **Preserve threadId within a single run**: Use the appropriate reply tool (`mcp__codex__codex-reply` or `mcp__manual_review__review_reply`) for Phase 3 follow-up rounds within the same top-level `/proof-checker` invocation, so the reviewer keeps prior-issue context when judging whether a fix closed the gap. Across separate top-level invocations, always start a fresh thread (see "Thread independence" below).
+
+### Fix quality
+- **Minimal fixes**: Fix exactly what's broken, nothing more.
+- **Full derivation**: Every fix includes complete mathematical argument.
+- **Explicit scope decisions**: Each fix is tagged ADD_DERIVATION / STRENGTHEN_ASSUMPTION / WEAKEN_CLAIM / ADD_REFERENCE.
+- **Compile after each fix**: LaTeX must compile cleanly.
+
+### Scope honesty
+- **Don't overclaim**: If a fix makes a result conditional, say so.
+- **Separate "proven" from "assumed"**: The audit report has an explicit section for this.
+- **Log open problems**: Issues requiring future work are listed, not hidden.
+
+### Opt-in flag discipline
+- **Deep-fix is opt-in only**: never auto-enable; never block on `deep_fix_plans` content; existing callers must observe identical reviewer output and identical JSON schema if they do not pass `--deep-fix`.
+- **Reviewer prompt augmentation is additive**: the deep-fix block is appended to the Phase 1 prompt, not substituted for any part of it. The original mandatory checklist (A-H) and original per-issue OUTPUT FORMAT remain in place verbatim.
+- **Restatement check is opt-in only**: Phase 3.6 runs only when `--restatement-check` is set; existing callers must observe identical reviewer output and identical JSON schema if they do not pass the flag.
+- **No Phase reordering**: enabling Phase 3.6 inserts it strictly between 3.5 and 3.9; it does not skip any other phase or change their semantics.
+- **No verdict crosstalk**: neither deep-fix output nor `restatement_drift` ever alters top-level `verdict` or `reason_code`. A paper with non-empty drift or with deep-fix plans may still pass; a paper with FAIL verdict stays FAIL whether or not either flag was set.
+
+## Output Files
+
+| File | Content | When |
+|------|---------|------|
+| `PROOF_SKELETON.md` | Dependency DAG + assumption ledger + micro-claims | Phase 0.5 |
+| `PROOF_AUDIT.md` | Cumulative round-by-round audit log | Updated each round |
+| `PROOF_AUDIT.json` | Machine-readable submission verdict (see below) | Always emitted |
+| `proof_audit_report.tex/.pdf` | Formal before/after report | Phase 4 |
+| `PROOF_CHECK_STATE.json` | State for recovery | Phase 5 |
+| `PROOF_AUDIT.html` (+ `.review.json` sidecar) | Single-file HTML view of `PROOF_AUDIT.md` auto-rendered via `/render-html "PROOF_AUDIT.md" --json "PROOF_AUDIT.json"`. **Non-blocking** — if `/render-html` fails the audit still counts as complete; `PROOF_AUDIT.{md,json}` are the canonical outputs. | Workflow end (when `RENDER_HTML = true`, default) |
+
+When `--restatement-check` is set, `PROOF_AUDIT.json` additionally carries `details.restatement_drift` and `details.restatement_check_status`; both fields are omitted when the flag is unset. See "Submission Artifact Emission" below.
+
+## Submission Artifact Emission
+
+This skill **always** writes `PROOF_AUDIT.json` at the paper directory
+root (i.e. `paper/PROOF_AUDIT.json` when invoked from `/paper-writing`
+with paper-dir `paper/`; `<your-paper-dir>/PROOF_AUDIT.json` when invoked
+standalone), regardless of caller or whether the paper contains theorems.
+A paper with no `\begin{theorem}` / `\begin{lemma}` / `\begin{proof}` emits
+verdict `NOT_APPLICABLE`; silent skip is forbidden. `paper-writing`
+Phase 6 and `verify_paper_audits.sh` both rely on this artifact
+existing at `<paper-dir>/PROOF_AUDIT.json`.
