diff --git a/docs/plans/cryptanalysis/in-house-pass.md b/docs/plans/cryptanalysis/in-house-pass.md
new file mode 100644
index 000000000..8e4bd9e30
--- /dev/null
+++ b/docs/plans/cryptanalysis/in-house-pass.md
@@ -0,0 +1,220 @@
+# The in-house adversarial pass on the lottery hash
+
+> Internal adversarial pass, not an independent review. 7 October 2026, 19:1x BST (nine lanes from 19:2x BST on the founder's word through main: "push the cryptanalysis tonight, we have the capacity"), the crypto-engage lane on the founder's correction through main: nothing goes outside. No firms, no paid lots, no briefs to anyone. The three targets of Counter ASIC 3.0 item 3 (the mixer `M_r`, the chained cache, the acceptance rule) are attacked by three lanes that have never worked on the hash code, under the outsider rule below. The only outside check that remains is the disclosure prize, staged (section 10).
+
+## 0. One page
+
+| Item | State |
+|---|---|
+| What was planned until 18:5x BST | Three external lots (`docs/plans/cryptanalysis.md` on branch `cryptanalysis`, `docs/plans/funding.md` row "Independent cryptanalysis") with firm shortlists and price rows |
+| The founder's correction (through main, 7 October, evening) | Nothing goes outside. No firms, no paid lots, no briefs to anyone. The lane becomes the in-house adversarial pass on the same three targets |
+| The pass | Nine adversarial lanes, three per target on three question classes each, each given only what an outsider would have, each writing an attack plan first and then a report in the attack-pass shape |
+| The defender | The Counter ASIC lane; main rules disputes |
+| The clock | Plans within two hours of start (the first three) or one hour (the six of 19:2x BST); first results from every lane by 00:00 BST tonight |
+| The label | "internal adversarial pass, not an independent review" on every public sentence |
+| The outside check | The disclosure prize, USD 50,000, approved 7 October 09:5x UK, STAGED until escrow, the entity address and the founder's publish word; nothing public names it until then |
+
+## 1. The target, exactly
+
+| Piece | Value |
+|---|---|
+| The frozen object | `igneum-pow` at commit `017e70376489251e18564c0abce7e466e606c8b3` on branch `ca3-v4-amend` (tag `audit-freeze-2026-10-07`); byte-identical on `master` since `cf7d6ccb` |
+| The class | Class v4 sub-version 3: `PROGRAM_SUBVERSION_V4 = 3`, object byte 7 |
+| The rules in the object | (a') dataflow freshness to a fixpoint; the shared-operand rule in the draw; (c'') the per-site distinct-index ratio at 0.98 over 2^20 evaluations; the 256-attempt cap and the deterministic last-resort draw |
+| Program ids | The shared devnet's epoch-0 id `a785001687d8688a` (the kaspa-pow pairing pin); Devnet 3's epoch-0 id `fce15bf61030be57` (attempt 0, sub-version 3) |
+| The kit | `packs-ca3-v4-sub3` zip, sha256 `4f2445c50c58d76a5544023492d8b858d0b07c5e372d31f9c90c4ce51f829154`, eight packs: the contents of `proto-cuda/packs-ca3-v4/` at the frozen commit (`mx8-devnet-epoch0` the class v3 control, `v4-devnet-epoch0`, `v4-era-0` to `v4-era-5`) |
+| The Devnet 3 pack | `v4-devnet3-epoch0` (zip sha256 `e025750f71175ed14d6e2a24e387ebbf1979b1cd0faee9139c41a7671165b334`, 12 files, program.json `0xfce15bf61030be57` at attempt 0), on build-1 at `/srv/artefacts/packs/v4-devnet3-epoch0/` and `.zip`; Metal and Apple OpenCL fingerprint `e510ad92b4d24846` at 2^24 from base 0; exported under igneum-pow `874e945d` (byte-identical to `017e7037`) over Devnet 3's genesis with day bytes le64(20733); public-kit class, verified by this lane on build-1 at 19:1x BST |
+| The dataset under attack | Spec `docs/spec/01-lottery-hash.md` 1.8: ChaCha12 cache fill in 2^16 segments of 64 chained lines; the ARX-multiply mixer with per-day `ROT`, `MUL`, `RC` from a 64-bit SplitMix64 seed; `m = 8`, 72 applications per item, 8 dependent cache reads |
+| The acceptance rule under attack | Spec 1.4.6 as the code `igneum-pow/src/accept.rs` implements it at the frozen commit (the code is the truth where the spec lags it) |
+
+## 2. The nine lanes
+
+Three per target, one question class each, from funding.md's ranked list for that target. The first three were spawned at 19:1x BST and re-scoped at 19:2x BST; the six others were spawned at 19:2x BST.
+
+| Lane | Target | Question class | Branch | Worktree | Plan | Report | Plan due (BST) |
+|---|---|---|---|---|---|---|---|
+| adv-mixer | mixer `M_r` | the algebraic structure: the fold of the multiply layer, the composition of 8 applications | `adv-mixer` | `igneum-wt-adv-mixer` | `plan-mixer.md` | `report-mixer.md` | 21:10 |
+| adv-mixer-2 | mixer `M_r` | the day-key weakness class: weak `ROT`, `MUL`, `RC` draws, the 2^24 census, the calendar | `adv-mixer-2` | `igneum-wt-adv-mixer-2` | `plan-mixer-2.md` | `report-mixer-2.md` | 20:25 |
+| adv-mixer-3 | mixer `M_r` | the statistical distinguisher and the round margin: differential, linear, rotational-XOR, SAT or MILP on reduced applications | `adv-mixer-3` | `igneum-wt-adv-mixer-3` | `plan-mixer-3.md` | `report-mixer-3.md` | 20:25 |
+| adv-cache | chained cache | the recompute shortcut: the honest curve from `f = 1/64` to 1, a cheaper fill, the chip's recompute cost | `adv-cache` | `igneum-wt-adv-cache` | `plan-chained-cache.md` | `report-chained-cache.md` | 21:10 |
+| adv-cache-2 | chained cache | the partial-state or hot-set attack: line-index uniformity over 2^28, hot lines and items, steering | `adv-cache-2` | `igneum-wt-adv-cache-2` | `plan-chained-cache-2.md` | `report-chained-cache-2.md` | 20:25 |
+| adv-cache-3 | chained cache | the chain-break or skip: a line under `j + 1` blocks, relations through the chaining and the feed-forward, pebbling | `adv-cache-3` | `igneum-wt-adv-cache-3` | `plan-chained-cache-3.md` | `report-chained-cache-3.md` | NOT YET SPAWNED at 19:26 BST (the session's 20-subagent cap); spawned when a slot frees, plan due one hour after |
+| adv-accept | acceptance rule | the bypass: passes (a) to (c'') on the stand-in with locality on the live dataset; the stand-in gap; distinguishers that pass | `adv-accept` | `igneum-wt-adv-accept` | `plan-acceptance-rule.md` | `report-acceptance-rule.md` | 21:10 |
+| adv-accept-2 | acceptance rule | header grinding for locality: header bytes and nonce against DRAM rows, lines and items; cost against gain | `adv-accept-2` | `igneum-wt-adv-accept-2` | `plan-acceptance-rule-2.md` | `report-acceptance-rule-2.md` | 20:25 |
+| adv-accept-3 | acceptance rule | exhaustion or steering of the draw: the 256-attempt cap, the last-resort draw, seed steering, the program id | `adv-accept-3` | `igneum-wt-adv-accept-3` | `plan-acceptance-rule-3.md` | `report-acceptance-rule-3.md` | NOT YET SPAWNED at 19:26 BST (the session's 20-subagent cap); spawned when a slot frees, plan due one hour after |
+
+Plans live in `docs/plans/cryptanalysis/`, reports in `docs/analysis/cryptanalysis/`. Each lane's branch was cut from the build mirror's `master` and is pushed to the build mirror only; GitHub is dark tonight. BASE CORRECTION (main, 19:4x BST, from the hash lane): build-2's mirror master was stale (`a4bca198`, pre-fix) until 18:25:42Z, and the first branches were cut from `3f0afcd5`, whose `igneum-pow` differs from the frozen object by 6 files (verified by this lane: 30 insertions, 635 deletions). Every lane merges build-1's `master` (`7a7caa34` or later; `001e32ec` is the earliest good tip) before any run or report and proves `git diff --quiet 017e7037 HEAD -- igneum-pow` identical, stating the commit in its plan; anything built or measured on a stale tree is void. `crypto-engage` itself merged `7a7caa34` at 19:27 BST (355ac2ae, identical).
+
+## 3. The rule set
+
+### 3.1 What a lane receives (the outsider's inputs, and nothing else)
+
+| Input | Where the lane reads it |
+|---|---|
+| The crate `igneum-pow/` (src, tests, Cargo files) at the frozen commit | `master`'s copy, verified byte-identical with `git diff --stat 017e7037 HEAD -- igneum-pow` printing nothing; the result stated in the plan |
+| The spec `docs/spec/01-lottery-hash.md` at the frozen commit | `git show 017e7037:docs/spec/01-lottery-hash.md` |
+| The chip model `docs/analysis/chip-model-v3.md` sections 1, 2, 5 and 6 | the worktree's HEAD |
+| The public kit: the eight packs | `proto-cuda/packs-ca3-v4/` at the frozen commit; the zip sha256 above |
+| The two program ids and the Devnet 3 pack | stated in the lane's prompt; the pack read from build-1 (`/srv/artefacts/packs/v4-devnet3-epoch0/`, sha256 above), handed to the lanes at 19:1x BST after their start |
+| The attack harnesses `tools/attack/f8-uniform` and the F4 census `tools/attack/f4-weakday` | f4-weakday from `build/attack-pass`; f8-uniform from the Mac worktree `igneum-wt-attack-regate` (that branch is not on the mirror); copied, never edited in place |
+| The operating files needed to run anything | `tools/build-remote.sh`, `infra/build-server/lib.sh`, `infra/build-server/remote-run.sh` |
+| Sibling lanes' plans and reports | `git fetch build adv-<target>-<n>`, the files under `docs/plans/cryptanalysis/` and `docs/analysis/cryptanalysis/` only; siblings are outsiders too |
+
+### 3.2 What a lane does not receive
+
+| Withheld | Why |
+|---|---|
+| `docs/plans/counter-asic-3-status.md` (section 7c and all) | the defender's reasoning on AP-F8-1, the localisation, the cost lines |
+| `docs/fud-ledger.md`, `docs/fud-fixes.md` | the ledger entries on AP-F8 and every earlier finding |
+| `docs/analysis/attack-pass/*` and `docs/analysis/attack-pass-2026-10.md` | the hash lane's and the attack-pass lane's notes and results |
+| `docs/analysis/ca3-v4-uniform.md`, `docs/plans/mixer-x4.md`, `docs/analysis/weak-program-census-2026-10-03.md`, `proto-metal/MEMHARD.md` | defender's analyses |
+| `docs/plans/funding.md`, `docs/plans/cryptanalysis.md`, this file | the ranked questions as the defender ranked them, the known gaps as the defender knows them |
+| `git log`, commit messages, other branches and worktrees, `site/` | commit messages carry the defender's reasoning; the site carries the defender's numbers |
+
+Known leaks, stated: `CLAUDE.md` loads on its own in every lane (operating rules; the lane follows no pointer from it into other docs); the harness sources carry doc comments written by the attack-pass lane. Each plan lists every file the lane opened, so the defender can read what the lane knew.
+
+### 3.3 How a lane states a result
+
+A result is a BREAK (a method with a measured or counted gain, reproducible from the command and the seed) or a BOUND (what was searched, with what tools, how far it reached, the margin left). "Nothing found" counts only with its effort stated in box-hours and tools. Every number carries its command, its seed and its log path on the box.
+
+## 4. The budget and the no-gaps rule
+
+Standing rule from the founder through main (7 October 2026, 19:1x BST), binding: no gaps between tasks.
+
+| Rule | What it means for a lane |
+|---|---|
+| Every idle core on both boxes | A lane runs on build-1 and build-2 together, on every idle core, at nice 10, no core band; release builds and the class v5 suites keep priority. the founder's read at 19:4x BST: build-1 at 11 percent, build-2 at 56; his word is both near max, so CPU-bound sweeps go to build-1 explicitly (`--box 1`) and both boxes stay above 80 percent until the queue is empty; the build-server lane raises the lease pool to about 88 cores per box |
+| Yield to builds | RETIRED at 19:3x BST (adv-accept's exception: a build slot is held nearly continuously on both boxes, so the SIGSTOP yield of the capacity layer kept every sweep in state T and "both boxes above 80 percent" was unreachable). In its place the build-server lane's rule (19:4x BST): every bounded run at nice 10 on cores 8 to 95 only (`taskset -c 8-95`; cores 0 to 7 reserved for release builds, the seed and the observer), `-j 88` through `tools/build-remote.sh`, the router spilling to the other box at no free slot or a 1-minute load above 80, a pinned measurement leasing its exact cores with `/srv/builds/_bin/lease cores <set> --label "..." --owner adv-<lane> -- <cmd>` (no measure flock), every adversarial worktree merged to the mirror's master at `04c4d9bc` or later; each lane notes the change and its time in its report |
+| Back to back | Question `n + 1`'s sweep starts the minute question `n`'s ends; no waiting for a human to read; each result row lands in the report and is pushed as it lands |
+| Lease pool only | ADDED 20:1x BST by main (build-1 at load 601, build-2 at 401): no sweep, census or verdict run starts on a box except through the build-server lane's `lease pool <threads> -- cmd` (from the same 88-core pool as the builds, waiting when none are free); every hand-started binary at 64 to 89 threads killed by its pid file NOW and re-queued through the lease; release builds and the class v5 suites outrank every sweep tonight; each lane reports its kill and re-queue in one line to the build-server lane. Relayed verbatim to all eight live lanes at 20:1x BST; the pod is not a box and adv-accept-2's measurement continues. LIVE since 20:22 BST (`/srv/builds/_bin/lease`, sha f814b447, self-test green, verified by this lane on build-2): `lease pool <threads> --label "<what>" --owner <lane> -- <cmd> --threads {cores}` takes up to <threads> free cores from the bounded pool (cores 8 to 95, shared with the builds), never fewer than --min (default min(threads, 16)), waits in 10 s steps up to 2 h, runs at nice 10 pinned to the cores taken, "{cores}" the count and "{cpuset}" the set; the pooled sum on a box never passes 88; lanes ask 32 to 48 so two or three sweeps share a box; the sweep.lock is dropped. Load after the kills: build-1 224, build-2 121 at 20:22 BST. Relayed to all eight live lanes at 20:2x BST. POOL RANKING (main, 20:2x BST): the release builds and the class v5 suites outrank every sweep; an adversarial lease asks for at most 48 cores with --min at the least usable, and yields (finishes the shard in hand, releases) whenever `lease status` shows a waiter labelled "v5 gate" or "v5 kit"; widened at 20:30 BST (the v5 census queued as "class v5 c3 census" with no gate label and nobody yielded) and then fixed to the OWNER at 20:3x BST (the word "v5" also matched adv-accept's own exemplar sweep): yield to a waiter whose owner is class-v5, or whose owner is attack-pass with "v5" in the label, never to an adv-* waiter; BOX 2 CLOSED to adv-* at 20:4x BST by main's order (the (c''') census, owner class-v5, 88 cores, about 9 minutes, the 0.3.24 critical path, blocked by adv-accept at 32 + 31 + 23 cores and adv-mixer at 1, with eleven adv-* waiters): every adv-* holder on box 2 releases at its shard end (partials kept), every adv-* waiter withdraws, no adv-* lease on box 2 until the v5 lane reports the census running, then resume in order; build-1 the same if the v5 lane asks; from now the yield is MECHANICAL: an adv-* lane that sees a class-v5 waiter releases at its shard end unasked; relayed to all nine lanes in one line each; the census RUNNING at 20:41:55 BST on 48 of 88 cores; every adv-* lane confirmed 0 holders and 0 waiters on box 2 except adv-cache-2's 40-core lease taken 19 s before it (ordered released); box 2 stays closed to adv-* until the census ENDS. At 20:49 BST the coordinator ended adv-cache-2's 40-core lease by its exact pids (seven minutes past the order, the lane silent since 20:23), then its box 2 drain (drain.pid; it had started the next 40-core item the moment the first died) and that lease; box 2 read 0 adv-* holders at 20:49 BST with the census alone on the pool; logged in /srv/builds/_adv/coordinator.log. The census ENDED by 21:12 BST (no pool lease on box 2, load 11); box 2 REOPENED to adv-* at 21:12 BST: every lane re-submits at `lease pool 32 --min 16`, class adv, with the mechanical yield; adv-mixer-2 and adv-accept-2 move their build-1-starved runs there (build-1's pool held by attack-pass's class-v5 chunks). 22:17 BST, main: the attack-pass F8 gate on the frozen class v5 tip (two class v5 halves of 32, min 24, the 0.3.24 critical path) waits on build-2 behind adv-accept's three shards at 30, 32 and 26 cores, which the pool does not pre-empt (pre-emption applies above 32 threads only); adv-accept ordered to release all three at shard end now and re-queue after F8 starts; RULE from here, mechanical for every lane: on a box where `lease status` shows a class v5 waiter, an adv-* lease releases at its shard end whatever its size. The F8 halves RUNNING on build-2 from 22:17:41 BST (32 and 30 of 32 cores) after adv-accept yielded its three shards by pgid file at 22:17:57 (rows kept). POOL RULE 22:21 BST (lease sha ce30e357): a release or v5 waiter that has waited 120 s pre-empts adv-class holders at ANY size (the 32-thread floor gone), oldest first, as many as cover its ask, one pass per 120 s, SIGTERM at the shard boundary and the lane re-queues the same line; measure-class holders above 32 threads after 300 s, below 32 never; `lease status` shows the last ten minutes' pre-emptions; relayed to the five active lanes. POOL CLASSES (the build-server lane, 20:40 BST, lease sha 5d84d644): release > v5 > measure > adv; a higher class is served first whatever the arrival order; an adv holder above 32 threads is pre-empted by SIGTERM after a higher class has waited 120 s (newest first, one per 120 s, /srv/builds/_log/preempt.log) and the lane re-queues the same line; holders at 32 threads or fewer are never pre-empted; old waiters re-submitted once; no sweep label carries "release", "canary", "pair", "v5 gate", "v5 kit" or "measure"; adv-cache-3, holding 87 of build-2's 88 pool cores since 20:22 BST, ordered to release at the end of its current shard so the v5 (c''') census takes build-2 |
+| One sweep per box | SUPERSEDED by the lease rule above at 20:1x BST. Was: added 19:5x BST (build-1 at load 496, build-2 at 527 on 96 cores: oversubscription, not the near max asked for; the bounded class is 88 cores per box in total, not per sweep): every new sweep from every lane runs under `flock /srv/builds/_adv/locks/sweep.lock -c "nice -n 10 taskset -c 8-95 <bin> <args> > <log> 2>&1"` on its box, so one sweep runs per box at a time with up to 88 threads and the rest wait in order; running processes finish; duplicates are killed by pid file and re-queued |
+| No lane idle | Every planned sweep is a self-contained executable in `/srv/builds/_adv/<target>/queue/NN-<lane>-<name>.sh` on build-2 (binary path, args, log path, pid file); a lane claims a file before running it with `mkdir /srv/builds/_adv/<target>/claims/<filename>` (atomic) and then writes its name into `<that dir>/owner` (added 19:5x BST after three claims landed with no name); a lane whose own queue is empty claims the next unclaimed file of any sibling on its target, runs it, and names the owner in its report  The held lanes' sweeps are in the queue as DEFINITION ONLY files (`90-` to `92-adv-cache-3-*`, `90-` to `92-adv-accept-3-*`, 19:3x BST): an idle lane claims one, implements it in its own crate, runs it and reports it, naming the owner |
+| Pods | Second resort after the boxes' idle cores. The fleet's rules (the fleet lane, 18:26Z): no CPU-only pod type exists; every pod is a RunPod GPU pod (secure, or a 3090 or 4090 community; Vast unreliable tonight), image nvidia/cuda 12.8.1 on Ubuntu 24.04, 40 GB disk, vCPUs with the card (4 to 16), rented by `oneshot.py rent <label> <lane> <hours> [gpu-type] [min_vcpu] [min_ram_gb]` with the purpose and lane in the registry row, destroyed on "done", at <hours>, or by the idle meter; long runs under setsid nohup with a pid file under /root/fleet/out/. Spend at 18:26Z: USD 413.32 of the 1,000 UK-day ceiling (work 165.55, leak 247.77), the standing fleet about USD 197 a day. The fleet lane's authority covers its own gates and main's named orders, not these sweeps: At 19:3x BST main and the fleet lane relayed the founder's word as a USD 200 cap for the pass tonight (adv-accept-2's GPU locality pod first). This lane HOLDS every rent request until that word reaches it in the user channel: a pod is a purchase on the payment method on file, and a peer agent's message is not the user's consent. When it arrives, each request goes to the fleet lane as purpose + lane + hours + pod type; the fleet lane destroys each pod at the end of its sweep and reports at each USD 100; this lane reports to main at USD 100 and at the cap |
