adv-mixer-2: Q8 row (lead time under the interim day rule against O-1.10, seeding, round keys)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/analysis/cryptanalysis/logs/adv-mixer-2/avalanche-day-11582441.log

@@ -0,0 +1,17 @@
+2026-10-07T20:42:07Z start avalanche-day-11582441 (lease pool 1 min 1): /srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 avalanche --index 11582441 --states 1024
+lease: holding 1 pool cores (42, waited 0 s, class adv): adv-mixer-2 avalanche-day-11582441
+adv-mixer-2 avalanche --index 11582441 --states 1024 | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item | median cost A for gains 226
+
+### Avalanche: day 11582441 (33681-08-24), ROT [24, 7, 12, 15, 12, 7, 24, 15], 1024 states, flips of each of 512 input bits
+
+| Applications k | Mean output flip fraction | Min per output bit | Max per output bit | Address bits (22 of s[0]) mean flip | Address min per bit | Output bits never flipped by some input bit |
+|---|---|---|---|---|---|---|
+| 1 | 0.4665 | 0.0000 | 1.0000 | 0.4309 | 0.0000 | 2040 |
+| 2 | 0.5000 | 0.4297 | 0.5674 | 0.4998 | 0.4385 | 0 |
+| 3 | 0.5000 | 0.4238 | 0.5693 | 0.4999 | 0.4395 | 0 |
+| 4 | 0.5001 | 0.4307 | 0.5645 | 0.5001 | 0.4443 | 0 |
+| 8 | 0.5000 | 0.4326 | 0.5742 | 0.5001 | 0.4414 | 0 |
+
+Terminated
+lease: released 1 pool cores after 4 s, exit 0
+2026-10-07T20:42:11Z end avalanche-day-11582441 rc=0

docs/analysis/cryptanalysis/logs/adv-mixer-2/avalanche-day-14330190.log

@@ -0,0 +1,17 @@
+2026-10-07T20:41:56Z start avalanche-day-14330190 (lease pool 1 min 1): /srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 avalanche --index 14330190 --states 1024
+lease: holding 1 pool cores (42, waited 0 s, class adv): adv-mixer-2 avalanche-day-14330190
+adv-mixer-2 avalanche --index 14330190 --states 1024 | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item | median cost A for gains 226
+
+### Avalanche: day 14330190 (41204-09-23), ROT [1, 1, 2, 31, 1, 31, 1, 31], 1024 states, flips of each of 512 input bits
+
+| Applications k | Mean output flip fraction | Min per output bit | Max per output bit | Address bits (22 of s[0]) mean flip | Address min per bit | Output bits never flipped by some input bit |
+|---|---|---|---|---|---|---|
+| 1 | 0.3313 | 0.0000 | 1.0000 | 0.2818 | 0.0000 | 19948 |
+| 2 | 0.4995 | 0.3359 | 0.6660 | 0.4992 | 0.3564 | 0 |
+| 3 | 0.5000 | 0.4297 | 0.5703 | 0.4999 | 0.4443 | 0 |
+| 4 | 0.5000 | 0.4287 | 0.5713 | 0.5001 | 0.4355 | 0 |
+| 8 | 0.5000 | 0.4326 | 0.5693 | 0.5001 | 0.4414 | 0 |
+
+Terminated
+lease: released 1 pool cores after 5 s, exit 0
+2026-10-07T20:42:01Z end avalanche-day-14330190 rc=0

docs/analysis/cryptanalysis/logs/adv-mixer-2/avalanche-day-2230620.log

@@ -0,0 +1,16 @@
+2026-10-07T20:41:41Z start avalanche-day-2230620 (lease pool 1 min 1): /srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 avalanche --index 2230620 --states 1024
+lease: holding 1 pool cores (42, waited 0 s, class adv): adv-mixer-2 avalanche-day-2230620
+adv-mixer-2 avalanche --index 2230620 --states 1024 | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item | median cost A for gains 226
+
+### Avalanche: day 2230620 (8077-03-25), ROT [23, 1, 1, 27, 23, 23, 23, 1], 1024 states, flips of each of 512 input bits
+
+| Applications k | Mean output flip fraction | Min per output bit | Max per output bit | Address bits (22 of s[0]) mean flip | Address min per bit | Output bits never flipped by some input bit |
+|---|---|---|---|---|---|---|
+| 1 | 0.4513 | 0.0000 | 1.0000 | 0.4300 | 0.0000 | 5857 |
+| 2 | 0.5000 | 0.4258 | 0.5703 | 0.4999 | 0.4365 | 0 |
+| 3 | 0.5000 | 0.4307 | 0.5742 | 0.4998 | 0.4404 | 0 |
+| 4 | 0.5000 | 0.4326 | 0.5723 | 0.5002 | 0.4434 | 0 |
+| 8 | 0.5000 | 0.4297 | 0.5684 | 0.4999 | 0.4336 | 0 |
+
+lease: released 1 pool cores after 4 s, exit 0
+2026-10-07T20:41:45Z end avalanche-day-2230620 rc=0

docs/analysis/cryptanalysis/logs/adv-mixer-2/avalanche-day-3921743.log

@@ -0,0 +1,16 @@
+2026-10-07T20:41:45Z start avalanche-day-3921743 (lease pool 1 min 1): /srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 avalanche --index 3921743 --states 1024
+lease: holding 1 pool cores (42, waited 0 s, class adv): adv-mixer-2 avalanche-day-3921743
+adv-mixer-2 avalanche --index 3921743 --states 1024 | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item | median cost A for gains 226
+
+### Avalanche: day 3921743 (12707-05-16), ROT [7, 30, 25, 2, 30, 10, 26, 30], 1024 states, flips of each of 512 input bits
+
+| Applications k | Mean output flip fraction | Min per output bit | Max per output bit | Address bits (22 of s[0]) mean flip | Address min per bit | Output bits never flipped by some input bit |
+|---|---|---|---|---|---|---|
+| 1 | 0.4545 | 0.0000 | 1.0000 | 0.4190 | 0.0000 | 4729 |
+| 2 | 0.5000 | 0.4209 | 0.5762 | 0.4999 | 0.4355 | 0 |
+| 3 | 0.5000 | 0.4346 | 0.5801 | 0.4998 | 0.4375 | 0 |
+| 4 | 0.5000 | 0.4258 | 0.5703 | 0.5001 | 0.4375 | 0 |
+| 8 | 0.5000 | 0.4336 | 0.5693 | 0.4999 | 0.4414 | 0 |
+
+lease: released 1 pool cores after 6 s, exit 0
+2026-10-07T20:41:51Z end avalanche-day-3921743 rc=0

docs/analysis/cryptanalysis/logs/adv-mixer-2/avalanche-day-5517722.log

@@ -0,0 +1,17 @@
+2026-10-07T20:42:01Z start avalanche-day-5517722 (lease pool 1 min 1): /srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 avalanche --index 5517722 --states 1024
+lease: holding 1 pool cores (42, waited 0 s, class adv): adv-mixer-2 avalanche-day-5517722
+adv-mixer-2 avalanche --index 5517722 --states 1024 | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item | median cost A for gains 226
+
+### Avalanche: day 5517722 (17077-01-04), ROT [19, 8, 24, 20, 19, 8, 2, 8], 1024 states, flips of each of 512 input bits
+
+| Applications k | Mean output flip fraction | Min per output bit | Max per output bit | Address bits (22 of s[0]) mean flip | Address min per bit | Output bits never flipped by some input bit |
+|---|---|---|---|---|---|---|
+| 1 | 0.4484 | 0.0000 | 1.0000 | 0.4096 | 0.0000 | 5562 |
+| 2 | 0.5000 | 0.4316 | 0.5703 | 0.4998 | 0.4355 | 0 |
+| 3 | 0.5000 | 0.4277 | 0.5762 | 0.5000 | 0.4434 | 0 |
+| 4 | 0.5000 | 0.4316 | 0.5693 | 0.5001 | 0.4375 | 0 |
+| 8 | 0.5000 | 0.4219 | 0.5742 | 0.5002 | 0.4473 | 0 |
+
+Terminated
+lease: released 1 pool cores after 6 s, exit 0
+2026-10-07T20:42:07Z end avalanche-day-5517722 rc=0

docs/analysis/cryptanalysis/logs/adv-mixer-2/avalanche-day-57146.log

@@ -0,0 +1,17 @@
+2026-10-07T20:41:36Z start avalanche-day-57146 (lease pool 1 min 1): /srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 avalanche --index 57146 --states 1024
+lease: holding 1 pool cores (42, waited 0 s, class adv): adv-mixer-2 avalanche-day-57146
+adv-mixer-2 avalanche --index 57146 --states 1024 | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item | median cost A for gains 226
+
+### Avalanche: day 57146 (2126-06-18), ROT [8, 27, 27, 27, 27, 8, 8, 8], 1024 states, flips of each of 512 input bits
+
+| Applications k | Mean output flip fraction | Min per output bit | Max per output bit | Address bits (22 of s[0]) mean flip | Address min per bit | Output bits never flipped by some input bit |
+|---|---|---|---|---|---|---|
+| 1 | 0.4595 | 0.0000 | 1.0000 | 0.4013 | 0.0000 | 4151 |
+| 2 | 0.5000 | 0.4297 | 0.5723 | 0.5000 | 0.4395 | 0 |
+| 3 | 0.5000 | 0.4268 | 0.5732 | 0.5001 | 0.4443 | 0 |
+| 4 | 0.5000 | 0.4238 | 0.5674 | 0.5000 | 0.4238 | 0 |
+| 8 | 0.5000 | 0.4199 | 0.5684 | 0.4999 | 0.4443 | 0 |
+
+Terminated
+lease: released 1 pool cores after 5 s, exit 0
+2026-10-07T20:41:41Z end avalanche-day-57146 rc=0

docs/analysis/cryptanalysis/logs/adv-mixer-2/avalanche-day-9911374.log

@@ -0,0 +1,17 @@
+2026-10-07T20:41:51Z start avalanche-day-9911374 (lease pool 1 min 1): /srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 avalanche --index 9911374 --states 1024
+lease: holding 1 pool cores (42, waited 0 s, class adv): adv-mixer-2 avalanche-day-9911374
+adv-mixer-2 avalanche --index 9911374 --states 1024 | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item | median cost A for gains 226
+
+### Avalanche: day 9911374 (29106-06-04), ROT [23, 13, 1, 1, 31, 5, 31, 10], 1024 states, flips of each of 512 input bits
+
+| Applications k | Mean output flip fraction | Min per output bit | Max per output bit | Address bits (22 of s[0]) mean flip | Address min per bit | Output bits never flipped by some input bit |
+|---|---|---|---|---|---|---|
+| 1 | 0.4531 | 0.0000 | 1.0000 | 0.4410 | 0.0000 | 4274 |
+| 2 | 0.4999 | 0.4287 | 0.5732 | 0.5002 | 0.4443 | 0 |
+| 3 | 0.5000 | 0.4307 | 0.5674 | 0.4999 | 0.4307 | 0 |
+| 4 | 0.5000 | 0.4287 | 0.5732 | 0.5001 | 0.4316 | 0 |
+| 8 | 0.5000 | 0.4277 | 0.5654 | 0.4999 | 0.4385 | 0 |
+
+Terminated
+lease: released 1 pool cores after 5 s, exit 0
+2026-10-07T20:41:56Z end avalanche-day-9911374 rc=0

docs/analysis/cryptanalysis/logs/adv-mixer-2/avalanche-genesis.log

@@ -0,0 +1,17 @@
+2026-10-07T20:41:16Z start avalanche-genesis (lease pool 1 min 1): /srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 avalanche --index 20729 --states 1024
+lease: holding 1 pool cores (42, waited 0 s, class adv): adv-mixer-2 avalanche-genesis
+adv-mixer-2 avalanche --index 20729 --states 1024 | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item | median cost A for gains 226
+
+### Avalanche: day 20729 (2026-10-03), ROT [6, 25, 5, 25, 29, 11, 9, 21], 1024 states, flips of each of 512 input bits
+
+| Applications k | Mean output flip fraction | Min per output bit | Max per output bit | Address bits (22 of s[0]) mean flip | Address min per bit | Output bits never flipped by some input bit |
+|---|---|---|---|---|---|---|
+| 1 | 0.4611 | 0.0000 | 1.0000 | 0.4271 | 0.0000 | 5534 |
+| 2 | 0.5000 | 0.4238 | 0.5742 | 0.5001 | 0.4238 | 0 |
+| 3 | 0.5000 | 0.4316 | 0.5684 | 0.5001 | 0.4326 | 0 |
+| 4 | 0.5000 | 0.4229 | 0.5693 | 0.4999 | 0.4336 | 0 |
+| 8 | 0.5000 | 0.4297 | 0.5703 | 0.5002 | 0.4365 | 0 |
+
+Terminated
+lease: released 1 pool cores after 5 s, exit 0
+2026-10-07T20:41:21Z end avalanche-genesis rc=0

docs/analysis/cryptanalysis/logs/adv-mixer-2/avalanche-plant-alleq.log

@@ -0,0 +1,16 @@
+2026-10-07T20:41:21Z start avalanche-plant-alleq (lease pool 1 min 1): /srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 avalanche --plant alleq --states 1024
+lease: holding 1 pool cores (42, waited 0 s, class adv): adv-mixer-2 avalanche-plant-alleq
+adv-mixer-2 avalanche --plant alleq --states 1024 | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item | median cost A for gains 226
+
+### Avalanche: plant alleq on day 20729, ROT [6, 6, 6, 6, 6, 6, 6, 6], 1024 states, flips of each of 512 input bits
+
+| Applications k | Mean output flip fraction | Min per output bit | Max per output bit | Address bits (22 of s[0]) mean flip | Address min per bit | Output bits never flipped by some input bit |
+|---|---|---|---|---|---|---|
+| 1 | 0.4611 | 0.0000 | 1.0000 | 0.4401 | 0.0000 | 2192 |
+| 2 | 0.5000 | 0.4238 | 0.5703 | 0.5001 | 0.4355 | 0 |
+| 3 | 0.5000 | 0.4248 | 0.5674 | 0.5001 | 0.4355 | 0 |
+| 4 | 0.5000 | 0.4307 | 0.5742 | 0.5000 | 0.4453 | 0 |
+| 8 | 0.4999 | 0.4189 | 0.5732 | 0.4999 | 0.4414 | 0 |
+
+lease: released 1 pool cores after 5 s, exit 0
+2026-10-07T20:41:26Z end avalanche-plant-alleq rc=0

docs/analysis/cryptanalysis/logs/adv-mixer-2/avalanche-plant-rot1.log

@@ -0,0 +1,16 @@
+2026-10-07T20:41:26Z start avalanche-plant-rot1 (lease pool 1 min 1): /srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 avalanche --plant rot1 --states 1024
+lease: holding 1 pool cores (42, waited 0 s, class adv): adv-mixer-2 avalanche-plant-rot1
+adv-mixer-2 avalanche --plant rot1 --states 1024 | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item | median cost A for gains 226
+
+### Avalanche: plant rot1 on day 20729, ROT [1, 1, 1, 1, 1, 1, 1, 1], 1024 states, flips of each of 512 input bits
+
+| Applications k | Mean output flip fraction | Min per output bit | Max per output bit | Address bits (22 of s[0]) mean flip | Address min per bit | Output bits never flipped by some input bit |
+|---|---|---|---|---|---|---|
+| 1 | 0.3449 | 0.0000 | 1.0000 | 0.3125 | 0.0000 | 16197 |
+| 2 | 0.5000 | 0.4277 | 0.5654 | 0.5000 | 0.4395 | 0 |
+| 3 | 0.5000 | 0.4326 | 0.5713 | 0.4999 | 0.4434 | 0 |
+| 4 | 0.5000 | 0.4287 | 0.5684 | 0.4998 | 0.4414 | 0 |
+| 8 | 0.5000 | 0.4316 | 0.5693 | 0.4999 | 0.4424 | 0 |
+
+lease: released 1 pool cores after 5 s, exit 0
+2026-10-07T20:41:31Z end avalanche-plant-rot1 rc=0

docs/analysis/cryptanalysis/logs/adv-mixer-2/avalanche-plant-weakday.log

@@ -0,0 +1,17 @@
+2026-10-07T20:41:31Z start avalanche-plant-weakday (lease pool 1 min 1): /srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 avalanche --plant weakday --states 1024
+lease: holding 1 pool cores (42, waited 0 s, class adv): adv-mixer-2 avalanche-plant-weakday
+adv-mixer-2 avalanche --plant weakday --states 1024 | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item | median cost A for gains 226
+
+### Avalanche: plant weakday on day 20729, ROT [6, 6, 6, 6, 6, 6, 6, 6], 1024 states, flips of each of 512 input bits
+
+| Applications k | Mean output flip fraction | Min per output bit | Max per output bit | Address bits (22 of s[0]) mean flip | Address min per bit | Output bits never flipped by some input bit |
+|---|---|---|---|---|---|---|
+| 1 | 0.3242 | 0.0000 | 1.0000 | 0.2675 | 0.0000 | 11454 |
+| 2 | 0.5000 | 0.4307 | 0.5674 | 0.5002 | 0.4424 | 0 |
+| 3 | 0.5000 | 0.4307 | 0.5713 | 0.5001 | 0.4443 | 0 |
+| 4 | 0.4999 | 0.4277 | 0.5703 | 0.4998 | 0.4326 | 0 |
+| 8 | 0.5000 | 0.4307 | 0.5684 | 0.5001 | 0.4404 | 0 |
+
+Terminated
+lease: released 1 pool cores after 5 s, exit 0
+2026-10-07T20:41:36Z end avalanche-plant-weakday rc=0

