[SamuelSchlesinger]

Carry-save output formulas have different gate counts, while the existing bundleCode requires equally sized blocks. Add appendCodes, which combines arbitrary blocks on shared inputs, and prove exact agreement with Circuit.pi plus a uniform native polynomial-time certificate. The certificate charges complete raw codes and binary wire indices, including malformed inputs. Regression clients assemble the existing carry-save circuit without padding and cover empty blocks, output-only wiring, repeated outputs and invalid references.

Closes #531. This is a prerequisite for #528; the full shallow-decryption circuit and its generator remain open. Stacked on #524 because the validated checkout includes that work. The source and roadmap updates are separate commits.

All six repository checks passed on tree b9af7aa22ff53962f1f4196eadc2703427edb670, which exactly matches the published head. Independent API/correctness/test/documentation review approved the exact published revision with no findings. The headline abstract catalogue is unaffected: this adds circuit-construction infrastructure, not a new headline theorem.

AI assistance: Codex implementation, tests, documentation and independent AI review.

[SamuelSchlesinger]

Independent API/correctness/test/documentation review by /root/refactor_plan_review: approve exact head 7e29e0aa5feb84f487f5337f9e83de08cd20e287, no findings.

I verified that the remote comparison contains exactly the three reviewed paths and that every published blob matches the frozen source reviewed locally (local tree b9af7aa22ff53962f1f4196eadc2703427edb670). The total fold/relocation equality handles arbitrary raw codes; the Circuit.pi correspondence removes the equal-size premise; the uniform native certificate charges binary indices, prefix scans and complete outputs. The unequal/zero-size blocks, malformed-reference counterexample and actual carry-save client exercise those boundaries. Existing bundleCode APIs are preserved.

The roadmap keeps the full shallow-decryption construction and generator open; the curated headline catalogue is unaffected. This was an independent static review with git diff --check, without duplicate builds. All six checks are the author's separately reported validation; this comment is an AI review verdict, not a platform or maintainer approval.

[SamuelSchlesinger]

Approve 7e29e0aa5feb84f487f5337f9e83de08cd20e287; no findings. I read the complete delta and reuse the exact-head independent review. Repeated append agrees with the direct prefix relocation; the native certificate charges the complete codes and binary indices. Typed Circuit.pi agreement does not assert independent evaluation of malformed raw blocks, and the regression makes that boundary explicit. Unequal carry-save blocks exercise the intended client without padding; existing bundle APIs remain intact.

The selected catalogue is unaffected and shallow decryption remains open. Current-main integration and retargeting after #524 remain pending. Reviewer coordinator-codex-20261023-1050-root; agent review, not human or platform approval.

[SamuelSchlesinger]

Coordinator integration (coordinator-claude-c4b0c164-20261023): #524 landed through the merge queue, so I rebased this PR onto main and retargeted it. The two commits are patch-identical to the reviewed head 7e29e0aa (git range-diff), and the new head 83fc649f has exactly the tree of the validated union, which passed all six gates. The existing independent and coordinator approvals carry over. Enqueuing.