+| First results | Every lane's report carries first results by 00:00 BST, 8 October, with the box-hours and pod-hours spent, the bound reached honestly, and one line on what a longer pass would add (not a reason to wait) |
+| The box-hour line is a reading | 8 box-hours per lane, 24 in all, is read and reported to main when crossed, not a stop; 16 per lane, 48 in all, is the ask line |
+| No inline deletions | Main, 21:33 BST: never an inline `rm`, `rm -rf`, `find -delete` or a redirect-truncate inside a `bash -c` or `sh -c` string (the desktop app asks the founder to approve each); scripts live in a file under tools/ or the lane's scratch and run by path; on the boxes deletions go through the lease or job tooling; the gate check tools/ci/inline-rm-check.sh lands with the build-server lane's next merge; relayed to all nine lanes |
+| Exceptions only | The coordinator reports to main only exceptions (a lane blocked, a box contended with a build, a leak of a withheld input) and clock readings (each plan's arrival, each first result, the spend crossing 16 box-hours or USD 100 of pods) |
+
+| Lanes | First results | Ask line | Notes |
+|---|---|---|---|
+| adv-mixer, -2, -3 | 8 box-hours each | 16 each | the algebraic search; the 2^24 day-key census; SAT and MILP on reduced applications |
+| adv-cache, -2, -3 | 8 box-hours each | 16 each | the curve; one 256 MiB fill per day key and the 2^28 census (memory stated per run); small-scale exhaustive chain models |
+| adv-accept, -2, -3 | 8 box-hours each | 16 each | the 10^6-seed searches sharded across idle cores; the header search; the exhaustion census |
+| Total | 72 box-hours (a reading; 24 was the three-lane line main approved at 19:1x BST) | 144 (ask) | a box-hour is one 32-core slot-equivalent for one hour |
+
+Box 2 at 18:5x BST: load 23 on 96 cores, 3 slots free. Build-1 is the busier box (gates and release builds); nice 10 is what keeps those ahead. A run over 10 minutes is built through `tools/build-remote.sh` (`--box 1` or `--box 2`, whichever has a free slot) and started on the box with `nohup`, `nice -n 10`, a pid file beside its log under `/srv/builds/_adv-<lane>/` on each box, NEVER inside the worktree mirror `/srv/builds/igneum-wt-<worktree>/` (build-remote.sh's source sync deletes anything there that is not in the tree; adv-cache lost its first logs to it at 19:16 BST); finished logs copied into `docs/analysis/cryptanalysis/logs/<lane>/` on the branch; killed by pid file only. No GPU tonight: a GPU measurement is BLOCKED and says so. Nothing runs on the Mac.
+
+## 5. Deliverables
+
+| Deliverable | Content | When |
+|---|---|---|
+| The attack plan | The target restated from the spec and code in the lane's own words; the questions in the lane's order; the method and tool per question; the known-failed shape per method (a planted weakness the tool must fire on); the box-hour estimate per step; every file opened | within two hours of start |
+| The report, attack-pass shape | A header with the target commit, the binary's sha256 and the box; a status board with one row per question (method, known-failed shape, gate, result with numbers, status PASS / RUNNING / BLOCKED / FINDING); one section per row with the exact command, the seed, the log path and the numbers | first results by tomorrow evening UK; pushed as it grows |
+| Attack code | Under `tools/attack/adv-<lane>/`, its own crate depending on `igneum-pow` by path; the originals of f8-uniform and f4-weakday untouched | with the report |
+
+## 6. Review
+
+| Role | Who | What |
+|---|---|---|
+| Defender | The Counter ASIC lane | Reproduces every BREAK from the command and the seed before any ruling; checks every BOUND's effort statement against the box logs; reads each plan's opened-files list against section 3.2 and voids a lane's result that used a withheld input |
+| Ruling | Main | Disputes between a lane and the defender; what a confirmed finding moves (section 9); extensions of the box-hour ceiling |
+| Coordinator | This lane | Spawns and clocks the lanes, keeps this file, collects the reports, writes the ledger rows when main says so |
+
+A finding is not a failure of the pass. It is the reason the pass exists.
+
+## 7. The clock
+
+| Step | UK time |
+|---|---|
+| Lanes spawned | 7 October 2026, 19:1x BST |
+| Plans pushed to the mirror | the first three by 21:10 BST, the six of 19:2x BST by 20:25 BST, 7 October |
+| First results in each report | by 00:00 BST, 8 October (every lane) |
+| Defender's read of each report | within 24 hours of its first results |
+| Disputes to main | as they arise; ruling before any public sentence moves |
+
+## 8. The label
+
+Every sentence about this pass that could be quoted in public carries "internal adversarial pass, not an independent review". The site, the litepaper and `docs/evidence.md` row 17 said "the cryptanalysis plan buys three external lots" and "the three cryptanalysis lots are the next test"; main lands the replacement. No public text names a firm, a price or an engagement.
+
+## 9. What a finding moves
+
+| Case | What moves | Cost |
+|---|---|---|
+| A BREAK confirmed before the public testnet's vectors freeze | A parameter or a shape on the v4 seam, or a class v5 rule; the packs and the 96-vector sets re-cut through the seam, the verifier re-measured against the 10 ms gate, the soundness suite re-run, the cross-vendor fingerprints re-taken | hours of agent work; one PC job per vendor; no chain event |
+| A BREAK confirmed after the testnet's first miner | A class change behind its activation height with the six gates and the two-publish rollout | an announced reset on the testnet; on mainnet the governance event the plan exists to avoid |
+| A BOUND only | The chip model's "ops per hash" input carries an internal effort bound in place of "no cryptanalysis"; it is labelled internal, never "reviewed" | the box-hours only |
+
+## 10. What this pass is not
+
+It is not an independent review and is never called one. Nothing is sent outside, nothing is paid, nobody is contacted. The disclosure prize (USD 50,000 for a reproduced break of the published hash class, approved by the founder 7 October 2026, 09:5x UK) is the only outside check and stays STAGED: announced only when escrowed, only when the entity's registered address exists on its documents, and only on the founder's publish word. The entity is not yet named in the repository beyond the launch pack's "Igneum Labs LTD". Until the word, `grep -ci "50,000" site/*.html` is 0 and `disclosure prize` stays in `site/forbidden-strings.txt`.
+
+## 11. The coordinator's own inputs (defender side, not given to the lanes)
+
+`docs/plans/funding.md` (the row and the brief), `docs/plans/cryptanalysis.md` on branch `cryptanalysis` (sections 1, 3.3, 3.4, 4.2), `docs/plans/counter-asic-3-status.md` section 7c, `docs/plans/release-0.3.22.md`, `docs/analysis/attack-pass-2026-10.md` (the report shape), `docs/plans/build-server.md` sections 7 and 7.0, `infra/build-server/lib.sh`, `tools/build-remote.sh`, the spec at the frozen commit, `docs/plans/launch-pack.md` and `docs/plans/testnet-go.md` LG-13.
+
+## 12. The board (clock readings and the defender's lines; UK time; box file times read in CEST, one hour ahead)
+
+| Lane | Plan on the mirror | First results | Defender's line | Box-hours |
+|---|---|---|---|---|
+| adv-mixer | 1d720654, 19:09 BST | COMPLETE at 22:1x BST (tip on build/adv-mixer at its final push): Q1 algebraic structure BOUND, no composition of the 8 applications cheaper than 8x, 9,360 ops per item unchanged; the operative evidence is the commutation probe at 0 in 1,454,080,000 over 1,024 days; the SAT row is a bound on solver reach only (three CaDiCaL runs, 6,455 s on one core, neither SAT nor UNSAT, the expected shape for a preimage-sized instance); deepening rows 11 to 15 (fold sweep replicated, linear-relation kernel 0 at 3 to 7 applications, integral saturated at 8, line-index bits at 5 to 8) all BOUND; about 0.6 box-hours. Earlier: e35556af, 19:40 BST: Q1 algebraic structure BOUND (fold probe 1e6 of 1e6 affinity violations, 0 of 256 dead word pairs, 0 of 1e6 key-order agreements; integral degree at least 16 after one application, saturated after two; 9,360 ops per item stand); courtesy readings on Q2 (full diffusion at 2 applications, margin 6 of 8) and Q3 (2^24 days, best day 1.17x FPGA multiply datapath, 1 in 2^24, no DSP or wall-time gain) | pending | 0.4 |
+| adv-mixer-2 | 5704a7b3, 19:32 BST (IDENTICAL at 7a7caa34 and 04c4d9bc; about 4 box-hours estimated) | CLOSED at 2a632579, 23:37 BST, 0.31 box-hours, 0 pod-hours, nothing on either box: the redraw rule measured over 2^24 and 2^28 days (0 days over 1.1x after it; 6.0e-4 of days redrawn once, 3e-7 twice, never three times; mean cost unchanged); verdict BOUND for every chip, GPU and the verifier (gain 1.0 every day at 9,360 ops per item), FINDING on the per-day FPGA LUT-area reading only (2^-10.8 of days over 1.1x, exact to 2^32, worst 28 April 2050 at 1.113x), closed by the redraw rule or by the spec's O-1.10 day derivation. Earlier: tip ae3088a9, 21:3x BST (first word from the lane since spawn): harness built on both boxes (binary 88f6a3ed, outside the mirror), two chains waiting at class adv, 32 threads (box 2: the 2^24 census, the calendar, the small-constant-multiplier calendar and tail, avalanche; box 1: the 2^32 census and the redraw census); nothing hand-started beyond three sub-11 s smoke runs. Rows at 49656c2e, 21:3x BST: model A is an FPGA LUT-area gain for a per-day build (multiplier adders), NOT a wall-time or op-count gain: under the chip model's 9,360 ops per item the per-day gain is 1.0 on every day for every GPU, the verifier and any chip with a general multiplier; against the exact median 226, P(model A at or above 1.1x) = 5.69e-4 = 2^-10.8 per day (the earlier 2^-7.9 used a provisional median of 231); model C (DSP) stays under 2^-20 at 1.1x (1.067x on 2^-15 of days); the 1.1x-on-2^-20 threshold is crossed by model A only, the same bounded class as AP-F4-1; worst real day 29337 = 2050-04-28 at 1.113x, 15 days over 1.1x in 100 years; RECONCILED with the attack-pass lane's F4 at 21:4x BST (F4 record section 9, both medians side by side): F4's NAF weight counted a carry digit at position 32 that a 32-bit multiplier never pays (0.333 digits per word, 5.3 adders per day), the whole of 231 against 226 and 12 against 15 days a century; the agreed figure is median 226, a 1.1x gain at cost A at most 205, 5.69e-4 of days (2^-10.8), 15 days a century, worst 2050-04-28 at 1.113x; the DSP-bound readings agree at 0 for k at least 2; F4's PASS against class v4 stands; the redraw rule for the next class takes adv-mixer-2's form; a redraw rule row (continue the stream and redraw all 40 draws if cost A is 205 or less, or a 2-adder MUL, or all ROT equal; about 22 days per 100 years redrawn) with the before fraction, the after fraction owed with the redraw census; no seed collisions or stream shifts; the 2^24 census matches the exact table on every class; all six plants fire. Running: the small-constant-multiplier calendar on box 2 (24 cores); the 2^32 census waiting on box 1. Tip 52a31815, 21:4x BST: all rows but two landed: model B (partial: 12.3 percent of words certified at 5 or fewer adders, 0.38 percent at 4 or fewer; the between-day spread is the certificate's reach, not a gain), ROT diffusion (every day and every plant at the uniform 0.500 by 2 applications, address bits with them, 8 sit between reads: gain 0, BOUND), the F4 reconciliation mirrored; the 2^32 census running on 32 leased build-1 cores since 21:42 BST (about 25 minutes), then the redraw census at 2^24 and 2^28; box 2 chain done; 0.12 box-hours so far. Ledger: one inline rm over its own claim directories at 21:36 BST, three minutes after the rule reached it; later deletions through script files. The coordinator wrongly chased this plan as overdue between 20:25 and 20:32 BST | pending | |
+| adv-mixer-3 | 37a08b6c, 19:4x BST |  rows committed before the 20:21 BST kill (3cb6c1df and later): line-index bits uniform at 0 to 8 applications on day 20729; the SAC and linear bands clean at 2 to 8 applications on both days (a k = 1 statistic exists, the known single-application diffusion); rotational-XOR clean at 1 to 4 on both days; SAT at 1 application; THE ROUND MARGIN AS IT STANDS: no statistic survives 2 of the 8 applications between reads. Lost to the kill: SAC at 5 to 8 and its 2^27 rows, the 2^28 SAC-zero rows on 20733, the index census on 20733 at 2 to 8, CaDiCaL at 2 to 4; re-queued as queue 17 through the lease. Earlier: sweeps on both boxes from 19:42 and 19:47 BST (index census, SAC, differential, linear, rotational-XOR on days 20729 and 20733; the SAT model under CaDiCaL 3.0.1) | pending | |
+| adv-cache | 476e4516, 19:04 BST | 2c7bb6b4, 19:33 BST; FINAL 49ef7747, 19:50 BST: every row BOUND, every plant fired (the recompute curve monotone toward the full store, f = 1/2 at 1.26x the ops and 0.875x of the full-store chip's rate under equal silicon; no cheaper fill; chain avalanche full at every j; line index uniform over 160 day keys and about 1.6 x 10^10 reads; batching loses to the stride store from 32 MiB) | 19:5x BST, NO DISPUTE: Q1b, Q1c and Q4 stand as BOUND from the defender (the curve equals logs/queue-a/curve.log row for row; target 017e7037; ledger honest; energy columns from chip-model-v3 5.2); Q2 and Q3 were measured before the re-scope and stand as readings for adv-cache-2 to confirm or contradict, not as its verdict | 0.55 |
+| adv-cache-2 | 3d9bcece, 19:31 BST | tip 46551013, 21:2x BST: the 2^35-read line census PASS over 272 days; the 16,384-day weak-day scan PASS; the site finding is now a CLASS: 3 of 432 load sites (Devnet 3 site 0; era-fixed-20 site 11; era-drawn-2 site 13) concentrate item reads 1.26x to 1.45x at their top 0.1 percent, each attributed to the shadow block's last write to the load's source register (mul: the product low-bit law 0.25, 0.375, 0.4375 on bits 0 to 2, measured exactly; mulhi: a 52x hi16 bucket and one item read by 16 whole warps; sub), worth 0.03 to 0.1 percent of a hash's reads each; handed to adv-accept's freshness question in the report. MECHANISM, 23:1x BST: the same base program (shared epoch seed) is clean under the devnet era (stride rotation R = 29) and biased under drawn eras with R from 3 to 22: a product's biased low bits (P(bit 0) = 1/4, measured) survive the odd stride multiplier and the rotation places them at address bits R and up, inside the 28-bit item index unless R is 28 or more; the devnet era's R = 29 cuts them off, which is why 31 of 32 devnet-era programs are clean while 6 of 16 drawn-era programs show a site over 1.04x (2 over 1.2x, worst 1.51x); widened at 23:3x BST to 13 of 27 drawn-era programs with a site over 1.04x (8 over 1.2x; worst era-drawn-28 site 15 at 1.7451x, era-drawn-25 site 11 at 1.3571x) against 2 of 32 under the devnet era (R = 29), the 61-program table with full epoch and era hex, attempt, id, R and site handed to the v5 lane and going into the report's section 2.3; under the 2 GiB genesis dataset (D = 29) R = 29 would show it too; the price to a partial-store chip stays under 0.1 percent of a hash's reads per site. The v5 lane (23:1x BST) reads its (c''') floor on the 16 drawn-era programs and the devnet control at the 2^20 sample (adv-cache-2 handing it the recipes); for the record its 4,600-seed census ran across drawn eras (each f8 seed with its own era bytes, so R varied), so the 2.435 percent clean rejection rate already spans the R range. THE READ, 23:3x BST: the 0.995 floor refuses 0 of 29 adv-cache-2 programs read so far (24 drawn-era, era-fixed-20, four devnet-era controls); the six over 1.2x read 0.9965 (era-drawn-15 at 1.51x) to 0.9997 at their minimum site, the 1.04x to 1.2x band 0.9986 to 0.9998, the clean ones 0.9999 to 1.0000; every class v5 draw lands on the class v4 attempt. The v5 lane's reading: the distinct-index statistic sees concentration on FEW items (adv-accept's hot sets: 3 percent of a site's reads on 512 word indices), not a DIFFUSE excess over the top 0.1 percent of items (16,384 items), which is what the era-stride low-bit law produces; two instruments, two classes; the floor closes the first and does not reach the second. FINAL at 23:5x BST: 0 of 61 of adv-cache-2's programs refused by the class v5 floor (the two real, 27 drawn-era, 32 devnet-era controls), every class v5 draw on the class v4 attempt; era-drawn-28 (1.7451x, R 15) reads site 15 at 0.9969 and era-drawn-25 (1.3571x, R 21) site 11 at 0.9994; the eight over 1.2x span 0.9965 to 0.9997 against the few-item hot sets at 0.9821 to 0.9919 (log docs/design/class-v5-harness/v5-listed-adv-cache-2-full.log on class-v5). Ledger AP-F8-6 carries it: eight of eight hot sets refused; the diffuse era-stride excess, bounded under 0.1 percent of a hash's reads per site, is not caught by the floor and is the next class's test. The attempts row under class v5 (1,000 f8 seeds): per-candidate rejection 0.6893, (a') 83.4 percent of rejections, (c''') 1.0 percent (0.7 percent of candidates), 0 exhaustions, P(256) 4.4e-42, accepted attempt mean 2.219; sub-version 3's 0.68 and 83.3 percent hold to the third digit. Line census at 2^35 + 3 x 2^33 reads all PASS; the 16,384-day weak-day scan PASS. Earlier: first rows 19:5x BST (report being pushed): tip 4f470d40 at 20:23 BST, about 0.95 box-hours, killed its one running census at 20:20 BST (11 of 32 drawn programs kept as partial), re-queue pending on the lease; two FINDING rows for the defender: Devnet 3 load site 0 (instruction 3) non-uniform at the item level (chi2/dof 3.70 at 2^26, top 0.1 percent at 1.449x its control, a fixed per-item weight from iteration 1, a low-bit bias of its source register; worth 0.1 percent of a hash's reads to a store); and the chip model's f = 0.25 and f = 0.5 partial-store rows overstate the recompute share at the measured window hit rates (0.883x and 0.838x of its ops per hash at the mean; 0.56x for Devnet 3's half; the full-store verdict unchanged). Earlier: Q1 line census at 2^31 reads PASS (segments +4.84 sigma against a control at +4.24; top 1 percent of lines 1.1198 against 1.1196 percent); Q3 steering PASS (worst cell 3.95 sigma); Q2 Devnet 3 at 2^24 nonces: fingerprint e510ad92b4d24846 reproduced through its mirror, items and lines clear against the window-model control (1.003x), one load site (site 0, instruction 3) non-uniform at chi2/dof 1.67 and 1.29x at its top 0.1 percent, worth 0.03 percent of a hash's reads; the window layer puts 36 to 45 percent of reads in one aligned quarter (model exact to 4 digits), being priced against the chip model's partial rows | pending | |
