falcon_det{1024,512}_pubkey_coeffs skipped the first byte of the key and
decoded the remaining bytes without ever looking at it, so a buffer whose
header byte is wrong (a key for a different logn, or bytes that are not a
Falcon public key at all) was unpacked as though it were valid, returning 0
and a coefficient vector that does not correspond to any det key. The
verify entry points do not have this gap: they go through falcon_verify,
which checks the header before touching the rest of the key. Check the
byte here the same way and return FALCON_ERR_FORMAT, which the header's
"non-zero error code if pubkey is invalid" contract already promises.

deterministic1024.o and deterministic512.o were in the shared OBJ list, so
every binary linked both, including test_falcon and speed, which use
neither, and each KAT driver, which uses only its own variant. Give each
test_deterministic<n> binary its own deterministic<n>.o prerequisite and
keep the generic objects in OBJ, so a binary pulls in only the variant it
exercises. The objects still have their own rules and "clean" still
removes them.

deterministic{1024,512}.c include inner.h (and, through it, config.h
and fpr.h), but their object rules named only deterministic.h and
falcon.h, so an edit to e.g. FALCON_FPEMU in config.h left stale
deterministic objects in an incremental build. List the same headers
as the other object rules.

falcon_det{1024,512}_get_salt_version take no length parameter and
read the signature's second byte unconditionally, unlike the other
entry points, which validate their input's length or take a fixed-size
format. Spell out the resulting >= 2 bytes precondition so callers
handling untrusted input know to check it (as the Go binding does).

test_inner declared its message buffer as uint8_t data[data_len], and
the KAT loop starts at data_len = 0; a zero-length variable-length
array is undefined behavior (C11 6.7.6.2p5) and trips
-fsanitize=vla-bound before the first KAT is checked. data_len is
bounded by NUM_KATS, so use a fixed-size buffer of that length.

The per-call-site "if len(b) == 0 { NULL } else { &b[0] }" branches
look like they should be a shared helper, but the duplication is
load-bearing: cgo enforces its pointer-passing rules against the
syntactic form of the call arguments, so an inline &b[0] is checked
against just the slice's backing array, while the same pointer
returned from a helper is resolved to its entire containing
allocation -- and panics when the caller's slice aliases a struct
that also holds Go pointers, exactly what TestPointerToPointer
constructs. Say so where the next reader would reach for the helper,
and add the det512 mirror of that regression test, which the copied
det512 bindings were missing.

The CT-format salt-version check compares vct but its error message
printed the stale v from the earlier compressed-format check, so a
failure would report the (correct) compressed version instead of the
offending CT one.

hash_to_point_coeffs declared its scratch space as a uint8_t array,
but Zf(hash_to_point_ct) documents that tmp[] must have 16-bit
alignment (it stores uint16_t through it). Declare the buffer as
uint16_t so the alignment holds by construction; on strict-alignment
targets the byte array was undefined behavior. No output change: the
KATs are unaffected.

FALCON_DET{1024,512}_SIG_COMPRESSED_MAXSIZE and _SIG_CT_SIZE expanded
to an unparenthesized "...-40+1", which miscomputes inside a larger
expression such as FALCON_DET512_SIG_CT_SIZE * 2. All existing uses
are value-unchanged.

scripts/gen_deterministic.sh built each deterministic<n>.c with a single
pipeline redirected straight into the target. Under "set -e" a pipeline's
status is that of its last command, so a failing "cc -E" (a #error or syntax
error in the template) was masked by unexpand: the script exited 0 and
overwrote the target with whatever cpp had emitted, and because the Makefile
regenerates only when the template is newer, the broken file then counted as
up to date.

Run the stages one at a time into a private mktemp directory so every exit
status is seen, generate all requested files there before moving any into
place, and reject missing or non-numeric arguments up front. A failure now
leaves the existing sources untouched.

Installing with mv rather than redirection has its own edge cases, so tighten
those too. Reject n values with a leading zero and duplicate n, since either
would produce a staged file name that does not correspond one-to-one with the
requested targets. Refuse to run when a target path is a directory: mv would
otherwise place the generated file inside it and report success without
replacing the requested path. Finally install all staged files with a single
mv invocation; each replacement is still atomic because the staging directory
is on the destination filesystem.

* Correct the drift timeline: it was not "three months" of public red

Four documents (README, AUDIT_READINESS, BLOCKERS, the follow-up workflow)
claimed the live-deployment check "failed in public for three months". Both
halves are false, and git says so:

  2026-06-16  committed contract diverges from deployed app 763809096
  2026-08-13  #12 rebuilds verify_deployment.py so it CAN fail
  2026-08-30  testnet-followup.yml lands; the drift goes red in public
  2026-09-03  closed by deploying 770964251 from the committed artifact

So the divergence was 79 days, not three months -- and for 58 of them
NOTHING DETECTED IT, because the verifier of the day hashed the deployed
program and compared it to the chain. The job that "failed in public" did
not exist until day 75; it was red for 4 days, not 90.

The honest account is worse for us and more useful to a reviewer: this
repo's flagship drift was missed for two months by a check that could not
fail -- the same defect class the project keeps finding. Claiming we left
it red on purpose for three months converted a detection failure into a
discipline story. It also would not have survived first contact with
anyone running `git log`.