docs/analysis/cryptanalysis/logs/adv-mixer-2/calendar-100y.log

@@ -0,0 +1,200 @@
+2026-10-07T20:31:52Z start calendar-100y (lease pool 32 min 16): /srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 calendar --from 20729 --years 100 --threads {cores}
+lease: holding 24 pool cores (50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73, waited 0 s, class adv): adv-mixer-2 calendar-100y
+adv-mixer-2 calendar --from 20729 --years 100 --threads 24 | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item | median cost A for gains 226
+
+calendar: 36525 days (100 years) from 20729 (2026-10-03), 0.3 s
+## Calendar 2026-10-03 to 2126-10-03: 36525 days from 20729
+
+| Class | Count | Fraction | log2 | Worst day: cost A, gain A, date |
+|---|---|---|---|---|
+| ROT all equal | 0 | 0.000e0 | -inf | none |
+| ROT distinct <= 2 | 1 | 2.738e-5 | -15.2 | day 57146: 220, 1.0273x, 2126-06-18 |
+| ROT distinct <= 3 | 1 | 2.738e-5 | -15.2 | day 57146: 220, 1.0273x, 2126-06-18 |
+| ROT distinct <= 4 | 47 | 1.287e-3 | -9.6 | day 28343: 211, 1.0711x, 2047-08-08 |
+| ROT max multiplicity >= 4 | 80 | 2.190e-3 | -8.8 | day 36389: 208, 1.0865x, 2069-08-18 |
+| ROT same-word pair sums to 32 | 4469 | 1.224e-1 | -3.0 | day 36268: 204, 1.1078x, 2069-04-19 |
+| ROT two same-word pairs sum to 32 | 223 | 6.105e-3 | -7.4 | day 37145: 207, 1.0918x, 2071-09-13 |
+| ROT any pair sums to 32 | 21683 | 5.936e-1 | -0.8 | day 29337: 203, 1.1133x, 2050-04-28 |
+| ROT >= 4 in {1,31} | 37 | 1.013e-3 | -9.9 | day 28343: 211, 1.0711x, 2047-08-08 |
+| ROT all 8 in {1,2,30,31} | 0 | 0.000e0 | -inf | none |
+| ROT >= 4 in {8,16,24} | 149 | 4.079e-3 | -7.9 | day 32331: 204, 1.1078x, 2058-07-09 |
+| ROT column set == diagonal set | 0 | 0.000e0 | -inf | none |
+| MUL any = 1 | 0 | 0.000e0 | -inf | none |
+| MUL any = 2^32-1 | 0 | 0.000e0 | -inf | none |
+| MUL any involution (x^2 = 1) | 0 | 0.000e0 | -inf | none |
+| MUL any w32 <= 2 | 0 | 0.000e0 | -inf | none |
+| MUL any w32 <= 3 | 0 | 0.000e0 | -inf | none |
+| MUL any w32 <= 4 | 8 | 2.190e-4 | -12.2 | day 32331: 204, 1.1078x, 2058-07-09 |
+| MUL >= 2 with w32 <= 4 | 0 | 0.000e0 | -inf | none |
+| MUL any popcount <= 4 or >= 28 | 4 | 1.095e-4 | -13.2 | day 46028: 221, 1.0226x, 2096-01-08 |
+| MUL two equal | 0 | 0.000e0 | -inf | none |
+| MUL two inverse (a*b = 1) | 0 | 0.000e0 | -inf | none |
+| MUL any in exact 2-adder set (model C k >= 1) | 0 | 0.000e0 | -inf | none |
+| MUL model C k >= 2 | 0 | 0.000e0 | -inf | none |
+| RC any = 0 | 0 | 0.000e0 | -inf | none |
+| RC any popcount <= 4 or >= 28 | 11 | 3.012e-4 | -11.7 | day 39234: 216, 1.0463x, 2077-06-02 |
+| RC + rk = 0 for any of the 72 keys | 0 | 0.000e0 | -inf | none |
+| RC two equal | 0 | 0.000e0 | -inf | none |
+| RC[i] + rk = RC[j] + rk' for some i != j, two of the 72 keys | 0 | 0.000e0 | -inf | none |
+| cost A gain >= 1.1x | 15 | 4.107e-4 | -11.2 | day 29337: 203, 1.1133x, 2050-04-28 |
+| cost A gain >= 1.2x | 0 | 0.000e0 | -inf | none |
+| cost A gain >= 1.5x | 0 | 0.000e0 | -inf | none |
+
+| Cost A statistic | Value |
+|---|---|
+| mean | 225.812 |
+| median (this census) | 226 |
+| median used for gains | 226 |
+| min | 203 (gain 1.1133x) |
+| max | 250 |
+| days with gain A >= 1.05x (cost <= 215) | 1682 (4.605e-2, log2 -4.4) |
+| days with gain A >= 1.1x (cost <= 205) | 15 (4.107e-4, log2 -11.2) |
+| days with gain A >= 1.2x (cost <= 188) | 0 (0.000e0, log2 -inf) |
+| days with gain A >= 1.5x (cost <= 150) | 0 (0.000e0, log2 -inf) |
+| days with gain A >= 2x (cost <= 113) | 0 (0.000e0, log2 -inf) |
+
+| Model C k | Days |
+|---|---|
+| 0 (gain 1.0000x) | 36525 |
+
+| w32 per word | Count | Fraction |
+|---|---|---|
+| 4 | 8 | 1.369e-5 |
+| 5 | 145 | 2.481e-4 |
+| 6 | 1001 | 1.713e-3 |
+| 7 | 5471 | 9.362e-3 |
+| 8 | 20353 | 3.483e-2 |
+| 9 | 56389 | 9.649e-2 |
+| 10 | 110403 | 1.889e-1 |
+| 11 | 149548 | 2.559e-1 |
+| 12 | 135979 | 2.327e-1 |
+| 13 | 76874 | 1.315e-1 |
+| 14 | 24530 | 4.197e-2 |
+| 15 | 3563 | 6.097e-3 |
+| 16 | 136 | 2.327e-4 |
+
+| Cost A | Days |
+|---|---|
+| 203 | 1 |
+| 204 | 7 |
+| 205 | 7 |
+| 206 | 4 |
+| 207 | 36 |
+| 208 | 32 |
+| 209 | 59 |
+| 210 | 70 |
+| 211 | 139 |
+| 212 | 181 |
+| 213 | 273 |
+| 214 | 355 |
+| 215 | 518 |
+| 216 | 652 |
+| 217 | 836 |
+| 218 | 1052 |
+| 219 | 1250 |
+| 220 | 1487 |
+| 221 | 1707 |
+| 222 | 2003 |
+| 223 | 2117 |
+| 224 | 2266 |
+| 225 | 2287 |
+| 226 | 2377 |
+| 227 | 2417 |
+| 228 | 2258 |
+| 229 | 2148 |
+| 230 | 1909 |
+| 231 | 1740 |
+| 232 | 1428 |
+| 233 | 1231 |
+| 234 | 934 |
+| 235 | 803 |
+| 236 | 563 |
+| 237 | 429 |
+| 238 | 320 |
+| 239 | 233 |
+| 240 | 160 |
+| 241 | 97 |
+| 242 | 53 |
+| 243 | 41 |
+| 244 | 25 |
+| 245 | 10 |
+| 246 | 5 |
+| 247 | 2 |
+| 248 | 1 |
+| 249 | 1 |
+| 250 | 1 |
+
+Lowest-cost days (cost A, day, date, gain A):
+  203 29337 2050-04-28 1.1133x
+  204 27945 2046-07-06 1.1078x
+  204 31573 2056-06-11 1.1078x
+  204 32331 2058-07-09 1.1078x
+  204 33997 2063-01-30 1.1078x
+  204 36268 2069-04-19 1.1078x
+  204 38621 2075-09-28 1.1078x
+  204 43959 2090-05-10 1.1078x
+  205 22109 2030-07-14 1.1024x
+  205 22633 2031-12-20 1.1024x
+  205 25617 2040-02-20 1.1024x
+  205 37526 2072-09-28 1.1024x
+  205 42573 2086-07-24 1.1024x
+  205 54469 2119-02-18 1.1024x
+  205 54669 2119-09-06 1.1024x
+  206 27016 2043-12-20 1.0971x
+  206 43428 2088-11-25 1.0971x
+  206 51241 2110-04-18 1.0971x
+  206 53114 2115-06-04 1.0971x
+  207 21620 2029-03-12 1.0918x
+  207 22322 2031-02-12 1.0918x
+  207 24505 2037-02-03 1.0918x
+  207 25605 2040-02-08 1.0918x
+  207 26262 2041-11-26 1.0918x
+  207 26331 2042-02-03 1.0918x
+  207 27362 2044-11-30 1.0918x
+  207 28102 2046-12-10 1.0918x
+  207 28839 2048-12-16 1.0918x
+  207 29075 2049-08-09 1.0918x
+  207 29110 2049-09-13 1.0918x
+  207 31021 2054-12-07 1.0918x
+  207 31548 2056-05-17 1.0918x
+
+## Cross-day structure over the calendar
+
+| Quantity | Count | Expected |
+|---|---|---|
+| 64-bit seed collisions (identical parameters on two days) | 0 | 3.616e-11 |
+| stream shifts by k in 1..=72 (one day's draws overlap another's) | 0 | 5.207e-9 |
+| MUL value shared by two days (one multiplier block reusable, 0 gain) | 77 | 79.5 |
+| RC value shared by two days | 39 | 39.8 |
+|   shared MUL 15f6219f | day 21331 word 0 and day 23336 word 15 | |
+|   shared MUL b137cdd3 | day 21022 word 11 and day 23744 word 2 | |
+|   shared MUL 974d17c3 | day 20830 word 3 and day 25754 word 15 | |
+|   shared MUL c90f788b | day 27185 word 11 and day 29614 word 8 | |
+|   shared MUL c1ff73cf | day 23973 word 5 and day 30055 word 14 | |
+|   shared MUL 33399aaf | day 28288 word 15 and day 30612 word 9 | |
+|   shared MUL d5539933 | day 23057 word 15 and day 31231 word 6 | |
+|   shared MUL c55fe51f | day 28311 word 7 and day 32877 word 3 | |
+
+| Rank | Day | Date | Cost A | Gain A |
+|---|---|---|---|---|
+| 1 | 29337 | 2050-04-28 | 203 | 1.1133x |
+| 2 | 27945 | 2046-07-06 | 204 | 1.1078x |
+| 3 | 31573 | 2056-06-11 | 204 | 1.1078x |
+| 4 | 32331 | 2058-07-09 | 204 | 1.1078x |
+| 5 | 33997 | 2063-01-30 | 204 | 1.1078x |
+| 6 | 36268 | 2069-04-19 | 204 | 1.1078x |
+| 7 | 38621 | 2075-09-28 | 204 | 1.1078x |
+| 8 | 43959 | 2090-05-10 | 204 | 1.1078x |
+| 9 | 22109 | 2030-07-14 | 205 | 1.1024x |
+| 10 | 22633 | 2031-12-20 | 205 | 1.1024x |
+
+| Model C days (k >= 1) | Day | Date | k | Gain C |
+|---|---|---|---|---|
+| none | | | | |
+
+Planted shift check: two synthetic seeds s and s + GAMMA share draws 1..39 of the first with 0..38 of the second:
+  draw 1 of s = ad760cafa1697b60, draw 0 of s + GAMMA = ad760cafa1697b60, equal = true
+
+Terminated
+lease: released 24 pool cores after 1 s, exit 0
+2026-10-07T20:31:53Z end calendar-100y rc=0

docs/analysis/cryptanalysis/logs/adv-mixer-2/exact-w32.log

@@ -0,0 +1,185 @@
+adv-mixer-2 exact --threads 40 | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item
+
+exact: w32 over 2^31 odd constants, 10.3 s
+
+| w32 | Constants | Fraction | log2 |
+|---|---|---|---|
+| 1 | 2 | 9.3132e-10 | -30.00 |
+| 2 | 118 | 5.4948e-8 | -24.12 |
+| 3 | 3136 | 1.4603e-6 | -19.39 |
+| 4 | 49608 | 2.3101e-5 | -15.40 |
+| 5 | 520000 | 2.4214e-4 | -12.01 |
+| 6 | 3805120 | 1.7719e-3 | -9.14 |
+| 7 | 19948544 | 9.2893e-3 | -6.75 |
+| 8 | 75681408 | 3.5242e-2 | -4.83 |
+| 9 | 207381504 | 9.6570e-2 | -3.37 |
+| 10 | 405171200 | 1.8867e-1 | -2.41 |
+| 11 | 550371328 | 2.5629e-1 | -1.96 |
+| 12 | 498774016 | 2.3226e-1 | -2.11 |
+| 13 | 282427392 | 1.3152e-1 | -2.93 |
+| 14 | 89686016 | 4.1763e-2 | -4.58 |
+| 15 | 13107200 | 6.1035e-3 | -7.36 |
+| 16 | 557056 | 2.5940e-4 | -11.91 |
+
+mean w32 per word 11.1111; expected cost A mean 225.7778
+exact cost A median 226 (the census uses 231)
+
+| Gain A threshold | Cost A <= | P(day) exact | log2 | Days per 100 years (36,525) | Expected in 2^24 | Expected in 2^32 |
+|---|---|---|---|---|---|---|
+| 1.05x | 220 | 1.9247e-1 | -2.4 | 7029.9697 | 3229112.12 | 826652702.6 |
+| 1.1x | 209 | 4.3257e-3 | -7.9 | 157.9956 | 72572.93 | 18578670.2 |
+| 1.15x | 200 | 2.7628e-5 | -15.1 | 1.0091 | 463.52 | 118662.3 |
+| 1.2x | 192 | 7.0629e-8 | -23.8 | 0.0026 | 1.18 | 303.3 |
+| 1.3x | 177 | 2.4424e-14 | -45.2 | 0.0000 | 0.00 | 0.0 |
+| 1.5x | 154 | 3.0484e-28 | -91.4 | 0.0000 | 0.00 | 0.0 |
+| 2x | 115 | 2.1503e-63 | -208.2 | 0.0000 | 0.00 | 0.0 |
+| 3x | 77 | 1.5073e-116 | -384.8 | 0.0000 | 0.00 | 0.0 |
+
+| Cost A | P exact | log2 |
+|---|---|---|
+| 151 | 1.6805e-30 | -98.9 |
+| 152 | 9.0505e-30 | -96.5 |
+| 153 | 4.7699e-29 | -94.1 |
+| 154 | 2.4603e-28 | -91.7 |
+| 155 | 1.2421e-27 | -89.4 |
+| 156 | 6.1373e-27 | -87.1 |
+| 157 | 2.9683e-26 | -84.8 |
+| 158 | 1.4053e-25 | -82.6 |
+| 159 | 6.5125e-25 | -80.3 |
+| 160 | 2.9545e-24 | -78.2 |
+| 161 | 1.3121e-23 | -76.0 |
+| 162 | 5.7045e-23 | -73.9 |
+| 163 | 2.4280e-22 | -71.8 |
+| 164 | 1.0117e-21 | -69.7 |
+| 165 | 4.1272e-21 | -67.7 |
+| 166 | 1.6483e-20 | -65.7 |
+| 167 | 6.4452e-20 | -63.8 |
+| 168 | 2.4673e-19 | -61.8 |
+| 169 | 9.2471e-19 | -59.9 |
+| 170 | 3.3930e-18 | -58.0 |
+| 171 | 1.2189e-17 | -56.2 |
+| 172 | 4.2868e-17 | -54.4 |
+| 173 | 1.4760e-16 | -52.6 |
+| 174 | 4.9753e-16 | -50.8 |
+| 175 | 1.6418e-15 | -49.1 |
+| 176 | 5.3040e-15 | -47.4 |
+| 177 | 1.6774e-14 | -45.8 |
+| 178 | 5.1927e-14 | -44.1 |
+| 179 | 1.5736e-13 | -42.5 |
+| 180 | 4.6677e-13 | -41.0 |
+| 181 | 1.3552e-12 | -39.4 |
+| 182 | 3.8513e-12 | -37.9 |
+| 183 | 1.0712e-11 | -36.4 |
+| 184 | 2.9159e-11 | -35.0 |
+| 185 | 7.7680e-11 | -33.6 |
+| 186 | 2.0251e-10 | -32.2 |
+| 187 | 5.1661e-10 | -30.9 |
+| 188 | 1.2895e-9 | -29.5 |
+| 189 | 3.1495e-9 | -28.2 |
+| 190 | 7.5256e-9 | -27.0 |
+| 191 | 1.7592e-8 | -25.8 |
+| 192 | 4.0230e-8 | -24.6 |
+| 193 | 8.9987e-8 | -23.4 |
+| 194 | 1.9688e-7 | -22.3 |
+| 195 | 4.2127e-7 | -21.2 |
+| 196 | 8.8151e-7 | -20.1 |
+| 197 | 1.8037e-6 | -19.1 |
+| 198 | 3.6087e-6 | -18.1 |
+| 199 | 7.0586e-6 | -17.1 |
+| 200 | 1.3497e-5 | -16.2 |
+| 201 | 2.5227e-5 | -15.3 |
+| 202 | 4.6085e-5 | -14.4 |
+| 203 | 8.2276e-5 | -13.6 |
+| 204 | 1.4353e-4 | -12.8 |
+| 205 | 2.4465e-4 | -12.0 |
+| 206 | 4.0740e-4 | -11.3 |
+| 207 | 6.6268e-4 | -10.6 |
+| 208 | 1.0528e-3 | -9.9 |
+| 209 | 1.6334e-3 | -9.3 |
+| 210 | 2.4745e-3 | -8.7 |
+| 211 | 3.6598e-3 | -8.1 |
+| 212 | 5.2839e-3 | -7.6 |
+| 213 | 7.4457e-3 | -7.1 |
+| 214 | 1.0239e-2 | -6.6 |
+| 215 | 1.3738e-2 | -6.2 |
+| 216 | 1.7982e-2 | -5.8 |
+| 217 | 2.2958e-2 | -5.4 |
+| 218 | 2.8586e-2 | -5.1 |
+| 219 | 3.4704e-2 | -4.8 |
+| 220 | 4.1074e-2 | -4.6 |
+| 221 | 4.7382e-2 | -4.4 |
+| 222 | 5.3265e-2 | -4.2 |
+| 223 | 5.8341e-2 | -4.1 |
+| 224 | 6.2245e-2 | -4.0 |
+| 225 | 6.4677e-2 | -4.0 |
+| 226 | 6.5437e-2 | -3.9 |
+| 227 | 6.4448e-2 | -4.0 |
+| 228 | 6.1776e-2 | -4.0 |
+| 229 | 5.7617e-2 | -4.1 |
+| 230 | 5.2275e-2 | -4.3 |
+| 231 | 4.6124e-2 | -4.4 |
+| 232 | 3.9569e-2 | -4.7 |
+| 233 | 3.2996e-2 | -4.9 |
+| 234 | 2.6737e-2 | -5.2 |
+| 235 | 2.1047e-2 | -5.6 |
+| 236 | 1.6090e-2 | -6.0 |
+| 237 | 1.1943e-2 | -6.4 |
+| 238 | 8.6036e-3 | -6.9 |
+| 239 | 6.0137e-3 | -7.4 |
+| 240 | 4.0771e-3 | -7.9 |
+| 241 | 2.6802e-3 | -8.5 |
+| 242 | 1.7077e-3 | -9.2 |
+| 243 | 1.0543e-3 | -9.9 |
+| 244 | 6.3038e-4 | -10.6 |
+| 245 | 3.6493e-4 | -11.4 |
+| 246 | 2.0445e-4 | -12.3 |
+| 247 | 1.1080e-4 | -13.1 |
+| 248 | 5.8068e-5 | -14.1 |
+| 249 | 2.9412e-5 | -15.1 |
+| 250 | 1.4392e-5 | -16.1 |
+| 251 | 6.8003e-6 | -17.2 |
+| 252 | 3.1012e-6 | -18.3 |
+| 253 | 1.3642e-6 | -19.5 |
+| 254 | 5.7860e-7 | -20.7 |
+| 255 | 2.3647e-7 | -22.0 |
+| 256 | 9.3070e-8 | -23.4 |
+| 257 | 3.5256e-8 | -24.8 |
+| 258 | 1.2846e-8 | -26.2 |
+| 259 | 4.4996e-9 | -27.7 |
+| 260 | 1.5140e-9 | -29.3 |
+| 261 | 4.8901e-10 | -30.9 |
+| 262 | 1.5152e-10 | -32.6 |
+| 263 | 4.5000e-11 | -34.4 |
+| 264 | 1.2801e-11 | -36.2 |
+| 265 | 3.4848e-12 | -38.1 |
+| 266 | 9.0711e-13 | -40.0 |
+| 267 | 2.2558e-13 | -42.0 |
+| 268 | 5.3543e-14 | -44.1 |
+| 269 | 1.2118e-14 | -46.2 |
+| 270 | 2.6123e-15 | -48.4 |
+| 271 | 5.3586e-16 | -50.7 |
+| 272 | 1.0447e-16 | -53.1 |
+| 273 | 1.9335e-17 | -55.5 |
+| 274 | 3.3928e-18 | -58.0 |
+| 275 | 5.6372e-19 | -60.6 |
+| 276 | 8.8563e-20 | -63.3 |
+| 277 | 1.3137e-20 | -66.0 |
+| 278 | 1.8368e-21 | -68.9 |
+| 279 | 2.4171e-22 | -71.8 |
+| 280 | 2.9881e-23 | -74.8 |
+| 281 | 3.4636e-24 | -77.9 |
+| 282 | 3.7569e-25 | -81.1 |
+| 283 | 3.8049e-26 | -84.4 |
+| 284 | 3.5896e-27 | -87.8 |
+| 285 | 3.1466e-28 | -91.4 |
+| 286 | 2.5557e-29 | -95.0 |
+| 287 | 1.9175e-30 | -98.7 |
+
+| Model C | Value |
+|---|---|
+| exact 2-adder set size (cost 0..=2) | 4192 |
+| P(word) | 1.9521e-6 (log2 -19.0) |
+| P(k >= 1, gain 1.067x) | 3.1232e-5 (log2 -15.0) |
+| P(k >= 2, gain 1.143x) | 4.5725e-10 (log2 -31.0) |
+| P(MUL any = 1) | 7.4506e-9 (log2 -27.0) |
+| P(ROT all equal) | 3.6347e-11 (log2 -34.7) |

