Co-authored-by: Cosimo Bassi <65770425+cusma@users.noreply.github.com>

Co-authored-by: JBScaled <164410456+JBScaled@users.noreply.github.com>

Co-authored-by: JBScaled <164410456+JBScaled@users.noreply.github.com>

Co-authored-by: JBScaled <164410456+JBScaled@users.noreply.github.com>

Co-authored-by: JBScaled <164410456+JBScaled@users.noreply.github.com>

Merging 13 sequential PRs, each of which regenerated the TEAL from ITS OWN
source, left contracts/out as a textual git-merge of compiler outputs. The
teal-matches-source gate classified it precisely: STALE ARTIFACT -- instruction
streams identical (nothing deployed or tested was wrong), but the emitted
'// inscription.py:NNN' references pointed at the wrong lines, misleading any
auditor tracing TEAL back to source.

- contracts/out regenerated with the exact pinned invocation (cd contracts;
  puyapy inscription.py --out-dir out --target-avm-version 12; puyapy 5.8.1,
  algorand-python 3.5.0). verify_teal_matches_source now exits 0: every
  artifact byte-derives from the merged source.
- trelyan_client.py regenerated from the fresh arc56.
- verify_teal_matches_source's embedded-client comparison now excludes
  compilerInfo/sourceInfo -- the generator drops build metadata on embedding,
  so full-JSON equality fails FOREVER on a freshly generated client (observed
  today, the first day this comparison ran against a same-day regen). The
  behavioral keys all still participate. Mirrors verify_client_matches_arc56.py.

Verified after regen: teal-matches-source exit 0 (six ok lines including the
client), verify_client_matches_arc56 OK, contract suite on a fresh LocalNet
28/28 with real Falcon signatures.

Windows note for the next person: puyapy resolves 'python' via VIRTUAL_ENV or
the system path -- without VIRTUAL_ENV set, the WindowsApps store shim wins and
compilation dies with "Python was not found". Set VIRTUAL_ENV to the compile
venv when invoking outside CI.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Vendor the pinned det1024 tree + Rust trelyan-pq (ffi/core), KATs first

Running the LocalNet contract suite for the first time since the PR stack merged
produced three honest failures: the zero-address and TCE-76 guards, present in
the source AND the committed TEAL, were absent at runtime. Root cause: the suite
deploys through trelyan_client.py, whose embedded _APP_SPEC_JSON is frozen at
generation time -- and it was last generated in June. The coverage map had a
hole exactly one file wide: verify_teal_matches_source proves source -> TEAL,
contract-drift proves TEAL -> deployed app, and nothing proved TEAL -> generated
client, which is the copy the tests actually exercise.

- contracts/trelyan_client.py regenerated from the committed arc56 (one line:
  the embedded spec). All 28 LocalNet tests now pass against a program carrying
  every merged guard.
- contracts/verify_client_matches_arc56.py added and wired into the
  teal-matches-source CI job. Behavioral-keys comparison (byteCode, methods,
  state, bareActions, structs, name, arcs) -- full-JSON equality was tried
  first and fails forever on a FRESH client, because the generator legitimately
  drops compilerInfo/sourceInfo; that near-miss is recorded in the script
  header. Proven to bite: against the June client it exits 1 naming byteCode.
- Exit 2 ("could not compare") is failure, never agreement -- same rule as the
  sibling verifiers.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

v4.1 replaces v4's placeholder references for the two governed judgments:
- sign-kk crop reference = repeated sign-aa sessions (fresh keypair each),
  matched in protocol and count; crop-positive iff C_kk > max(C_aa), strict.
- sign-rr raw rule = three states calibrated against a matched null-rr bank
  (clears / inconclusive_pool_offset / fail_beyond_reference); the PASS set
  is not enlarged; SHAPE and the raw state can never issue PASS or FAIL.
- N = 20 accepted sessions per bank, IDs frozen before the governed
  experiment; permitted reuse enumerated; no within-session resampling.

Correction (2026-08-20, from the full-team implementation review, recorded
in place per the evidence discipline): the session's own gating A/A control
is a conditioned draw and is NOT a bank member; the AA bank is dedicated
ungated sign-aa repeats only, minimum 2. No session had been judged under
the uncorrected reading.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

V4_BACKLOG §A1-A5, all post-run because the harness is never rebuilt while a session measures.