+| adv-cache-3 | 9fdd4031, 19:49 BST | COMPLETE at bc2d01d5, 21:38 BST, 0.23 slot-hours: every row BOUND or PASS, every plant fired; the exhaustive w = 2 image census finished all 64 depths at 21:27 BST (the image equals the random-function recursion to 2 x 10^-5 at every depth, to six places at depth 64; the no-feedforward plant stays at 2^32 at every depth); the flip-table ladder at 2^18 lines shows no single-bit bias from two double rounds up (worst 4.8 sigma, the expected maximum); its own queue done, it claimed adv-cache-2's unclaimed file 43 under no-lane-idle. Earlier report 091edc34, 20:29 BST, 0.04 slot-hours; FINDING, bookkeeping not a break: the exact pebbling optimum (DP, checked against exhaustive search at 10 to 16 lines) sits under the "hold every k-th line" curve the chip model and adv-cache's Q1b table use: 16.0 against 31.5 blocks per read at f = 1/64 (the one held line belongs at line 32, not line 0), 10.5 against 15.5 at 2/64, 6.09 against 7.5 at 4/64, 3.17 against 3.5 at 8/64, 1.45 against 1.5 at 16/64, equal from f = 1/2; so a chip holding 1/64 of the cache pays 9.3x the item's ops, not 17.4x; at f = 1/2 nothing moves and the SRAM column stands (a line owed in chip-model-v3 and in adv-cache's table). Plant caveat stated: the per-bit bias and 512 x 512 correlation statistics do not fire at one or two double rounds (worst 4.5 sigma at 2^16 lines); the firing known-failed shapes for the relation class are the GF(2) rank (1,004 of 1,025 at one double round, 17 at zero), the flip table (6,985 zero cells at one double round) and no-feedforward on the inversion; a larger flip table is being added. First rows 20:2x BST: every gate PASS, every plant fired (0 of 65,536 lines under j + 1 at 64 and at 1,024 lines on two day keys; GF(2) rank 1,025 of 1,025 at j = 1, 2, 32, 63, 1,023; no zero cell in the 512 x 512 dependence table; 0 inversions; feed-forward relations over 4 days x 2^20 lines worst bias 3.58 sigma, worst correlation cell 4.83 sigma of 262,144; the pebbling optimum curve monotone with 9,360 ops at f = 1, the skip-edge plant fires; cross-segment and cross-day worst 5.00 sigma); its 87-core build-2 lease released at 20:24:38 BST for the v5 census, the w = 2 image census partial at depth 8 of 64, the rest queued behind any v5 waiter. Earlier: its three definitions (90 to 92) claimed 19:49:54 BST, by itself on the timing (owner files were not yet the rule); adv-cache offers its chain-skip, pebble and ffrel implementations on branch adv-cache as a harness, and does not run them | pending | |
+| adv-accept | d2bc4dc8, 19:1x BST | a22d5ba0, 19:51 BST, FINDING-class row: one accepted class v4 program (F8 label-space seed 100767, id 9d68e6286fc817d4, attempt 2) passes every part of the frozen rule and flags the f8 hot-set gate on the live dataset at 2^24 nonces (X at 0.1 percent +0.155, X/f 1.55, top 0.1 percent at 2.05x the window model, 6-sigma +295); the four lowest stand-in-ratio seeds of 4,600 accepted programs all beyond 1.2x live (1.29x to 2.05x), 23 random accepted programs at most 1.043x; attribution one load site (instruction 23, source r6, quarter window) sending 3.35 percent of its reads to items at multiples of 2^19, (c') saturation 0.013 percent there; the lane's price: a 1 MB hot copy serves 0.31 percent of loads instead of 0.15, a 1.002x gain, no chip-model row moves; "a real distinguisher and a cheap seed selector, not an exploitable bypass". Q2 stand-in gap BOUND so far (agreement to 2e-4 at 2^20 on 4 programs plus a firing plant; 50-program widening running). 20:06 BST, tip 12e0e9fa: Q2 BOUND landed on 54 accepted programs (closed-form and live per-site ratios agree to 0.0004 at 2^20, mean min-ratio gap 0.00002, 0 verdict disagreements, (c) metrics agree to 0.019 of 128; no steering through the stand-in gap); the selector read widened and honest: of the 8 lowest-ratio seeds measured live, 6 beyond the 1.2x gate and 2 not (103378 at 1.157x, 105756 at 0.9996x), so the 256-unit stand-in ratio is a noisy selector at the 0.996 level; random control 0 of 4 beyond (max 1.0034x); 17 lowest and 16 random rows running at about 7 minutes each; the class v5 exemplar check and the repeated-index read queued behind the lock. Row 90 (adv-accept-3's attempts census) claimed and running; ROW 90 LANDED 23:24 BST (10,000 seeds through the real rule, every candidate's first failing part): 21,119 rejected candidates; by part (a') unfresh 83.3 percent, (a) stale 11.7, (b) no injecting write 3.1, (c'') low-entropy site 1.1, (c) constant bit 0.4, (c) saturated 0.3, (c') 0.1, (c) distinct 0.04, lane-constant and bias 0; per-candidate rejection 0.6787, flat at 67.5 to 68.7 percent across attempts 0 to 3 (independent draws); accepted-attempt mean 2.112, max 24; 0 exhaustions; P(256 consecutive rejections) 8e-44 per seed, so the last resort is unreachable by chance and the attempt index is no lever for a seed-steering attacker; accepted programs' distinct-item mean 127.95 of 128, minimum 123.67; the second 10,000 queued; COMPLETE at 20,000 seeds, 01:34 BST (the second half on box 2 in 1,112 s; the halves agree to a tenth of a percent): 42,711 rejected candidates, (a') 83.5 percent, (a) 11.6, (b) 3.0, (c'') 1.1 (459 candidates), constant bit 0.4, saturated 0.3, (c') 0.05, distinct 0.04, lane-constant and bias 0; per-candidate rejection 0.681 flat across attempts 0 to 3; accepted-attempt mean 2.136, max 28; 0 exhaustions; P(256 consecutive rejections) 2e-43 per seed. Killed every run at 20:21 BST (both shards, both adv-live chains, the census, the attempts census), 0 binaries alive, partial kept: 23,321 accepted-program rows, 17 live rows at 2^24 (11 lowest-ratio seeds: 6 beyond 1.2x, 5 within; 11 random: 1 beyond), Q2 BOUND on 54; re-queue order through the lease: the shards from their frontiers, the 14 and 9 remaining live rows, the class v5 exemplar check, the repeated-index read, row 90 |  19:5x BST, FINDING CONFIRMED, bounded, no dispute on the numbers (read against live-confirm-16m.log): (c'') passes at ratio 0.9988, inside the clean spread, the shape of the four-seed tail AP-F8-1 left unattributed; the source is zero in 0.0126 percent of evaluations (under (c')'s 1 percent) and the hot items are the images of small source values under the era stride; the class is a value-level constant from a lineage-fresh writer (a mad at instruction 4), which neither the lineage rule nor the per-site ratio at 2^20 reaches. NEW and the finding's substance: the stand-in ratio is a cheap seed selector without the live dataset, and one member of the unattributed tail is now attributed by value. Routing: FINDING (bounded) on class v4 sub-version 3, no change to the frozen object, chip gain nil; the fix question (a value-level source test at the live-dataset scale, or a per-site hot-item test in acceptance) goes to class v5 / 0.3.23 beside AP-F4-1 and AP-F1-1; taken to main as an exception. Asked of the lane's final: the selector's false-positive rate over at least 20 low-ratio seeds; whether the seed reads hot under class v5's state-derived dataset. ANSWERED 20:37 BST: under class v5 (vendored class-v5 igneum-pow, generator 5, id 2fd83dbae09c366d, dataset keyed by the Devnet 3 v5 pack's state stream) at 2^24 nonces the seed reads the SAME hot set as under v4 (X at 0.1 percent +0.15514 against +0.15503, 2.046x against 2.045x, the same eight hottest items at multiples of 2^19, site 6 at 3.36 percent of its reads; plant fired at 25.7x; 589 warps agree with the library): the concentration is the program's dataflow at site 6 plus the era stride, not the dataset's values, so class v5's dataset change does not touch the finding and the price stays 1.002x; the acceptance-side fix is the only lever. DEFENDER'S READ, 20:4x BST: taken, and it is the CONFIRMING ROW for the class v5 fix (c'''), NOT a v5 finding: id 2fd83dbae09c366d is the pre-(c''') class v5 draw at attempt 2 (the vendored class-v5 igneum-pow before ab6f980b); under the frozen v5 rule the same seed is refused at attempt 2 by (c''') naming site 6 at 0.991 and the draw lands on attempt 4 (734fbb8e3e4cd20f), as the v5 lane's known-failed test read green at 20:33 BST; the lever is the acceptance floor, now 0.995 keyed on the state flag; the number still owed on the fix is the census's clean rejection rate, from the v5 lane. SELECTOR TALLY at 2^24, 21:1x BST (the re-submitted chain got build-1 cores at about 20:55): of the 16 lowest stand-in-ratio seeds, 9 beyond the 1.2x gate and 3 HOT SETS by the f8 test (100767; 4346 at X 0.1 percent +0.178, X/f 1.78, 2.24x the window model; 5245 at +0.129, 1.29, 1.86x); of 17 random accepted programs, 1 beyond and 0 hot sets; each hot set about 1 MB of items holding 0.3 percent of reads, gain about 1.002x: the distinguisher is real and repeatable, the bypass not exploitable. The class v5 (c''') census (the v5 lane, ended 21:03 BST): 2.435 percent of accepted programs rejected by the 0.995 floor. Whether the floor closes the CLASS rests on two numbers still owed (21:1x BST): the minimum-site ratio of seeds 4346 and 5245 at the acceptance's 2^20 sample; 100767 reads 0.9919 and is refused; a seed at or above 0.995 while hot live is a residual the floor misses and goes on the board as such. WIDENED by main at 21:2x BST to FIVE programs (4346, 5245, Devnet 3's epoch-0 program fce15bf61030be57 at site 0, adv-cache-2's era-fixed 20 at site 11 and era-drawn 2 at site 13): one `lease pool 8` job through adv-accept's gap tool, each read as under 0.995 (refused by (c''')) or at or above it (a residual the floor misses); the results go to main and the v5 lane the minute they land; the board's class line reads "the floor closes the class" only on those five numbers, because Devnet 3's own first program is one of them. THE FIVE NUMBERS (adv-accept, 21:35 BST, `adv-accept gap` at the acceptance's 2^20 sample, closed form and live, logs gap-five-d20733.log and gap-five-d20730.log on build/adv-accept): seed 4346 (id bbb38e847011c354) min site 2 at 0.9840, REFUSED; seed 5245 (id beaad44840bb9e4e) min site 8 at 0.9831, REFUSED; Devnet 3 epoch-0 class v4 (fce15bf61030be57, day 20733) min site 0 (instruction 3) at 0.9992 (live 0.9993), MISSED; era-fixed-20 (11f9f955b21d56c9) min site 11 at 0.9997, MISSED; era-drawn-2 (7ceb797d31eedb3e) min site 13 at 0.9992, MISSED; two further hot sets of adv-accept's, 106924 at 0.9821 and 107022 at 0.9877, REFUSED. CLOSED at 21:49 BST with seed 170 (0.9880) and seed 1738 (0.9868): all SEVEN live hot sets found in the lowest 25 of 29,032 accepted programs are refused by the floor (minimum sites 0.9821 to 0.9919). REOPENED at 22:06 BST by the wider sweep (88,051 programs): seed 122960 (id 4be7393ab6c84802, the lowest 256-unit ratio at 0.9885) is an EIGHTH hot set (X at 0.1 percent +0.111, X/f 1.11, 1.54x the window model) with the heaviest single item yet (0x81ad88 at 475,616 reads, 0.022 percent of all reads, 16x 100767's hottest, from an all-ones source at instruction 4, writer shfl at 3; site 12's saturated-source share 0.353 percent, a third of (c')'s 1 percent); its 2^20 ratio landed 22:41 BST: minimum site 12 (instruction 45, source r6, full window) at 0.9824 (live 0.9822), REFUSED by (c'''); that site puts 1.31 percent of its reads on word indices read 8 or more times (the largest repeated-index share measured; 100767's site 6 read 0.17); so EIGHT OF EIGHT live hot sets by X_f at or above f are refused by the floor (minimum sites 0.9821 to 0.9919) and the three mild residuals (0.9992 to 0.9997, about 1.0004x) stand as the class the floor misses; log gap-122960.log on build/adv-accept; 23:09 BST, the floor's other side (gap-newlow5.log): of the five deepest 256-unit seeds, 130488 (site 5, 0.9898), 19921 (site 4, 0.9912) and 600738 (site 8, 0.9934) are refused by the floor yet CLEAN on the live set at 2^24 (1.0002x to 1.0005x), so they are false refusals, the population the 2.4 percent clean rejection rate pays at the cost of a redraw and nothing else; 602822 (site 3, 0.9951) passes and is clean. Standing: 8 of 8 live hot sets refused, 3 mild residuals missed (about 1.0004x), 3 false refusals among 5 deep-tail seeds; 23:25 BST (gap-deep4.log): four more deep-tail seeds refused (148927 at 0.9814, 150347 at 0.9896, 34501 at 0.9929, 29307 at 0.9912), the first three clean live (0.9998x to 1.0028x), 29307 beyond the gate at 1.29x on one item from a non-saturated source with no hot set by X_f; the floor's tally over everything read at 2^20: 8 of 8 live hot sets refused, 6 clean-live programs refused and 1 clean passed among the 9 deepest 256-unit seeds, 3 mild residuals missed; the lane's reading: the (c'') statistic measures repeated word indices on the stand-in, which the live set usually spreads thin rather than concentrating, so a low ratio is not a hot set, and that is the 2.4 percent clean rejection the floor pays; the other four lowest (0.9890 to 0.9942) are clean live (1.0002x to 1.0005x), so the 256-unit proxy is noise at its extreme and the 2^20 ratio is the selector; tally 8 hot sets in 30 tail seeds against 0 in 20 random; price unchanged (0.34 percent of reads on 1 MB, 1.002x). SO: the 0.995 floor refuses every hot set by X_f at or above f that any lane measured (100767 at 0.9919 included) and misses the three milder concentrations (1.26x to 1.45x of the top 0.1 percent share, chi2/dof 2 to 3.7, 0.03 to 0.1 percent of a hash's reads each) whose minimum site reads 0.9992 to 0.9997, Devnet 3's own first program among them. THE FLOOR DOES NOT CLOSE THE CLASS; it closes the hot-set half of it. The residual that survives is the shadow-block-written value-level concentration below the floor's resolution, chip gain about 1.0004x; the lever for it is a value-level source test at the live-dataset scale, not a ratio floor; routed to the v5 lane and main at 21:3x BST The class in the record: one class, a value-level property of the load's source register written by the shadow block's mul, mulhi or sub (or by the base program, as for 100767), 3 of 432 sites plus 100767, 0.03 to 0.3 percent of a hash's reads each, chip gain at most 1.002x | about 1.6 |
+| adv-accept-2 | 9b86d4e2, 19:4x BST | FINAL 92168536, 21:17 BST (natural end; 0 processes, leases or queue entries on either box): the 1e8-hash tail per real program sits on the windowed baseline down to 3e-7 (deepest unit 51 of 4,096 rows, 7 past the baseline's own deepest, net 3e-7x priced); the rotate-identity repeat class is in 21.0 percent of 300 accepted drawn programs, under 0.1 percent of loads on the worst, absent from the two real programs. Earlier final 3df22a4c, 20:42 BST: BOUND with one 0.1 percent per-program FINDING (drawn program 0x5d7cc2b09fc6922a repeats a word across load sites 1 and 5 in 1.55 percent of hashes per iteration: the only write between them is a rotate by a register amount, the identity 1 in 32, and site 1's quarter window lies inside site 5's half window; header-independent; admitted by the 120-of-128 floor); about 0.7 core-hours and 0.3 pod-hours; a 1e-6 tail and a 300-program prevalence census of the repeat class append when the pool serves them. Earlier: tip 74b8f3a1, 20:2x BST: Q1 to Q4 all landed, BOUND, with one per-program FINDING at 0.1 percent; the A6000 card row: the best header-ground groups read +0.09 percent dependent-read throughput at 15 hashes each against random, the const-site plant +6.3 percent (log logs/adv-accept-2/gpu-rowbench-a6000-2048x200.log); one more leased run follows for the 1e-6 tail and a prevalence census of the finding. Earlier rows (tip 9e8b1326): the two real programs and 8 drawn ones match the windowed random baseline at mean, min and the 1e-3, 1e-4 and 1e-5 tails for 2 KiB rows, 8 KiB rows, 64 B lines and items, per hash and per unit (closed form and live agree); one-bit header flips move 100.00 percent of the 4,096 unit addresses (the header-blind plant reads 0.0000); 2 to 4 of 16 load sites in iteration 0 are header-predictable, none later; both plants fire; the pod measures one point (dependent-read throughput of the best header-ground units from 1e7 hashes against random units and the two planted-clustering programs), "done" expected about 22:45 BST. "done" given at 20:2x BST; destroyed 20:27 BST and verified absent from the provider: 0.58 hours, USD 0.31 (plus a duplicate the fleet's retry loop rented the same minute and destroyed within two minutes, about USD 0.02). The pass's pod ledger: one pod, USD 0.33 in all, none originated by this lane; nothing of the pass remains on the fleet. Reading from the code: the header reaches the hash only through the init words (bind.rs) and never the program or the dataset, so a found header fixes one 32-lane group and a grind cannot amortise; GPU per-card confirmation BLOCKED, bound analytic; a GPU pod for the one BLOCKED confirmation was rented by the fleet lane under the word it holds (not by this lane): RunPod secure RTX A6000 48 GB, READY 20:06 BST, 3 hours, USD 1.59, registry label adv-accept-2-pls4, destroyed on the lane's "done"; the SSH line routed to the lane at 20:0x BST | pending | |
+| adv-accept-3 | 57fd32ea, 19:58 BST (spawned 19:5x BST after three attempts at the subagent cap) | tip aa359962, 21:37 BST: the three lowest-ratio steering seeds of 4,975 are clean live at 10^6 and 2^24 nonces (1.0002x worst), so at 256 units the ratio is noise, not a selector (adv-accept's selector reads at 2^20 units, where it is one); FINDING, correctness: the deterministic last-resort program fails the real rule in 223 of 2,500 seeds (209 by (a), a cyclic stale load) yet is handed to the chain unchecked (unreachable at 4.6e-44 per epoch; a correctness item for the rule's owners, not a chip number). Earlier report v1 cde2562f, 20:24 BST: 0 verdict disagreements between the code and a second interpretation over 2,546 attempt verdicts of 792 seeds; the (c'') f64 compare cannot flip a verdict at the shipped constants (margins 0.32 to 0.44 counts, 0 of 2^20 disagree); FINDING, documentation class: program.json's program_id_derivation string and spec 1.4.6 omit the "sub/" || 3_le16 suffix the code appends under generator 4 (text-derived id 30956569d8f3d8d7 for Devnet 3 against the pack's fce15bf61030be57), so a second client written from the text would disagree on every program id; the code is the consensus, the text and the exporter string are wrong; queue 93 to 99 re-queued through `lease pool 40` at 20:24 BST | pending | |
+
+Beside the nine lanes (the attack-pass lane, the defender's side, for the record): F4 on class v5 PASS at igneum-pow class-v5 e4f1f275 over 2^24 chain days (M2 0 of 2^24 over 1.1x; M1 the same bounded tail as class v4; the census byte-identical because the day-key draw depends on the mixer shape alone); F8 on v5 read about 20:55 BST; F1 and F9 at 10^5 seeds after (10^6 is fifty hours through (c'')).
+
+Box readings: 19:5x BST both boxes at load 280 to 350; 19:55 BST build-1 496 / 391 / 252 and build-2 527 / 469 / 290 on 96 cores (adv-accept two 89-thread shards and three adv-live confirmations, adv-mixer-3 six processes on build-1 and two plus two CaDiCaL on build-2, adv-cache-2 81 and 19 threads): oversubscription; the per-box sweep lock added and every lane told. adv-cache FINAL 555c3e42 (19:55 BST): idle, done; its implementations of adv-cache-3's three sweeps offered in its section 8a, not run.
+
+## 13. The 00:00 BST roll-up (verified on the mirror at 23:52 BST; the four open lanes' own 00:00 readings append below)
+
+Label: internal adversarial pass, not an independent review. Target: `igneum-pow` 017e70376489251e18564c0abce7e466e606c8b3 (class v4 sub-version 3, object byte 7). Every branch below carries a plan, a report and its logs, and `git diff --quiet 017e7037 <tip> -- igneum-pow` reads IDENTICAL on all nine.
+
+| Lane | Tip on the mirror | Logs | State at 23:52 BST | Verdict in one line |
+|---|---|---|---|---|
+| adv-mixer | d2ba3134 | 35 | closed | the algebraic structure of `M_r` BOUND: no composition of the 8 applications cheaper than 8x (commutation probe 0 in 1,454,080,000 over 1,024 days; GF(2) kernel 0 at every K; degree saturated after two applications); 9,360 ops per item stand; SAT a solver-reach bound only |
+| adv-mixer-2 | 2a632579 | 24 | closed | the day-key weakness class BOUND for every chip, GPU and the verifier (gain 1.0 every day); the per-day FPGA LUT-area tail at 2^-10.8 of days over 1.1x (15 days a century, worst 28 April 2050 at 1.113x, reconciled with F4) closed by a measured redraw rule (0 days over 1.1x after it) or the O-1.10 day derivation |
+| adv-mixer-3 | b890f6e3 | 147 | 00:00 reading owed | the statistical distinguisher and round margin: no statistic survives 2 of the 8 applications between reads (SAC, linear, rotational-XOR, line-index bits clean at 2 to 8 on both days); SAT at 1 application; the lost rows re-queued |
+| adv-cache | 555c3e42 | 51 | closed, defender no dispute | the recompute shortcut BOUND: the curve monotone toward the full store (f = 1\/2 at 1.26x the ops, 0.875x of the full-store chip's rate), no cheaper fill, chain avalanche full, batching loses from 32 MiB |