docs/analysis/cryptanalysis/logs/adv-mixer-2/scm-calendar.log

@@ -0,0 +1,165 @@
+2026-10-07T20:31:53Z start scm-calendar (lease pool 32 min 16): /srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 scm-refine --from 20729 --count 36525 --threads {cores}
+lease: holding 24 pool cores (50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73, waited 0 s, class adv): adv-mixer-2 scm-calendar
+adv-mixer-2 scm-refine --from 20729 --count 36525 --threads 24 | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item | median cost A for gains 226
+
+scm: level 1: 90 values (0.0 s)
+scm: level 2: 4101 values (0.0 s)
+scm: level 3: 185223 values (0.0 s)
+scm: level 4: 7983205 values; cost <= 4: 8172620 of 2^31 odd (0.0038) (0.5 s)
+scm-refine: 36525 days, 24 threads, sets built in 0.5 s
+
+| SCM level (restricted form) | Odd constants | Fraction of 2^31 | log2 |
+|---|---|---|---|
+| 0 | 1 | 4.6566e-10 | -31.0 |
+| 1 | 90 | 4.1910e-8 | -24.5 |
+| 2 | 4101 | 1.9097e-6 | -19.0 |
+| 3 | 185223 | 8.6251e-5 | -13.5 |
+| 4 | 7983205 | 3.7175e-3 | -8.1 |
+
+Terminated
+lease: released 24 pool cores after 272 s, exit 143
+2026-10-07T20:36:25Z end scm-calendar rc=143
+2026-10-07T20:36:28Z killed by lane adv-mixer-2: certificate too slow, restructured and re-queued
+2026-10-07T20:39:47Z start scm-calendar (lease pool 32 min 16): /srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 scm-refine --from 20729 --count 36525 --threads {cores}
+lease: 0 of 16 pool cores free (88 leased); waiting
+lease: holding 30 pool cores (42,43,44,45,46,47,48,49,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95, waited 81 s, class adv): adv-mixer-2 scm-calendar
+adv-mixer-2 scm-refine --from 20729 --count 36525 --threads 30 | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item | median cost A for gains 226
+
+scm: level 1: 90 values (0.0 s)
+scm: level 2: 4101 values (0.0 s)
+scm: level 3: 185223 values (0.0 s)
+scm: level 4: 7983205 values; cost <= 4: 8172620 of 2^31 odd (0.0038) (0.4 s)
+scm: shifted sets and inverses ready (0.7 s)
+scm-refine: 36525 days, 30 threads, sets built in 0.7 s
+
+| SCM level (restricted form) | Odd constants | Fraction of 2^31 | log2 |
+|---|---|---|---|
+| 0 | 1 | 4.6566e-10 | -31.0 |
+| 1 | 90 | 4.1910e-8 | -24.5 |
+| 2 | 4101 | 1.9097e-6 | -19.0 |
+| 3 | 185223 | 8.6251e-5 | -13.5 |
+| 4 | 7983205 | 3.7175e-3 | -8.1 |
+
+## Model B (36525 days from 20729 (2026-10-03)): 36525 days, 584400 words, 2.1 s
+
+| Certified adders per word | Words | Fraction |
+|---|---|---|
+| 3 | 50 | 8.5558e-5 |
+| 4 | 2180 | 3.7303e-3 |
+| 5 | 69987 | 1.1976e-1 |
+| none | 512183 | 8.7643e-1 |
+
+| Cost B statistic | Value |
+|---|---|
+| mean | 219.000 |
+| median | 219 |
+| min | 181 |
+
+| Cost B | Days |
+|---|---|
+| 181 | 1 |
+| 182 | 2 |
+| 184 | 1 |
+| 185 | 1 |
+| 186 | 4 |
+| 187 | 9 |
+| 188 | 5 |
+| 189 | 11 |
+| 190 | 12 |
+| 191 | 12 |
+| 192 | 26 |
+| 193 | 20 |
+| 194 | 32 |
+| 195 | 48 |
+| 196 | 83 |
+| 197 | 99 |
+| 198 | 110 |
+| 199 | 131 |
+| 200 | 171 |
+| 201 | 214 |
+| 202 | 288 |
+| 203 | 320 |
+| 204 | 397 |
+| 205 | 458 |
+| 206 | 548 |
+| 207 | 607 |
+| 208 | 705 |
+| 209 | 840 |
+| 210 | 890 |
+| 211 | 1020 |
+| 212 | 1121 |
+| 213 | 1284 |
+| 214 | 1291 |
+| 215 | 1444 |
+| 216 | 1506 |
+| 217 | 1589 |
+| 218 | 1537 |
+| 219 | 1658 |
+| 220 | 1745 |
+| 221 | 1584 |
+| 222 | 1656 |
+| 223 | 1532 |
+| 224 | 1453 |
+| 225 | 1460 |
+| 226 | 1341 |
+| 227 | 1192 |
+| 228 | 1027 |
+| 229 | 995 |
+| 230 | 830 |
+| 231 | 709 |
+| 232 | 584 |
+| 233 | 465 |
+| 234 | 356 |
+| 235 | 336 |
+| 236 | 219 |
+| 237 | 165 |
+| 238 | 116 |
+| 239 | 103 |
+| 240 | 51 |
+| 241 | 52 |
+| 242 | 23 |
+| 243 | 18 |
+| 244 | 12 |
+| 245 | 3 |
+| 246 | 2 |
+| 250 | 1 |
+
+Lowest cost B days (day, date, cost A, cost B, w32 per word, certified per word):
+  43959 2090-05-10 A=204 B=181 w32=[8,11,9,8,5,10,9,12,12,8,9,10,11,12,11,11] cert=[5,-,5,-,3,-,5,-,-,-,5,-,5,5,-,-]
+  31548 2056-05-17 A=207 B=182 w32=[10,11,9,11,7,10,11,9,9,9,11,10,8,12,10,12] cert=[-,-,-,5,5,5,-,5,-,-,-,-,5,5,5,-]
+  48931 2103-12-21 A=213 B=182 w32=[10,12,12,9,10,10,10,8,11,11,10,9,9,10,11,13] cert=[-,5,-,5,-,-,-,5,5,-,5,5,5,-,5,-]
+  42453 2086-03-26 A=212 B=184 w32=[8,11,11,9,8,10,10,7,10,10,12,13,11,14,10,10] cert=[5,-,-,-,-,5,-,5,-,-,-,-,5,5,5,5]
+  56294 2124-02-17 A=207 B=185 w32=[5,10,10,11,11,10,11,12,11,9,9,10,10,8,10,12] cert=[3,-,-,5,5,-,-,-,5,-,-,-,-,5,5,-]
+  21212 2028-01-29 A=211 B=186 w32=[11,11,7,12,12,10,13,8,7,10,11,7,11,10,13,10] cert=[-,-,5,5,-,-,-,5,5,5,5,5,-,4,-,-]
+  23018 2033-01-08 A=214 B=186 w32=[12,12,12,12,8,6,11,11,10,10,11,9,11,12,9,10] cert=[5,5,-,-,5,4,5,-,5,-,-,-,-,-,-,5]
+  29337 2050-04-28 A=203 B=186 w32=[9,8,9,8,10,10,12,10,8,10,12,11,9,10,11,8] cert=[-,5,-,-,5,-,-,-,5,-,5,-,5,-,-,-]
+  29472 2050-09-10 A=220 B=186 w32=[10,10,12,13,14,10,8,11,10,12,11,10,9,10,12,10] cert=[-,5,-,5,-,5,-,-,5,-,-,5,5,5,-,5]
+  21706 2029-06-06 A=209 B=187 w32=[8,9,9,8,10,9,9,13,10,11,10,10,11,13,12,9] cert=[5,-,-,5,5,-,-,-,5,-,-,-,-,5,-,5]
+  23415 2034-02-09 A=210 B=187 w32=[7,10,12,10,9,12,9,10,13,10,10,10,10,9,12,9] cert=[4,5,-,-,5,-,-,-,5,5,-,-,-,5,-,-]
+  28147 2047-01-24 A=219 B=187 w32=[13,8,9,12,9,10,10,15,9,13,10,10,11,12,10,10] cert=[-,5,-,-,-,-,5,5,5,-,5,5,-,5,-,-]
+  32331 2058-07-09 A=204 B=187 w32=[8,10,9,12,13,10,10,10,9,9,10,9,12,4,11,10] cert=[5,-,-,-,-,5,5,-,-,5,-,-,-,3,-,5]
+  36389 2069-08-18 A=208 B=187 w32=[10,12,8,9,10,9,9,9,10,10,8,12,11,11,11,11] cert=[5,5,5,-,-,-,-,5,5,-,5,-,-,-,-,-]
+  48811 2103-08-23 A=213 B=187 w32=[12,7,9,11,9,11,8,11,11,11,10,10,11,11,11,12] cert=[-,5,5,-,5,-,-,5,-,5,5,-,-,-,5,-]
+  52490 2113-09-18 A=217 B=187 w32=[10,8,13,10,10,12,11,10,10,9,12,10,13,10,12,9] cert=[5,5,-,5,-,-,-,-,5,5,-,-,-,5,5,5]
+  53221 2115-09-19 A=215 B=187 w32=[10,9,10,12,11,10,10,7,11,13,11,12,11,9,10,11] cert=[-,5,-,5,-,5,5,5,-,-,-,5,-,-,5,-]
+  54469 2119-02-18 A=205 B=187 w32=[12,9,10,9,14,9,10,11,10,8,12,10,6,11,8,8] cert=[-,-,5,-,-,5,-,-,5,5,-,-,4,-,5,5]
+  28277 2047-06-03 A=217 B=188 w32=[10,12,10,11,10,11,11,14,10,11,11,9,9,11,10,9] cert=[5,-,5,-,-,5,5,-,5,-,-,-,-,-,5,5]
+  29773 2051-07-08 A=210 B=188 w32=[13,8,11,9,10,10,10,10,11,8,11,10,11,9,10,11] cert=[-,5,-,-,5,-,-,-,-,5,5,-,5,-,5,-]
+  32926 2060-02-24 A=207 B=188 w32=[9,14,7,9,11,11,8,12,11,11,9,10,7,11,9,10] cert=[5,-,5,-,-,5,5,-,-,-,5,-,5,-,-,5]
+  45458 2094-06-17 A=211 B=188 w32=[9,11,12,12,12,10,7,11,11,8,10,8,10,13,9,10] cert=[-,-,-,5,5,-,5,-,-,-,5,5,5,-,-,-]
+  49692 2106-01-20 A=207 B=188 w32=[7,12,10,10,8,12,11,8,10,10,11,7,11,11,10,11] cert=[5,5,-,5,-,-,-,5,-,-,5,5,-,-,-,-]
+  27945 2046-07-06 A=204 B=189 w32=[7,10,14,9,8,9,11,10,11,8,11,9,8,12,11,8] cert=[5,-,-,-,5,5,-,-,-,5,-,5,5,-,-,5]
+
+| SCM self-test constant | Certified | Expected |
+|---|---|---|
+| 0x00000003 | 1 | 1 |
+| 0x00000005 | 1 | 1 |
+| 0x00000007 | 1 | 1 |
+| 0x00000009 | 1 | 1 |
+| 0xffffffff | 1 | 1 |
+| 0x80000001 | 1 | 1 |
+| 0x0000000f | 1 | 1 (16-1) |
+| 0x0000002d | 2 | 2 (9*5) |
+| 0x9e3779b9 | none | <= w32-1 or none |
+lease: released 30 pool cores after 83 s, exit 0
+2026-10-07T20:41:10Z end scm-calendar rc=0