A1 (the one that mattered). judge_v2 used to compute p = (0+1)/(0+1) = 1.0 from an EMPTY null —
a PASS-shaped number derived from nothing — while its SHAPE arm, guarded by n > 0, could never
fire, so every experiment fell through to PASS. Not hypothetical: the ubuntu CI session of
2026-08-18 printed `crop max|t| = 38.17  p_emp = 1.000` and reported the sign-aa CONTROL as PASS
with its shape arm never run. The gated experiments were saved by the control rule; sign-aa is
read on its isolated verdict, so the control that gates the session was the one the defect could
mislabel. Now: crop_empirical_p = None and INCONCLUSIVE, which is what "the diagnostic did not
run" actually means. The PRIMARY statistic never depended on the null, so a real location
difference still FAILs — fail-closed must not become fail-silent in the direction that hides a
signal. Two regression tests, one per direction.

A2. controls.aa_verdict / controls.aa_ok are now in report.json. The A/A downgrade is applied
through a local flat_for_rule, so a failed control previously left controls_ok:true and flat:PASS
in the artifact while every key verdict read INCONCLUSIVE — the sign-aa row was the only trace.

A3-A5. READING_GUIDE now documents sign-aa and its downgrade-only gate. The sign-kk description
no longer says "fixed message M0" (v3 replaced it with a four-message rotation) or "the per-key
timing fingerprint measured directly" — the barred word, and it presupposed the finding; it now
says what the design is and that a per-key difference is what the experiment TESTS FOR, never
what it assumes. Two doc comments stopped calling the v3 real-operation null a "flat-control
null", and crop_empirical_p's docs now state that None means the diagnostic did not run.

40 tests green, fmt + clippy -D warnings clean. No decision rule changed; A1 is strictly
restrictive (it converts an unearned PASS into INCONCLUSIVE).

Security Impact: no vendored C, no build flags, no signer path. Evidence-layer only, and every
change removes a way for the harness to report more confidence than it earned.

§4c, the reading of the 82k session:
- All five pre-registered gates passed; SESSION VERDICT PASS at MDE90 ~= 14.5 us (against a
  planned 30-42 us - the machine was quieter, sd 350-357 us vs the 425-1039 us planning band, so
  the session DOES resolve the 12-17 us range every earlier session was blind to).
- sign-aa puts the arm offset at +1.40 us with a CI of [-3.53, +6.33] - EXCLUDING +13.9 us. The
  control added the day before has answered its question: no systematic arm/layout offset of that
  size on the machine where the 8-of-9 pattern was observed. The pattern also failed to reproduce
  (this session: +4.05, -7.22, -6.94; pooled 9 of 12, two-sided p ~= 0.15).
- Exactly what the PASS licenses, and the list of what it does not license at any sample size.
- A predictions scorecard including the one that was WRONG (sign-key predicted a near-certain
  FAIL at E|t| ~= 12.5; observed t = 2.36, PASS) and why: it assumed v3b's point estimates were
  true. So did the 44% FAIL forecast. Both failed for the same reason.
- The methodological result, which is worth more than the verdict: the +12-17 us deltas that three
  rounds of council review forced this repo to withdraw have now failed to reproduce at 17x the
  samples, INCLUDING THEIR SIGN. Sub-threshold t with a CI excluding zero is a documented
  non-replicating shape here, not a weak signal.
- Recorded before anyone reads them as a finding: two gated pairs again show that same shape,
  now negative. Fourth session running; the first three did not replicate.

Document header rewritten: the top of this file previously presented the WITHDRAWN v1 FAIL as
the report's verdict, so a reader who skimmed left with the wrong finding (flagged by the pre-run
language audit). There is now a five-row table of every session, its verdict and what it is worth
today, with the standing statement that nothing here is a constant-time claim. Earlier sections
stay unedited except where a correction is marked - the record of what was claimed and withdrawn
is itself the evidence that the process works.

Security Impact: none - documentation. No code, no vendored C, no flags. The net effect on claims
is restrictive: one over-broad header removed, one PASS bounded by a stated MDE90, and a
previously live hypothesis (arm layout) excluded by measurement rather than by argument.