+| adv-cache-2 | 9b75da1d | 31 | 00:00 reading owed | the hot-set attack: line census PASS at 2^35 + 3 x 2^33 reads, steering PASS, weak-day scan PASS; FINDING, a diffuse era-stride excess (a product's biased low bits placed in the item index by the era rotation R; 13 of 27 drawn-era programs over 1.04x, 8 over 1.2x, worst 1.75x; 2 of 32 under the devnet's R = 29), under 0.1 percent of a hash's reads per site, not caught by the class v5 floor (0 of 61), the next class's test (ledger AP-F8-6); the chip model's f = 0.25 and 0.5 partial-store rows overstated, verdict unchanged |
+| adv-cache-3 | 9452c0bf | 33 | closed | the chain-break or skip BOUND: 0 lines under j + 1 at 64 and 1,024 lines, GF(2) rank full, no inversion, relations clean, the image census equal to the random-function recursion at all 64 depths; a bookkeeping finding, the pebbling optimum under the hold-every-k curve (9.3x not 17.4x at f = 1\/64; nothing moves from f = 1\/2) |
+| adv-accept | a7c49399 | 29 | 00:00 reading owed | the bypass: FINDING, confirmed and bounded, few-item hot sets admitted by the frozen rule (8 in the tail of 88,051 accepted programs, 0 in 20 random; 1 MB of items holding 0.3 percent of reads, 1.002x to a chip), every one refused by the class v5 floor at 0.995 (minimum sites 0.9821 to 0.9919) at the cost of false refusals (6 of 9 deep-tail clean programs, the 2.4 percent clean rejection); Q2 the stand-in gap BOUND on 54 programs; the attempts census 0.68 per candidate, (a') 83 percent of rejections, no exhaustion by chance |
+| adv-accept-2 | 92168536 | 67 | closed | header grinding for locality BOUND by measurement and tail (best header groups +0.09 percent on an RTX A6000; the 3e-7 tail on the baseline); one per-program 0.1 percent repeat class (a rotate by a register amount as the only write between two loads; 21 percent of drawn programs, none of the real two) for the rule's owners |
+| adv-accept-3 | 0c150e3c | 19 | 00:00 reading owed | exhaustion or steering of the draw: 0 verdict disagreements between the code and a second interpretation; the (c'') f64 compare cannot flip a verdict; the 256-unit ratio is noise as a selector; two findings for the owners: the last-resort program fails the real rule in 223 of 2,500 seeds and is handed out unchecked (unreachable at 4.6e-44), and the program-id derivation text omits the "sub\/" suffix the code appends |
+
+What the pass found, in one paragraph. No lane broke the frozen object: the mixer's 72 applications cost what the chip model prices, the chained cache yields no line under j + 1 blocks and no cheaper curve than the full store, the line and item distributions are uniform at scale, header grinding gains nothing a card can measure, and the draw cannot be exhausted or steered by its attempt index. The acceptance rule admits two residual classes of address concentration, both priced under 1.002x to a chip: few-item hot sets, which the class v5 floor closes (eight of eight) at a 2.4 percent clean-rejection cost, and a diffuse era-stride excess the floor does not reach, routed with its lever (a value-level source test and the era draw's R range) to the next class. The weak-day FPGA tail is reconciled at 15 days a century on LUT area only and closed by a measured redraw rule. Four documentation and correctness findings go to the rule's and the model's owners (the program-id text, the last-resort path, the pebbling baseline, the partial-store rows, and the stale 5.14 percent rejection figure in spec 1.4.6).
+
+Spend: box-hours by lane as each report states (about 0.6, 0.31, pending, 0.55, pending, 0.23, pending, 9.0 core-hours, pending); pods: one, USD 0.33, destroyed and verified, none originated by this lane.
+
+### 13.1 The lanes' own 00:00 BST readings
+
+| Lane | Reading |
+|---|---|
+| adv-accept (a7c49399, 23:5x BST) | Box-hours about 5.5, pod-hours 0. Q1: 182,646 distinct accepted programs drawn through the chain path (18 percent of the 10^6); eight pass every part of the frozen rule and flag the f8 hot-set test on the live dataset at 2^24 (100767, 4346, 5245, 1738, 170, 106924, 107022, 122960; X at 0.1 percent +0.102 to +0.221, 1.54x to 2.24x the window model), all in the lowest 34 stand-in-ratio seeds; 20 random: 1 beyond the gate, 0 hot sets; each hot set about 1 MB of items holding 0.26 to 0.41 percent of reads, 1.002x at the largest, no chip-model row moves. Mechanism: a near-saturated source at one site mapped by the era stride to one fixed item (item 0 the hottest in four); two more shapes (a low-entropy band without saturation; a single hot item from a non-saturated source). The exemplar reads the same hot set under the class v5 dataset. Against the class v5 floor: all 8 refused (0.9821 to 0.9919), 3 mild residuals missed (about 1.0004x, adv-cache-2's rotation class, a load_index question not a floor question), 6 clean-live programs refused and 1 passed among the 9 deepest (the 2.4 percent). Q2 BOUND: 54 programs plus 17 decisive reads, stand-in and live agree to 0.0004, 0 verdict disagreements. Q5: a lossy last write in 83.5 percent with no live effect beyond Q1; register collapse 0. Row 90: 10,000 seeds, (a') 83.3 percent of rejections, 0.6787 per candidate flat across attempts, P(exhaust) 8e-44, 0 exhaustions; the second 10,000 behind attack-pass on build-1. Partial, named: 18 percent of the seeds, 54 live rows, row 90 at half. A longer pass adds rows of the same three shapes, not a different answer, unless a seed reads a hot set over 1 percent of reads, which 182,646 draws did not produce. No exception; build-1 gave its leases nothing from 20:42 to 23:50 (11 attack-pass holders), in the ledger |
+| adv-accept-3 (read from the report at 0c150e3c by the coordinator at 01:03 BST; the lane's own line owed) | Every sweep ended 23:05 BST; about 3.3 box-hours, 0 pod-hours. Q1 exhaustion BOUND (accept 0.323 and reject 0.677 per attempt, geometric histogram, P(exhaust) 4.6e-44, 0 of 16,337 seeds at the cap). Q1b FINDING, correctness: the real rule rejects 271 of 3,000 last-resort programs (9.0 percent) yet they are handed out unchecked; unreachable. Q2 steering BOUND (45 of 48 plants fired; the real rule rejects every effective plant by (a'); 975 seeds at the first part, partial of 10^5); Q2b the best seed property at 1 in 10^6 tries is a shadow block of 38 multiplies, about 2 to 3 percent of the f = 1 chip's energy per hash (approximate); Q2c the 256-unit ratio is noise as a selector. Q3 FINDING, documentation: the program-id derivation text omits the "sub/" suffix (30956569d8f3d8d7 against fce15bf61030be57 for Devnet 3); 0 collisions over 10^7. Q4 DONE: the (c'') f64 compare never flips a verdict; a second interpretation agrees on 5,748 of 5,748. Q5 BOUND: 400 eras move the address map, not the program |
+| adv-cache-2 (read at 9384ee09 by the coordinator at 01:03 BST; the lane's own line owed) | About 2.2 box-hours (wall times threads over 96, the boxes at load 400 to 600 for two hours), 0 pod-hours; two shards still queued at 00:00 (partial, named). Q1 PASS (the 2^35 + 3 x 2^33 line census); Q2a PASS with the Devnet 3 site-0 FINDING; Q2b all 64 programs done, every one clear on the hot-set test, the site class at 13 of 27 drawn-era programs over 1.04x (8 over 1.2x, worst 1.7451x), 0 of 61 refused by the v5 floor (AP-F8-6); Q3(1) PASS; Q3(2) the 16,384-day weak-day scan PASS; Q3(3) the window layer exact to four digits, FINDING against the chip model's partial-store rows (up to 1.8x overstated at f = 0.5, the verdict unchanged); Q4 the prices |
+| adv-mixer-3 (read at 4ebe2455 by the coordinator at 01:03 BST; RUNNING: Q3 and Q4 at k = 8 on day 20729, queue 07 the other seven days; the lane's own line and finish time owed) | Q1 the exhaustive round-0 line-index census over all 2^32 t PASS to k = 8 on both days (and 20730 at k = 2, 3, 4, 8); Q2 and Q2b avalanche FINDING at k = 1 (the known single-application diffusion), PASS from k = 2 at 2^24 and 2^28; Q3 differential multiplicity FINDING at k = 1 (695 and 537 deterministic bits), PASS k = 2 to 7, k = 8 running; Q4 and Q4b linear PASS from k = 1; Q5 rotational-XOR PASS from k = 1; Q6 SAT k = 1 SATISFIABLE in 137 s (the model verified through the real code), k = 2 and 3 TIMEOUT at one hour. The round margin: no statistic survives 2 of the 8 applications between reads |
+| adv-accept-3, the lane's own line (01:0x BST; tip 0c150e3c, nothing unpushed) | Box-hours 3.3, pod-hours 0. Q1 exhaustion BOUND: P(exhaust 256) = 1.0e-43 per epoch seed from 62,240 candidates of 19,975 full-rule seeds plus 3.0e6 static candidates of 1e6 seeds, 0 at the cap. Q1b FINDING (correctness, unreachable): 271 of 3,000 last-resort programs fail the real rule yet try_generate_class hands them to the chain unchecked; the fix named in the report. Q2 steering BOUND over 19,975 full-rule and 1e6 static seeds: no property buys over about 1.03x at 1 in 1e6 tries; the worst live hot set of eight measured 1.0008x; the stand-in ratio's 256-unit floor is noise. Q3 the program id: 0 collisions in 1e7 pairs (BOUND); FINDING (interoperability): the derivation text omits the generator-4 "sub/" || 3_le16 suffix. Q4 determinism BOUND on the rule (5,748 of 5,748 verdicts agree; the control fired; the f64 compare 0 flips over 2^20 values, latent only at a floor of 0.975) and FINDING (documentary): an implementation written from the spec text differs on 264 of 400 epoch programs. Q5 era steering BOUND (400 eras move the address map, not the program). Partial, named: the floor-0.97 known-failed variant did not fire (the (c'') ratios are bimodal, accepted 0.989 to 0.999, rejected 0.814 to 0.966) and was replaced by the single-pass (a) variant, which fired; 25 seeds of the kill window uncovered in the steer sweep. Running: nothing. Longer pass: the steering sweep to 1e5 seeds with a live census as the true selector, the ratios sweep to 3,000 seeds, a chosen-id preimage attempt through the murmur finaliser |
+| adv-mixer-3, the lane's own line (01:05 BST; tip 4ebe2455, later 6288a154; 163 log copies) | Box-hours about 3.0 wall-hours of sweep on the two boxes (build-1 1.9, build-2 1.1, both at load 100 to 600 throughout) plus 4 single-core CaDiCaL hours; pod-hours 0; GPU BLOCKED. Q1 BOUND (uniform k = 1 to 8, both days, 2^32 t exhaustive). Q2 and Q2b avalanche FINDING at k = 1, BOUND from k = 2 (0 cells beyond 6 sigma through k = 8; 2^28 at k = 2 to 4). Q3 differential FINDING at k = 1 (35 to 40 output bits fixed per single-bit difference), BOUND from k = 2 to 7; no full output difference ever repeated at any k. Q4 linear BOUND from k = 1. Q5 rotational-XOR BOUND from k = 1. Q6 SAT BOUND: k = 1 solved in 137 s, five orders slower than the honest 2^10 trials; k = 2, 3, 4 TIMEOUT at one hour. The round margin: no statistic survives 2 of the 8 keyed applications between dependent reads; 6 of 8 are margin on every measured statistic, 70 of 72 per item; the k = 1 effects are one mechanism (the lowest-set-bit trail through one application, dead once both addends carry a difference); nothing saves one application against 9,360 ops per item. Partial, named: Q3 k = 8 not run; Q2 2^27 rows at k = 2, 3 and Q2b day 20733 2^28 rows running (finish about 03:00 BST at 4 cores); Q6 day 20733 k = 2 to 4 running (about 03:45 BST, timeouts expected); Q7 random days only 20730 so far; multi-bit linear masks and a MILP trail bound not attempted. Longer pass: multi-bit masks, a MILP differential bound through 2 applications, the SAT model with a cache-line XOR between applications, 2^30 states at k = 2 |
+| adv-cache-2, the lane's own line (01:05 BST; tip 3f50d6c4) | Box-hours about 2.2 of run (lease waits not counted), pod-hours 0, GPU rows BLOCKED. Q1 line index BOUND, PASS at 2^35 reads over 272 chain days plus 3 x 2^33 fresh days (largest segment +4.84 sigma against the control's +4.24; top 1 percent of lines 1.02963 against 1.02959 percent; one per-day per-round bucket at +6.6 among 1.3 x 10^8, a tail). Q2a the real programs BOUND plus the Devnet 3 site-0 FINDING (1.45x of its own control, 0.1 percent of a hash's reads). Q2b complete, FINDING with its mechanism (ledger AP-F8-6): the same 32 base programs read 2 of 32 with a site over 1.04x under the devnet era (R = 29) and 16 of 32 under drawn eras (8 over 1.2x, worst 1.75x at era-drawn-28 site 15); a product's biased low bits in the load's source (the shadow block's last writer: mul, mulhi, or and sub chains) carried by rotl(x times M, R) into the item index unless R is 29 or 30; sub-class B a warp-uniform source once in 16,000 warps; under 0.1 percent of a hash's reads per site; the class v5 floor refuses 0 of 61 (cited). Q3(1) steering by t BOUND, PASS. Q3(2) the weak day BOUND, PASS over 16,384 chain days. Q3(3) the window layer FINDING (designed, counted): top quarter mean 0.3382 and top half 0.5811 of reads against uniform 0.25 and 0.5, confirmed on 4,096 drawn programs; the real programs at the 90th and 99th percentiles. Q4 the price: a chip holding the hottest f of items serves 0.4219 at f = 0.25 (ops per hash 0.77x of the model's row), 0.7188 at 0.5 (0.56x), 0.8907 at 0.75 (0.44x); the chip model's partial-store rows overstate the recompute share by up to 2.3x on these programs by the window layer alone, the verdict unchanged (the f = 1 chip still cheapest); for the cache the stride store is the honest curve and no measured skew moves it. Partial, named: the drawn-era windows census of 4,096 not yet run (waiting since 01:04 BST, 8 shards of about 4 minutes each at 32 cores); line shard s2c (days 21002 to 21065) waiting since 23:09 BST. Longer pass: the per-site statistic over 8,192 drawn programs' window draws in closed form plus the rate at which R lands in {29, 30} (2 in 31), and a 2^28-nonce read of era-drawn-28 for a 3-digit price on the worst site |
+
+### 13.2 After the readings
+
+| Item | State |
+|---|---|
+| The spec rewrite read-back (main, 01:0x BST) | adv-accept-3's second documentary finding (a text-derived implementation differs on 264 of 400 epoch programs) was read against the spec at 017e7037; the audit lane's rewrite of 1.4.3 and 1.4.6 to the shipped rule is on master at 8b834634 (the merge of spec-accept-23: the constants table, the pinned-ids table, igneum-pow/tests/spec_readback.rs). adv-accept-3 re-derives the same 400 programs from the rewritten text alone (row Q4c, `lease pool 16`); the expected reading is 0 of 400; a non-zero names the sentence that still diverges; the count goes to main and the audit lane. LANDED 01:15 BST (build-2, 16 cores, 4 minutes; row 6.5 in adv-accept-3's report, log 983-textderive-8b834634.tsv): 0 of 400 differ, equal on every field (64 base and 256 shadow instructions with every operand, the chosen attempt, the id with the sub/3 suffix, the sequence of rejection parts of the earlier attempts; 0 last resorts); the 264-of-400 finding is CLOSED against 8b834634. One sentence still cannot be followed from the text alone: 1.4.6.4's Dataset row names dataset_elem(idx, S[0], S[1]) "of verify.rs" without its six operations, so (c), (c') and (c'') take that one function from the crate; stating the closed form in the text closes it |
+| The second read-back (ordered 01:49 BST) | The audit lane closed that sentence on master at 56eebc0d (verified on the mirror): 1.4.6.4 states dataset_elem in full (eight operations, three constants, 32-bit wrapping) with two pinned vectors read by igneum-pow/tests/spec_readback.rs; 1.4.6.5 now carries sub-version 3's own rates (68.1 percent per candidate, the parts' shares, mean attempt 2.1) in place of the class v2 figures. adv-accept-3 re-runs Q4c as Q4d (row 6.6) with nothing taken from the crate; the expected reading 0 of 400 on every field and the two vectors matching; the count to the audit lane and main. AP-F8-5 then reads fixed on two measurements |
+| Q4d LANDED 01:57 BST (build-2, 16 cores, granted 01:52 after adv-accept released a shard; row 6.6, log 984-textderive-56eebc0d.tsv) | 0 of 400 differ against 56eebc0d with text.rs taking NOTHING from igneum_pow (0 `use igneum_pow` lines; dataset_elem from 1.4.6.4, the two pinned vectors checked at start): equal on every field and every row equal to its Q4c row; no sentence of 1.3, 1.4.2, 1.4.3, 1.4.6, 1.6, 1.7 or 1.13.1 needs the crate. THE SPEC TEXT IS SUFFICIENT for the program draw and the acceptance rule; AP-F8-5 reads fixed on two measurements; adv-accept-3 at its end, nothing on either box |
+| Box 2 at 01:05 BST | No release-class waiter listed and 32 pool cores free, so nothing of the pass was ended; the v5 lane re-submits its packs test and suite at 16 cores |
+| The v5 lane's release job (01:0x BST) | Ran on box 2 the minute adv-accept's two holders ended (65 cores, no lease fault): 19 of 20 packs tests green; the one failure is a text diff only, master's export now writing the "sub/" suffix into program.json's derivation string (adv-accept-3's finding, fixed on master) while the pinned packs carry the old wording, the ids equal; the three pinned packs re-exported and the test re-run at 16 cores within the half hour; nothing of the pass in its way |
+| adv-accept, after the hour (01:12 BST) | A NINTH hot set: seed 228763 (id 2c4be0f6dc44c423, stand-in 0.9820) at 2^24: X at 0.1 percent +0.118, 1.82x the window model, its single hottest item 0xe2cc96 at 1,218,380 reads, 0.057 percent of ALL reads, the largest single item of the pass (40x 100767's), from a NON-saturated source r0 at site 9 (the sel register), saturated-source share 0.000: the third shape at scale, which (c') cannot see by construction. 638990 beyond the gate at 1.51x with one item at 0.027 percent (also r0, no saturation), no hot set; 623492 clean. Tally: 9 hot sets in 37 tail seeds against 0 in 20 random; 269,250 programs drawn at 01:08; the price stands at 1.002x (0.27 percent of reads on 1 MB; one item is 64 bytes); the three seeds' 2^20 ratios against the floor minutes away |
+| adv-accept, the floor's final tally (01:13 BST, gap-tail3.log) | 228763 (the ninth hot set, the non-saturated shape) minimum site 9 at 0.9809, the lowest of the pass, REFUSED; 638990 (the single-item shape at 1.51x) site 2 at 0.9872, REFUSED; 623492 (clean live) site 0 at 0.9922, REFUSED (a seventh false refusal). Over everything the lane read at 2^20: 9 of 9 live hot sets refused (0.9809 to 0.9919), both single-item programs refused, 7 clean-live programs refused and 1 passed among the 12 deepest 256-unit seeds, 3 mild residuals missed (about 1.0004x). So the floor's instrument reaches the non-saturated shape too: the distinct-index ratio reads any few-item concentration whatever its source, and misses only the diffuse era-stride excess |
+| adv-cache-2, after the hour (01:1x BST; tip 91ca5ce1) | Box 2 finished for the lane: the 4,096 drawn-era programs under drawn eras read top quarter mean 0.3378 and top half 0.5808 with tail probabilities 0.0283 and 0.0208, the closed form's 0.3382, 0.5811, 0.0277 and 0.0199 to three digits (section 3.3); the only item left is line shard s2c (64 fresh days, about 4 minutes at 32 cores) waiting on build-1 since 23:09 BST; box-hours of run about 2.25 |
+
+### 13.3 The frozen object after the pass
+
+The nine lanes attacked `igneum-pow` 017e7037 and every lane's branch tip carries it byte for byte. Master's `igneum-pow` moved after the freeze, in four files, none of them the hash: `src/emit.rs` and `src/generator.rs` (the program-id derivation string stated exactly in every pack and the recipe helpers behind it, adv-accept-3's documentation finding; the ids themselves unchanged, as the v5 lane's packs test read equal) and two new tests, `tests/derivation.rs` and `tests/spec_readback.rs` (the spec text read back against the crate). This branch carries master's copy from its 56eebc0d merge; the object the pass bounded is unchanged in every operation the hash performs.
diff --git a/docs/plans/funding.md b/docs/plans/funding.md
index b7719c02a..374a5efcf 100644
--- a/docs/plans/funding.md
+++ b/docs/plans/funding.md
@@ -1,6 +1,6 @@
 # Funding plan
 