docs/analysis/cryptanalysis/logs/adv-mixer-2/scm-sample-2p16.log

@@ -0,0 +1,148 @@
+2026-10-07T20:41:12Z start scm-sample-2p16 (lease pool 32 min 16): /srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 scm-refine --sample 65536 --seed 1 --threads {cores}
+lease: holding 30 pool cores (42,43,44,45,46,47,48,49,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95, waited 0 s, class adv): adv-mixer-2 scm-sample-2p16
+adv-mixer-2 scm-refine --sample 65536 --seed 1 --threads 30 | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item | median cost A for gains 226
+
+scm: level 1: 90 values (0.0 s)
+scm: level 2: 4101 values (0.0 s)
+scm: level 3: 185223 values (0.0 s)
+scm: level 4: 7983205 values; cost <= 4: 8172620 of 2^31 odd (0.0038) (0.4 s)
+scm: shifted sets and inverses ready (0.7 s)
+scm-refine: 65536 days, 30 threads, sets built in 0.7 s
+
+| SCM level (restricted form) | Odd constants | Fraction of 2^31 | log2 |
+|---|---|---|---|
+| 0 | 1 | 4.6566e-10 | -31.0 |
+| 1 | 90 | 4.1910e-8 | -24.5 |
+| 2 | 4101 | 1.9097e-6 | -19.0 |
+| 3 | 185223 | 8.6251e-5 | -13.5 |
+| 4 | 7983205 | 3.7175e-3 | -8.1 |
+
+## Model B (random sample of 65536 days in [genesis, genesis + 2^32), seed 1): 65536 days, 1048576 words, 3.5 s
+
+| Certified adders per word | Words | Fraction |
+|---|---|---|
+| 2 | 1 | 9.5367e-7 |
+| 3 | 79 | 7.5340e-5 |
+| 4 | 3777 | 3.6020e-3 |
+| 5 | 125020 | 1.1923e-1 |
+| none | 919699 | 8.7709e-1 |
+
+| Cost B statistic | Value |
+|---|---|
+| mean | 219.051 |
+| median | 219 |
+| min | 176 |
+
+| Cost B | Days |
+|---|---|
+| 176 | 1 |
+| 180 | 1 |
+| 182 | 2 |
+| 183 | 2 |
+| 184 | 5 |
+| 185 | 4 |
+| 186 | 10 |
+| 187 | 10 |
+| 188 | 19 |
+| 189 | 21 |
+| 190 | 24 |
+| 191 | 28 |
+| 192 | 40 |
+| 193 | 50 |
+| 194 | 63 |
+| 195 | 96 |
+| 196 | 130 |
+| 197 | 171 |
+| 198 | 203 |
+| 199 | 266 |
+| 200 | 308 |
+| 201 | 369 |
+| 202 | 442 |
+| 203 | 587 |
+| 204 | 662 |
+| 205 | 828 |
+| 206 | 954 |
+| 207 | 1116 |
+| 208 | 1286 |
+| 209 | 1467 |
+| 210 | 1669 |
+| 211 | 1854 |
+| 212 | 1890 |
+| 213 | 2117 |
+| 214 | 2373 |
+| 215 | 2621 |
+| 216 | 2693 |
+| 217 | 2894 |
+| 218 | 2846 |
+| 219 | 3004 |
+| 220 | 2966 |
+| 221 | 2959 |
+| 222 | 2873 |
+| 223 | 2819 |
+| 224 | 2691 |
+| 225 | 2579 |
+| 226 | 2324 |
+| 227 | 2221 |
+| 228 | 1945 |
+| 229 | 1686 |
+| 230 | 1492 |
+| 231 | 1189 |
+| 232 | 1003 |
+| 233 | 941 |
+| 234 | 719 |
+| 235 | 558 |
+| 236 | 408 |
+| 237 | 340 |
+| 238 | 233 |
+| 239 | 176 |
+| 240 | 107 |
+| 241 | 68 |
+| 242 | 44 |
+| 243 | 25 |
+| 244 | 16 |
+| 245 | 12 |
+| 246 | 8 |
+| 247 | 2 |
+| 248 | 3 |
+| 249 | 3 |
+
+Lowest cost B days (day, date, cost A, cost B, w32 per word, certified per word):
+  3575307864 9790830-06-15 A=211 B=176 w32=[11,10,9,10,13,10,10,12,10,8,11,10,13,7,12,7] cert=[-,5,5,5,-,-,-,5,5,5,5,5,-,5,-,4]
+  40251252 112174-03-09 A=199 B=180 w32=[11,8,10,10,9,9,12,11,6,9,7,10,10,7,11,11] cert=[-,5,-,-,-,5,-,5,5,5,5,-,5,5,-,-]
+  1797458231 4923243-06-27 A=208 B=182 w32=[11,14,11,10,8,9,11,10,10,10,8,7,11,9,11,10] cert=[5,-,-,-,-,-,-,5,5,-,-,5,5,5,-,5]
+  3494196493 9568755-01-24 A=208 B=182 w32=[11,8,9,13,11,9,11,10,9,8,14,8,10,9,13,7] cert=[5,5,5,-,5,5,-,-,5,5,-,5,-,-,-,5]
+  673712866 1846533-03-06 A=200 B=183 w32=[9,9,8,10,8,10,8,10,11,9,10,7,9,10,13,11] cert=[-,-,-,-,-,-,5,-,-,-,5,5,5,-,5,-]
+  1465410610 4014127-12-24 A=211 B=183 w32=[11,9,7,10,11,10,14,11,10,12,11,10,9,10,8,10] cert=[-,5,5,5,-,5,-,-,-,5,-,5,-,-,5,5]
+  1787741900 4896641-01-28 A=209 B=184 w32=[9,9,12,8,7,11,12,12,9,10,9,12,10,11,9,11] cert=[-,-,5,5,5,-,5,-,-,5,5,-,-,-,5,-]
+  2155846726 5904477-11-09 A=216 B=184 w32=[10,11,9,11,11,11,11,12,9,9,9,10,12,11,11,11] cert=[5,5,-,5,5,5,5,-,-,-,5,-,-,-,-,-]
+  2422431588 6634362-06-03 A=209 B=184 w32=[12,8,10,10,9,9,7,10,13,8,10,10,14,8,12,11] cert=[5,5,-,5,-,5,4,-,-,5,5,-,-,5,-,-]
+  3959748521 10843393-03-22 A=217 B=184 w32=[12,7,12,10,11,10,13,10,8,9,8,13,12,13,11,10] cert=[5,4,-,-,5,-,-,-,5,-,5,5,-,-,5,5]
+  4009639510 10979990-02-10 A=205 B=184 w32=[10,13,13,7,11,9,9,10,7,8,10,8,12,10,10,10] cert=[-,5,5,5,-,5,-,-,5,5,-,-,-,-,-,-]
+  1206471223 3305176-01-07 A=210 B=185 w32=[11,10,12,11,11,10,10,11,12,7,10,8,12,10,8,9] cert=[-,-,-,-,5,-,5,-,5,4,-,5,-,-,5,4]
+  1616262275 4427145-10-23 A=207 B=185 w32=[13,10,11,10,11,11,9,12,10,8,9,12,7,9,8,9] cert=[-,5,-,5,-,-,5,-,-,5,-,-,5,5,5,5]
+  1664583387 4559444-07-09 A=213 B=185 w32=[10,10,10,10,9,11,9,12,12,11,10,10,11,11,8,11] cert=[5,-,-,-,5,5,5,-,5,-,-,4,-,-,5,-]
+  2367534968 6484060-07-30 A=200 B=185 w32=[7,7,8,11,11,11,13,9,11,8,9,8,10,11,9,9] cert=[5,5,5,-,-,-,-,5,-,5,5,4,-,-,-,-]
+  19840853 56292-05-30 A=203 B=186 w32=[9,13,12,7,11,10,12,8,10,9,8,7,9,10,11,9] cert=[-,-,-,5,-,-,-,5,5,-,5,5,-,5,-,5]
+  262979916 721984-07-22 A=209 B=186 w32=[8,10,10,12,10,11,8,12,8,11,11,10,8,11,10,11] cert=[5,5,-,-,-,-,5,-,5,5,-,5,-,-,5,-]
+  549969971 1507736-08-21 A=211 B=186 w32=[8,13,10,8,8,8,10,13,10,12,11,11,11,11,9,10] cert=[5,-,5,5,5,-,-,-,5,5,-,5,-,-,-,-]
+  597874693 1638895-04-24 A=208 B=186 w32=[10,10,10,10,12,10,11,11,10,8,11,10,11,8,10,8] cert=[5,5,5,-,-,-,-,-,-,5,-,5,-,5,-,5]
+  679783403 1863153-09-29 A=211 B=186 w32=[10,12,9,13,9,10,10,10,7,11,9,12,12,8,10,11] cert=[-,5,-,-,-,5,5,5,5,-,-,-,-,5,5,-]
+  1861251130 5097902-07-07 A=208 B=186 w32=[8,10,10,11,12,9,12,10,9,11,11,10,9,10,11,7] cert=[5,-,5,-,-,5,-,5,5,-,-,-,-,5,-,4]
+  2159884252 5915532-03-25 A=204 B=186 w32=[10,8,11,9,8,7,10,9,9,11,10,14,9,11,9,11] cert=[-,-,5,-,5,5,5,-,-,-,-,-,5,-,5,-]
+  2615337220 7162520-02-07 A=212 B=186 w32=[13,10,9,10,12,8,11,9,10,12,9,11,11,8,11,10] cert=[-,-,5,5,-,5,-,5,5,-,5,5,-,5,-,-]
+  3171283364 8684648-12-11 A=212 B=186 w32=[9,10,11,9,11,8,14,10,11,10,10,9,13,10,8,11] cert=[5,5,5,-,-,5,-,-,5,-,-,5,-,5,-,-]
+
+| SCM self-test constant | Certified | Expected |
+|---|---|---|
+| 0x00000003 | 1 | 1 |
+| 0x00000005 | 1 | 1 |
+| 0x00000007 | 1 | 1 |
+| 0x00000009 | 1 | 1 |
+| 0xffffffff | 1 | 1 |
+| 0x80000001 | 1 | 1 |
+| 0x0000000f | 1 | 1 (16-1) |
+| 0x0000002d | 2 | 2 (9*5) |
+| 0x9e3779b9 | none | <= w32-1 or none |
+Terminated
+lease: released 30 pool cores after 4 s, exit 0
+2026-10-07T20:41:16Z end scm-sample-2p16 rc=0

docs/analysis/cryptanalysis/logs/adv-mixer-2/scm-tail-2p24.log

@@ -0,0 +1,139 @@
+2026-10-07T20:36:25Z start scm-tail-2p24 (lease pool 32 min 16): /srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 scm-refine --days /srv/builds/_adv-adv-mixer-2/logs/tail-2p24.txt --threads {cores}
+lease: holding 24 pool cores (50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73, waited 0 s, class adv): adv-mixer-2 scm-tail-2p24
+adv-mixer-2 scm-refine --days /srv/builds/_adv-adv-mixer-2/logs/tail-2p24.txt --threads 24 | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item | median cost A for gains 226
+
+scm: level 1: 90 values (0.0 s)
+scm: level 2: 4101 values (0.0 s)
+scm: level 3: 185223 values (0.0 s)
+scm: level 4: 7983205 values; cost <= 4: 8172620 of 2^31 odd (0.0038) (0.4 s)
+scm-refine: 16384 days, 24 threads, sets built in 0.4 s
+
+| SCM level (restricted form) | Odd constants | Fraction of 2^31 | log2 |
+|---|---|---|---|
+| 0 | 1 | 4.6566e-10 | -31.0 |
+| 1 | 90 | 4.1910e-8 | -24.5 |
+| 2 | 4101 | 1.9097e-6 | -19.0 |
+| 3 | 185223 | 8.6251e-5 | -13.5 |
+| 4 | 7983205 | 3.7175e-3 | -8.1 |
+
+Terminated
+lease: released 24 pool cores after 33 s, exit 143
+2026-10-07T20:37:00Z stopped by lane adv-mixer-2 (stop-tree.sh): slow certificate, restructured and re-queued
+2026-10-07T20:41:10Z start scm-tail-2p24 (lease pool 32 min 16): /srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2 scm-refine --days /srv/builds/_adv-adv-mixer-2/logs/tail-2p24.txt --threads {cores}
+lease: holding 30 pool cores (42,43,44,45,46,47,48,49,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95, waited 0 s, class adv): adv-mixer-2 scm-tail-2p24
+adv-mixer-2 scm-refine --days /srv/builds/_adv-adv-mixer-2/logs/tail-2p24.txt --threads 30 | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item | median cost A for gains 226
+
+scm: level 1: 90 values (0.0 s)
+scm: level 2: 4101 values (0.0 s)
+scm: level 3: 185223 values (0.0 s)
+scm: level 4: 7983205 values; cost <= 4: 8172620 of 2^31 odd (0.0038) (0.4 s)
+scm: shifted sets and inverses ready (0.7 s)
+scm-refine: 16384 days, 30 threads, sets built in 0.7 s
+
+| SCM level (restricted form) | Odd constants | Fraction of 2^31 | log2 |
+|---|---|---|---|
+| 0 | 1 | 4.6566e-10 | -31.0 |
+| 1 | 90 | 4.1910e-8 | -24.5 |
+| 2 | 4101 | 1.9097e-6 | -19.0 |
+| 3 | 185223 | 8.6251e-5 | -13.5 |
+| 4 | 7983205 | 3.7175e-3 | -8.1 |
+
+## Model B (days from /srv/builds/_adv-adv-mixer-2/logs/tail-2p24.txt): 16384 days, 262144 words, 1.5 s
+
+| Certified adders per word | Words | Fraction |
+|---|---|---|
+| 2 | 21 | 8.0109e-5 |
+| 3 | 329 | 1.2550e-3 |
+| 4 | 5970 | 2.2774e-2 |
+| 5 | 69087 | 2.6355e-1 |
+| none | 186737 | 7.1235e-1 |
+
+| Cost B statistic | Value |
+|---|---|
+| mean | 193.445 |
+| median | 194 |
+| min | 167 |
+
+| Cost B | Days |
+|---|---|
+| 167 | 1 |
+| 168 | 1 |
+| 169 | 1 |
+| 170 | 1 |
+| 171 | 2 |
+| 172 | 1 |
+| 173 | 12 |
+| 174 | 10 |
+| 175 | 13 |
+| 176 | 21 |
+| 177 | 29 |
+| 178 | 50 |
+| 179 | 67 |
+| 180 | 83 |
+| 181 | 106 |
+| 182 | 145 |
+| 183 | 195 |
+| 184 | 264 |
+| 185 | 353 |
+| 186 | 413 |
+| 187 | 521 |
+| 188 | 619 |
+| 189 | 727 |
+| 190 | 835 |
+| 191 | 955 |
+| 192 | 1087 |
+| 193 | 1185 |
+| 194 | 1162 |
+| 195 | 1271 |
+| 196 | 1212 |
+| 197 | 1143 |
+| 198 | 1039 |
+| 199 | 838 |
+| 200 | 685 |
+| 201 | 519 |
+| 202 | 355 |
+| 203 | 235 |
+| 204 | 138 |
+| 205 | 64 |
+| 206 | 24 |
+| 207 | 2 |
+
+Lowest cost B days (day, date, cost A, cost B, w32 per word, certified per word):
+  1912814 7207-02-09 A=205 B=167 w32=[8,10,10,11,10,11,8,11,11,11,10,7,10,9,8,12] cert=[5,5,5,-,-,-,5,5,5,-,4,5,5,-,-,5]
+  4937963 15489-09-07 A=199 B=168 w32=[8,9,9,9,12,8,9,10,13,10,11,8,9,7,10,9] cert=[5,5,-,5,5,5,4,5,-,-,-,5,-,5,5,-]
+  1243652 5375-01-02 A=198 B=169 w32=[7,11,9,9,11,10,10,10,9,10,10,8,10,9,7,10] cert=[5,5,-,5,5,-,-,-,-,5,-,5,-,5,4,5]
+  144688 2366-02-22 A=200 B=170 w32=[8,9,10,12,9,10,11,9,7,7,9,10,8,11,10,12] cert=[-,5,-,5,5,5,-,-,5,5,-,-,5,-,5,5]
+  943820 4554-02-03 A=206 B=171 w32=[9,11,9,9,13,8,13,11,7,11,10,6,9,9,12,11] cert=[-,-,5,5,-,-,5,5,5,5,5,4,5,5,-,-]
+  3820052 12428-12-12 A=201 B=171 w32=[11,10,8,10,10,9,9,11,8,7,9,9,13,9,10,10] cert=[-,5,5,5,5,5,5,-,5,4,5,-,-,5,-,-]
+  13086747 37800-04-19 A=204 B=172 w32=[8,9,12,11,6,10,11,10,11,10,9,9,8,12,11,9] cert=[5,-,-,5,5,5,-,-,-,5,5,5,5,5,-,5]
+  369578 2981-11-14 A=204 B=173 w32=[9,9,12,10,8,10,10,10,10,9,10,10,12,10,9,8] cert=[5,-,-,-,5,5,5,5,5,4,5,-,-,-,-,5]
+  886811 4398-01-03 A=206 B=173 w32=[14,10,10,9,10,11,11,8,10,10,8,9,10,8,11,9] cert=[5,-,5,-,5,-,-,-,5,-,5,-,5,5,5,-]
+  4557750 14448-09-11 A=201 B=173 w32=[10,6,10,11,9,9,11,9,8,11,10,10,9,10,10,10] cert=[-,5,-,-,5,-,5,5,5,-,5,-,5,5,-,5]
+  5318233 16530-10-30 A=205 B=173 w32=[10,10,10,12,8,7,10,10,11,10,9,10,11,10,10,9] cert=[-,-,-,-,-,5,5,5,-,-,5,5,5,5,5,5]
+  6307475 19239-04-13 A=200 B=173 w32=[9,8,8,10,8,12,12,7,10,10,9,8,10,11,10,10] cert=[-,5,5,5,5,5,-,4,-,5,5,5,-,-,-,-]
+  8311997 24727-06-24 A=202 B=173 w32=[9,7,9,11,10,10,8,10,9,10,11,10,10,10,11,9] cert=[5,5,5,-,-,5,5,5,-,-,5,5,-,-,-,5]
+  8998349 26606-08-24 A=198 B=173 w32=[9,11,11,11,11,10,9,10,11,9,5,7,9,8,9,10] cert=[-,-,5,-,-,5,-,5,-,5,4,5,5,5,5,-]
+  9695486 28515-05-05 A=206 B=173 w32=[10,11,10,8,8,12,8,11,11,11,10,9,11,10,8,10] cert=[5,5,5,5,5,-,5,-,5,-,-,5,-,-,5,5]
+  10620122 31046-11-28 A=202 B=173 w32=[10,8,11,9,9,11,11,8,9,10,8,11,11,9,10,9] cert=[-,5,-,5,-,-,-,-,-,5,-,5,5,5,5,5]
+  11594702 33715-03-21 A=204 B=173 w32=[8,9,9,11,9,9,10,11,9,12,9,10,11,11,10,8] cert=[5,-,5,-,5,-,-,-,5,-,5,4,5,5,-,5]
+  14918619 42815-10-17 A=206 B=173 w32=[9,7,10,9,11,9,11,11,10,9,10,10,11,10,11,10] cert=[5,5,-,-,-,5,5,5,5,5,-,5,-,-,5,-]
+  15220307 43641-10-14 A=201 B=173 w32=[10,11,10,8,11,9,10,10,9,9,11,8,8,8,11,10] cert=[5,5,-,5,-,-,-,5,5,-,-,5,5,5,-,5]
+  772101 4083-12-10 A=202 B=174 w32=[8,9,12,8,9,11,10,8,7,10,8,10,12,10,9,13] cert=[-,5,-,-,5,-,5,5,5,5,-,5,-,5,5,-]
+  2535640 8912-05-07 A=203 B=174 w32=[7,12,9,9,11,9,10,8,11,9,10,8,11,12,9,10] cert=[5,-,5,5,5,-,5,5,-,5,-,5,-,5,-,-]
+  4192229 13447-12-08 A=202 B=174 w32=[10,8,9,8,11,10,10,9,10,9,8,10,10,12,11,9] cert=[5,5,5,-,-,5,5,-,-,-,5,-,-,5,-,5]
+  5534466 17122-11-09 A=198 B=174 w32=[11,12,10,9,11,9,6,10,8,12,9,8,8,7,12,8] cert=[-,-,5,5,-,5,4,-,-,-,-,5,5,5,5,5]
+  8605322 25530-07-29 A=206 B=174 w32=[9,10,8,11,10,7,9,12,10,11,11,10,9,11,12,8] cert=[5,5,5,5,5,5,5,-,-,5,5,-,-,-,-,-]
+
+| SCM self-test constant | Certified | Expected |
+|---|---|---|
+| 0x00000003 | 1 | 1 |
+| 0x00000005 | 1 | 1 |
+| 0x00000007 | 1 | 1 |
+| 0x00000009 | 1 | 1 |
+| 0xffffffff | 1 | 1 |
+| 0x80000001 | 1 | 1 |
+| 0x0000000f | 1 | 1 (16-1) |
+| 0x0000002d | 2 | 2 (9*5) |
+| 0x9e3779b9 | none | <= w32-1 or none |
+lease: released 30 pool cores after 2 s, exit 0
+2026-10-07T20:41:12Z end scm-tail-2p24 rc=0