Eight concurrent rust-ci runs had queued on PR #39, most of them behind markdown-only commits.
Three causes, three fixes, all in the workflow file:

1. A pull_request path filter is evaluated against the PR's CUMULATIVE diff, not the newest
   commit. PR #39 has touched rust/** and third_party/** extensively, so every later push to the
   branch matches the filter no matter what it changed. That is GitHub behaving as documented and
   the filter cannot express "what this commit touched" -- so the fix is the concurrency group
   below, not a cleverer filter.
2. push and pull_request both fired for the same SHA, running everything twice. push is now
   restricted to the default branch; pull_request already covers PR branches.
3. No concurrency group, so superseded runs kept going. Added, with cancel-in-progress: a
   superseded run reports on code nobody has any more.

And the falcon-ct evidence session no longer runs per-push -- it is now schedule (weekly) plus
workflow_dispatch. It costs 20+ minutes, and its verdict is currently INCONCLUSIVE BY
CONSTRUCTION on this class of runner: the null gate is a fixed |t| < 4.5 applied to a
pool-vs-pool null whose spread grows as the environment gets QUIETER, sd(t)^2 ~= 1 +
(sigma_key/sigma_total)^2 * (n/32). The runner's sigma_total is ~32 us against the laptop's
350-733 us, so 5 of 20 null sessions tripped the gate and voided the session while BOTH synthetic
controls behaved perfectly (evidence/ct/OBSERVATION_ci-ubuntu-2026-08-18.md). Until the v4 null
lands, a per-push session spends runner time re-deriving a known INCONCLUSIVE. Weekly plus
on-demand keeps its real value -- it is also the end-to-end smoke test of the harness, and it is
what caught that the v3.1 binary ran correctly before the 5.5-hour local session.

The reason to restore the per-push trigger is written into the job so it is not forgotten: when
the v4 null makes a CI session capable of a verdict again.

Security Impact: none. CI scheduling only -- no gate weakened. Every correctness job (3-OS KAT,
fmt+clippy -D warnings, MSRV, cargo audit + deny) still runs on every relevant push and PR; only
the non-gating observation job moved off that cadence.

Increment 1 of METHODOLOGY-v4 (committed first, fb96211). Put to the FULL six-seat team as a
red/blue/apex `council run` per Brandon's standing directive of 2026-08-19 ("use always the
entire team for all tasks", now charter 3.0). The team found six defects; all six are fixed
below, and one of them changed the design.

WHAT THIS ADDS
- --null-design rr|ss, default rr. `ss` = ONE fresh 32-key pool, BOTH classes drawing from it by
  INDEPENDENT index streams: E[mean0-mean1 | pool] = 0 by construction, mixture shape preserved
  (which a single-key A/A null cannot give). `rr` is unchanged, so no session changes its rules
  without saying so on the command line.
- controls.null_raw_t_sd -- the one number METHODOLOGY-v4 2 pre-registers as the validation
  reading -- printed with its pre-registered band and recorded in report.json. schema_version 5.
- Per-null-session logging for both designs.

WHAT THE TEAM CHANGED (apex action 4, the one that matters)
`ss` narrows the null while 2a's compensating matched crop references are NOT wired, so the same
fixed |t| < 4.5 gate trips LESS often: selecting `ss` was a route to an easier pass. My claim that
"v4 makes sessions harder to pass, never easier" was true of the SHAPE arm and false of the gate.
A change that makes a session easier to pass may not also be allowed to issue the verdict, so:
VALIDATION-ONLY MODE. Under `ss` every experiment is marked ungated and session_verdict is
INCONCLUSIVE, with report.validation_only = true and a loud console line. METHODOLOGY-v4 2 already
said "nothing in session 1 is read as evidence about the signer" -- that was prose a reader
holding report.json would never have seen. It is now enforced.

THE OTHER FIVE
- sample_sd returned 0.0 for n < 2, and 0.0 <= 1.25 is the pre-registered PROCEED band -- a check
  that cannot fail, reachable for real because the null loop breaks on the first session that
  cannot run. Now Option<f64>, None below two observations, serialized as null, printed as
  "UNDEFINED ... This is NOT the '<= 1.25 proceed' band -- it is no reading at all."
- The 1.25/1.60 lines are not enforced anywhere in code. Rather than pretend, the artifact now
  says so: controls.null_raw_t_sd_gate = "human (METHODOLOGY-v4 2); no verdict reads this number".
  The mechanical protection is validation_only above.
- --aa-repeats / --rr-sessions were parsed and never read: an inert knob, this project's dominant
  defect class. I caught this myself before the review returned and the team confirmed it as
  Critical. They are REFUSED with an explanation until 2a is wired, and --help says so rather
  than advertising them.
- Parser guarantees were false as written: `--null-design rr --aa-repeats 1` was accepted because
  the check tested the VALUE (!= 1) rather than whether the option was SUPPLIED, and
  `--rr-sessions 0` parsed fine. Now presence-based, and zero is refused.
- The null-session error string was lost in a refactor (`could not run: {e}` -> `could not run`),
  making keygen, allocation and FFI failures indistinguishable. Restored.