Also corrects the guard docstring in
sdk/tests/test_reports_print_on_a_windows_console.py, which said the U+2194
line stayed invisible because "the happy path never touches it". The drift
branch DID run -- on Linux CI, where the stream is UTF-8 and the character
encodes fine. The uncovered case was never the failure path; it was the
failure path on a cp1252 stream.

And drops "which is the property the contract exists to demonstrate" from
the README: I5 is a control the contract enforces, not its purpose. The
contract exists to verify Falcon-1024 on-chain via falcon_verify.

Found by putting the draft write-up to the Apex Council for refutation
before publishing it, per the standing directive. 3 of 4 responding seats
refuted; the arithmetic objection was checkable and correct.

Verification (FALCON_DET1024_LIB set, TRELYAN_REQUIRE_KAT=1):
  sdk/tests  145 passed, 5 skipped
  drift banner + app-id partition + cp1252 guards  35 passed

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* Record that on-chain acceptance is NOT independent verification

AUDIT_READINESS lists the on-chain verifier (go-algorand's falcon_verify)
and the pinned signer source (algorand/falcon @ ce15e75b) as adjacent rows
and never states what follows from putting them together:

  go-algorand go.mod  -> github.com/algorand/falcon v0.1.0 -> ce15e75b
  this repo pins      -> algorand/falcon                      ce15e75b

They are the same C source at the same commit. So "the AVM verified our
signature" is a sign/verify round-trip inside ONE implementation, not
cross-implementation evidence -- and combined with the interop KAT being
unrunnable by construction (det1024 0xBA vs randomized 0x3A), NOTHING
currently checks these signatures against an independent Falcon.

Caught while adversarially reviewing a draft write-up that claimed the AVM
was "a different implementation accepting our bytes". No shipped document
made that claim, so this commit adds no retraction -- it adds the caveat
that stops the claim being made, by us or by a reader reading two rows of
a table in the natural order.

The pin itself is correct and must not be bumped: matching what the chain
runs is the entire point. The defect was leaving the consequence unwritten.

Security impact: documentation only, no code path changes. The caveat
WEAKENS a claim an auditor could otherwise have inferred from this file.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

AUDIT_READINESS lists the on-chain verifier (go-algorand's falcon_verify)
and the pinned signer source (algorand/falcon @ ce15e75b) as adjacent rows
and never states what follows from putting them together:

  go-algorand go.mod  -> github.com/algorand/falcon v0.1.0 -> ce15e75b
  this repo pins      -> algorand/falcon                      ce15e75b

They are the same C source at the same commit. So "the AVM verified our
signature" is a sign/verify round-trip inside ONE implementation, not
cross-implementation evidence -- and combined with the interop KAT being
unrunnable by construction (det1024 0xBA vs randomized 0x3A), NOTHING
currently checks these signatures against an independent Falcon.

Caught while adversarially reviewing a draft write-up that claimed the AVM
was "a different implementation accepting our bytes". No shipped document
made that claim, so this commit adds no retraction -- it adds the caveat
that stops the claim being made, by us or by a reader reading two rows of
a table in the natural order.

The pin itself is correct and must not be bumped: matching what the chain
runs is the entire point. The defect was leaving the consequence unwritten.

Security impact: documentation only, no code path changes. The caveat
WEAKENS a claim an auditor could otherwise have inferred from this file.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Four documents (README, AUDIT_READINESS, BLOCKERS, the follow-up workflow)
claimed the live-deployment check "failed in public for three months". Both
halves are false, and git says so:

  2026-06-16  committed contract diverges from deployed app 763809096
  2026-08-13  #12 rebuilds verify_deployment.py so it CAN fail
  2026-08-30  testnet-followup.yml lands; the drift goes red in public
  2026-09-03  closed by deploying 770964251 from the committed artifact

So the divergence was 79 days, not three months -- and for 58 of them
NOTHING DETECTED IT, because the verifier of the day hashed the deployed
program and compared it to the chain. The job that "failed in public" did
not exist until day 75; it was red for 4 days, not 90.

The honest account is worse for us and more useful to a reviewer: this
repo's flagship drift was missed for two months by a check that could not
fail -- the same defect class the project keeps finding. Claiming we left
it red on purpose for three months converted a detection failure into a
discipline story. It also would not have survived first contact with
anyone running `git log`.

Also corrects the guard docstring in
sdk/tests/test_reports_print_on_a_windows_console.py, which said the U+2194
line stayed invisible because "the happy path never touches it". The drift
branch DID run -- on Linux CI, where the stream is UTF-8 and the character
encodes fine. The uncovered case was never the failure path; it was the
failure path on a cp1252 stream.

And drops "which is the property the contract exists to demonstrate" from
the README: I5 is a control the contract enforces, not its purpose. The
contract exists to verify Falcon-1024 on-chain via falcon_verify.

Found by putting the draft write-up to the Apex Council for refutation
before publishing it, per the standing directive. 3 of 4 responding seats
refuted; the arithmetic objection was checkable and correct.

Verification (FALCON_DET1024_LIB set, TRELYAN_REQUIRE_KAT=1):
  sdk/tests  145 passed, 5 skipped
  drift banner + app-id partition + cp1252 guards  35 passed

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Drift banner crashed a Windows console, downgrading exit 1 (DRIFT) to exit 2 (could not check)