docs/analysis/cryptanalysis/logs/adv-mixer-2/smoke-day-20733.log

@@ -0,0 +1,15 @@
+adv-mixer-2 day --index 20733 | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item
+
+### day 20733 (2026-10-07)
+
+| Field | Value |
+|---|---|
+| seed64 | de33e763e23f9008 |
+| ROT | 28 11 18 18 13 28 5 13 |
+| MUL | d1d79e7f bcb61f8b 970e91ab d749d96d 143d7339 2cde0d69 12d0a8c1 2d335be9 80a8aae9 7ac896c7 9de23db7 c362827d 5f4cdb5b fc6c5097 6f547f83 1ac31b47 |
+| w32(MUL) | 10 11 13 13 11 12 11 13 12 12 10 10 13 10 10 12 |
+| RC | e5bef5a3 db2a7d90 cd1fa7e1 30289419 0a730d58 432f8579 6ab978a5 8c984f49 788c3c9e 051eef02 05e77db9 8b3cd4f3 6948d6cf 0d8677f6 f9505c8c 4513c163 |
+| cost A | 231 (gain 1.0000x against 231) |
+| model C k | 0 (gain 1.0000x) |
+| classes fired | none |
+

docs/analysis/cryptanalysis/logs/adv-mixer-2/smoke-plant.log

@@ -0,0 +1,93 @@
+adv-mixer-2 plant | internal adversarial pass, not an independent review | class v4 x8, 72 applications per item
+
+### day 20729 unplanted
+
+| Field | Value |
+|---|---|
+| seed64 | 2e689968528b3e14 |
+| ROT | 6 25 5 25 29 11 9 21 |
+| MUL | addda577 e83ff665 a15aee9f 31ffb8cb e72c824d 225e647b 3ec0ace3 d1eb11d5 fa5c7dc5 40128acf 70bc55cf b823fa39 07fcdf49 56a6c8b1 c05d3115 02063ddd |
+| w32(MUL) | 12 9 12 10 12 11 11 12 10 10 12 9 8 14 11 8 |
+| RC | 0655b978 2c53cb31 e14235d3 30d45c30 5b07a13b 25271fad 418b165b f7fe03d7 67943b1d 5ba337a2 24aa3983 6abbbed4 12488b47 a4a81e53 96f96da0 b86823f8 |
+| cost A | 219 (gain 1.0548x against 231) |
+| model C k | 0 (gain 1.0000x) |
+| classes fired | ROT same-word pair sums to 32; ROT any pair sums to 32 |
+
+### plant alleq on day 20729
+
+| Field | Value |
+|---|---|
+| seed64 | 2e689968528b3e14 |
+| ROT | 6 6 6 6 6 6 6 6 |
+| MUL | addda577 e83ff665 a15aee9f 31ffb8cb e72c824d 225e647b 3ec0ace3 d1eb11d5 fa5c7dc5 40128acf 70bc55cf b823fa39 07fcdf49 56a6c8b1 c05d3115 02063ddd |
+| w32(MUL) | 12 9 12 10 12 11 11 12 10 10 12 9 8 14 11 8 |
+| RC | 0655b978 2c53cb31 e14235d3 30d45c30 5b07a13b 25271fad 418b165b f7fe03d7 67943b1d 5ba337a2 24aa3983 6abbbed4 12488b47 a4a81e53 96f96da0 b86823f8 |
+| cost A | 219 (gain 1.0548x against 231) |
+| model C k | 0 (gain 1.0000x) |
+| classes fired | ROT all equal; ROT distinct <= 2; ROT distinct <= 3; ROT distinct <= 4; ROT max multiplicity >= 4; ROT column set == diagonal set |
+
+### plant mul1 on day 20729
+
+| Field | Value |
+|---|---|
+| seed64 | 2e689968528b3e14 |
+| ROT | 6 25 5 25 29 11 9 21 |
+| MUL | addda577 e83ff665 a15aee9f 31ffb8cb e72c824d 00000001 3ec0ace3 d1eb11d5 fa5c7dc5 40128acf 70bc55cf b823fa39 07fcdf49 56a6c8b1 c05d3115 02063ddd |
+| w32(MUL) | 12 9 12 10 12 1 11 12 10 10 12 9 8 14 11 8 |
+| RC | 0655b978 2c53cb31 e14235d3 30d45c30 5b07a13b 25271fad 418b165b f7fe03d7 67943b1d 5ba337a2 24aa3983 6abbbed4 12488b47 a4a81e53 96f96da0 b86823f8 |
+| cost A | 209 (gain 1.1053x against 231) |
+| model C k | 1 (gain 1.0667x) |
+| classes fired | ROT same-word pair sums to 32; ROT any pair sums to 32; MUL any = 1; MUL any involution (x^2 = 1); MUL any w32 <= 2; MUL any w32 <= 3; MUL any w32 <= 4; MUL any popcount <= 4 or >= 28; MUL any in exact 2-adder set (model C k >= 1); cost A gain >= 1.1x (cost <= 210) |
+
+### plant mul1all on day 20729
+
+| Field | Value |
+|---|---|
+| seed64 | 2e689968528b3e14 |
+| ROT | 6 25 5 25 29 11 9 21 |
+| MUL | 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 |
+| w32(MUL) | 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 |
+| RC | 0655b978 2c53cb31 e14235d3 30d45c30 5b07a13b 25271fad 418b165b f7fe03d7 67943b1d 5ba337a2 24aa3983 6abbbed4 12488b47 a4a81e53 96f96da0 b86823f8 |
+| cost A | 64 (gain 3.6094x against 231) |
+| model C k | 16 (gain infx) |
+| classes fired | ROT same-word pair sums to 32; ROT any pair sums to 32; MUL any = 1; MUL any involution (x^2 = 1); MUL any w32 <= 2; MUL any w32 <= 3; MUL any w32 <= 4; MUL >= 2 with w32 <= 4; MUL any popcount <= 4 or >= 28; MUL two equal; MUL two inverse (a*b = 1); MUL any in exact 2-adder set (model C k >= 1); MUL model C k >= 2; cost A gain >= 1.1x (cost <= 210); cost A gain >= 1.2x (cost <= 192); cost A gain >= 1.5x (cost <= 154) |
+
+### plant rcrk0 on day 20729
+
+| Field | Value |
+|---|---|
+| seed64 | 2e689968528b3e14 |
+| ROT | 6 25 5 25 29 11 9 21 |
+| MUL | addda577 e83ff665 a15aee9f 31ffb8cb e72c824d 225e647b 3ec0ace3 d1eb11d5 fa5c7dc5 40128acf 70bc55cf b823fa39 07fcdf49 56a6c8b1 c05d3115 02063ddd |
+| w32(MUL) | 12 9 12 10 12 11 11 12 10 10 12 9 8 14 11 8 |
+| RC | 0655b978 2c53cb31 e14235d3 673b8a1a 5b07a13b 25271fad 418b165b f7fe03d7 67943b1d 5ba337a2 24aa3983 6abbbed4 12488b47 a4a81e53 96f96da0 b86823f8 |
+| cost A | 219 (gain 1.0548x against 231) |
+| model C k | 0 (gain 1.0000x) |
+| classes fired | ROT same-word pair sums to 32; ROT any pair sums to 32; RC + rk = 0 for any of the 72 keys |
+
+### plant rot1 on day 20729
+
+| Field | Value |
+|---|---|
+| seed64 | 2e689968528b3e14 |
+| ROT | 1 1 1 1 1 1 1 1 |
+| MUL | addda577 e83ff665 a15aee9f 31ffb8cb e72c824d 225e647b 3ec0ace3 d1eb11d5 fa5c7dc5 40128acf 70bc55cf b823fa39 07fcdf49 56a6c8b1 c05d3115 02063ddd |
+| w32(MUL) | 12 9 12 10 12 11 11 12 10 10 12 9 8 14 11 8 |
+| RC | 0655b978 2c53cb31 e14235d3 30d45c30 5b07a13b 25271fad 418b165b f7fe03d7 67943b1d 5ba337a2 24aa3983 6abbbed4 12488b47 a4a81e53 96f96da0 b86823f8 |
+| cost A | 219 (gain 1.0548x against 231) |
+| model C k | 0 (gain 1.0000x) |
+| classes fired | ROT all equal; ROT distinct <= 2; ROT distinct <= 3; ROT distinct <= 4; ROT max multiplicity >= 4; ROT >= 4 in {1,31}; ROT all 8 in {1,2,30,31}; ROT column set == diagonal set |
+
+### plant weakday on day 20729
+
+| Field | Value |
+|---|---|
+| seed64 | 2e689968528b3e14 |
+| ROT | 6 6 6 6 6 6 6 6 |
+| MUL | 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 |
+| w32(MUL) | 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 |
+| RC | 0655b978 2c53cb31 e14235d3 30d45c30 5b07a13b 25271fad 418b165b f7fe03d7 67943b1d 5ba337a2 24aa3983 6abbbed4 12488b47 a4a81e53 96f96da0 b86823f8 |
+| cost A | 64 (gain 3.6094x against 231) |
+| model C k | 16 (gain infx) |
+| classes fired | ROT all equal; ROT distinct <= 2; ROT distinct <= 3; ROT distinct <= 4; ROT max multiplicity >= 4; ROT column set == diagonal set; MUL any = 1; MUL any involution (x^2 = 1); MUL any w32 <= 2; MUL any w32 <= 3; MUL any w32 <= 4; MUL >= 2 with w32 <= 4; MUL any popcount <= 4 or >= 28; MUL two equal; MUL two inverse (a*b = 1); MUL any in exact 2-adder set (model C k >= 1); MUL model C k >= 2; cost A gain >= 1.1x (cost <= 210); cost A gain >= 1.2x (cost <= 192); cost A gain >= 1.5x (cost <= 154) |
+