AND THE TEST THAT DID NOT TEST WHAT IT CLAIMED
`null_ss_arms_draw_independent_indices` checked only marginal coverage and P(a != b) ~ 31/32. A
reviewer supplied the counterexample: b := (a+1) mod 32, forced equal to a on 1/32 of positions,
passes both while being a deterministic function of a. Independence is a property of the JOINT
distribution, so it now runs a Pearson chi-square over all 1024 (a,b) cells (mean 1023, sd ~45 on
1023 df; the shifted counterexample scores in the hundreds of thousands) and asserts no cell is
empty. Production was never wrong -- the two streams come from disjoint SHAKE halves -- but the
test would have gone green on a later correlated implementation.

43 tests, fmt + clippy pedantic/nursery -D warnings clean. Default rr path unchanged in what it
judges. Guards verified against a rebuilt binary (cargo test does NOT refresh target/debug).

Security Impact: no vendored C, no build flags, no signer path, no new dependency. Evidence-layer
only, and net restrictive: a new mode exists but it is structurally incapable of issuing a Falcon
verdict, one unearned PASS band is closed, and two false guarantees are made true.

A second review -- an independent reimplementation of welch_t / pooled_percentile / t_values /
crop_statistic that reproduces report.json exactly -- found seven defects in revision 1. Every
number below was re-verified locally before acting on it. The design survives; three of my claims
do not.

WITHDRAWN: "10.24 / 1.742 = 5.88, within 1% of the boundary". That number should never have been
computed. It divides a max-of-nine ORDER STATISTIC by an sd measured on the RAW t: the nine crop
t's have their own spreads across the 20 null sessions -- 3.82, 4.79, 5.21, 5.63, 4.69, 3.94,
3.24, 2.91, 2.33 -- and none of them is 1.742. The max is attained at crop 0.80 in 8 of 20
sessions and at six other crops in the rest, so it is not even a fixed statistic. Cropping also
shrinks the denominator (SE 2466 ns raw vs 906 ns at crop 0.50 on raw-sign-rr.csv), so removing a
location offset deflates the crop by MORE than the raw factor -- the opposite direction to what
"the same factor" assumed. And every stable-looking estimate disagrees: the chi-square band maps
10.24 to 4.03-7.73, spanning all three outcome branches; two decompositions give 4.97 and 7.31.

OVERSTATED IN ITS OWN CONSEQUENCE: "v3.1's PASS may flip". Revision 1 named only the middle
outcome -- the one that does NOT change the verdict. All three are now pre-registered, with
thresholds read off the code (SHAPE iff the crop exceeds ALL 20 null sessions; sign-kk combines at
>= 2 of 3; session = worst of kk_combined and sign-rr; the three kk crops are 3.4754 / 5.3584 /
5.8405):
  >= 5.8405           nothing moves                      -> PASS unchanged
  5.3584 - 5.8405     sign-kk-1 alone SHAPE              -> PASS UNCHANGED (one pair cannot carry
                                                            >=2-of-3); one CT_REPORT row and one
                                                            sentence need correcting
  < 5.3584            kk-1 AND kk-2 SHAPE                -> session SHAPE
Flipping the SESSION needs the v4 null's crop max below 5.3584, not below 5.84.

AND THE BEST AVAILABLE PRIOR SAYS IT DOES NOT FLIP: v3b's 20 null sessions carry an inflation of
only 1.004-1.024, so they are ALREADY a v4-equivalent null on the location statistic. Their crop
max is 5.749 -- between kk-2's 5.358 and kk-1's 5.840, i.e. the middle branch. n = 2352 against
v3.1's 40180, so it settles nothing, but it is evidence and it belongs in the file.

