Merge crypto-engage f1c86098 into master (gate: green on f1c86098, recorded by tools/ci/pre-push.sh; landed on the build mirror)

docs/plans/cryptanalysis/in-house-pass.md

@@ -229,12 +229,12 @@ Internal adversarial pass, not an independent review. Target `igneum-pow` 017e70
 | adv-mixer-2 | 2a632579 | 0.31 | 0 | the day-key weakness class BOUND for every chip, GPU and the verifier; FINDING on FPGA LUT area only (2^-10.8 of days over 1.1x, 15 days a century, worst 2050-04-28 at 1.113x, reconciled with F4), closed by the measured redraw rule (0 days over 1.1x after it) or the O-1.10 day derivation | none |
 | adv-mixer-3 | 981bfff2 | about 5.0 wall-hours plus 8 single-core SAT hours | 0 | Q1 BOUND (2^32 t uniform k = 1 to 8, both days, 8 random days); Q2 and Q2b FINDING at k = 1 only (the single-application diffusion), BOUND from k = 2 to 8 at 2^24, 2^27, 2^28; Q3 FINDING at k = 1, BOUND k = 2 to 7; Q4 and Q5 BOUND from k = 1; Q6 SAT BOUND (k = 1 in 137 s, five orders slower than brute force; k = 2 to 4 timeout at one hour on both days). The round margin: no statistic survives 2 of 8 applications between reads, 70 of 72 per item | Q3 k = 8 not run; multi-bit masks and a MILP trail bound not attempted; GPU BLOCKED |
 | adv-cache | 555c3e42 | 0.55 | 0 | the recompute shortcut BOUND on every row, every plant fired (defender: no dispute) | none |
-| adv-cache-2 | 91ca5ce1 | about 2.25 of run | 0 | Q1 line census PASS at 2^35 + 3 x 2^33 reads; Q2 real programs PASS with the Devnet 3 site-0 FINDING; Q2b 64 programs, the diffuse era-stride class (16 of 32 base programs biased under drawn eras against 2 of 32 under the devnet's R = 29, 8 over 1.2x, worst 1.75x; under 0.1 percent of a hash's reads per site; the class v5 floor refuses 0 of 61; ledger AP-F8-6); Q3 steering and the 16,384-day weak-day scan PASS; Q3(3) the window layer exact to four digits and the chip model's partial-store rows overstated up to 2.3x, verdict unchanged | line shard s2c (64 fresh days) waiting on build-1 since 23:09 BST |
+| adv-cache-2 | bfc3746c (closed 04:59 BST) | 2.35 of run (0.08 a duplicate windows run by its build-1 drain, recorded) | 0 | Q1 line census PASS at 2^35 + 3 x 2^33 reads; Q2 real programs PASS with the Devnet 3 site-0 FINDING; Q2b 64 programs, the diffuse era-stride class (16 of 32 base programs biased under drawn eras against 2 of 32 under the devnet's R = 29, 8 over 1.2x, worst 1.75x; under 0.1 percent of a hash's reads per site; the class v5 floor refuses 0 of 61; ledger AP-F8-6); Q3 steering and the 16,384-day weak-day scan PASS; Q3(3) the window layer exact to four digits and the chip model's partial-store rows overstated up to 2.3x, verdict unchanged | none: s2c ran 04:56 to 04:59 BST, PASS at 2^33 reads; the line census total 2^36 reads over 464 chain days at the control's values |
 | adv-cache-3 | 9452c0bf | 0.23 | 0 | the chain-break or skip BOUND on every row, every plant fired; the pebbling optimum under the hold-every-k curve (bookkeeping) | none |
-| adv-accept | c8a98e46 | about 9.2 at 03:25 BST, running to its 16-hour line | 0 | Q1 the bypass FINDING, confirmed and bounded: 9 few-item hot sets in the tail of 408,067 accepted programs, 0 in 20 random, 1.002x at the largest; all 9 refused by the class v5 floor, 7 clean programs falsely refused among the 12 deepest (the 2.4 percent), 3 mild residuals missed (the era-stride class, about 1.0004x); Q2 the stand-in gap BOUND; Q5 distinguishers BOUND; row 90 the attempts census complete (0.681 per candidate, (a') 83.5 percent, 0 exhaustions, P 2e-43) | the sweep at 408,067 of 10^6 seeds, shards running on in the pool's gaps; ends at 16 box-hours with the count |
+| adv-accept | 8f188e5a (closed 09:47 BST) | 15.1 | 0 | Q1 the bypass FINDING, confirmed and bounded: 9 few-item hot sets in the tail of 796,042 accepted programs (37 measured live from the stand-in tail, 22 beyond the 1.2x gate), 0 in 20 random, 1.002x at the largest; all 9 refused by the class v5 floor, 7 clean programs falsely refused among the 12 deepest (the 2.4 percent), 3 mild residuals missed (the era-stride class, about 1.0004x); Q2 the stand-in gap BOUND; Q5 distinguishers BOUND; row 90 the attempts census complete (0.681 per candidate, (a') 83.5 percent, 0 exhaustions, P 2e-43) | the sweep at 796,042 of 10^6 (79.6 percent): three ranges unswept (40886 to 100001, 706081 to 800001, 849304 to 900001) after their waiters gave up at the pool's 2-hour limit; the last shard ended 09:37 BST with nothing left running; BOUND, no BREAK |
 | adv-accept-2 | 92168536 | about 9.0 core-hours | 0.3 (the one pod) | header grinding BOUND by measurement (+0.09 percent on an RTX A6000) and by tail (3e-7); one 0.1 percent repeat class for the rule's owners | none |
 | adv-accept-3 | 7826d2b2 | 3.3 | 0 | exhaustion BOUND (P 1.0e-43); the last-resort path FINDING (correctness, unreachable); steering BOUND (no property over 1.03x at 1 in 1e6 tries); the program id BOUND with the derivation-string FINDING (fixed on master and in the packs); determinism BOUND, the spec text proven sufficient by two read-backs (0 of 400 at 8b834634 with one named function, 0 of 400 at 56eebc0d with nothing from the crate); the era lever BOUND | the steering sweep at 975 of 10^5 full-rule seeds (1e6 static) |
 