docs/analysis/cryptanalysis/report-mixer-2.md

@@ -0,0 +1,318 @@
+# Report: the day-key weakness class of the mixer M_r (lane adv-mixer-2)
+
+Internal adversarial pass, not an independent review. Every sentence below that could be quoted carries that label.
+
+## Header
+
+| Field | Value |
+|---|---|
+| Target commit | 017e70376489251e18564c0abce7e466e606c8b3 (class v4 sub-version 3, object byte 7) |
+| Target | the per-day draw of ROT[0..7], MUL[0..15], RC[0..15] for M_r (spec 01 section 1.8.4), class v4 (x8, 72 applications per item) |
+| Branch | adv-mixer-2 from build/master 7a7caa34, merged 04c4d9bc; plan 5704a7b3; harness ae3088a9 |
+| Byte identity | `git diff --quiet 017e7037... HEAD -- igneum-pow` printed IDENTICAL at 7a7caa34 and at 04c4d9bc (the whole crate) |
+| Harness | tools/attack/adv-mixer-2 (binary `adv-mixer-2`), igneum-pow by path, nothing re-implemented |
+| Binary sha256 | 88f6a3edfffad166d35a3bcadcaff7907613e710b842cfcbe94fbb1601f7c37b for queue 01, 02 and the exact run; b5d823aa14da80d0b02fc2e02666a70af1ce14fe464ad683be9616a4b5df5179 from 21:39 UK (the model B certificate restructured; census, exact, calendar code unchanged), identical on both boxes, at /srv/builds/_adv-adv-mixer-2/bin/ |
+| Boxes | igneum-build-1 and igneum-build-2, rustc 1.99.0; every sweep through `/srv/builds/_bin/lease pool` at class adv, 32 cores, --min 16, nice 10 |
+| Logs | /srv/builds/_adv-adv-mixer-2/logs/ on each box; copies in docs/analysis/cryptanalysis/logs/adv-mixer-2/ |
+| Price | chip-model-v3.md 5.2: 128 ops per application hoisted, 9,360 ops per item; the spec's 130 per application |
+| Clock | UK time throughout |
+
+## What the per-day gain means, and for whom
+
+The honest miner (any GPU) and the CPU verifier run `memhard::mixer` with the day's constants as operands: 16
+multiplies, 16 XORs, 32 adds, 32 XORs, 32 rotates per application, the same instruction count on every day. A
+multiplier unit costs the same for MUL = 3 as for MUL = 0x9E3779B9. So under chip-model-v3's op count (9,360 ops per
+item, value-independent) the per-day gain is exactly 1.0 on every day for every GPU, for the verifier, and for a
+chip with a general multiplier. The chip model credits hash rate only through that count.
+
+The day's constants matter only to a datapath that bakes them in. An ASIC cannot be masked per day. An FPGA bitstream
+can be synthesised per day, and that is the only per-day attacker; its per-day gain is an AREA gain (fewer LUTs per
+multiplier, so more copies of the pipeline per device), which the chip model does not price as hash rate. The three
+cost models of this lane read that area:
+
+| Model | What it measures | For whom | Gain over 1.1x on more than 2^-20 of days? |
+|---|---|---|---|
+| A, LUT shift-add (64 + sum of (w32 - 1)) | adder-equivalents per application with every multiplier as a canonical signed-digit shift-add chain; rotations and constant XORs free | a per-day FPGA build with multipliers in LUTs; not a wall-time gain for any chip | YES: P(cost A <= 205, gain >= 1.102x against the exact median 226) = 5.694e-4 = 2^-10.8 per day (exact, 16-fold convolution of the w32 table over all 2^31 odd constants; about 21 days per 100 years). 1.2x: 2^-28.8 (1 day in 2^28). 1.5x: under 2^-91 |
+| B, certified shift-add | the same datapath with each multiplier at its certified chain (exact for 1 to 4 adders, decomposition certificate for 5) | the same FPGA, closer to what a synthesiser achieves; an upper bound on the attacker's cost per word | NOT READ AS A GAIN: 12.3 percent of words are certified at 5 or fewer adders, 0.38 percent at 4 or fewer; the remaining 88 percent carry their model A cost, so cost B's spread between days is the certificate's reach, not the attacker's. What it does establish: a synthesiser's real per-day variation is smaller than model A's, because every certified word collapses to 5 whatever its w32 (7 to 13 in the tail days) |
+| C, DSP | 16 / (16 - k) with k the words whose constant has a 2-adder chain and leaves its DSP block | a per-day FPGA build with multipliers in DSP blocks (value-independent) | NO: k >= 1 gives 1.067x on 3.123e-5 = 2^-15.0 of days; the first gain over 1.1x is k >= 2 (1.143x) on 4.57e-10 = 2^-31.0 |
+| Chip model (ops per item) | 9,360 per item, value-independent | every GPU, the verifier, any chip with a general multiplier | NO: the gain is 1.0 on every day |
+
+Threshold used: the brief's, a gain over 1.1x on more than 2^-20 of days. Model A crosses it by 9 binary orders;
+model C and the chip-model reading do not. The redraw rule below is proposed on the model A reading, because the
+census of a public calendar is the attacker's cheapest tool and a 10 percent area edge on 1 day in 1,750 is free to
+take even if it buys no hash rate against the chip model's attacker. The worst real calendar day is 29337 = 2050-04-28 (cost A 203, model A gain 1.113x, model C 1.0, chip model
+1.0); the 15 days over 1.1x in 100 years are listed in Q4 below.
+
+## Status board
+
+| Q | Method | Known-failed shape | Gate | Result (numbers) | Status |
+|---|---|---|---|---|---|
+| Q0 plants | `plant` on the day-20729 draw with one field replaced, through the same classifier | alleq, rot1, mul1, mul1all, rcrk0, weakday (all ROT equal and MUL = 1) | every plant lands in its class with its gain | all six fire: alleq -> "ROT all equal" (cost 219); mul1 -> "MUL any = 1", gain 1.1053x; mul1all and weakday -> cost 64, gain 3.61x, model C k = 16; rcrk0 -> "RC + rk = 0"; rot1 -> "ROT all 8 in {1,2,30,31}" | PASS |
+| Q3 exact tail, model A | w32 over all 2^31 odd constants (exact), 16-fold convolution | the table must give 2 constants at w32 = 1 (1 and 2^32 - 1) and the mean must match the census | mean w32 11.1111; mean cost A 225.78, exact median 226; P(gain >= 1.05x) 4.72e-2; >= 1.1x 5.694e-4 (2^-10.8); >= 1.15x 1.66e-6 (2^-19.2); >= 1.2x 2.13e-9 (2^-28.8); >= 1.3x 2.07e-16; >= 1.5x under 2^-91 | FINDING (area reading), crosses 2^-20 |
+| Q3 exact, model C | exact 2-adder set (4,192 odd constants, 2^-19.0 per word) | the set must contain 1, 2^32 - 1, 2^s +- 1 | P(k >= 1) 3.12e-5 (gain 1.067x), P(k >= 2) 4.57e-10 (1.143x) | PASS (bound: under 2^-20 at 1.1x) |
+| Q1 census 2^24 | `census --from 20729 --count 2^24` (32 structural classes, cost A histogram, model C) | plants above | counts against the analytic expectation | 16,777,216 days in 0.3 s on 24 leased cores: gain A >= 1.1x on 9,525 days (5.677e-4, 2^-10.8; exact 5.694e-4); >= 1.2x on 0; min cost 191 (1.183x, day 4819563); model C k >= 1 on 511 days (exact expectation 524), k >= 2 on 0; ROT all equal 0 (expected 6e-4); MUL = 1, MUL = -1, MUL involution, MUL two equal, RC = 0: 0 each; every class within its expectation (table below) | PASS (census agrees with the exact table) |
+| Q2 census 2^32 | `census --count 2^32` | plants above | the model A tail against the exact table | queue 06, waiting in the box-1 lease pool since 21:28 UK | RUNNING |
+| Q4 the real calendar | `calendar --from 20729 --years 100` (36,525 days: 3 October 2026 to 3 October 2126) | the planted stream-shift pair must be found (it was) | worst day with date under A and C | worst day 29337 = 2050-04-28, cost A 203, model A gain 1.113x (an FPGA area gain; 1.0 for every chip and GPU); 15 days over 1.1x in 100 years (exact expectation 20.8), none over 1.2x; model C: no day with k >= 1 in 100 years (expectation 1.1) | FINDING (area reading only) |
+| Q5 cross-day structure | seed collisions, stream shifts by k in 1..72, shared MUL and RC values over the calendar | planted shift pair (found) | counts against expectation | 64-bit seed collisions 0 (expected 3.6e-11); stream shifts 0 (expected 5.2e-9); MUL values shared between two days 77 (expected 79.5), RC 39 (39.8): chance, and a shared constant hands a datapath nothing (the other 39 draws differ) | PASS (BOUND: nothing beyond chance) |
+| Q2 model B | `scm-refine` on the calendar (36,525 days), on the lowest 2^14 days of the 2^24 census, on a 2^16-day random sample | the self-test constants (3, 5, 7, 9, 2^32 - 1, 2^31 + 1 at 1 adder; 45 at 2): all as expected | the certified-cost distribution | exact sets: 90 constants at 1 adder, 4,101 at 2, 185,223 at 3, 7,983,205 at 4 (0.38 percent of odd constants at 4 or fewer under the restricted form); random words certified at 5 or fewer: 12.3 percent; the rest uncertified. Cost B is a PARTIAL metric (a certified word costs 5, an uncertified one w32 - 1), so its between-day spread (sample: mean 219, min 176; calendar worst day 43959 = 2090-05-10 at B 181) is the certificate's selectivity, not a measured gain, and is not read as one | PARTIAL (bound on the per-word chain length only) |
+| Q6 ROT diffusion | `avalanche` (1, 2, 3, 4, 8 applications; the 22 address bits; 1,024 states x 512 input bits) on the genesis day, the plants, the 7 worst ROT days of the census | plant rot1 and weakday must read weaker than the genesis day at 1 application: they do (mean flip 0.345 and 0.324 against 0.461; 16,197 and 11,454 input-output pairs never flipped against 5,534) | a per-day gain only if a bit-exact shortcut follows | at 2 applications every day, planted days included, reads mean 0.500, every output bit between 0.42 and 0.58 (sampling spread of 1,024 states), address bits 0.500, no pair unflipped; 8 applications sit between reads. No day gives a shortcut; gain 0 | PASS (BOUND) |
+| Q7 redraw rule | `redraw-census` 2^24 and 2^28 days with the rule below | `--max-cost 0` must reproduce the real draw on 1,000 days (asserted in the binary) | fraction redrawn; residual over 1.1x must be 0 | queue 07 | RUNNING |
+| Q8 anything else | watched while the rows ran; three observations, no box time | n/a | stated or measured | (1) Lead time: the only per-day attacker is an FPGA bitstream synthesised for the day, and synthesis of a full-device design takes hours (approximate, from memory; no figure measured here). Under the interim day rule (`bind::day_bytes`, a pure function of the calendar) the attacker has unlimited lead; under the spec's own proposal O-1.10 (day bytes carry the first epoch seed of the day, known about 20 minutes ahead, section 1.12) a per-day bitstream cannot be ready in time, which removes the whole class without a redraw. (2) The mixer stream is seeded by 64 bits of the day key (K[0], K[1]); K[2..7] enter only the item init; no collision or shift was found in 100 years or 2^24 days, and the planted shift was. (3) The 72 round keys are fixed multiples of 0x9E3779B9; RC + rk = 0 happened on 10 of 2^24 days (expected 4.5, within Poisson) and costs a datapath nothing on either side | PASS (stated) |
+| GPU rows | none needed | | | no row of this class depends on a GPU | BLOCKED (not applicable) |
+
+## Q7: the proposed redraw rule
+
+Rule, for the day's parameter draw (spec 1.8.4): after the forty draws, compute cost A = 64 + sum over the sixteen
+MUL of (w32(MUL) - 1), and the count k of MUL values with a 2-adder chain. If cost A <= 205 (a model A gain of 1.1x
+or more against the median 226), or k >= 1, or the eight ROT are equal, continue the SAME SplitMix64 stream and draw
+all forty again; repeat until accepted. The honest miner and the verifier pay forty more 64-bit draws per redraw,
+once a day; nothing else changes; every accepted day is a day the current rule could have drawn.
+
+| Quantity | Value |
+|---|---|
+| Fraction of days redrawn at least once (exact, models A and C) | 5.694e-4 + 3.123e-5 = 6.0e-4 (2^-10.7), about 22 days per 100 years |
+| Fraction over 1.1x under model A after the rule | 0 by construction; measured by queue 07 over 2^24 and 2^28 days (PENDING). Before the rule, measured: 5.677e-4 (2^24 census), 4.107e-4 (the 100-year calendar, 15 of 36,525 days) |
+| Fraction over 1.1x under model C after the rule | 0 (k = 0 on every accepted day) |
+| Chip-model reading after the rule | unchanged: 1.0 on every day before and after |
+| What the rule does not fix | the seed is 64 bits of the day key (K[0], K[1]); the day is a pure function of the calendar; both stand; neither is a weakness of this class on the numbers above |
+| The alternative that removes the class | the spec's O-1.10 day derivation (section 1.12): a day key known 20 minutes ahead leaves no time to synthesise a bitstream for it (hours, approximate); the redraw rule is then unnecessary for this class and harmless to keep |
+
+## Sections per row
+
+### Q0 plants (PASS)
+
+Command on box 1: `nice -n 10 taskset -c 8-95 adv-mixer-2 plant` (19:4x UK, 0.3 s; the only hand-started runs of
+this lane were the three smoke runs before the lease rule of 20:22 UK). Log: logs/adv-mixer-2/smoke-plant.log. The
+unplanted day 20729 (3 October 2026): ROT 6 25 5 25 29 11 9 21, cost A 219, classes "ROT same-word pair sums to 32"
+(ROT[5] + ROT[7] = 32) and "any pair sums to 32".
+
+### Q3 exact tail (FINDING on the area reading)
+
+Command on box 1: `adv-mixer-2 exact --threads 40` (19:5x UK, 10.3 s wall, 173 CPU-s). Log: logs/adv-mixer-2/
+exact-w32.log. The w32 table over all 2^31 odd constants:
+
+| w32 | Constants | Fraction |
+|---|---|---|
+| 1 | 2 | 9.3e-10 |
+| 2 | 118 | 5.5e-8 |
+| 3 | 3,136 | 1.5e-6 |
+| 4 | 49,608 | 2.3e-5 |
+| 5 | 520,000 | 2.4e-4 |
+| 6 | 3,805,120 | 1.8e-3 |
+| 7 | 19,948,544 | 9.3e-3 |
+| 8 | 75,681,408 | 3.5e-2 |
+| 9 | 207,381,504 | 9.7e-2 |
+| 10 | 405,171,200 | 0.189 |
+| 11 | 550,371,328 | 0.256 |
+| 12 | 498,774,016 | 0.232 |
+| 13 | 282,427,392 | 0.132 |
+| 14 | 89,686,016 | 4.2e-2 |
+| 15 | 13,107,200 | 6.1e-3 |
+| 16 | 557,056 | 2.6e-4 |
+
+The exact cost A distribution (64 + the 16-fold convolution of w32 - 1), cumulative at the gain thresholds against
+the median 226 (the log's own threshold table was printed against a provisional 231 and is superseded by this one,
+computed from the log's per-cost table):
+
+| Gain A | Cost A <= | P(day), exact | log2 | Days per 100 years |
+|---|---|---|---|---|
+| 1.05x | 215 | 4.717e-2 | -4.4 | 1,723 |
+| 1.1x | 205 | 5.694e-4 | -10.8 | 20.8 |
+| 1.15x | 196 | 1.660e-6 | -19.2 | 0.06 |
+| 1.2x | 188 | 2.132e-9 | -28.8 | 0.00008 |
+| 1.3x | 173 | 2.07e-16 | -52.1 | 0 |
+| 1.5x | 150 | under 1e-27 | under -91 | 0 |
+
+Reading: an FPGA built for the worst day in 100 years saves about 15 percent of its multiplier adders under model
+A (cost about 196 against 226); a chip, a GPU and the verifier save nothing. The planted weak day (cost 64) would be
+a 3.6x area gain; its probability under the real draw is 2^-27 for one MUL = 1 and under 2^-400 for all sixteen.
+
+### Q1 census over 2^24 consecutive chain days (PASS)
+
+Command on box 2 (queue 01, claimed and run by the chain at 21:22 UK, held 24 pool cores after a 578 s wait):
+`adv-mixer-2 census --from 20729 --count 2^24 --threads 24 --lowest 16384 --out-days .../tail-2p24.txt`, 0.3 s of
+compute. Log: logs/adv-mixer-2/census-2p24.log. Mean cost A 225.780 (exact 225.778), median 226, min 191, max 257.
+
+| Class | Count in 2^24 | Fraction | Analytic expectation | Worst day: cost A, gain A |
+|---|---|---|---|---|
+| ROT all equal | 0 | 0 | 3.6e-11 (0.0006 days) | none |
+| ROT distinct <= 2 | 4 | 2.4e-7 | 31 x 30 x (2^8 - 2) / 2 / 31^8 = 1.4e-7 (2.4 days) | day 57146 (2126-06-18): 220, 1.027x |
+| ROT distinct <= 3 | 534 | 3.2e-5 | 3.1e-5 | day 2230620: 201, 1.124x |
+| ROT distinct <= 4 | 26,010 | 1.55e-3 | about 1.5e-3 | day 1092491: 200, 1.130x |
+| ROT max multiplicity >= 4 | 35,631 | 2.1e-3 | 2.3e-3 | day 9506389: 200, 1.130x |
+| ROT same-word pair sums to 32 (ROT[0]+ROT[2], [1]+[3], [4]+[6], [5]+[7]) | 2,062,481 | 0.123 | 1 - (30/31)^4 = 0.123 | day 14377595: 194, 1.165x |
+| ROT two same-word pairs | 100,725 | 6.0e-3 | 6 x (1/31)^2 x (30/31)^2 = 5.9e-3 | day 3921743: 199, 1.136x |
+| ROT any pair sums to 32 | 10,022,037 | 0.597 | 0.60 | day 4819563: 191, 1.183x |
+| ROT >= 4 in {1, 31} | 16,545 | 9.9e-4 | 9.7e-4 | day 9911374: 200, 1.130x |
+| ROT all 8 in {1, 2, 30, 31} | 2 | 1.2e-7 | (4/31)^8 = 7.7e-8 (1.3 days) | day 14330190: 213, 1.061x |
+| ROT >= 4 in {8, 16, 24} | 74,541 | 4.4e-3 | 4.4e-3 | day 5517722: 195, 1.159x |
+| ROT column set equals diagonal set (as multisets) | 383 | 2.3e-5 | about 2e-5 | day 11582441: 209, 1.081x |
+| MUL any = 1 | 0 | 0 | 7.5e-9 (0.13 days) | none |
+| MUL any = 2^32 - 1 | 0 | 0 | 7.5e-9 | none |
+| MUL any involution (x^2 = 1: four values) | 0 | 0 | 3.0e-8 | none |
+| MUL any w32 <= 2 | 13 | 7.7e-7 | 16 x 5.6e-8 = 8.9e-7 | day 6861741: 214, 1.056x |
+| MUL any w32 <= 3 | 431 | 2.6e-5 | 16 x 1.5e-6 = 2.4e-5 | day 9217072: 198, 1.141x |
+| MUL any w32 <= 4 | 6,577 | 3.9e-4 | 16 x 2.5e-5 = 3.9e-4 | day 2257951: 197, 1.147x |
+| MUL two or more with w32 <= 4 | 1 | 6.0e-8 | 120 x (2.5e-5)^2 = 7.4e-8 | day 5274327: 211, 1.071x |
+| MUL two equal | 0 | 0 | 120 / 2^31 = 5.6e-8 | none |
+| MUL two inverse (a x b = 1) | 1 | 6.0e-8 | 5.6e-8 | day 12321130: 232 |
+| MUL in the exact 2-adder set (model C k >= 1) | 511 | 3.05e-5 | 3.12e-5 | day 9217072: 198 |
+| MUL model C k >= 2 | 0 | 0 | 4.6e-10 | none |
+| RC any = 0 | 0 | 0 | 3.7e-9 | none |
+| RC + rk = 0 for one of the 72 keys | 10 | 6.0e-7 | 16 x 72 / 2^32 = 2.7e-7 (4.5 days) | day 3194363: 212, 1.066x |
+| RC two equal | 1 | 6.0e-8 | 120 / 2^32 = 2.8e-8 | day 2875598: 220 |
+| RC[i] + rk = RC[j] + rk' (two words share one XOR constant in two applications) | 76 | 4.5e-6 | 120 x 142 / 2^32 = 4.0e-6 | day 3826820: 211, 1.071x |
+| cost A gain >= 1.1x (cost <= 205) | 9,525 | 5.68e-4 | 5.69e-4 exact | day 4819563: 191, 1.183x |
+| cost A gain >= 1.2x (cost <= 188) | 0 | 0 | 2.1e-9 (0.04 days) | none |
+
+Every count sits within its expectation (the RC + rk = 0 count, 10 against 4.5, is 2.6 sigma on a Poisson; the 2^32
+census re-reads it). What each class hands a per-day datapath: a ROT class 0 ops (rotations are wiring on every
+day); an RC class 0 ops (a constant XOR is inverters; RC + rk = 0 removes an inverter row the honest GPU does not
+pay for either); a MUL class the adders counted in cost A. No class gives a bit-exact shortcut (the verifier
+recomputes every application), so the wall-time gain for every GPU and the verifier is 1.0 on every day.
+
+### Q4 and Q5: the real calendar, 3 October 2026 to 3 October 2126 (FINDING on the area reading; BOUND on structure)
+
+Command on box 2 (queue 02, 21:31 UK, 24 leased cores, 0.3 s): `adv-mixer-2 calendar --from 20729 --years 100`.
+Log: logs/adv-mixer-2/calendar-100y.log. The day index is `bind::day_index` (Unix days); day 20729 is the chain's
+genesis day, 3 October 2026.
+
+| Rank | Day | Date | Cost A | Gain A (FPGA LUT area) | Gain, chip model and GPU |
+|---|---|---|---|---|---|
+| 1 | 29337 | 2050-04-28 | 203 | 1.113x | 1.0 |
+| 2 | 27945 | 2046-07-06 | 204 | 1.108x | 1.0 |
+| 3 | 31573 | 2056-06-11 | 204 | 1.108x | 1.0 |
+| 4 | 32331 | 2058-07-09 | 204 | 1.108x | 1.0 |
+| 5 | 33997 | 2063-01-30 | 204 | 1.108x | 1.0 |
+| 6 | 36268 | 2069-04-19 | 204 | 1.108x | 1.0 |
+| 7 | 38621 | 2075-09-28 | 204 | 1.108x | 1.0 |
+| 8 | 43959 | 2090-05-10 | 204 | 1.108x | 1.0 |
+| 9 | 22109 | 2030-07-14 | 205 | 1.102x | 1.0 |
+| 10 | 22633 | 2031-12-20 | 205 | 1.102x | 1.0 |
+
+15 of 36,525 days reach 1.1x under model A (expectation 20.8); none reaches 1.15x; the first is 14 July 2030. Model
+C: no day in 100 years (expectation 1.1). ROT all equal: none. MUL with w32 <= 3: none. RC + rk = 0: none. The
+cross-day structure:
+
+| Quantity | Count | Expected | Reading |
+|---|---|---|---|
+| 64-bit seed collisions (two days with identical parameters) | 0 | 3.6e-11 | none |
+| Stream shifts by k in 1..72 (seed_b = seed_a + k x gamma: one day's draws are another's, offset) | 0 | 5.2e-9 | none; the planted pair (s, s + gamma) was found by the same scan |
+| A MUL value shared by two days | 77 | 79.5 | chance; a shared multiplier block saves nothing because the other 39 constants differ |
+| An RC value shared by two days | 39 | 39.8 | chance; 0 ops anyway |
+
+### Q2 model B: certified shift-add chains (PARTIAL)
+
+Commands on box 2 (queue 03 and 04, 21:40 to 21:41 UK, 24 to 30 leased cores; sets built in 0.5 s, the three
+refines 2.1 s, 1.5 s and 3.5 s): `adv-mixer-2 scm-refine --from 20729 --count 36525`, `--days tail-2p24.txt` (the
+16,384 lowest-cost-A days of the 2^24 census), `--sample 65536 --seed 1` (random days in [genesis, genesis + 2^32)).
+Logs: logs/adv-mixer-2/scm-calendar.log, scm-tail-2p24.log, scm-sample-2p16.log. The restricted chain form: odd `a`,
+`b` already built, `a + (b << s)`, `a - (b << s)`, `(b << s) - a` for `s` in 1..31, or `a x b`; no odd-part
+normalisation across shifts, so every level is a subset of what a synthesiser reaches.
+
+| Adders | Odd constants (exact) | Fraction of 2^31 |
+|---|---|---|
+| 0 | 1 | 4.7e-10 |
+| 1 | 90 | 4.2e-8 |
+| 2 | 4,101 | 1.9e-6 |
+| 3 | 185,223 | 8.6e-5 |
+| 4 | 7,983,205 | 3.7e-3 |
+
+| Set | Words | Certified at 3 | At 4 | At 5 | Uncertified |
+|---|---|---|---|---|---|
+| Calendar, 36,525 days | 584,400 | 50 (8.6e-5) | 2,180 (3.7e-3) | 69,987 (12.0 percent) | 87.6 percent |
+| Random sample, 65,536 days | 1,048,576 | 79 (7.5e-5) | 3,777 (3.6e-3) | 125,020 (11.9 percent) | 88.1 percent |
+| Census tail, 16,384 lowest-A days | 262,144 | 329 (1.3e-3), plus 21 at 2 | 5,970 (2.3 percent) | 69,087 (26.4 percent) | 71.3 percent |
+
+Reading: the tail days are tail days because their constants are cheap, and the certificate reaches twice as many of
+their words (28.7 percent at 5 or fewer against 12.3 percent); a synthesiser's real cost per word is at most 5 for
+those and unknown for the rest, so the FPGA's true per-day spread is bounded above by model A's and is not measured
+here. A longer pass computes the optimal chain length for every odd constant (an exhaustive adder-graph search over
+2^31 values, feasible on a box in hours) and replaces models A and B with the exact per-word table.
+
+### Q6 ROT diffusion (PASS, BOUND)
+
+Command on box 2 (queue 05, 21:41 to 21:4x UK, 1 leased core each, 5 s to 60 s per day): `adv-mixer-2 avalanche
+--index <day> --states 1024` and `--plant alleq|rot1|weakday`. Logs: logs/adv-mixer-2/avalanche-*.log. Round keys
+of round 0 (`round_key_mult(0, j, 8)`); each of the 512 input bits flipped on 1,024 random states; mean flip
+fraction over the 512 x 512 input-output pairs, the minimum and maximum per pair, the 22 address bits of s[0], and
+the pairs never flipped.
+
+| Day | ROT | Why chosen | k = 1: mean, address mean, pairs never flipped | k = 2: mean, min, max, address mean, never | k = 8: mean, never |
+|---|---|---|---|---|---|
+| 20729 (genesis) | 6 25 5 25 29 11 9 21 | reference | 0.461, 0.427, 5,534 | 0.500, 0.424, 0.574, 0.500, 0 | 0.500, 0 |
+| plant alleq | 6 x 8 | the brief's planted shape | 0.461, 0.440, 2,192 | 0.500, 0.424, 0.570, 0.500, 0 | 0.500, 0 |
+| plant rot1 | 1 x 8 | the weakest all-equal draw | 0.345, 0.313, 16,197 | 0.500, 0.428, 0.565, 0.500, 0 | 0.500, 0 |
+| plant weakday | 6 x 8, MUL = 1 | all ROT equal and MUL = 1 | 0.324, 0.268, 11,454 | 0.500, 0.431, 0.567, 0.500, 0 | 0.500, 0 |
+| 57146 (2126-06-18) | 8 27 27 27 27 8 8 8 | ROT distinct <= 2, the only such day in 100 years | 0.460, 0.401, 4,151 | 0.500, 0.430, 0.572, 0.500, 0 | 0.500, 0 |
+| 2230620 | 23 1 1 27 23 23 23 1 | ROT distinct <= 3, worst | 0.451, 0.430, 5,857 | 0.500, 0.426, 0.570, 0.500, 0 | 0.500, 0 |
+| 3921743 | 7 30 25 2 30 10 26 30 | two same-word pairs sum to 32 | 0.455, 0.419, 4,729 | 0.500, 0.421, 0.576, 0.500, 0 | 0.500, 0 |
+| 9911374 | 23 13 1 1 31 5 31 10 | >= 4 in {1, 31} | 0.453, 0.441, 4,274 | 0.500, 0.429, 0.573, 0.500, 0 | 0.500, 0 |
+| 14330190 | 1 1 2 31 1 31 1 31 | all 8 in {1, 2, 30, 31} | 0.331, 0.282, 19,948 | 0.500, 0.336, 0.666, 0.499, 0 | 0.500, 0 |
+| 5517722 | 19 8 24 20 19 8 2 8 | >= 4 byte-aligned | 0.448, 0.410, 5,562 | 0.500, 0.432, 0.570, 0.500, 0 | 0.500, 0 |
+| 11582441 | 24 7 12 15 12 7 24 15 | column set equals diagonal set | 0.467, 0.431, 2,040 | 0.500, 0.430, 0.567, 0.500, 0 | 0.500, 0 |
+
+Reading: one application never diffuses fully on any day (the quarter-round structure, not the draw), and the draws
+in {1, 2, 30, 31} diffuse least at k = 1 (0.33 against 0.46). By k = 2 every day, the planted ones included, sits at
+the uniform 0.500 with every pair flipped, and the 22 address bits with them; 8 applications separate consecutive
+cache reads and 72 make an item. No ROT draw lets an attacker predict an address or skip an application, and a
+bit-exact verifier would reject the result if one did. Gain from any ROT class: 0 ops on every day.
+
+### Reconciliation with the attack-pass lane's F4 census (read: docs/analysis/attack-pass/f4-weakday.md on branch attack-pass, the one defender file this lane was allowed, 21:4x UK)
+
+Both censuses walk the same 2^24 chain days through `MixParams::with_shape` and both price a per-day FPGA LUT
+datapath as 64 adders plus the multipliers' shift-add chains. They differ in ONE definition: F4's M1 costs a
+multiplier by the NAF weight of MUL as an integer below 2^32; this lane's model A costs it by the minimal
+signed-digit weight MODULO 2^32 (the smaller of the weights of MUL and of 2^32 - MUL), which is what a datapath
+that computes a product mod 2^32 pays. The modular weight is never larger, averages 11.11 per word against about
+11.4, and so moves the median from 231 to 226 and widens the relative tail.
+
+| Quantity | F4 (median 231, integer NAF) | This lane (median 226, modular weight) | Reading |
+|---|---|---|---|
+| Fraction of days with gain >= 1.1x, 2^24 census | 3.264e-4 (5,476 days) | 5.677e-4 (9,525 days) | both over 2^-20 (9.5e-7), by 342x and 595x |
+| The same, exact expectation | 3.24e-4 | 5.694e-4 | each census matches its own table |
+| Days over 1.1x in the first 100 years (36,525 days) | 6 (expectation 12) | 15 (expectation 20.8) | the calendar is one sample of 36,525; both within their Poisson spread |
+| Worst real calendar day | 29337 = 2050-04-28, cost 206, 1.121x | 29337 = 2050-04-28, cost 203, 1.113x | THE SAME DAY under both metrics |
+| First day over 1.1x | 22633 (2031-12-20), 1.111x | 22109 (2030-07-14), 1.102x; 22633 reads 1.102x | |
+| Worst day in 2^24 | 4819563, cost 197, 1.173x | 4819563, cost 191, 1.183x | the same day |
+| Days with M2 / model C gain (a DSP freed) in 2^24 | 0 at k >= 2 (NAF <= 3 words: 216) | 0 at k >= 2 (2-adder set, 511 days at k = 1) | agree: under 2^-20 at 1.1x |
+| ROT all equal, MUL = 1, RC = 0 | 0, 0, 0 | 0, 0, 0 | agree |
+
+Agreed figures (reconciled with the attack-pass lane at 21:5x UK; its record carries the same side-by-side in its
+section 9): the cause of the whole difference is one digit. F4's `naf_weight` takes the canonical NAF of the constant
+as a u64 and counts the carry digit at position 32, which a 32-bit odd constant carries with probability 1/3
+(measured there on 2^18 constants: mean weight 11.442 with it, 11.109 without; this lane's exact table gives
+11.1111); a multiplier modulo 2^32 never builds a digit at position 32. So the agreed convention is this lane's:
+median 226, a 1.1x gain at cost A <= 205, 5.69e-4 of days (2^-10.8 against the 2^-20 threshold), 15 days a century,
+worst day 29337 = 28 April 2050 at 1.113x; the DSP readings agree (0 at k >= 2, 1.067x at k >= 1 on 3.12e-5); the
+redraw rule for the next class takes the form in Q7. Both lanes read the threshold as crossed on the LUT-area
+reading only; F4's verdict (PASS against class v4 on the DSP-bound reading, the LUT tail bounded) stands, and this
+lane's reading of the same numbers is FINDING on the area reading, BOUND for every chip, GPU and the verifier. F4
+also timed the verifier on the worst day (pending in its record when read), which this lane did not repeat: the
+verifier's instruction count is day-independent by construction.
+
+### Ledger of rule changes during the run (box-hours stay honest)
+
+| Time (UK) | Change | Effect on this lane |
+|---|---|---|
+| 19:22 | worktree cut from build/master 7a7caa34; IDENTICAL check | none |
+| 19:32 | plan pushed 5704a7b3 | |
+| 19:4x | SIGSTOP yield to builds dropped; nice 10 on cores 8 to 95 | run-box.sh rewritten before any sweep |
+| 19:4x | logs out of the worktree mirror (/srv/builds/_adv-adv-mixer-2/) | adopted before any sweep |
+| 19:40 to 19:50 | three smoke runs on box 1 by hand (plant 0.3 s, day, census 2^20 0.3 s, exact 10 s) | 0.05 box-hours |
+| 20:22 | `lease pool` is the only way to start a sweep | queue files rewritten; nothing of this lane was running |
+| 20:40 | priority classes release > v5 > measure > adv; 32 cores --min 16 | queue files at 32/16 |
+| 21:12 | box 2 open to adv-* | chain 01 to 05 started on box 2 at 21:22, chain 06 to 07 on box 1 at 21:28 |
+| 21:31 | queue 01 and 02 done on box 2 (0.3 s each after a 578 s lease wait); 03 scm-calendar started on 24 cores | 0.01 box-hours |
+| 21:36 | 03 and the chain stopped by pid file (stop-tree.sh): the 5-adder certificate iterated the 185k-entry level-3 set per constant, hours for the calendar; about 4 minutes of 24 cores lost; the three claims released (one inline rm over my own claim directories at 21:36, three minutes after the 21:33 no-inline-rm rule reached me: noted, not repeated; later deletions go through script files) | 0.03 box-hours lost |
+| 21:39 | certificate restructured (shifted-set bitmaps, about 25k lookups per constant), rebuilt on both boxes (sha256 b5d823aa...), chain 03 to 05 restarted on box 2 | |
+| 21:40 to 21:4x | queue 03, 04, 05 done on box 2 (scm 2 to 4 s each on 24 to 30 cores; eleven avalanche runs on 1 core each) | 0.03 box-hours |
+
+Box-hours spent so far: 0.12 (the smoke runs, queue 01 to 05 and the stopped 03). The 2^32 census and the redraw census wait on box 1. Pod-hours: 0. GPU: none.
+
+## Bound reached, honestly
+
+Exact for model A and model C over the whole draw space (every odd constant counted, not sampled); the census rows,
+the real-calendar worst day, model B and the diffusion numbers are pending the lease pool. A longer pass would add
+model B certificates past 5 adders (an exact optimal-SCM table for all 2^31 constants) and a census over 2^36 days
+for the model A tail below 2^-28; neither changes the crossing above, which is exact.

