attack-pass F8/F9: re-gate interim (nine of thirty seeds over 1.2x on the amended stream, load-after-load chain); F9's box 2 run withdrawn as a re-gate (candidate_class path)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/analysis/attack-pass-2026-10.md

@@ -29,7 +29,7 @@ against the log before quoting it to the project lead.
 | F6 | Verifier worst case over 10^5 programs + O-1.14 laptop run | worst program under 10 ms cold on the half-core proxy and the laptop | O-1.14 CLOSED on an i7-9700K (v4 6.006 ms avg, 6.334 cold max; dr736 10.04 fails as it must). Box search: 100,000 programs drawn and ranked, 50,000 timed cold on the one-core proxy (min / median / p99 / max 4.610 / 4.948 / 5.606 / 6.194 ms, `attack-f6/48484`); half-core re-times of the worst (batches B and C) queued, starved of the exclusive hold by back-to-back shared holders (F2's runner now stopped to free it); carried at the genesis ratio the worst would read 10.3 ms, at the additive cost 9.66 ms, so batch C decides | INCOMPLETE (batch C decides; re-armed) |
 | F7 | Era-draw bias harness + 2^20 era-seed census | no re-roll inside the publish window; no era class with gain over 1.1x over 2^-20 | (b) census PASS at 2^24 seeds: no class over 1.1x, stride bijective on all draws, R, pos and M uniform (chi-square 38.5 on 30 dof), op-weight corners 1.0x, planted cases fire; (c) 64-bit day-key seeding PASS as the spec intends, 0 collisions in 2^17; (a) re-roll harness INCOMPLETE by the plan's allowance: the node's era seed is a plain chain block hash (`seed_below`), the cut is grindable with one block of hash at no delay (1 of 6 epochs) and immune past one block interval (0 of 6), and the 1-hour VDF of spec 4.4 is not in the node; the era-VDF lane builds it with `reroll.mjs` as its gate. Record `docs/analysis/attack-pass/f7-era.md`; the harness's three devnet-980 nodes stopped by pid at 12:1x UK | PASS (b, c); INCOMPLETE (a) pending the era VDF, a freeze precondition |
 | F8 | Uniformity censuses (line-index 2^28, distinct lines, cross-hash histogram) | uniform within the window model of spec 1.13.1, layer 8; the excess beyond it within 6 sigma over 64 seeds; no hot set under 1% of items beyond the model | line index PASS at 2^28 (max +5.61 sigma, control +5.61). Phase E, 64 seeds at 2^18 nonces: 31 of 64 over 1.2x of the window model (median 1.17x, p90 2.70x, max 13.09x), 23 with a hot item, the lossy-source class across the stream. AP-F8-1 resolved to a mechanism: the window null gives 1.39x at the top 0.1% (not 4.05x); the rest is a lossy LOAD SOURCE (an `or` writer feeding site 15's load; the all-ones source is item 0xca5b92, 7 of 7 next-hottest predicted), a fault class in the acceptance rule's blind spot carried by 96.6% of v4 programs; hot-set bound at most 1.067x under rule (c); no v4 change, v5 generator item with phase E as its gate; phase E (64 seeds) pending | FINDING (mechanism ours; fix ships in 0.3.20 (the feature node) on `ca3-v4-amend`, re-gate by this lane's 64-seed census) |
-| F9 | Acceptance edges (39) + header grinding on an RTX 5090 | zero passing programs with a hot set under 1%; grinding gain under 1% of rate | (a) edges on generator 4 over 10^5 seeds: 34 disagreements in 105,064 candidates (29 const_bit, 4 bias, 1 lane_const), every one a one-bit or sampling-noise property moving the choice to an attempt both stand-ins accept, nothing in the attacker's favour: PASS; (b) hot-set search over 10^6 seeds: 11,696 passing programs (1.17%) concentrate 1% or more of reads on a hot set, worst 17.3%: FINDING, the same or-saturation load-source class as AP-F8-1 found by a second harness (F9-1 merged into AP-F8-1), re-gated on the amended stream; (c) grinding on the 5090: +0.004% at K = 2^14, ceiling +43%: PASS. Record `docs/analysis/attack-pass/f9-grind.md` | (a) PASS; (b) FINDING = AP-F8-1 class, re-gate running; (c) PASS |