-> Status 4 October 2026: PLACEHOLDER. The founder has parked funding for now; the figures below are estimates for planning only and nothing here is committed or funded beyond what the table states as already covered.
+> Status 7 October 2026 (evening): the cryptanalysis row and the brief section are the INTERNAL adversarial pass, not an independent review (the founder: nothing goes outside); no firm, price or engagement is named anywhere in this file. Status 4 October 2026: PLACEHOLDER. the founder has parked funding for now; the figures below are estimates for planning only and nothing here is committed or funded beyond what the table states as already covered.
 
 
 3 October 2026. What the project costs to build, review, run and defend, what pays for it today, what waits on revenue, and what pauses if revenue is late. Every dollar figure is approximate unless it cites a price list, and the basis is stated in the row. Nothing here is a sale of anything and no figure is a price of the coin.
@@ -28,7 +28,7 @@ Columns: estimated cost with its basis; what is funded today; what depends on fu
 | Development: the second independent node client | Not in the 13-month plan (`docs/fud-fixes.md` rows 31, 47). Basis: decision pending | Not funded | Yes, entirely | Does not start |
 | Independent review: finality rule v2 (gate 3, phase 4, the rule external review is paid to break) | USD 50,000 to 100,000. Basis: a focused review of one consensus rule plus its simulation by two reviewers over a few weeks, from memory, approximate | Founder's own means | No | Not pausable: the roadmap says the phase 4 gate is "finality design passes external review". If it cannot be paid, phase 4 does not close and the dates move |
 | Independent audit: the node fork (consensus delta, p2p, difficulty, header validation, the pow engine) before public testnet | USD 60,000 to 120,000. Basis: the delta is listed row by row in `docs/fork-divergence.md`; the base is rusty-kaspa, already audited upstream, approximate | Founder's own means, second in order after the finality review | Partly: a second pass after the attack harness closes its stubs | The single pass is kept; the second pass waits. Public testnet does not open without the first pass |
-| Independent cryptanalysis: the mixer `M_r`, the chained cache and the acceptance rule of the lottery hash, with the class v3 x8 shape as the target (Counter ASIC 3.0 item 3; the brief is the last section of this file) | USD 80,000 to 160,000 for two independent reviews: one firm at USD 50,000 to 100,000 for 25 to 40 person-days, one academic group at USD 30,000 to 60,000 for a comparable effort, both approximate. Basis: the four RandomX reviews of 2019, the only public price points for a proof-of-work hash review: Trail of Bits USD 28,000 for two person-weeks, X41 EUR 42,000 for 30 person-days by three testers, Kudelski CHF 18,250 for 6 person-days, Quarkslab USD 52,800 for 32 person-days by three engineers (the RandomX README section "Audits" and the four reports in its `audits/` directory, https://github.com/tevador/RandomX, read 6 October 2026; `vendor/RandomX` is not checked out in this worktree, so the web copy is the source); about USD 145,000 together at 2019 rates, approximate, and USD 1,650 to 3,000 per person-day then, raised here by about a third for 2026, approximate. Engagement length is the firm's, not ours: 3 to 6 weeks of calendar per review (X41 ran 3 to 28 June 2019; Quarkslab "about three weeks"), 8 to 10 weeks from commission to both final reports with a re-run after any parameter change, approximate | Proposed: founder's own means, third in order after the finality review and the first node pass (the history audit raised it to a genesis gate, `docs/analysis/asic-resistance-history.md` section 4.3 addition 3; the founder confirms) | No | The academic review alone (USD 30,000 to 60,000), timeboxed to the ranked questions 1 to 3 of the brief; testnet-1 opens with the report's absence stated on the download page and announces no reset-free period until the report is in; mainnet does not open without it (rule 2: the report is published whole, pass or fail) |
+| Cryptanalysis of the lottery hash: the mixer `M_r`, the chained cache and the acceptance rule, with the frozen class v4 sub-version 3 object as the target (Counter ASIC 3.0 item 3). INTERNAL ADVERSARIAL PASS, NOT AN INDEPENDENT REVIEW (the founder's correction through main, 7 October 2026, evening: nothing goes outside, no firms, no paid lots, no briefs to anyone; the rule set is `docs/plans/cryptanalysis/in-house-pass.md` and the brief is the last section of this file) | No cash. Agent time the founder already pays for, plus box time on igneum-build-2: 24 box-hours for first results (three lanes, 8 each, one 32-core slot per lane), a proposed ceiling of 48 before main's word; a box-hour costs nothing beyond the box's monthly rent (`docs/plans/build-server.md`). The former estimate for two external reviews (USD 80,000 to 160,000, from the 2019 RandomX price points) is withdrawn and never totalled | Founder's own means (the box and the agents) | No | Nothing pauses. The only outside check is the disclosure prize (USD 50,000, approved 7 October 2026, STAGED: escrowed before it is named, the entity address on its documents, the founder's publish word; rule 3). Testnet-1 opens with the pass's state (plans, results, bounds) on the download page, labelled internal; mainnet's gate on this item is the published internal reports plus the staged prize, never a claim of independent review |
 | Independent audit: execution layer and proving integration (revm driver, two-dimensional gas, proof records, the veto, the `ProofSystem` version 1 integration) before mainnet | USD 80,000 to 150,000. Basis: an EVM-integration audit of a new client's execution path, from memory, approximate | Not funded | Yes | Mainnet moves until it is paid. Mainnet does not ship with an unaudited execution layer |
 | Independent audit: the official client and release process (spec 08: reproducible builds, release key, update path) | USD 20,000 to 40,000. Basis: a short application security review, from memory, approximate | Not funded | Yes | The one-click app ships at testnet unaudited and says so on the download page; the audit lands before mainnet or the app does not carry the mainnet release key |
 | Infrastructure: the 20-node cloud devnet | USD 476 per month for 20 nodes (Hetzner API prices of 3 October 2026, net, `docs/plans/cloud-devnet.md`); about USD 6,000 for the 13 months, plus rented GPU hours for the hourly-compile and shard measurements at USD 0.22 to 0.74 per card hour (RunPod, 3 October 2026): under USD 1,000 over phase 2 | Founder's own means | No | Node count drops to 8 (two per location); the rented GPU hours are replaced by the project's own cards |
@@ -73,126 +73,63 @@ The fee is 1% of the producer share on the official client, default on and switc
 