docs/plans/cryptanalysis/plan-mixer-2.md

@@ -0,0 +1,112 @@
+# Attack plan: the day-key weakness class of the mixer M_r (lane adv-mixer-2)
+
+Internal adversarial pass, not an independent review. Every sentence below that could be quoted carries that label.
+
+| Field | Value |
+|---|---|
+| Lane | adv-mixer-2, question class: weak parameter draws of M_r (the day-key weakness class) |
+| Target commit | 017e70376489251e18564c0abce7e466e606c8b3 (class v4 sub-version 3, object byte 7) |
+| Branch | adv-mixer-2, cut from build/master 7a7caa34 at 19:22 UK, 7 October 2026; merged build/master 04c4d9bc at 19:40 UK |
+| Byte identity | `git diff --quiet 017e7037... HEAD -- igneum-pow` printed IDENTICAL at both 7a7caa34 and 04c4d9bc (the whole crate, every file) |
+| Attacker | an outsider with the public kit; nothing read under docs/ beyond the spec, chip-model-v3.md sections 1, 2, 5, 6 and the siblings' cryptanalysis files |
+| Plan due | 20:25 UK, 7 October 2026. First report rows due 00:00 UK, 8 October |
+| Toolchain | rustc 1.99.0 on both boxes; the Mac's PATH rustc is 1.69.0 and is never used (no cargo on the Mac) |
+
+## 1. The target, restated from spec and code
+
+Spec 01 sections 1.3, 1.8.1, 1.8.4, 1.8.5, 1.12; code `igneum-pow/src/seed.rs`, `memhard.rs`, `bind.rs`, `generator.rs`.
+
+1. The day. `bind::day_index(ts_ms) = ts_ms / 86,400,000`, so the day is the Unix day count. Day bytes are
+   `"igneum-day/" || le64(day)` (19 bytes). The Devnet 3 pack carries day 20733 and the public epoch-0 pack day
+   20730; the genesis day of the chain is 20729 (3 October 2026, `bind.rs` test). Nothing from the chain enters the
+   day key: every future day's parameters are computable today.
+2. The day key. `K[0..7] = seed_words_from_bytes(day_bytes)`: four FNV-1a 64 passes with salted bases, each
+   finished with the murmur mix, split into two 32-bit words. Only `K[0] | K[1] << 32` (salt 0, 64 bits) seeds the
+   mixer stream. K[2..7] enter the item init only.
+3. The draw. One SplitMix64 stream from that 64-bit seed: `ROT[i] = 1 + next() mod 31` for i in 0..7, then
+   `MUL[i] = low32(next()) | 1` for 0..15, then `RC[i] = low32(next())` for 0..15. Forty draws, in that order.
+4. The mixer. `M(s, rk)`: per word `s[i] = (s[i] ^ (RC[i] + rk)) * MUL[i]`, then one ChaCha-shaped double round
+   (four column quarter rounds with ROT[0..3], four diagonal with ROT[4..7]). Class v4 is `MX8` plus a shadow
+   block: `mixer_mult = 8`, `derive_len = 0`, so M is applied 8 times between dependent reads with round keys
+   `(r*8 + j + 1) * 0x9E3779B9`, 72 applications per item, 9 rounds of 8.
+5. The price. chip-model-v3.md 5.2: 128 ops per application with `RC[i] + rk` hoisted, 9,360 ops per item
+   (72 x 128 + 144 init and fold). Every gain below is priced against 9,360 per item, and against 130 per
+   application where the spec's figure is the reference.
+
+A weak day is a draw whose constants let a datapath BUILT FOR THAT DAY do less than 9,360 ops' worth of work per
+item. A bit-exact verifier never lets any attacker skip an application, so the per-day gain lives only in what a
+constant costs when it is baked into hardware: a constant rotation is wiring (0 ops on every day), a constant XOR
+is inverters (0 ops on every day), and a constant multiply is a shift-add chain whose length depends on the day.
+The only per-day attacker that exists is an FPGA bitstream synthesised for the day (an ASIC cannot be masked per
+day). The absolute standing of that attacker against a GPU is a separate question and is stated as unknown.
+
+## 2. The questions, in order
+
+| # | Question | Result shape |
+|---|---|---|
+| Q1 | Census of structural classes over 2^24 consecutive chain days from genesis (ROT, MUL, RC, cross-field) | counts, fractions, analytic expectation, worst day per class |
+| Q2 | Per-day gain under three cost models (below), over the same 2^24, then 2^32 days | gain histogram, fraction over 1.1x, 1.2x, 1.5x, 2x, largest gain, its day |
+| Q3 | Exact tail by convolution: per-word cost table over all 2^31 odd constants, 16-fold convolution | P(gain > 1.1x) exact under model A; compared with Q2's census |
+| Q4 | The real calendar: every day from genesis for 100 years (20729 to 57253) | worst day with ISO date and gain under each model; the first ten |
+| Q5 | Cross-day structure: 64-bit seed collisions, stream shifts (seeds differing by k x 0x9E3779B97F4A7C15, |k| <= 72), shared constants between days | counts over the calendar and over 2^24 days |
+| Q6 | ROT functional check: avalanche of 1, 2, 4, 8 applications and of the 22 address bits, on the worst ROT days found and on the planted all-equal day | diffusion numbers against a median day; a per-day gain only if a bit-exact shortcut follows, else 0 |
+| Q7 | Redraw rule if the fraction with gain over 1.1x exceeds 2^-20 per day | the rule, its own census, its cost to the honest miner |
+| Q8 | Anything else seen in Q1 to Q7 | measured or stated unknown |
+
+Cost models, defined here and not borrowed:
+
+| Model | Cost per application | What it prices |
+|---|---|---|
+| A, LUT shift-add | 64 + sum_i (w32(MUL_i) - 1), with w32 the minimal signed-digit weight of MUL_i MODULO 2^32 (the smaller of the NAF weight of the constant and of its 2^32 complement, digits at position 32 and above discarded) | an FPGA datapath for the day: adders for the quarter rounds (32 add + 32 xor) plus a canonical signed-digit multiplier per word; constant rotations and XORs free |
+| B, certified shift-add | 64 + sum_i scm_i, with scm_i the smallest adder count for which a chain is CERTIFIED (exact sets for 1, 2, 3 adders by bitmap; a 4-adder certificate by decomposition over those sets; otherwise w32 - 1) | the same datapath with the multiplier optimised, as a synthesiser would; an upper bound on the attacker's cost, so a lower bound on his gain |
+| C, DSP | 16 / (16 - k), k the words whose constant has w32 <= 3 and leaves its DSP block for LUTs | an FPGA whose multipliers sit in DSP blocks, value-independent, with the cheap ones moved out |
+
+Gain of a day under a model = the median day's cost over the day's cost. A day's MUL = 1 words count 0 adders
+under A and B (the planted shape).
+
+## 3. Method and tool per question
+
+Harness: `tools/attack/adv-mixer-2/` (crate `attack-adv-mixer-2`, binary `adv-mixer-2`, `igneum-pow` by path,
+nothing re-implemented: every key and draw comes from `bind::day_bytes`, `seed_words_from_bytes`,
+`MixParams::with_shape(key, Shape::for_class(&V4_CLASS))`, and `memhard::mixer` for Q6). Commands:
+
+| Command | Question | Known-failed shape (must fire) | Box-hours (estimate) |
+|---|---|---|---|
+| `census --from 20729 --count 2^24 --threads N` | Q1, Q2 (models A, C; B on the tail) | `plant alleq`, `plant mul1`, `plant mul1all`, `plant rcrk0`: the day-20729 draw with the field replaced, run through the same classifier, must land in its class and show its gain (mul1all: cost 64 under A, gain about 3.4x) | 0.1 |
+| `census --from 20729 --count 2^32 --threads N` | Q2 extended | same plants | 1.5 |
+| `exact --threads N` | Q3 | the table must give P(MUL = 1) = 2^-31 and the convolution's mean must match the census mean within 0.01 | 0.3 |
+| `scm-build` then `scm-refine --days <file>` | Q2 model B on the calendar, on the census tail (lowest 2^14 days under A) and on a 2^16-day random sample | `scm-refine` on MUL = 3, 5, 7, 9 must certify 1 adder; on 0x9E3779B9 it must certify at most w32 - 1 | 1.5 |
+| `calendar --from 20729 --years 100` | Q4, Q5 (collisions, shifts) | a planted pair of days with seeds differing by one gamma must be found by the shift scan | 0.1 |
+| `avalanche --index <day> [--plant alleq]` | Q6 | the planted all-equal ROT day runs beside a median day; a `--plant rot1` (all ROT = 1) must show weaker single-application diffusion than the median | 0.5 |
+| `redraw-census` | Q7 | the proposed rule applied to 2^24 days: fraction redrawn, fraction over 1.1x after the rule, which must be 0 | 0.2 |
+
+Runs over 10 minutes go through `tools/attack/adv-mixer-2/run-box.sh` on the box: `nohup nice -n 10` in a setsid
+process group, pid file beside the log under `/srv/builds/igneum-wt-adv-mixer-2/adv/`, a 5 s poll of
+`/srv/builds/_locks` (build-k, quiet, core-*) that SIGSTOPs the group while any is held and SIGCONTs when clear,
+the pattern of `infra/build-server/capacity/run.sh`. Every sweep is a queue file
+`/srv/builds/_adv/mixer/queue/NN-adv-mixer-2-<name>.sh` on build-2, claimed by `mkdir .../claims/<file>` before it
+runs. CPU-bound sweeps run on build-1 (load 9 to 16 at 19:40 UK against build-2's 55 to 65); the binary is
+built on both boxes so a queue file runs on either. No GPU is used; no row needs one.
+
+Total estimate: about 4 box-hours. 8 is the reading line, 16 the ask line.
+
+## 4. What is already known from the siblings (read, not relied on)
+
+adv-mixer's report (branch build/adv-mixer) ran the f4 census: M1 cost mean 231, 3.26e-4 of days over 1.1x on
+its generous metric, 0 days with M2 gain, ROT all equal never seen. This lane recomputes with its own cost models
+(modular weight, certified chains), adds the exact tail, the real calendar with dates, the cross-day structure and a
+redraw rule. Where the two censuses agree the agreement is stated; where they differ the difference is explained.
+
+## 5. Files opened (the outsider rule)
+
+| File | Why |
+|---|---|
+| igneum-pow/Cargo.toml, Cargo.lock (listed), src/seed.rs, src/memhard.rs, src/bind.rs, src/generator.rs (LoadClass, MX8, V3_CLASS, V4_CLASS), tests/mixer.rs (header, contract) | the target |
+| docs/spec/01-lottery-hash.md at 017e7037: 1.2, 1.3, 1.8, 1.12 | the target |
+| docs/analysis/chip-model-v3.md sections 1, 2, 5, 6 | the price |
+| proto-cuda/packs-ca3-v4/ (listing), v4-devnet-epoch0/program.json (day fields) | the public kit |
+| /srv/artefacts/packs/v4-devnet3-epoch0.zip on build-1: sha256 e025750f... verified | the public kit |
+| tools/attack/f4-weakday/{Cargo.toml, src/main.rs} from build/attack-pass | prior harness, read only |
+| tools/attack/f8-uniform/{Cargo.toml, src/main.rs} (header) | prior harness, read only |
+| tools/build-remote.sh, infra/build-server/lib.sh, remote-run.sh, capacity/lib.sh, capacity/run.sh, capacity/ (listing) | operating files |
+| build/adv-mixer: docs/plans/cryptanalysis/plan-mixer.md, docs/analysis/cryptanalysis/report-mixer.md; build/adv-accept and build/adv-cache: file listings only | siblings |

