Fixed source-derived check, 2026-10-17

Question: can the documented FreeLIP / NTL 1.5 zrandomb routine directly
produce the two already known shared SEC binary-curve starting integers?

Inputs fixed before testing:
  SEC131: 0x10134db223421eb623422888a7879682
  SEC193: 0x23daf8a23206f9c4f299d7b21a9c369137f2c84ae1aa04
  bounds: exactly 2^131 and 2^193 respectively
  limb widths: 26 and 30, as in the existing historical source controls

The original routine fills ceil(bit_length(bound)/width)+1 limbs, highest
limb first, using accepted zrandom(2^width) draws, then reduces modulo bound.
For a power-of-two bound, every wholly retained low limb is unchanged.
Use the last min(floor(m/width),6) full limbs at width 26 and at most five
at width 30. Both sequences are at least four limbs long. The source model
uses high-to-low chronology. A reversed chronology is an additional explicit
packing hypothesis, not a claim about zrandomb's source.

All initial states are allowed, so default seeding, clock seeding and calls
before these observations are already absorbed. Existing exact proofs show
two rejected internal states cannot occur within 16 transitions for widths
26/30. Thus the only possible interior timings of these short observation
sequences are consecutive states or one additional transition in one gap.

Use existing independently audited modular identities to seek contradictions.
Passing an identity check is inconclusive and must never be called a match.
Source routine changes, 62-bit limbs, field-polynomial reduction of a larger
integer, other bounds, external interleaved calls, and hashing are out of scope.

Controls: simulate the specified source routine with documented public seed
7157891 and seed 20000; all real observations must pass the necessary-condition
check. Also force each possible single rejection gap and use all documented
boundary values of the rejected interval. Check every contradiction again
using cleared modular denominators and alternative ceiling arithmetic.