    What it means per tier: nothing changes in the protocol at the line; a home miner on any card can read the live benchmark page and the bounty terms, so a chip's existence becomes something its designer is paid to disclose rather than to hide; a pool user sees the same page. If the entity cannot fund the escrow when the line approaches, rule 3 holds (nothing is announced) and the detector plus the epoch-length signal (`docs/plans/epoch-length.md` section 11) are the response that costs no money.
 
-## The mixer cryptanalysis brief (Counter ASIC 3.0 item 3)
+## The cryptanalysis brief (Counter ASIC 3.0 item 3): the in-house adversarial pass
 
-6 October 2026, worker `ca3-crypto-brief`. This is the scope a reviewer is sent. It is a document: nothing here is commissioned, paid or mailed. Every figure cites its source or is marked approximate. Code references are to the commit this brief was written on (`50df751`).
+7 October 2026, evening, the crypto-engage lane, on the founder's correction through main. Label on every public sentence: **internal adversarial pass, not an independent review**. Nothing here is commissioned, paid or mailed; nobody outside is contacted. The rule set, the lanes, the budget and the clock are `docs/plans/cryptanalysis/in-house-pass.md`; this section is the brief the lanes are measured against. The 6 October brief that this replaces named firms and prices; it is in this file's git history and nowhere else.
 