tools/attack/adv-mixer-2/Cargo.lock

@@ -0,0 +1,14 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "attack-adv-mixer-2"
+version = "0.1.0"
+dependencies = [
+ "igneum-pow",
+]
+
+[[package]]
+name = "igneum-pow"
+version = "0.2.0"

tools/attack/adv-mixer-2/Cargo.toml

@@ -0,0 +1,21 @@
+[package]
+name = "attack-adv-mixer-2"
+version = "0.1.0"
+edition = "2021"
+description = "Adversarial lane adv-mixer-2: the day-key weakness class of the mixer M_r (weak parameter draws), censused through the real draw code of igneum-pow"
+license = "MIT"
+publish = false
+
+[[bin]]
+name = "adv-mixer-2"
+path = "src/main.rs"
+
+[dependencies]
+igneum-pow = { path = "../../../igneum-pow" }
+
+[workspace]
+
+[profile.release]
+opt-level = 3
+lto = true
+codegen-units = 1

tools/attack/adv-mixer-2/queue/01-adv-mixer-2-census-2p24.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# adv-mixer-2 queue file (owner: lane adv-mixer-2). Self-contained: binary, args, log, pid file. Runs on either box through /srv/builds/_bin/lease pool (rule of 20:22 UK, 7 October 2026).
+set -uo pipefail
+B=/srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2
+L=/srv/builds/_adv-adv-mixer-2/logs
+mkdir -p "$L"
+run() { # <name> <lease-threads> <min> <args...>: one sweep through lease pool (class adv), log + pid file beside it
+  local name="$1" thr="$2" mn="$3"; shift 3
+  echo "$(date -u +%FT%TZ) start $name (lease pool $thr min $mn): $B $*" >> "$L/$name.log"
+  /srv/builds/_bin/lease pool "$thr" --min "$mn" --label "adv-mixer-2 $name" --owner adv-mixer-2 -- "$B" "$@" >> "$L/$name.log" 2>&1 &
+  echo $! > "$L/$name.pid"
+  wait $!
+  local rc=$?
+  echo "$(date -u +%FT%TZ) end $name rc=$rc" >> "$L/$name.log"
+  rm -f "$L/$name.pid"
+}
+run census-2p24 32 16 census --from 20729 --count 2^24 --threads {cores} --lowest 16384 --out-days "$L/tail-2p24.txt"

tools/attack/adv-mixer-2/queue/02-adv-mixer-2-calendar.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# adv-mixer-2 queue file (owner: lane adv-mixer-2). Self-contained: binary, args, log, pid file. Runs on either box through /srv/builds/_bin/lease pool (rule of 20:22 UK, 7 October 2026).
+set -uo pipefail
+B=/srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2
+L=/srv/builds/_adv-adv-mixer-2/logs
+mkdir -p "$L"
+run() { # <name> <lease-threads> <min> <args...>: one sweep through lease pool (class adv), log + pid file beside it
+  local name="$1" thr="$2" mn="$3"; shift 3
+  echo "$(date -u +%FT%TZ) start $name (lease pool $thr min $mn): $B $*" >> "$L/$name.log"
+  /srv/builds/_bin/lease pool "$thr" --min "$mn" --label "adv-mixer-2 $name" --owner adv-mixer-2 -- "$B" "$@" >> "$L/$name.log" 2>&1 &
+  echo $! > "$L/$name.pid"
+  wait $!
+  local rc=$?
+  echo "$(date -u +%FT%TZ) end $name rc=$rc" >> "$L/$name.log"
+  rm -f "$L/$name.pid"
+}
+run calendar-100y 32 16 calendar --from 20729 --years 100 --threads {cores}

tools/attack/adv-mixer-2/queue/03-adv-mixer-2-scm-calendar.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# adv-mixer-2 queue file (owner: lane adv-mixer-2). Self-contained: binary, args, log, pid file. Runs on either box through /srv/builds/_bin/lease pool (rule of 20:22 UK, 7 October 2026).
+set -uo pipefail
+B=/srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2
+L=/srv/builds/_adv-adv-mixer-2/logs
+mkdir -p "$L"
+run() { # <name> <lease-threads> <min> <args...>: one sweep through lease pool (class adv), log + pid file beside it
+  local name="$1" thr="$2" mn="$3"; shift 3
+  echo "$(date -u +%FT%TZ) start $name (lease pool $thr min $mn): $B $*" >> "$L/$name.log"
+  /srv/builds/_bin/lease pool "$thr" --min "$mn" --label "adv-mixer-2 $name" --owner adv-mixer-2 -- "$B" "$@" >> "$L/$name.log" 2>&1 &
+  echo $! > "$L/$name.pid"
+  wait $!
+  local rc=$?
+  echo "$(date -u +%FT%TZ) end $name rc=$rc" >> "$L/$name.log"
+  rm -f "$L/$name.pid"
+}
+run scm-calendar 32 16 scm-refine --from 20729 --count 36525 --threads {cores}

tools/attack/adv-mixer-2/queue/04-adv-mixer-2-scm-tail-sample.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# adv-mixer-2 queue file (owner: lane adv-mixer-2). Self-contained: binary, args, log, pid file. Runs on either box through /srv/builds/_bin/lease pool (rule of 20:22 UK, 7 October 2026).
+set -uo pipefail
+B=/srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2
+L=/srv/builds/_adv-adv-mixer-2/logs
+mkdir -p "$L"
+run() { # <name> <lease-threads> <min> <args...>: one sweep through lease pool (class adv), log + pid file beside it
+  local name="$1" thr="$2" mn="$3"; shift 3
+  echo "$(date -u +%FT%TZ) start $name (lease pool $thr min $mn): $B $*" >> "$L/$name.log"
+  /srv/builds/_bin/lease pool "$thr" --min "$mn" --label "adv-mixer-2 $name" --owner adv-mixer-2 -- "$B" "$@" >> "$L/$name.log" 2>&1 &
+  echo $! > "$L/$name.pid"
+  wait $!
+  local rc=$?
+  echo "$(date -u +%FT%TZ) end $name rc=$rc" >> "$L/$name.log"
+  rm -f "$L/$name.pid"
+}
+while [ ! -s "$L/tail-2p24.txt" ]; do sleep 30; done
+run scm-tail-2p24 32 16 scm-refine --days "$L/tail-2p24.txt" --threads {cores}
+run scm-sample-2p16 32 16 scm-refine --sample 65536 --seed 1 --threads {cores}

tools/attack/adv-mixer-2/queue/05-adv-mixer-2-avalanche.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# adv-mixer-2 queue file (owner: lane adv-mixer-2). Self-contained: binary, args, log, pid file. Runs on either box through /srv/builds/_bin/lease pool (rule of 20:22 UK, 7 October 2026).
+set -uo pipefail
+B=/srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2
+L=/srv/builds/_adv-adv-mixer-2/logs
+mkdir -p "$L"
+run() { # <name> <lease-threads> <min> <args...>: one sweep through lease pool (class adv), log + pid file beside it
+  local name="$1" thr="$2" mn="$3"; shift 3
+  echo "$(date -u +%FT%TZ) start $name (lease pool $thr min $mn): $B $*" >> "$L/$name.log"
+  /srv/builds/_bin/lease pool "$thr" --min "$mn" --label "adv-mixer-2 $name" --owner adv-mixer-2 -- "$B" "$@" >> "$L/$name.log" 2>&1 &
+  echo $! > "$L/$name.pid"
+  wait $!
+  local rc=$?
+  echo "$(date -u +%FT%TZ) end $name rc=$rc" >> "$L/$name.log"
+  rm -f "$L/$name.pid"
+}
+run avalanche-genesis 1 1 avalanche --index 20729 --states 1024
+run avalanche-plant-alleq 1 1 avalanche --plant alleq --states 1024
+run avalanche-plant-rot1 1 1 avalanche --plant rot1 --states 1024
+run avalanche-plant-weakday 1 1 avalanche --plant weakday --states 1024
+# the worst ROT days of the 2^24 census, read from its log once it exists
+while [ ! -f "$L/census-2p24.log" ] || ! grep -q "end census-2p24" "$L/census-2p24.log"; do sleep 30; done
+for cls in "ROT distinct <= 2" "ROT distinct <= 3" "ROT two same-word pairs sum to 32" "ROT >= 4 in {1,31}" "ROT all 8 in {1,2,30,31}" "ROT >= 4 in {8,16,24}" "ROT column set == diagonal set"; do
+  d=$(grep -F "| $cls |" "$L/census-2p24.log" | head -1 | sed -n 's/.*day \([0-9]*\):.*/\1/p')
+  [ -n "$d" ] && run "avalanche-day-$d" 1 1 avalanche --index "$d" --states 1024
+done

tools/attack/adv-mixer-2/queue/06-adv-mixer-2-census-2p32.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# adv-mixer-2 queue file (owner: lane adv-mixer-2). Self-contained: binary, args, log, pid file. Runs on either box through /srv/builds/_bin/lease pool (rule of 20:22 UK, 7 October 2026).
+set -uo pipefail
+B=/srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2
+L=/srv/builds/_adv-adv-mixer-2/logs
+mkdir -p "$L"
+run() { # <name> <lease-threads> <min> <args...>: one sweep through lease pool (class adv), log + pid file beside it
+  local name="$1" thr="$2" mn="$3"; shift 3
+  echo "$(date -u +%FT%TZ) start $name (lease pool $thr min $mn): $B $*" >> "$L/$name.log"
+  /srv/builds/_bin/lease pool "$thr" --min "$mn" --label "adv-mixer-2 $name" --owner adv-mixer-2 -- "$B" "$@" >> "$L/$name.log" 2>&1 &
+  echo $! > "$L/$name.pid"
+  wait $!
+  local rc=$?
+  echo "$(date -u +%FT%TZ) end $name rc=$rc" >> "$L/$name.log"
+  rm -f "$L/$name.pid"
+}
+run census-2p32 32 16 census --from 20729 --count 2^32 --threads {cores} --lowest 4096 --out-days "$L/tail-2p32.txt"

tools/attack/adv-mixer-2/queue/07-adv-mixer-2-redraw.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# adv-mixer-2 queue file (owner: lane adv-mixer-2). Self-contained: binary, args, log, pid file. Runs on either box through /srv/builds/_bin/lease pool (rule of 20:22 UK, 7 October 2026).
+set -uo pipefail
+B=/srv/builds/_adv-adv-mixer-2/bin/adv-mixer-2
+L=/srv/builds/_adv-adv-mixer-2/logs
+mkdir -p "$L"
+run() { # <name> <lease-threads> <min> <args...>: one sweep through lease pool (class adv), log + pid file beside it
+  local name="$1" thr="$2" mn="$3"; shift 3
+  echo "$(date -u +%FT%TZ) start $name (lease pool $thr min $mn): $B $*" >> "$L/$name.log"
+  /srv/builds/_bin/lease pool "$thr" --min "$mn" --label "adv-mixer-2 $name" --owner adv-mixer-2 -- "$B" "$@" >> "$L/$name.log" 2>&1 &
+  echo $! > "$L/$name.pid"
+  wait $!
+  local rc=$?
+  echo "$(date -u +%FT%TZ) end $name rc=$rc" >> "$L/$name.log"
+  rm -f "$L/$name.pid"
+}
+run redraw-2p24-206 32 16 redraw-census --from 20729 --count 2^24 --threads {cores} --max-cost 206
+run redraw-2p28-206 32 16 redraw-census --from 20729 --count 2^28 --threads {cores} --max-cost 206

tools/attack/adv-mixer-2/run-box.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# adv-mixer-2 chain runner (Mac side). For each queue file named: claim it on build-2 (mkdir
+# /srv/builds/_adv/mixer/claims/<file>, atomic; exists = taken), copy its text to the named box and run it there in one
+# detached chain, in order. Every queue file is self-contained and starts its binary only through
+# `/srv/builds/_bin/lease pool` (class adv, 32 cores, --min 16; single-threaded sweeps take 1), which pins and nices it.
+# Logs and pid files live under /srv/builds/_adv-adv-mixer-2/ on the box, never under the worktree mirror. Kill by pid
+# file only. History: 19:4x UK the SIGSTOP yield was dropped (cores 8 to 95 at nice 10); 20:22 UK the lease pool
+# became the only way to start a sweep; 20:40 UK priority classes (release > v5 > measure > adv).
+# Usage: run-box.sh <1|2> <queue-file-name>...
+set -euo pipefail
+BOX="$1"; shift
+KEY=~/.ssh/igneum_ed25519
+H1=$(head -1 ~/.config/igneum/build-server); H2=$(head -1 ~/.config/igneum/build-server-2)
+case "$BOX" in 1) H="$H1" ;; 2) H="$H2" ;; *) echo "box 1 or 2" >&2; exit 2 ;; esac
+QDIR=/srv/builds/_adv/mixer/queue; CDIR=/srv/builds/_adv/mixer/claims
+CHAIN=""
+for Q in "$@"; do
+  if ssh -i "$KEY" -o BatchMode=yes "$H2" "mkdir '$CDIR/$Q' 2>/dev/null && echo 'adv-mixer-2 box $BOX '\$(date -u +%FT%TZ) > '$CDIR/$Q/owner'"; then
+    BODY=$(ssh -i "$KEY" -o BatchMode=yes "$H2" "cat '$QDIR/$Q'")
+    ssh -i "$KEY" -o BatchMode=yes "$H" "mkdir -p /srv/builds/_adv-adv-mixer-2/logs /srv/builds/_adv-adv-mixer-2/q && cat > /srv/builds/_adv-adv-mixer-2/q/$Q && chmod +x /srv/builds/_adv-adv-mixer-2/q/$Q" <<< "$BODY"
+    CHAIN="$CHAIN /srv/builds/_adv-adv-mixer-2/q/$Q;"
+    echo "claimed $Q for box $BOX"
+  else
+    echo "queue file $Q is already claimed, skipped" >&2
+  fi
+done
+[ -n "$CHAIN" ] || exit 0
+STAMP=$(date -u +%Y%m%dT%H%M%SZ)
+# the detached chain keeps the ssh channel open, so the start is time-boxed to 20 s (perl alarm: macOS has no timeout)
+perl -e 'alarm 20; exec @ARGV' ssh -i "$KEY" -o BatchMode=yes "$H" "cd /srv/builds/_adv-adv-mixer-2 && (setsid nohup bash -c '$CHAIN' > logs/chain-$STAMP.log 2>&1 < /dev/null & echo \$! > logs/chain-$STAMP.pid); echo chain started on box $BOX: pid \$(cat logs/chain-$STAMP.pid), log logs/chain-$STAMP.log" || true