-Totals: box-hours about 30.4 of run across the nine lanes (0.6 + 0.31 + 5.0 + 0.55 + 2.25 + 0.23 + 9.2 + 9.0 + 3.3, the lanes' own figures, wall times threads over 96 or slot-hours as each states, lease waits excluded) plus about 9.8 single-core SAT hours; pod-hours 0.3 (one RunPod A6000, USD 0.33 in all, rented and destroyed by the fleet lane, none originated by this lane). The 24 box-hour line of section 4 was read and crossed by one lane (adv-accept at about 02:15 BST, reported); no lane reached the 16-hour ask line.
+Totals: box-hours about 36.4 of run across the nine lanes (0.6 + 0.31 + 5.0 + 0.55 + 2.35 + 0.23 + 15.1 + 9.0 + 3.3, the lanes' own figures, wall times threads over 96 or slot-hours as each states, lease waits excluded) plus about 9.8 single-core SAT hours; pod-hours 0.3 (one RunPod A6000, USD 0.33 in all, rented and destroyed by the fleet lane, none originated by this lane). The 24 box-hour line of section 4 was read and crossed by one lane (adv-accept at about 02:15 BST, reported); no lane reached the 16-hour ask line (adv-accept closed at 15.1 when its last shard ended).
 
 The verdict. No lane broke the frozen object. The mixer's 72 keyed applications cost what the chip model prices (no fold, no low-degree form, no statistic past 2 of 8 applications, no SAT preimage past 1); the chained cache yields no line under j + 1 blocks and no curve under the full store; the line and item distributions are uniform at 2^35 reads; header grinding gains nothing a card can measure; the draw cannot be exhausted or steered by its attempt index. The acceptance rule admits two residual classes of address concentration, both priced under 1.002x to a chip: few-item hot sets, which the class v5 floor at 0.995 closes entire (9 of 9) at a 2.4 percent clean-rejection cost; and a diffuse era-stride excess (a product's biased low bits placed in the item index by the era rotation unless R is 29 or 30) the floor does not reach, routed with its lever (a value-level source test and the era draw's R range) to the next class. The weak-day FPGA tail is reconciled at 15 days a century on LUT area only (no chip, GPU or verifier gain) and closed by a measured redraw rule. Already changed by the pass: the program-id derivation string in shipped packs; spec 1.4.3 to 1.4.6 rewritten to the shipped rule with its measured rates and proven text-sufficient; the chip model's partial-store and pebbling baselines flagged for correction; the last-resort path flagged for its owner.