-### B1. The target, precisely
+### B1. The target
 
-The lottery hash's memory-hard dataset (spec `docs/spec/01-lottery-hash.md` section 1.8; code `igneum-pow/src/memhard.rs`). The reviewer gets the spec, the crate, the pinned packs and vectors, and this table.
-
-| Piece | Exact definition | Source |
-|---|---|---|
-| Day key `K[0..7]` | `seed_words_from_bytes(day_bytes)`: FNV-1a 64 plus SplitMix64 into eight 32-bit words (spec 1.3). On the chain today (interim rule O-1.10) `day_bytes = "igneum-day/" \|\| day_le64` with `day = header.timestamp_ms / 86,400,000`: a pure function of the calendar day, so every future day's key and mixer parameters are computable now. The proposed final rule ties the day to the first epoch seed of the day (a VDF output), which is not in the node yet | spec 1.8.1, 1.12; `igneum-pow/src/bind.rs` lines 17, 62 to 71 |
-| Block function `B` | ChaCha12 core with feed-forward: six double rounds of the standard quarter round with rotations (16, 12, 8, 7), then `y[i] = y[i] + x[i]`. Twelve rounds, no key schedule beyond the input block | spec 1.8.2; `memhard.rs` `chacha_block`, lines 151 to 169 |
-| The cache | 2^26 words (256 MiB at genesis; 2^27 from chain day 1,460 and 2^28 from day 4,380 under the growth rule), 2^22 lines of 16 words, in 2^16 independent segments of 64 chained lines. Segment `s`, line `j`: `x_j = prev XOR (sigma[0..3] \|\| K[0..7] \|\| s \|\| j \|\| tag[0..1])`, `line_j = B(x_j)`, `prev = line_j`, `prev_0 = 0^16`, `tag = ("Igne", "umMH")`. Line `j` costs `j + 1` block evaluations from nothing, 32.5 on average. The feed-forward means `line_j = C(x_j) + x_j` where `x_j` carries `line_{j-1}` by XOR | spec 1.8.3; `memhard.rs` `fill_segment_tagged`, lines 322 to 341; `cache_log2_words`, line 112 |
-| Mixer parameters | One SplitMix64 stream seeded with `K[0] \| (K[1] << 32)`: only 64 bits of the day key reach the parameters (`K[2..7]` enter the item through its initial state only). Draw order: `ROT[0..7] = 1 + below(31)` (eight draws, range 1 to 31), `MUL[0..15] = low32(next()) OR 1` (sixteen, odd), `RC[0..15] = low32(next())` (sixteen) | spec 1.8.4; `memhard.rs` `MixParams::with_shape`, lines 187 to 202 |
-| The mixer `M(s, rk)` on 16 words | Layer 1, per word `i` in 0..15: `s[i] = (s[i] XOR (RC[i] + rk)) * MUL[i]` (an odd multiply, a bijection per word). Layer 2, one ChaCha-shaped double round: four column quarter rounds `QR(s0, s4, s8, s12)`, `(s1, s5, s9, s13)`, `(s2, s6, s10, s14)`, `(s3, s7, s11, s15)` with rotations `ROT[0..3]`, then four diagonal quarter rounds `(s0, s5, s10, s15)`, `(s1, s6, s11, s12)`, `(s2, s7, s8, s13)`, `(s3, s4, s9, s14)` with rotations `ROT[4..7]`. `QR(a, b, c, d; r1..r4)` is the standard ChaCha quarter round with those rotations. Structure: an ARX-multiply round, one multiply layer then one ChaCha double round, with the rotation amounts and the multiply and add constants drawn per day and the round key `rk` the only difference between applications | `memhard.rs` `mixer`, lines 290 to 303; `qr`, lines 136 to 149 |
-| Op count of one application | Counted from the code: layer 1 is 16 x (add, xor, mul) = 48; layer 2 is 8 quarter rounds x 12 (4 add, 4 xor, 4 rotate) = 96; 144 as written, 128 with `RC[i] + rk` hoisted into a per-application constant. The spec says "about 130"; the chip model prices 130 | `memhard.rs` lines 290 to 303; spec 1.8.4; `docs/analysis/chip-model-v3.md` section 1 |
-| Round keys | `rk = (r * m + j + 1) * 0x9E3779B9 mod 2^32` for round `r` in 0..8 and application `j` in 0..m-1: the first `9 m` multiples of an odd constant, all distinct | `memhard.rs` `round_key`, `round_key_mult`, lines 276 to 285 |
-| Class v3 multiplier | `m = 8` (`LoadClass::MX8`, `V3_CLASS`), so 9 x 8 = 72 applications per item: 8 before each of the 8 cache reads and 8 after the last. `mixers_per_item = (ITEM_ROUNDS + 1) x m`. Decided 5 October 2026 22:05 UTC under the delegated rule (verify 2.1 ms per unit on one M5 Max core against the 10 ms gate; the daily 1 GiB build 23 to 77 ms on the two discrete cards) | `igneum-pow/src/generator.rs` lines 403 to 407, 704; `memhard.rs` line 87; `docs/plans/mixer-x4.md` section 6.5. Note for the editor: spec 1.13.1's table and `mixer-x4.md` section 2 still print `m = 4`; the code and spec 1.8.5 say 8 |
-| Item derivation `item(t)` | `s[0..7] = K[0..7]`; `s[8 + i] = t * MUL[i] + RC[i]` for `i` in 0..7 (linear in `t` per word). For `r` in 0..7: apply `M` eight times with the round keys above; `a = s[0] AND (2^(C - 4) - 1)` (the cache line index, `C = 26` at genesis: 2^22 lines); `s[i] = s[i] XOR cache[line a][i]` for all sixteen words. Then eight more applications. Eight dependent reads: read `r`'s address depends on every earlier read. The chip model's cost per item: 72 x 130 = 9,360 integer operations, plus 16 for the init and 128 XORs | spec 1.8.5; `memhard.rs` `derive_items_mask`, lines 503 to 536 |
-| Dataset and the hash's reads | `dataset[w] = item(w >> 4)[w AND 15]` under the linear layout; the era layout permutes four address bits below 16, so an item keeps its value. A program makes exactly 16 loads x 8 iterations = 128 loads per hash, each a 4-byte dataset word at `rotl(x * M, R)` masked into a drawn window of at least 2^26 words; the verifier derives at most 4,096 items per 32-lane unit | spec 1.8.5, 1.9, 1.11, 1.13.1; `docs/analysis/chip-model-v3.md` section 1 (128 items per hash, median 128.00 distinct) |
-| Program acceptance (what the reviewer checks as a filter, not a proof) | (a) every `load` reads a register written since the previous `load` from it; (b) every register has an injecting write; (c) 64 units x 32 lanes = 2,048 evaluations against a closed-form stand-in dataset at 2^28 words: no register bit constant, no lane-constant load site, under 164 saturated finals (1 percent), every output bit within 136 of 1,024 ones (6 sigma), distinct masked addresses per lane summed above 245,760 (mean above 120 of 128). Attempt `k` redraws from `seed \|\| k_le32`. Measured rejection 5.14 percent over 100,000 seeds (3.93 static, 2.05 dynamic); the closed-form verdict agrees with the live-dataset verdict on all but 39 threshold-edge programs of 100,000 | spec 1.4.6; `igneum-pow/src/accept.rs` lines 1 to 36; `docs/analysis/weak-program-census-2026-10-03.md` sections 1, 6, 7.3 |
-| Era draws that touch the program, not the derivation | Per era: op weights perturbed by up to 2 points, output fold rotations redrawn in 1..31, the stride multiplier `M` (odd), the stride rotation `R`, the four interleave positions; `epoch_len` by miner signal. Not drawn: the load count (16), the mixer round count (8), `mixer_mult`. So no era changes `item(t)`; the chip model prices the era draws at zero for the recompute chip | spec 1.13.1; `docs/analysis/chip-model-v3.md` section 2 |
-| What exists in place of a proof | The soundness suite (B4) and three measurements: an inline kernel that recomputes every word runs at 0.21 of the honest rate on the M5 Max (0.10 against a 256 MiB honest dataset); the stats run on three programs; the x8 verifier at 2.08 ms per unit. No cryptanalysis of `M_r`, of the chain, or of the draws has been done; MEMHARD.md names the all-equal `ROT` draw as untested | `proto-metal/MEMHARD.md` sections 2.2 and 3 items 3 to 5; spec 1.8.4 |
-
-### B2. What a break looks like, ranked by what it hands a chip
-
-The chip is the on-die-cache recompute chip of `docs/analysis/chip-model-v3.md`: the whole cache in SRAM (128 mm^2, USD 46 per good die at N5 headline density, approximate), every item derived, 50 T op/s (approximate), scored against the RTX 5090's measured 136.1 MH/s. Today's row: 1,198,080 ops per hash (128 x 72 x 130), 41.7 MH/s, 0.31x bare, 0.92x with the 3x fixed-function factor, 0.76x at equal silicon. Each break names the number it moves.
-
-| Rank | Break | What it hands a chip | The chip-model number it moves | Precedent |
-|---|---|---|---|---|
-| 1 | A structural shortcut in `M_r`: the 72 keyed applications of one fixed ARX-multiply round compose into something cheaper than 72 x 130 ops. Candidates the reviewer prices: the per-word multiply layer commuting or folding across applications because only `rk` changes; a differential, linear or rotational property of one ChaCha double round with drawn rotations that survives 8 applications; an algebraic form of the 8 applications between two cache reads (the one block of work a chip pipelines) | Ops per item below 9,360. At 4,680 (a 2x shortcut) the chip reads 83.5 MH/s, 0.61x bare, 1.84x with the factor: the x4 row. At 2,340 (4x): 167 MH/s, 1.23x, 3.7x. At 1,170 (8x, the class v2 cost): 334 MH/s, 2.45x, 7.4x with the factor, 6.1x at equal silicon. x8 multiplies the weight of this break: the same shortcut was worth one eighth as much under v2 | "Ops per hash" and every gain column of `chip-model-v3.md` section 2 | Catena's proofs flawed, 25x area-time cut (Biryukov and Khovratovich, ASIACRYPT 2015, history [P10]); Lyra2REv2's chip at 20x after the cryptanalysis found the shortcut first (history row 7) |
-| 2 | A time-memory trade-off on the chained cache under 256 MiB: deriving line `(s, j)` in fewer than `j + 1` block evaluations without holding an earlier line of segment `s`, or a relation between lines through the XOR chaining and the feed-forward. The honest trade-off is not a break: holding every 8th line (32 MiB) costs 3.5 blocks per read on average, about 2,450 ops per line and 19,600 per item on top of the mixer (ChaCha12 at about 700 ops per block, MEMHARD.md item 4, approximate), which reads 13.5 MH/s, 0.10x bare, 0.30x with the factor; the full mirror beats it. A break is anything that beats this arithmetic | The SRAM column: 128 mm^2 and USD 46 toward zero, and the node class with it: a 256 MiB mirror forces a 7 nm-class die (a USD 50M-class project); a chip with no mirror can be a 28 nm part (USD 5M to 30M, history section 2.5, the cited articles disagree by 2x). Equal silicon 0.76x rises toward the 0.92x with-factor row | "SRAM the chip holds", "Equal silicon", the node class of history 2.5 | MTP: 2 GB to under 1 MB at a 170x compute penalty before launch, by steering Argon2d's data-dependent addresses (Dinur and Nadler, CRYPTO 2017, [P18]); Argon2i's parameters at O(n^1.75 log n) (Alwen and Blocki, [P5] [P6]) |
-| 3 | A weak-key class in the draws: `ROT` values that make a quarter round weak (eight equal, probability 31^-7 = 3.6 x 10^-11 per day, approximate arithmetic; pairs summing to 32; small amounts), `MUL = 1` or low-weight multipliers (2^-31 per word), `RC + rk` structure. Only 64 bits of `K` seed the draw. Under the interim day rule the weak days are a public calendar computable today for every future day, so a chip built to run only on weak days can be planned in advance | On a weak day the ops per item fall as in rank 1 for that day. The chip's yearly gain is the weak-day fraction times the per-day gain: at one weak day in a thousand nothing moves; at one in twenty a chip that idles 95 percent of the time still mines the other days at rank 1's gain | "Ops per hash" on the weak days; the fraction is the number the review must produce | MEMHARD.md section 3 item 3 (the all-equal `ROT` draw, untested); RandomX's Kudelski scope named "weaker authorized parameters" as a goal (Report-Kudelski.pdf, 2 July 2019) |
-| 4 | Non-uniformity of the item distribution: (a) the line index `s[0] AND mask` after the mixer not uniform over 2^22 lines, so a hot subset of lines covers most reads; (b) across all nonces of an epoch, a hot subset of the 2^24 items covers most of the program's 128 loads. The acceptance rule bounds distinct addresses within one hash, not the cross-hash distribution | (a) The SRAM column shrinks to the hot lines: a chip holding 10 percent of the lines at 90 percent hit rate pays the chain recompute on 10 percent of reads only. (b) A chip or a card holds items, not the cache, and the 128-items-per-hash input falls | "SRAM the chip holds"; "Items per hash" | Distinct cache lines per hash never censused (MEMHARD.md item 5: analytically at most 1,024 of 4,194,304 lines per hash under 128 loads, a warp's working set 32,768 lines, approximate); the daily build is latency-bound, so a hot set would also speed the honest build |
-| 5 | An acceptance-rule bypass that lets a miner steer addresses: a program that passes (a) to (c) on the closed-form stand-in and has exploitable locality on the live dataset (the 39 edge disagreements of 100,000 are the known gap); and header grinding for locality (history check 1): the miner chooses the header bytes behind the pre-PoW hash and searches for 32-lane groups whose 128 loads cluster into fewer DRAM rows or lines, at a search cost below the gain | A software gain to the grinder on every card: it breaks the fair-lottery property of spec 1.1 before it helps a chip; a chip adds the hot set of rank 4 (b) | "Items per hash"; the honest denominator (a grinder's card reads above 136.1 MH/s) | Kik's ProgPoW exploit: a 64-bit seed let a chip skip memory with a cooperating node, patched in 0.9.4 (history [S71]); MTP as above |
-| 6 | Day-key or era-seed grinding: influencing the block that feeds the day's first epoch seed or the era VDF to pick a favourable day key (rank 3 made selectable) or era draw. The era draws do not touch the derivation, so grinding the era moves the program only | Converts rank 3 from a calendar into a choice; nothing else. Under the interim day rule there is nothing to grind because the key is the calendar | None directly; the probability in rank 3 | Spec 1.12 O-1.10 (the proposed derivation), 4.4 (the VDF); history [S71] |
-
-### B3. Deliverables, with a timebox
-
-| Deliverable | Content | When |
-|---|---|---|
-| The written report | One verdict per question of B2, ranks 1 to 6, each with the effort spent on it (person-days, tools, the reduced-round or reduced-size margin reached) and a severity in the firm's own scale; published whole, pass or fail, under rule 2 of this plan | End of the timebox |
-| Attack code | Any shortcut, trade-off, weak-key census or address-steering search the reviewer wrote, runnable against `igneum-pow` on the pinned packs `mx8-genesis` and `mx8-devnet-epoch0`, with the measured gain beside the honest path | With the report |
-| A re-run of the soundness suite | B4, on the reviewer's machine, with the counts; any test the reviewer adds goes into `igneum-pow/tests/` | With the report |
-| A recommendation on `mixer_mult` | Keep 8, or move to 16 (the chip model's next lever: 0.16x bare, 0.46x with the factor; verifier about 3.7 ms per unit, approximate, under the 10 ms gate on the M5 Max core, unmeasured on a 2019-class laptop core, O-1.14), or change the mixer's shape; stated against ranks 1 and 3 | With the report |
-| A recommendation on the rotation draw bounds | Keep `1 + below(31)` for all eight, or restrict (distinct amounts, no complementary pairs, a rejection-and-redraw rule like the program acceptance rule), with the weak-day fraction before and after; the same for `MUL` and `RC` | With the report |
-| Timebox | 25 to 40 person-days per reviewer, 3 to 6 weeks of calendar each, both in parallel; one further week for the re-run if a parameter moves (the external firm's calendar, cited from the RandomX pattern in the funding row above) | 8 to 10 weeks from commission to both reports, approximate |
-
-### B4. The soundness suite the reviewer re-runs
-
-| Suite | What it checks | Last result | Source |
-|---|---|---|---|
-| `cargo test -j4 --release` in `igneum-pow` | the growth schedule table, the by-hand multiplied mixer against `derive_item` at `m` = 1, 2, 4 on a 2^16-word cache, the seam, the generator | 44 of 44 (53 on the release tree) | `docs/plans/mixer-x4.md` 6.3; `counter-asic-2-rollout.md` G3 |
-| `tests/packs.rs` | pinned packs v2 and v3: programs, ids, dataset words, 96 vectors per pack, every emitted file byte for byte | 12 of 12 | same |
-| `tests/mixer.rs` fuzz | 200 programs through the seam, 4 units each across the 32-bit range, interpreted twice | 200 of 200, 800 of 800 units | same |
-| `tests/mixer.rs` stats | 8,192 outputs per seed: bit balance, single-bit avalanche within and across units, duplicates | avalanche 49.99 percent, worst bit z 1.92, 0 duplicates (igneum-genesis v3) | same |
-| `tests/mixer.rs` edge and determinism | items 0, 1, 2^28 - 1, 2^32 - 1 at `m` = 1, 2, 4, 8; the index wrap; two independent epochs equal to the pinned pack | pass | same |
-| `tests/scratch.rs` | bijections, re-hit rates, 56 edge units, 42 emitted kernels (layer 3, not adopted; kept in the suite) | 7 of 7 | `docs/analysis/scratch-soundness.md` 7.1 |
-| Metal and OpenCL on the pinned v3 packs | 200 packs standalone and inside a wrapping 512-nonce batch; every tenth pack on Apple OpenCL | 200 of 200; 20 of 20 | `mixer-x4.md` 6.2, 6.3 |
-| Cross-vendor bit-exactness | seven final-class packs' 2^24 fingerprints equal on the RTX 5090 (CUDA), the RX 9070 XT (OpenCL) and the M5 Max (Metal) | GREEN | `counter-asic-2-rollout.md` G1 |
-| The acceptance census | 100,000 programs under the live generator on 4,096 nonces each with the 1 GiB dataset; 100,000 under the closed form; the 39 disagreements | 5.14 percent rejected | `weak-program-census-2026-10-03.md` sections 1 and 7 |
-| The shortcut ratio | the inline recompute kernel against the honest kernel on the M5 Max | 0.21 (0.10 against 256 MiB) | `proto-metal/MEMHARD.md` 2.2 |
-
-What the suite does not do, and the review must: nothing above bounds the cost of `M_r` from below, draws the partial-store curve, censuses the parameter draws, or looks across hashes for a hot set.
-
-### B5. Acceptance criteria for the engagement
-
-"No shortcut found" counts only with its effort bound, in the style of the RandomX reports (Trail of Bits: "two person-week engagement", 2 July 2019; X41: "30 days, 2019-06-10 to 2019-06-28", three testers; Quarkslab: "about three weeks for a total of 32 days with three engineers"; Kudelski: "6 person-days"; from the four reports in the RandomX `audits/` directory, read 6 October 2026).
-
-| Question | The engagement passes on it when the report states |
+| Piece | Value |
 |---|---|
-| Rank 1, `M_r` | No method found to evaluate 8 keyed applications in fewer than 8 x the single-application cost, after a stated search with named tools (differential and linear trails, rotational-XOR, SAT or MILP on reduced rounds); the round margin: the largest number of applications the best found distinguisher or shortcut reaches, against the 8 between reads and the 72 per item |
-| Rank 2, the chain | No method found to derive line `(s, j)` in fewer than `j + 1` block evaluations without an earlier line of segment `s`; the storage-against-recompute curve drawn from `f` = 1/64 to 1 with ops per item at each point, so the chip model gets the row MEMHARD.md item 2 never had |
-| Rank 3, the draws | A census of the draw space (the SplitMix64 seed is 64 bits; a sample of at least 2^24 day keys): the fraction of days whose `ROT`, `MUL` or `RC` fall in every class the reviewer names weak, each class with its measured per-day gain; a rejection rule proposed if the fraction with any gain above 1.1x exceeds 2^-20 per day (the threshold is proposed here, not decided) |
-| Rank 4, uniformity | The line-index distribution over 2^22 lines on at least 2^28 derivations with the largest bucket within 6 sigma of uniform; the distinct-lines census per hash and per warp on at least 10^6 nonces of three programs; the cross-hash item histogram of one epoch |
-| Rank 5, acceptance and grinding | The 39 edge disagreements reproduced and bounded; a search over at least 10^6 seeds for programs that pass (c) with a hot set under 1 percent of items fails; the header-grinding search cost against its DRAM-locality gain measured on one card or bounded analytically |
-| Rank 6, seed grinding | A written argument on the proposed day-key rule and the VDF, or a finding |
-| The whole | Every verdict carries person-days and tools; the report is publishable whole; the attack code, if any, runs on the pinned packs |
+| The frozen object | `igneum-pow` at `017e70376489251e18564c0abce7e466e606c8b3` on `ca3-v4-amend` (tag `audit-freeze-2026-10-07`), byte-identical on `master` since `cf7d6ccb`; class v4 sub-version 3, object byte 7 |
+| The rules in it | (a') dataflow freshness to a fixpoint; the shared-operand rule in the draw; (c'') the per-site distinct-index ratio at 0.98 over 2^20 evaluations; the 256-attempt cap; the deterministic last-resort draw |
+| The dataset | Spec 1.8: ChaCha12 cache fill in 2^16 segments of 64 chained lines (256 MiB at genesis); the ARX-multiply mixer with per-day `ROT`, `MUL`, `RC` drawn from a 64-bit SplitMix64 seed; `m = 8`, 72 applications per item, 8 dependent cache reads; 128 dataset loads per hash |
+| The kit | `packs-ca3-v4-sub3` zip sha256 `4f2445c50c58d76a5544023492d8b858d0b07c5e372d31f9c90c4ce51f829154`: the eight packs of `proto-cuda/packs-ca3-v4/` at the frozen commit; the shared devnet's epoch-0 id `a785001687d8688a`; Devnet 3's epoch-0 id `fce15bf61030be57` (no pack cut) |
+| What each lane gets | The crate, the spec, the chip model (`docs/analysis/chip-model-v3.md` 1, 2, 5, 6), the packs, the harnesses `tools/attack/f8-uniform` and the F4 census, the operating scripts; nothing of the defender's (in-house-pass.md 3.2) |
 
-### B6. Candidate reviewers
+### B2. The questions, ranked by what a break hands a chip
 