+
+The artifact conforms to the schema in `shared-references/assurance-contract.md`:
+
+```json
+{
+  "audit_skill":      "proof-checker",
+  "verdict":          "PASS | WARN | FAIL | NOT_APPLICABLE | BLOCKED | ERROR",
+  "reason_code":      "all_proofs_complete | minor_gaps | critical_gap | no_theorems | ...",
+  "summary":          "One-line human-readable verdict summary.",
+  "audited_input_hashes": {
+    "main.tex":                 "sha256:...",
+    "sections/4.theory.tex":    "sha256:..."
+  },
+  "trace_path":       ".aris/traces/proof-checker/<date>_run<NN>/",
+  "thread_id":        "<codex mcp thread id>",
+  "reviewer_model":   "<resolved — the model that actually ran (target: gpt-5.6-sol)>",
+  "reviewer_reasoning": "<resolved — the effort that actually ran (target: ultra)>",
+  "generated_at":     "<UTC ISO-8601>",
+  "details": {
+    "theorems_audited": <int>,
+    "issues": [ { "id": "T1-H3", "severity": "FATAL|CRITICAL|MAJOR|MINOR",
+                  "category": "quantifier|domination|...",
+                  "location": "sections/4.theory.tex:L182",
+                  "note": "..." }, ... ]
+  }
+}
+```
+
+### Optional: `details.deep_fix_plans` (only when `--deep-fix` is set)
+
+```json
+"details": {
+  ...
+  "deep_fix_plans": [
+    {
+      "issue_id": "T1-H3",
+      "corrected_statement": "<LaTeX, paste-ready>",
+      "changed_equations": [{"before": "<LaTeX>", "after": "<LaTeX>"}, ...],
+      "downstream_labels": ["thm:convergence", "cor:minimax", ...],
+      "minimal_tex_patch_plan": [
+        {"file": "sections/4.theory.tex",
+         "anchor_old": "<unique LaTeX snippet>",
+         "replacement_new": "<LaTeX to insert>"},
+        ...
+      ],
+      "closure_tests": [
+        "verify constant_dependence_diff matches computed value",
+        "limit case γ→0 reduces to identity",
+        ...
+      ],
+      "algebra_sanity": {
+        "dimension_table": {"<symbol>": "<type_signature>", ...},
+        "power_count": "<one-line check>",
+        "zero_coupling_check": "<one-line check>",
+        "constant_dependence_diff": "<before vs after>"
+      }
+    }
+  ],
+  "deep_fix_status": "ok" | "unavailable"
+}
+```
+
+Field semantics:
+- Both `deep_fix_plans` and `deep_fix_status` are **omitted entirely** when the flag is not set. The default schema does not include either key.
+- When the flag is set and reviewer returns well-formed plans, `deep_fix_status` is `"ok"` and `deep_fix_plans` mirrors `details.issues` one-to-one (each plan referenced by `issue_id`); `algebra_sanity` is present only for issues invoking Schur / Young / Cauchy-Schwarz / Hölder / quadratic-form / operator-norm / power-counting steps.
+- When the flag is set but reviewer output is malformed or truncated, `deep_fix_status` is `"unavailable"` and `deep_fix_plans` is `[]`. Downstream consumers MUST treat `"unavailable"` identically to the field being absent: not blocking.
+- Downstream consumers MUST treat absence of either field as the only valid default state and MUST NOT raise on missing.
+- `deep_fix_plans` is advisory tooling for the executor; `verify_paper_audits.sh` and `paper-writing` Phase 6 do not block on its content or shape.
+
+### Optional: `details.restatement_drift` (only when `--restatement-check` is set)
+
+```json
+"details": {
+  ...
+  "restatement_drift": [
+    {
+      "label": "thm:main",
+      "canonical_location": "sections/2.setup.tex:117",
+      "restatement_location": "sections/appendix.tex:1614",
+      "drift_type": "conditional_loss" | "scope_change" | "quantifier_loss" |
+                    "regime_envelope_change" | "constant_change" | "variable_rename",
+      "canonical_excerpt": "<short LaTeX>",
+      "restatement_excerpt": "<short LaTeX>",
+      "severity": "MAJOR" | "MINOR" | "CRITICAL",
+      "note": "..."
