adv-mixer-2: Q8 row (lead time under the interim day rule against O-1.10, seeding, round keys)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/analysis/cryptanalysis/report-mixer-2.md

@@ -57,6 +57,7 @@ take even if it buys no hash rate against the chip model's attacker. The worst r
 | Q2 model B | `scm-refine` on the calendar (36,525 days), on the lowest 2^14 days of the 2^24 census, on a 2^16-day random sample | the self-test constants (3, 5, 7, 9, 2^32 - 1, 2^31 + 1 at 1 adder; 45 at 2): all as expected | the certified-cost distribution | exact sets: 90 constants at 1 adder, 4,101 at 2, 185,223 at 3, 7,983,205 at 4 (0.38 percent of odd constants at 4 or fewer under the restricted form); random words certified at 5 or fewer: 12.3 percent; the rest uncertified. Cost B is a PARTIAL metric (a certified word costs 5, an uncertified one w32 - 1), so its between-day spread (sample: mean 219, min 176; calendar worst day 43959 = 2090-05-10 at B 181) is the certificate's selectivity, not a measured gain, and is not read as one | PARTIAL (bound on the per-word chain length only) |
 | Q6 ROT diffusion | `avalanche` (1, 2, 3, 4, 8 applications; the 22 address bits; 1,024 states x 512 input bits) on the genesis day, the plants, the 7 worst ROT days of the census | plant rot1 and weakday must read weaker than the genesis day at 1 application: they do (mean flip 0.345 and 0.324 against 0.461; 16,197 and 11,454 input-output pairs never flipped against 5,534) | a per-day gain only if a bit-exact shortcut follows | at 2 applications every day, planted days included, reads mean 0.500, every output bit between 0.42 and 0.58 (sampling spread of 1,024 states), address bits 0.500, no pair unflipped; 8 applications sit between reads. No day gives a shortcut; gain 0 | PASS (BOUND) |
 | Q7 redraw rule | `redraw-census` 2^24 and 2^28 days with the rule below | `--max-cost 0` must reproduce the real draw on 1,000 days (asserted in the binary) | fraction redrawn; residual over 1.1x must be 0 | queue 07 | RUNNING |
+| Q8 anything else | watched while the rows ran; three observations, no box time | n/a | stated or measured | (1) Lead time: the only per-day attacker is an FPGA bitstream synthesised for the day, and synthesis of a full-device design takes hours (approximate, from memory; no figure measured here). Under the interim day rule (`bind::day_bytes`, a pure function of the calendar) the attacker has unlimited lead; under the spec's own proposal O-1.10 (day bytes carry the first epoch seed of the day, known about 20 minutes ahead, section 1.12) a per-day bitstream cannot be ready in time, which removes the whole class without a redraw. (2) The mixer stream is seeded by 64 bits of the day key (K[0], K[1]); K[2..7] enter only the item init; no collision or shift was found in 100 years or 2^24 days, and the planted shift was. (3) The 72 round keys are fixed multiples of 0x9E3779B9; RC + rk = 0 happened on 10 of 2^24 days (expected 4.5, within Poisson) and costs a datapath nothing on either side | PASS (stated) |
 | GPU rows | none needed | | | no row of this class depends on a GPU | BLOCKED (not applicable) |
 
 ## Q7: the proposed redraw rule
@@ -74,6 +75,7 @@ once a day; nothing else changes; every accepted day is a day the current rule c
 | Fraction over 1.1x under model C after the rule | 0 (k = 0 on every accepted day) |
 | Chip-model reading after the rule | unchanged: 1.0 on every day before and after |
 | What the rule does not fix | the seed is 64 bits of the day key (K[0], K[1]); the day is a pure function of the calendar; both stand; neither is a weakness of this class on the numbers above |
+| The alternative that removes the class | the spec's O-1.10 day derivation (section 1.12): a day key known 20 minutes ahead leaves no time to synthesise a bitstream for it (hours, approximate); the redraw rule is then unnecessary for this class and harmless to keep |
 
 ## Sections per row