FALSE AND WITHDRAWN: "every 'no SHAPE' reading in v2, v3, v3b and v3.1 was made against an
inflated null". Checked against the committed reports: v2's null was 24 FLAT-LOOP sessions -- a
NARROW null -- and v2 returned SHAPE on all six signing experiments, so it contains no "no SHAPE"
readings at all; v3's first run had null_ok:false and minted nothing; v3b's inflation was under
2.5% and immaterial. ONLY v3.1 had a materially inflated null. Over-claiming about this project's
own record is the exact failure this file exists to correct, and I did it.

ALSO FIXED:
- The contradiction between 2a and 3.3 over which reference judges sign-kk. Named: repeated
  sign-aa. Ambiguity resolved BEFORE any measurement.
- "All ten experiments' raw samples are committed" -> report.json holds 9 experiments, the
  directory holds 11 raw CSVs, SHA256SUMS covers 13. And the null side is NOT recoverable, so a
  re-judge compares August's experiment crops against a null measured later, on different key
  material, in a different thermal state. Stated.
- The design was never priced. Measured: mean sign is 7.7066 ms, one 82k block is 632 s, 20 null
  sessions are 3.51 h = 63.6% of v3.1. Three references at 82k is ~10.5 h of null before an
  experiment runs. So v4 session 1 is a VALIDATION run at v3b scale (~1 h) whose only job is to
  answer whether null-ss gives sd(t) ~ 1; sizing a verdict session comes after. Running a 10-hour
  verdict session on an unvalidated null would repeat the v3.1 ordering mistake at five times the
  cost.

NEW 2b, alternatives rejected -- including one that would have been a disaster: a
label-permutation surrogate null returns sd(t) ~ 1 BY ALGEBRAIC IDENTITY whatever the data holds.
Run on raw-control-leaky.csv, whose raw t is -296.34, it returns 0.97. A reference that certifies
the deliberately leaky control is the check-that-cannot-fail defect this repo keeps a register
for. Excellent regression fixture, not a null.

AND a second confirmation of the defect that never touches a t statistic: sd(dmean) = 3229.8 ns
against rms(se) = 1839.1 ns implies a between-pool offset sd of 2655 ns, hence a predicted sd(t)
of 1.756 against 1.742 observed; both routes put sigma_key at 10.49 / 10.62 us.

Still a DRAFT, in force nowhere.

Security Impact: none - a design document. No code, no vendored C, no flags, no rule in force.

The first draft of §4c.1 said the v3.1 sign-aa control "establishes that the +12-17 us deltas
recorded in v2/v3/v3b were not a systematic arm or memory-layout artefact". Put to the six-seat
R&D council under the standing rule for a claim about to be relied on: five of six returned
OVERSTATED (the sixth is the watsonx seat, documented in the charter as restating what it is
handed). The objections are correct, so the claim is withdrawn and replaced by what survives.

WITHDRAWN, and why - five independent objections, all upheld:
1. CROSS-SESSION INFERENCE. The control ran in v3.1; the deltas are from v2/v3/v3b. That step
   assumes harness, allocator, build and layout were unchanged across them - and the version
   numbers are themselves evidence they were not. An artefact present earlier and perturbed by
   v3.1 produces exactly this pattern. (All five seats.)
2. A SAME-KEY CONTROL IS BLIND TO CONTENT x ARM INTERACTIONS. Cloning one keypair zeroes an
   offset that depends only on position or address; it cannot see effects requiring the two arms
   to hold DIFFERENT key material - cache-set conflicts, page colouring, content-dependent
   execution meeting arm-specific state. Those are still layout artefacts.
3. ONE LAYOUT DRAW. Placement is a draw from a distribution; one aa pair samples one placement.
4. POWER DOES NOT REACH THE BAND. MDE90 ~= 14.5 us sits at or above the low end of 12-17 us; a
   true 12 us offset is t ~= 4.8 against a 4.5 gate. The CI excludes +13.9 for a constant additive
   offset; the session is not a high-power refutation of 12 us.
5. FAILING TO DETECT IS NOT EQUIVALENCE. "No effect larger than X" needs a pre-registered margin
   and TOST (Schuirmann 1987), which was not pre-registered. Plus: the naive CI assumes iid, and
   82k timings on one laptop are serially dependent.

SURVIVES: in the v3.1 session, on that build and layout, a constant additive arm offset is
+1.40 us with a CI excluding +13.9 us. The hypothesis is weakened for constant additive offsets
in the current build and otherwise still open.

