FYI, following the useful discussion we had in Cologne, WG14 discussed memory object model issues again in its recent Ithaca meeting. They too seem to have a consensus to go with what appeared to the the UB group's preferred model: provenance not via integers, with integer-to-pointer casts limited to "address exposed" values, and allowing roundtrip casts of one-past values. They would, however, like to see more concrete implementation experience before actually adopting the model. Any thoughts (or offers!) on how best to establish that would be great.
WG14 also talked about subobject provenance, where WG14 had quite mixed views for several examples.
We weren't able to get to this week's meeting, unfortunately, and have otherwise been mostly preoccupied with other things, but we'll be going back to subobject models.