GMP 2.0.2 fixed-default followup
===============================

RESULT
No target match in a narrowly specified historical default-stream experiment.
This is a distinct packing model from direct concatenation of libc outputs.
It does not recover the SEC recipe or attribute the authors' software.

PRIMARY SOURCE EVIDENCE
1. Original GMP 2.0.2 archive, official project archive listing dated 6 June
   1996:
   https://gmplib.org/download/gmp/archive/gmp-2.0.2.tar.xz
   Archive SHA256:
   2f49d815df1895f7f1e8a91065f43b8ac96e8a19192840dee01bb55d00839e31
   mpz/random.c fills whole limbs from low to high using urandom(), then
   normalizes leading zero limbs. It does not seed the underlying RNG and
   does not reduce to a field bound. urandom.h's generic 32-bit branch is
   random() XOR (random() << 1). The C operand order is unspecified.

2. Original GNU libc 1.09.1 archive, GNU archive listing dated 27 May 1996:
   https://ftp.gnu.org/gnu/libc/glibc-1.09.1.tar.gz
   Archive SHA256:
   5bd1b271a64b46b3db78069c464b9da306d47c7204f4b64de8305b3e79ce8903
   stdlib/__random.c contains a literal 31-word default state, front index 3
   and rear index 0. It uses long and LONG_MAX: a modern 64-bit host call is
   not an acceptable proxy for the 32-bit source behavior.

3. Original GNU libc 2.0.6 archive, GNU archive listing dated 29 December 1997:
   https://ftp.gnu.org/gnu/libc/glibc-2.0.6.tar.gz
   Archive SHA256:
   2384c2e181bd55fec8e08838251cdd8fb807d9b306e1b49227ebf8956da473e0
   stdlib/random.c contains a different literal default table; random_r.c
   supplies the step using int32_t. Both releases' manual/math.texi explicitly
   says srandom(1) reproduces the default sequence. We use the literal static
   default tables without making a seeding call.

The downloaded original sources, member timestamps and hashes are preserved
in this directory and source-provenance.json. Archive listing dates are not
proof of the day each source file was first published. No contemporary source
connects these GNU implementations to the SEC authors.

EXACT EXPERIMENT
Only the generic 32-bit GMP branch was tested. For each of the two fixed
default tables and each of seven public field-size/target groups, start at
the default stream and generate 64 consecutive positive whole-limb integers.
Each limb consumes two consecutive random() results. Include both choices
of which result occupies shift 0 versus shift 1, independently for every
limb. This conservatively covers varying C operand order; it is not a search
over seeds, RNG states or arbitrary stream offsets.

Compare 15 public target integers: the six binary common starts/selected
precursors and the nine prime first-valid-x interval values. The prime
intervals are checked again against the curve equation. For binary fields,
compare both the raw whole-limb value and its low field-width bits. For prime
fields, compare the raw value and reduction modulo the public field prime.
These reductions are explicitly caller hypotheses, not GMP behavior.

14 group runs, 896 whole-number draw positions, and 164656 candidate values
counted separately by reduction: zero matches. Per-row counts and first
outputs are recorded in portable/result.json.

CONTROLS
Original RNG table/pointer declarations and step statements were extracted
from each release. Arithmetic was not rewritten. For 1.09.1 only its DEFUN
function declaration macro was replaced with an ordinary function signature.
A new output/syscall harness invokes the unchanged original GMP urandom.h.
The harness was compiled as actual 32-bit i386 code using GCC 15.2.0 with
-m32 -nostdlib -static -fno-pie -fwrapv, at both -O0 and -O2. The 128 raw
outputs and 128 GMP-packed limbs per release agree with the Python model;
both optimization levels agree. This is 512 C control values, with a second
build repeating them. It is not an original compiler or a full libc build.
The replay uses the specified 32-bit GNU machine arithmetic demonstrated by
these controls, including signed shift/overflow behavior. It is not a claim
about every implementation permitted by the C language.

Independent review passed: ../secp-fifth-software/gmp-defaults-independent-audit.json
independently reproduced all counts, controls and no-match results.

LIMITS
No claim covers explicit seeding, unknown earlier calls, more than the first
64 draws per size, random2, different packing/reduction, or other libc/OS
implementations. Generic 64-bit GMP and the HP-UX/SVR4/Alpha mrand48 branches
were not tested; no concrete historical platform/default compatibility was
established for them in this pass. This is not a general GMP exclusion.

PORTABLE FILES
portable/check_gmp_defaults.py, fixture.json, result.json, README.txt.
The verifier is stdlib-only. It consumes numeric defaults, public targets
and recorded C control values; it does not fetch sources or rebuild C.
