A Triad-of-Triads Contract for Certified Switching Under Fixed Accounting

This foundational manuscript introduces a new operational certification object for boundary-dominated physical and computational systems, addressing a long-standing gap between engine-level performance and falsifiable, replayable verification. Rather than proposing a new switching mechanism or physical effect, the work defines and executes a triad-of-triads certification grammar that separates state, pattern, and meta-decision layers, and cages them with two independent redundancy structures—a view square and a ladder square—under explicit accounting. The result is a signed branch map that preserves agreement with engine outputs in the fat interior while refusing or downgrading boundary haze in a deterministic, auditable way. The framework is deliberately external to engines. Timing (T) and locality (L) are fixed outside the engine so that threshold travel, smoothing, and quiet parameter drift cannot rescue ambiguous cases. Four-Solves-Three (4S3) auditing is embedded twice and nested, ensuring that no single curve, window, or tightening pass can carry a claim by itself. Zeros-stay-zeros accounting, yield logging, and a monotone collapse witness (Tz) make ambiguity expensive and visible rather than silently filtered away. Where appropriate, a narrowly scoped Strong-to-Weak classification is permitted to retain utility without erasing structural dependence. The method is validated through synthetic functional testing across two independent generators: a Tokenized Magnet Hysteresis corridor engine and an Addressing/L5 geometry engine. A unified ledger schema allows the same certifier to operate on both, preserving preregistered interior outcomes while enforcing refusal or downgrade at the boundary. This cross-engine regression demonstrates that the certifier comes close to engine behavior where claims are stable, yet diverges intentionally and reproducibly where engines tend to over-narrate. A bounded acceptance-recovery pass (TWA+) was implemented and tested; measured gains were minimal and highly conditional, leading to the deliberate decision not to pursue further recovery in order to preserve refusal-first behavior. By turning boundary behavior into a replayable, auditable object rather than a narrative dispute, this work provides a write-once rule spine that can be reused across magnet switching, routing dominance, and other corridor-based systems. Its immediate value is operational—locking down certification before real data arrives—and its long-term value is methodological: enabling future claims to fail cleanly, succeed durably, and be compared across platforms without moving thresholds.