Also withdrawn: the consequence that de-prioritised sign-kk arm randomisation on the strength of
sign-aa. It stays on the v4 list, joined by four new items the review generated - replicate the
A/A control across layout draws; a DIFFERENT-key swapped-arm control (the only design that can
close the artefact question rather than narrow it); cluster-robust/block-bootstrap SEs; and TOST
with a pre-registered margin for any bounding claim.

This is the fifth reading this document has had to weaken, and the first where the flawed step
was an INFERENCE of mine rather than a number. Recorded in place rather than quietly rewritten.

Security Impact: none - documentation. Strictly restrictive: a conclusion is withdrawn, no new
claim is made, and a de-prioritised control is restored to the work list.

The full-team review of the implementation caught a claim I had made in the draft and repeated in
commit messages: that v4 "makes sessions harder to pass, never easier". True of the SHAPE arm (a
narrower null makes SHAPE more likely); FALSE of the gate, because a narrower null trips the fixed
|t| < 4.5 line LESS often. `ss` therefore lets through sessions `rr` would have voided. That is
the intended correction -- they were being voided for arithmetic rather than environmental
reasons -- but it is still a liberalisation, and it lands BEFORE 2a's compensating matched
references exist.

So the file now states the restriction that the harness enforces: a session run with
--null-design ss CANNOT issue a Falcon verdict. Every experiment ungated, session_verdict
INCONCLUSIVE, report.validation_only = true, and the only reading is controls.null_raw_t_sd. The
restriction lifts when 2a is implemented and pre-registered in v4.1, not before.

Also added to the 2 reading table: an UNDEFINED sd (fewer than two usable sessions) is not a
reading at all and specifically not the "proceed" band -- the harness reports null rather than
0.0, because a false zero would land the decision in its proceed band on no data. And the table
now says out loud that these lines are applied by a HUMAN: report.json carries
controls.null_raw_t_sd_gate = "human ...; no verdict reads this number", so null_ok: true can
never be mistaken for "2 was satisfied".

Security Impact: none - a rules document. The net effect is restrictive: a mode that exists in
the harness is declared incapable of issuing a verdict, and one reading that could have been
satisfied by no data is closed.

Six-seat zuss (8/9 seats), written under the blindness clause of
PREREG_v41-release-replicate.md 3a(3): methodology only, no session
values. Majority locks Option (a) - crop-shape is NOT part of the
synthetic-control hypothesis, because a synthetic crop null cannot
calibrate or gate the Falcon crop/SHAPE path (non-transfer); the interim
raw-line ruling becomes permanent under it. The minority Option (b) draft
(matched synthetic null family + planted-shape positive control with a
numeric fire condition) is kept in full with the founder decision
criterion, because the split is real. Takes force only as a dated
pre-registration after the release-replicate decision, in the ruled order.

Security Impact: document only, explicitly not in force; no rule changes
until adopted.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Code (S8, S6): judge_raw_only now maps a non-finite raw t to INCONCLUSIVE
(welch_t is total today, so the guard is unreachable through real samples
and documented as such - it exists so INCONCLUSIVE-never-PASS survives a
future welch_t change). The regression test is now TWO-SIDED: the same
flat series judged v2-style against a bank built strictly below its own
crop statistic is demoted to Shape (the live failure's mechanism), while
raw-only Passes it - reverting the production wiring goes red. A constant
series is asserted flat-and-finite -> Pass.

Pre-registration amendment (S1-S5, prospective, before any run exists):
instrument pinned to the amendment commit with cargo build --release
--locked and recorded toolchain; null_raw_t_sd defined in the document
(n-1 sample SD over the 20 null-ss raw t values); one-run/first-launch
rule with every attempt kept and pre-measure environment capture;
blindness clause over the quarantined banks until the controls pre-reg
and section 6.1 are committed; reading gated on the replicate's own
controls with all-20-or-no-reading; the partial band is a NO-PROCEED;
the founder A/B choice is dated before any governed launch and a Branch A
stop carries to Branch B.

RETRACTIONS (S7, S9) - correcting my previous commit message and docs:
"cannot lift any session verdict" was FALSE: removing the mismatched crop
demotion can flip controls NOT-OK -> OK, which lifts control-blocked
INCONCLUSIVEs back to their isolated verdicts - that lift is the ruling's
intent and is now stated, not denied. And "the crop diagnostic does not
run" overstated the implementation: crop statistics are still computed
and retained as descriptive numbers; what is true is that no crop p
against any bank is computed and nothing in the verdict path reads them.
A raw-line fire on the flat control blocks the session pending diagnosis;
it does not by itself diagnose an environment failure.