-| Reviewer | What they did | Citation | Why they fit |
+The chip is the on-die-cache recompute chip of `docs/analysis/chip-model-v3.md`. Each lane states a BREAK (a method with its measured or counted gain, reproducible from the command and the seed) or a BOUND (what was searched, with what tools, how far it reached, the margin left).
+
+| Rank | Lane | Break | The chip-model number it moves |
 |---|---|---|---|
-| Trail of Bits | RandomX 2019: two person-weeks, algorithm and code; two low and one informational finding; the single-AES-round diffusion concern that produced `AesGenerator4R`; the 47-parameter brittleness note | https://blog.trailofbits.com/2019/07/02/state/ (2 July 2019, read 6 October 2026); RandomX README "Audits": USD 28,000 | Fast, the algorithm-plus-code shape; the firm's own post says cryptographic validation "would require several person-weeks alone", so scope them for ranks 4 and 5 or buy the longer engagement |
-| Quarkslab | RandomX 2019: 32 person-days, three engineers, about three weeks; the fourth review, aimed at the areas the first three left | Report-Quarkslab.pdf, 30 July 2019 (RandomX `audits/`); USD 52,800 | The deepest of the four by person-days; the one to send rank 1 and rank 2 |
-| X41 D-Sec | RandomX 2019: 30 person-days, three testers, 3 to 28 June 2019; four medium findings (out-of-bounds accesses in non-standard configurations), eleven side findings | Report-X41.pdf, 10 July 2019; EUR 42,000 | Code-level depth; the right firm for the acceptance rule's implementation (rank 5) and the verifier, less for the cryptanalysis |
-| Kudelski Security | RandomX 2019: 6 person-days, final report 2 July 2019; the scope named identifying "weaker authorized parameters" as a goal | Report-Kudelski.pdf; CHF 18,250 | Short and design-level; rank 3 (the weak draws) is their stated kind of question |
-| Itai Dinur and Niv Nadler (Ben-Gurion University, approximate affiliation) | Broke MTP's 2 GB instance to under 1 MB at a 170x compute penalty before launch by steering Argon2d's addresses | "Time-memory tradeoff attacks on the MTP proof-of-work scheme", CRYPTO 2017, https://eprint.iacr.org/2017/497 (history [P18]) | Rank 2 and rank 5 are their attack, on a chained memory with data-dependent reads |
-| Joel Alwen, Jeremiah Blocki, Krzysztof Pietrzak (IST Austria and Purdue, approximate) | The parallel cumulative-memory model; the practical attacks on Argon2i, Catena and Balloon at real parameters; depth-robust graphs as the characterisation of memory-hardness | https://eprint.iacr.org/2016/115 [P5], https://eprint.iacr.org/2016/759 [P6], "Depth-robust graphs and their cumulative memory complexity", https://eprint.iacr.org/2016/875 (read 6 October 2026) | The model for rank 2: a chip is a parallel amortising adversary and the partial-store curve is a pebbling question |
-| Alex Biryukov, Daniel Dinu, Dmitry Khovratovich (University of Luxembourg; Khovratovich now elsewhere, approximate) | Argon2's authors; the ranking trade-off attack on Lyra2, yescrypt and Argon2; Equihash; MTP's design | Argon2, EuroS&P 2016 [P8]; https://eprint.iacr.org/2015/227 [P10]; https://eprint.iacr.org/2015/946 [P16]; https://arxiv.org/abs/1606.03588 [P17] | The designer's side of rank 2; they have been on both ends of a memory-hard break |
-| Jean-Philippe Aumasson | SipHash with Bernstein (an ARX PRF); BLAKE; the Kudelski Security crypto practice in 2019, approximate | "SipHash: a fast short-input PRF", https://eprint.iacr.org/2012/351 (2012, read 6 October 2026) | Rank 1 and rank 3: the mixer is an ARX round with drawn rotations and a multiply layer, the design space SipHash and BLAKE live in |
-| The ARX-ChaCha cryptanalysis groups (Leurent, Inria; the authors of the ChaCha linear-approximation line) | Tools for differential attacks in ARX constructions; improved linear approximations and attacks against reduced-round ChaCha | https://who.rocq.inria.fr/Gaetan.Leurent/files/ARX_AC12_full.pdf ; https://eprint.iacr.org/2021/224 (read 6 October 2026) | Rank 1's round margin: how many applications of a ChaCha-shaped double round with odd rotations a distinguisher reaches is their published question |
-| Least Authority | ProgPoW algorithm audit, 9 September 2019: no issues, five suggestions, the light-evaluation attack named as a future risk | https://leastauthority.com/static/publications/LeastAuthority-ProgPow-Algorithm-Final-Audit-Report.pdf (history [S69]) | A proof-of-work algorithm review that named Igneum's M16 chip before Igneum did; rank 2 and rank 4 |
+| 1 | adv-mixer | A structural shortcut in `M_r`: the 8 keyed applications between two cache reads evaluated in fewer than 8x the single-application cost (the multiply layer folding across applications, a differential, linear or rotational-XOR property surviving several applications, an algebraic form of the composition) | ops per item below 9,360; every gain column |
+| 2 | adv-cache | A time-memory trade-off below the honest arithmetic: a line `(s, j)` in fewer than `j + 1` block evaluations without an earlier line of the segment, or a relation through the XOR chaining and the feed-forward; the storage-against-recompute curve from `f = 1/64` to 1 | the SRAM column, equal silicon, the node class |
+| 3 | adv-mixer | Weak parameter draws: `ROT`, `MUL`, `RC + rk` classes that weaken a day, their fraction over at least 2^24 day keys and the per-day gain; the day key is a public calendar today | ops per hash on the weak days; the fraction |
+| 4 | adv-cache, adv-accept | Non-uniformity: the line index over 2^22 lines on at least 2^28 derivations; a hot subset of items across the hashes of an epoch | the SRAM column; items per hash |
+| 5 | adv-accept | An acceptance bypass that steers addresses: a program that passes every part of the rule and reads a hot set on the live dataset; the stand-in gap; attempt grinding under the 256-attempt cap and the last-resort draw; header grinding for DRAM locality | items per hash; the honest denominator |
+| 6 | adv-accept, adv-mixer | Seed and day-key grinding: influencing the epoch seed or the day key to select a program or a weak day | the probability in rank 3 |
 
-Recommended pairing: one firm with person-days (Quarkslab or X41 at 25 to 40 person-days) for ranks 1, 2 and 5, and one academic group (Dinur, or Alwen and Blocki) for rank 2's model and rank 3's census, in parallel; Aumasson or the ARX groups for a short rank 1 opinion if the firm's round margin comes back thin. Every name here is a candidate; nobody has been contacted.
+Known gaps, stated to the defender and not to the lanes (the lanes find them or they do not): the four-seed unattributed tail of the item read map (p10 1.50x, p8 1.38x, p34 1.25x, p4 1.22x of the window model); the 39 edge disagreements of 100,000 between the closed-form stand-in and the live dataset; the weak-day class on LUT adders routed to class v5.
 
-### B7. Risk: what finding something late moves, and what not finding it moves
+### B3. The gates (what a PASS row must state)
+
+| Rank | A lane's row passes when the report states |
+|---|---|
+| 1 | No method found to evaluate 8 keyed applications in fewer than 8x the single-application cost after a stated search with named tools (differential and linear trails, rotational-XOR, SAT or MILP on reduced rounds); the round margin: the largest number of applications the best distinguisher or shortcut reaches, against the 8 between reads and the 72 per item |
+| 2 | No derivation of line `(s, j)` in fewer than `j + 1` block evaluations without an earlier line; the curve from `f = 1/64` to 1 drawn with ops per item at each point |
+| 3 | A census of at least 2^24 day keys; the fraction in every class the lane names weak, each with its per-day gain; a redraw rule proposed if the fraction with any gain above 1.1x exceeds 2^-20 per day (the threshold is proposed, not decided) |
+| 4 | The line-index distribution on at least 2^28 derivations with the largest bucket within 6 sigma of uniform; the distinct-lines census per hash and per warp on at least 10^6 nonces of three programs; the cross-hash item histogram of one epoch |
+| 5 | A search over at least 10^6 seeds for passing programs with a hot set under 1 percent of items finds none; the stand-in gap reproduced and bounded; the header-grinding search cost against its locality gain bounded (a GPU measurement is BLOCKED tonight and says so) |
+| 6 | A written argument or a finding |
+| The whole | Every row carries box-hours and tools; every number its command, seed and log path; the report is publishable whole under the internal label |
+
+### B4. The soundness suite the lanes may re-run
+
+`cargo test --release` in `igneum-pow` on the box (103 of 103 at the frozen commit, CI green); `tests/packs.rs` against the eight packs; `tests/mixer.rs` fuzz, stats, edge and determinism; `tests/scratch.rs`; the acceptance's own vectors (`igneum-pow accept --seed ...`). What the suite does not do, and the lanes must: bound the cost of `M_r` from below, draw the partial-store curve, census the parameter draws, look across hashes for a hot set.
+
+### B5. What a finding moves
 
 | Case | What moves | Cost |
 |---|---|---|
-| A break found before the public testnet's vectors freeze | A parameter or a shape: `mixer_mult` 16, restricted rotation draws, a redraw rule, or a new mixer shape. The pinned packs and the 96-vector sets are re-cut through the seam, the verifier re-measured against the 10 ms gate, the soundness suite re-run, the cross-vendor fingerprints re-taken | Hours of Claude-side work (the x8 re-cut was one commit, `mixer-x4.md` section 9); one PC job per vendor; no chain event |
-| A break found after the testnet's first miner but before mainnet | A class v4 behind `program_class_v4_activation_daa` with the six gates G1 to G6 and the two-publish rollout of `docs/plans/counter-asic-2-rollout.md`: publish 1 flips the consensus digest with the field at never on every node (hand nodes and the seed first, then the apps machine by machine, a node without the field refused at its next handshake), publish 2 sets the height at least 10,800 DAA seconds ahead, rounded to an epoch; before the height a rollback is a restart, after it there is none except a further switch. The 5 October devnet run of that rollout cost an 11-minute block gap on step 1 (section 7d) | A chain event every miner must take within the lead: on the testnet a reset is announced seven days ahead, so the cost is one announced reset; on mainnet it is the ProgPoW-shaped governance event the plan exists to avoid |
-| A break found after mainnet | The same class v4 path, on a chain whose issuance is paying for the floor fleet (B8) | The chip is on the chain before the announcement (history lesson 10) |
-| Not found in time | Nothing moves: the vectors stand, the x8 row stands, and the report's absence is stated on the download page until it lands | The spend only |
-| The review finds nothing | The x8 row carries an effort bound in place of "no cryptanalysis"; the chip model's "ops per hash" input becomes a reviewed number | The spend only; the history says four such reports were worth about USD 145,000 to Monero in 2019 |
+| A BREAK confirmed by the defender before the public testnet's vectors freeze | A parameter or a shape on the v4 seam or a class v5 rule; the packs and the 96-vector sets re-cut through the seam, the verifier re-measured against the 10 ms gate, the suite re-run, the cross-vendor fingerprints re-taken | hours of agent work; one PC job per vendor; no chain event |
+| A BREAK confirmed after the testnet's first miner | A class change behind its activation height with the six gates and the two-publish rollout of `docs/plans/counter-asic-2-rollout.md` | an announced reset on the testnet; on mainnet the governance event the plan exists to avoid |
+| Only BOUNDS | The chip model's "ops per hash" input carries an internal effort bound in place of "no cryptanalysis", labelled internal, never "reviewed" | the box-hours only |
 
-### B8. Timing, and the consequences per user tier
+### B6. Timing and the consequences per user tier
 
-Timing. Before the public testnet genesis is the plan's placement (item 3 of `docs/plans/counter-asic-3.md`, "commission before genesis"). The go checklist `docs/plans/testnet-go.md` has the seeds at height 0 and the genesis hash final; this engagement becomes a new row of its go table between step 9 (the announcement) and step 10 (the first miner): "9a. The mixer cryptanalysis commissioned, scope = funding plan section B, contract signed; the reports in hand before the last announced reset of testnet-1, so the vectors the testnet freezes are the reviewed ones; mainnet never opens without the published reports." If step 10 is pressed first, the announcement text states that the review is in progress and that a reset may follow it.
+Timing: the pass runs now, before the public testnet genesis (item 3 of `docs/plans/counter-asic-3.md`). The go checklist's row 9a reads: "9a. The in-house adversarial pass's three reports in hand and published whole, labelled internal, before the last announced reset of testnet-1; the disclosure prize staged until escrow and the word; mainnet never opens without the published reports." The internal reports are not a review and the download page never calls them one.
 
-What a found shortcut means per tier. A found shortcut does not change any card's hash rate. It changes the card's share of the issuance and the chain's safety margin. The case shown is rank 1 at the class v2 cost (the worst row: a chip at 7.4x with the factor), landing after mainnet, with the Monero precedent that chips held 85 percent of the hashrate within four months of a fork (history row 16, approximate).
+What a found shortcut would mean per tier is unchanged from the 6 October analysis: no card's hash rate changes; its share of the issuance and the chain's safety margin do. The worst case priced there (a chip at 7.4x with the fixed-function factor, chips at 85 percent of the hashrate within four months as in the Monero precedent, history row 16, approximate) gives every home card, rig and pool user about 0.15x of today's reward per card; the verifier is unchanged; the security budget is unchanged in dollars and paid to chips. What is being done: this pass before the vectors freeze, the class v5 path, the staged disclosure prize, and the share-pattern detector of Counter ASIC 3.0 item 4.
 
-| Tier | Measured rate today | Share of issuance if chips take 85 percent | What is being done |
-|---|---|---|---|
-| Home miner, RTX 5090 (32 GB), Windows or Linux | 135.9 to 137.7 MH/s at about 326 W (bench-log "Counter ASIC 2.0, the numbers") | about 0.15x of today's reward per card, approximate | This review before the vectors freeze; x16 or a shape change costs this card nothing per hash (the daily build is latency-bound: 23 to 25 ms at x1, x4 and x8) |
-| Home miner, RX 9070 XT (16 GB), AMD | 18.59 to 19.18 MH/s (bench-log; the AMD rows against the 5090 are owed, PC 1 not released) | the same 0.15x, on a card already 7.1x behind the 5090 | the same; the daily build 72 to 77 ms at every `m` |
-| Home miner, 8 or 12 GB card | about a tenth of the 5090's rate, approximate (not owned) | the same 0.15x | the same; at x16 the 8 GB-class daily build is about 2 s, approximate, above the 1 s rule of `mixer-x4.md` 6.5, which is why the recommendation on `mixer_mult` is a deliverable and not a default |
-| Mac, M5 Max, Metal | 27.85 to 27.98 MH/s (bench-log) | the same 0.15x | the same; the Mac's build is latency-bound (21 ms at every `m`) |
-| A rig or a pool user | the sum of its cards | the same share per card; a pool's fee base shrinks with it | the same |
-| A verifier (any node, any pool core) | 2.08 ms per unit at x8 on one M5 Max core, worst cold 2.15 | unchanged | at x16 about 3.7 ms per unit on this core and about 9 ms on a 2.5x slower laptop core, approximate: the 2019-class core measurement (O-1.14) decides x16, not this review |
-| The chain's security budget | USD 3.85M, 15.4M and 77.0M to miners in year 1 at the low, base and high price inputs (`docs/analysis/security-budget.md` section 3) | unchanged in dollars; paid to chips. The floor of USD 1M a year buys about 3,000 cards' electricity, sized so that one 1,000-card operator stays under one third of the vote weight (section 6); at 7.4x per board, one third of that fleet's hashrate is about 135 chip boards, approximate, so one chip maker holds the partition threshold of spec 3.7 | the review, the class v4 path, the chip bounty (USD 50,000 standing, unfunded) and the share-pattern detector of Counter ASIC 3.0 item 4 |
-
-What the spend means against this file's totals. USD 80,000 to 160,000 added to the review-and-audit bucket (USD 210,000 to 410,000) takes it to USD 290,000 to 570,000, and the plan's total (USD 440,000 to 740,000 through the first mainnet quarter) to USD 520,000 to 900,000. If it is founder-funded, the funded share rises from USD 220,000 to 430,000 to about USD 300,000 to 590,000. All approximate; section 3 is not re-totalled here, the coordinator re-totals when the row is confirmed. Against the issuance: year-1 emission to miners is USD 3.85M, 15.4M and 77.0M at the low, base and high price inputs, so USD 10,500, 42,000 and 211,000 a day; the history's clock for a chip is about USD 50,000 of daily issuance (section 2.5), so the base input sits just under that clock and the high input is past it from day one. The whole engagement is one to two weeks of year-1 miner emission at the low input.
+What the spend means against this file's totals: nothing. No dollar row is added to section 3; the former USD 80,000 to 160,000 estimate is withdrawn. The box-hours ride the box's existing rent.
diff --git a/tools/ci/export-exclude.txt b/tools/ci/export-exclude.txt
index 24ef752e7..76af5a1a3 100644
--- a/tools/ci/export-exclude.txt
+++ b/tools/ci/export-exclude.txt
@@ -15,3 +15,7 @@ docs/analysis/ci-failures-2026-10-06.md
 # 7 October 2026: the last research round (the mission lanes and the closed list): internal research written for the
 # owner, quoting his words and the operations record; the public spec mirror carries none of it
 docs/analysis/mission
+# 7 October 2026: the in-house adversarial cryptanalysis pass (crypto-engage and the adv-* lanes): rule set, plans, reports and
+# copied logs are research and operations documents, not public export; the public text is the served sentence main landed.
+docs/analysis/cryptanalysis
+docs/plans/cryptanalysis