+| F9 | Acceptance edges (39) + header grinding on an RTX 5090 | zero passing programs with a hot set under 1%; grinding gain under 1% of rate | (a) edges on generator 4 over 10^5 seeds: 34 disagreements in 105,064 candidates (29 const_bit, 4 bias, 1 lane_const), every one a one-bit or sampling-noise property moving the choice to an attempt both stand-ins accept, nothing in the attacker's favour: PASS; (b) hot-set search over 10^6 seeds: 11,696 passing programs (1.17%) concentrate 1% or more of reads on a hot set, worst 17.3%: FINDING, the same or-saturation load-source class as AP-F8-1 found by a second harness (F9-1 merged into AP-F8-1), re-gated on the amended stream; (c) grinding on the 5090: +0.004% at K = 2^14, ceiling +43%: PASS. Record `docs/analysis/attack-pass/f9-grind.md` | (a) PASS; (b) FINDING = AP-F8-1 class, its box 2 run withdrawn as a re-gate (wrong draw path), harness being fixed; (c) PASS |
 | F10 | Ladder signal monotonicity harness | no step without 90% over 7 windows in either direction | known-fail fails, known pass passes; new cases on the exact-share driver: 89% up holds (no step), 89 then 90% down with restarts steps only at 90% after the 7-window cool-down, the floor holds under 100% down (never below rung 0); decision per seed block memoised, identical after a restart, never differs between nodes; 19 of 19 checks per case. Two items to main, not findings: a stale commit string in the ladder lane's igneumd, and proof-synced nodes deciding rung 0 until the witness lands (a precondition line for spec 01). Record `docs/analysis/attack-pass/f10-ladder.md` | PASS |
 
 ## The rows
@@ -357,6 +357,19 @@ Second harness (F9 sub-row b, 10^6 seeds, 12:5x UK): the same class from the oth
 11,696 of 1,000,000 passing programs concentrate 1 percent or more of their reads on a hot set (worst 17.3 percent,
 seed 842871, an `or`-written load source all-ones in 36 percent of evaluations), so F9-1 merges into AP-F8-1 and
 F9's harness is the second re-gate of the amendment, run on the amended stream beside F8's 64-seed census.
+Re-gate interim (7 October 2026, 13:2x to 13:5x UK, box 2): F8's 64-seed census at 2^24 nonces against the amended
+stream (igneum-pow 8c728ca3, sub-version 1; pairing verified, the harness draws the devnet epoch-0 program as
+1a4230699a6b9c60) at 30 of 64 seeds shows nine over 1.2x of the window model (p31 29.27x, p11 5.45x, p19 3.32x, p6
+3.11x, p23 2.04x, p4 1.57x, p10 1.50x, p26 1.30x, p25 1.28x), p6's hottest item predicted from "site 13, r0,
+all-ones, last writer a load at 12": a load-after-load chain (a hot address yields a fixed dataset word, which is the
+next load's address), which the source rule admits because a load injects. Rule-level reading, checkable in code:
+generator.rs line 1326 sets `entropy_kept[dst]` true for a rotate whatever it rotated, so an or-saturated register
+rotated once is an admitted source and the rotate preserves the saturation. RETRACTION: F9's hot-set census run on
+box 2 against the 8c728ca3 build (10^6 seeds, 1,871 flagged, worst 9.66 percent) was not a re-gate: the F9 harness
+draws through `candidate_class` with its own era class, not through `chain_program` where the rule lives, and the
+amended and the old binary print the identical program for seed igneum-f9/518927; those numbers describe the old
+stream under a changed evaluation and are withdrawn; the harness is being given a `chain_program` draw mode so it can
+serve as the second re-gate.
 Status: FINDING-OPEN: mechanism found and ours; FIXED-AND-PASSED on the 64-seed verdict against the amended stream
 (igneum-pow 8c728ca3, sub-version 1, paired with release-0.3.20-node 8097d600) with F9's hot-set census agreeing.