+    }
+  ],
+  "restatement_check_status": "ok" | "unavailable"
+}
+```
+
+Field semantics:
+- Both `restatement_drift` and `restatement_check_status` are **omitted entirely** when the flag is not set. The default schema does not include either key.
+- When the flag is set and the cross-location scan completes, `restatement_check_status` is `"ok"` and `restatement_drift` lists detected pairs (possibly empty if none found).
+- When the scan fails (per "Failure mode" in Phase 3.6), `restatement_check_status` is `"unavailable"` and `restatement_drift` is `[]`.
+- Downstream consumers MUST treat absence or `"unavailable"` identically as the default state and MUST NOT raise on missing.
+- `restatement_drift` does **not** alter `details.issues` and does **not** change the top-level `verdict` decision rule. The reviewer may at its discretion mirror a CRITICAL-severity drift into `details.issues` as a regular issue, but that is a per-issue judgment, not an automatic schema-driven rule.
+
+### `audited_input_hashes` scope
+
+Hash the **declared input set** actually reviewed — the theorem-bearing
+`.tex` files passed into this invocation — not a repo-wide union and not
+the reviewer's self-reported opened subset. The external verifier rehashes
+these entries; any mismatch flags `STALE`.
+
+**Path convention** (must match `verify_paper_audits.sh`): keys are
+**paths relative to the paper directory** (no `paper/` prefix — the
+verifier resolves relative to the paper dir; prefixing produces
+`paper/paper/...` and false-fails as STALE). Use **absolute paths** for
+files outside the paper dir.
+
+### Verdict decision table
+
+| Input state                                           | Verdict          | `reason_code` example |
+|-------------------------------------------------------|------------------|-----------------------|
+| No theorems / lemmas / proofs in paper                | `NOT_APPLICABLE` | `no_theorems`         |
+| Theorems present but referenced files unreadable      | `BLOCKED`        | `source_unreadable`   |
+| All proof obligations discharged, no gaps             | `PASS`           | `all_proofs_complete` |
+| Only MINOR issues (notation / exposition)             | `WARN`           | `minor_gaps`          |
+| Any FATAL or CRITICAL issue (logic gap, wrong claim)  | `FAIL`           | `critical_gap`        |
+| Reviewer invocation failed (network / malformed)      | `ERROR`          | `reviewer_error`      |
+
+MAJOR issues alone map to `WARN` or `FAIL` at the reviewer's discretion and
+must carry an explicit justification in `summary` + `details.issues`.
+
+### Thread independence
+
+Every **top-level** `/proof-checker` invocation starts a fresh reviewer thread. For codex this is `mcp__codex__codex`; for manual this is `mcp__manual_review__review`. Do not reuse a saved threadId across separate invocations of this skill. Within a single top-level invocation, the appropriate reply tool (`mcp__codex__codex-reply` or `mcp__manual_review__review_reply`) threads the Phase 3 follow-up rounds — the reviewer needs prior-issue context to judge whether a fix actually closed the gap, and the Phase 1→3 flow above explicitly relies on this. The Phase 3.5 "Independent second review for FATAL/CRITICAL fixes" sub-step is the deliberate exception inside a single run: it must spawn a fresh thread so the blind reviewer has no exposure to the original critique.
+
+Do not accept prior audit outputs (PAPER_CLAIM_AUDIT, CITATION_AUDIT, EXPERIMENT_LOG) as input across separate invocations — the cross-run freshness is what preserves reviewer independence per `shared-references/reviewer-independence.md`.
+
+This skill never blocks by itself; `paper-writing` Phase 6 plus the
+verifier decide whether the verdict blocks finalization based on the
+`assurance` level.
+
+## Example Invocations
+
+```
+/proof-checker "neurips_2025.tex"
+/proof-checker "check the GMM generalization proof, focus on dimension dependence"
+/proof-checker "verify proof in paper.tex — difficulty: nightmare"
+/proof-checker "paper/main.tex --deep-fix"            # opt-in: ask reviewer to also emit repair-grade deep_fix_plans
+/proof-checker "paper/main.tex --restatement-check"   # opt-in: run Phase 3.6 to detect cross-location theorem-statement drift
+/proof-checker "paper/main.tex --deep-fix --restatement-check"   # both opt-ins, independent
+```