Left open, tracked for the next increment: a bin-level wiring test
through null_and_controls with the real generators, and verifying the
leaky control's 40k/60k work survives release-profile DCE.

Gates: fmt, clippy pedantic+nursery clean, 24 falcon-ct tests green.

Security Impact: harness only. The changes narrow (NaN guard, pre-reg
holes closed) or correct the record (retractions); no rule is loosened.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

A6. controls.null_reason is now serialised. It existed only as a console line, so a reader
holding report.json alone saw null_ok: false with no way to tell a too-noisy environment from
sessions that never ran — and the console is exactly what does not survive (the CI job publishes
to an expiring summary; a local run keeps it only if the launcher redirected it).

A7. One line per null session as it lands, with an explicit marker when a session trips the gate.
The null is two thirds of a long session's wall-clock and used to print its start and then
nothing for hours: a crash inside it was diagnosable only as 'it died somewhere in the null', and
a session drifting toward the gate was invisible until the end. On the ubuntu runner, where 5 of
20 sessions trip, this now shows as it happens instead of in a post-mortem.

A8. With no usable null the min/max folds printed 'crop-stat range inf..0.00' — a range that
reads like a measurement and is the empty set. Now 'none (null rejected)'.

The fold is extracted into fold_null() so null_and_controls stays under the line limit and the
empty-null display lives next to the decision that produces it.

40 tests green, fmt + clippy -D warnings clean. No decision rule touched; this is entirely about
what the artifact tells a reader who was not present when it ran.

Security Impact: none - no vendored C, no flags, no signer path.

The mechanism survived: two seats derived sd(t)^2 = 1 + (sigma_key/sigma_total)^2 * (n/32)
independently and got the same expression, and both reproduced the numerical chain (sd 1.742 ->
sigma_key 10.35 us -> sd(t) 2.945 on the CI runner). What did NOT survive is the single-null
proposal.

THE GAP, found independently by two seats (GPT-5.6 F5, Kimi F7): the inflation applies to ANY
pool-A-vs-pool-B comparison, null or not -- INCLUDING sign-rr, which is a GATED EXPERIMENT. A
same-pool null is matched to sign-kk and mismatched to sign-rr, so one null cannot serve both.

REVISED DESIGN (new section 2a) -- match each null to the structure of what it judges:
- environment gate: null-ss (one pool, both classes, independent draws). True zero, so a fixed
  |t| < 4.5 is meaningful. Kimi's independent derivation puts the per-session false-trip rate at
  ~6.8e-6, ~1.4e-4 over twenty sessions.
- crop reference for sign-kk (fixed key vs fixed key): sign-aa repeated. True zero, same structure.
- crop reference for sign-rr (pool vs pool): null-rr, i.e. the CURRENT null -- which is not a true
  zero and must therefore be used empirically, never against a fixed cutoff.

AND THE CONSEQUENCE ONE LEVEL UP: sign-rr cannot be gated against a fixed threshold at all. Under
NO leak its statistic carries the same inflation; at v3.1's numbers that is sd(t) = 1.742 and its
observed |t| = 0.73 sits inside it, but at ~10x the samples sign-rr would cross 4.5 with no leak
present -- the same failure the null sessions had on the CI runner. v4 must pre-register either
judging it empirically against null-rr (recommended; costs nothing new) or de-gating it.

STATISTICAL CAVEATS, all kept -- sigma_key was quoted far more precisely than 20 observations
support:
- sigma_key is not 10.4 us but roughly 6.3-17.0 us (chi-square interval on the t spread, 1.33-2.54).
- 5 of 20 trips is CONSISTENT WITH sd(t) = 2.95, not confirmation: expected 2.5, P(X>=5) ~ 0.10.
- Carrying sigma_key between machines is an assumption, not a derivation. Wording changed to "a
  consistent sigma_key explains both environments".
- The formula is an approximation under a stated hierarchical model, not an identity: deterministic
  Welch denominator, 32-key CLT, within-pool key variance really (31/32)*sigma_key^2. Negligible
  for the variance at these n; only tail probabilities -- which is what a gate is -- carry it.
- "Makes the gate valid again" is downgraded to "removes the dominant, growing term". Welch
  normality is asymptotic, temporal dependence can inflate it, and twenty tests keep a non-zero
  familywise trip rate.

Still a DRAFT and still in force nowhere. The Claude-side audit of the same document is still
running and may add more.

Security Impact: none - a design document. No code, no vendored C, no flags, no rule in force.

Implements the dated interim ruling from the six-seat review of the v4.1
validation session: synthetic controls (control-flat, control-leaky) are
judged on the raw |t| >= 4.5 line ONLY via the new judge_raw_only — the
crop diagnostic does not run for them (crop_empirical_p = None), because a
synthetic loop and the real signing operation do not share a crop null and
judging one against the other is a mismatched reference. Observed live in
the quarantined session: the flat control read "Shape" at raw t = 2.99
against the null-ss bank and flipped controls to NOT OK. The regression
test pins exactly that shape: a flat series whose crop would fire against
a tight real-op bank must still Pass, the leaky control must still Fail on
the raw line, short samples stay INCONCLUSIVE. Whether a crop-shape
control validation returns later — with its own synthetic reference family
AND a synthetic-shape positive control with a numeric fire condition — is
left to its own pre-registration, per the apex ruling that left (a)-vs-(b)
genuinely open. READING_GUIDE documents the ruling in the artifact itself.

Also: PREREG_v41-release-replicate.md — the release-harness replicate
pre-registered BEFORE it can even be built (App Control still blocks fresh
release exes; founder decision pending). One reading (null_raw_t_sd, the
committed bands, registered as a low-information point-estimate call per
review F4), explicit non-readings (no v3.1 re-judgment — that needs a
matched-count 82k bank; banks frozen but unused until the controls pre-reg
and a specified §6.1 exist), and a deviation rule that makes any off-spec
run exploratory with the bands not applied — this morning's lesson,
written down.

V4_BACKLOG §A sweep: A1-A8 verified all closed by the v4/v4.1 work (A1
empty-null fail-closed with the CI session documented in judge_v2; A2
aa_verdict/aa_ok in Controls; A3 READING_GUIDE covers sign-aa; A4 sign-kk
description corrected; A5 no "flat-control null" comments remain; A6
null_reason serialized; A7 per-session null logging; A8 fold_null).

Gates: cargo fmt, clippy pedantic+nursery -D warnings clean, 24 tests
green in falcon-ct (15 lib + 9 bin).

Security Impact: measurement harness only; no crypto code. The change
NARROWS what a control verdict may be based on (raw line only) and cannot
lift any session verdict; the flat control can now block a session only
for a genuine raw-line environment failure. To re-verify: the release
replicate runs under the committed pre-registration once the harness
decision lands.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Implements the matched banks under --null-design ss: sign-aa repeats (fresh
keypair each, ungated) form the sign-kk crop bank; a null-rr bank supplies
sign-rr's crop reference and its three-state raw rule. rr design unchanged
(refs_for_rr: everything = the gate null, no raw bank, byte-identical v3
judging).

The full-team review's findings, each applied and tested:
- S1: reference banks are all-or-nothing — collect_sessions returns Result
  and a failed session propagates instead of silently truncating the bank;
  rr_raw_state returns no_reference_bank / invalid_statistic (NaN) rather
  than relabelling harness faults as fail_beyond_reference.
- S2: the gating A/A control is a conditioned draw and is excluded from the
  bank; ss requires --aa-repeats N >= 2 (enforced in check_v4_options and
  live via the CLI).
- S3: tests exercise production paths — refs_for_rr is the function the rr
  arm returns, and the tests call it; the guard truth table calls
  check_v4_options itself.
- S4: requested bank counts are serialized (aa_repeats_requested,
  rr_sessions_requested) because the rank floor 1/(N+1) makes N part of
  the rule.
- S5: both banks' raw CSVs are written (bank_raws), not only judged crops.

Gates: cargo fmt, clippy -D warnings (pedantic+nursery), 47 tests green,
all four CLI guard paths exercised against the built binary.

Security Impact: measurement harness only — no crypto code touched. What
changed: reference-bank construction and the sign-rr raw rule under the ss
design; ss sessions remain validation-only (ungated, INCONCLUSIVE,
validation_only:true) until a pre-registration lifts it. What could break:
a wrong bank would mis-calibrate future SHAPE annotations — mitigated by
all-or-nothing collection, serialized requested counts, and production-path
tests. To re-verify: the pending validation run reads only null_raw_t_sd.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>