[merynz]

Behavioral-integrity hardening against exact frozen base 7f39a846ad05f91560836026e5ef6dfbc74dc731.

This PR remains draft. It does not merge, refreeze, authorize a learned fit, or authorize formal Family-1 selection.

Scientific firewall

• no rigxl_03490 IDs, counts, thresholds, or family-conditioned repair branches;
• no J=67 / generation-limit 75 repair constants;
• generic synthetic/causal witnesses only for behavioral repair;
• rigxl_03490 remains dev/integration-only and can never become untouched formal Family-1 evidence;
• historical affected learned IRIS results remain quarantined.

Geppetto — behavioral closure PASS

Canonical record: canonical/GEPPETTO_V2_BEHAVIORAL_CLOSURE_20260903.md.

Major generic repairs:

1. shipping MAP/direct geometry supervision aligned;
2. STOP first-hit semantics and sole cardinality authority;
3. rank/categorical root-parent-support objectives;
4. latent-state-only autoregression;
5. strengthened Compiler mechanical acceptance (roots=1, illegal_parents=0, unsupported=0);
6. anonymous root-free deterministic correspondence with geometric teacher canonicalization;
7. uncertainty NLL isolated from shared decoder latent (log_sigma(h.detach())).

Confirmed causal seam: uncertainty NLL was able to optimize shared latent state through log_sigma(h). Detaching sigma-head input changed the frozen generic fork_5 from FAIL-through-2048 to sustained PASS at step 544 while preserving sigma learning.

Geppetto run 33703334408:

• chilecentral, job 100487117556: 27/27 PASS
• exact rerun westus3, job 100487622297: 27/27 PASS

Cross-region behavioral replay: PASS.

IRIS — privileged-input source firewall PASS

Historical scope: canonical/IRIS_LEAK_SCOPE_20260903.md.
Repair ledger: canonical/IRIS_PRIVILEGED_INPUT_FIREWALL_REPAIR_V1_20260903.md.
Successor correction: canonical/IRIS_REPROJECTION_V2_PRIVILEGED_INPUT_CORRECTION_20260903.md.

Pre-repair causal run 33704040761 confirmed:

• alpha-only learned-native feature delta 2.012694835662842;
• cyclic view re-enumeration pooled-evidence delta 0.18466269969940186;
• foreground-mask mutation produced 8 candidate-valid flips and anchor count 64 -> 32.

The legacy source suite still passed at that time, so dedicated negative regressions were required.

Generic repairs:

1. learned native path and direct learner interface are RGB-only; renderer alpha remains storage/provenance metadata only;
2. absolute learned view-slot scalar vi removed; analytic projected camera-forward depth is used with projected grid/validity;
3. production learned Q-domain is now RGB_CAMERA_FULL_FRAME_LATTICE_V1, deterministic full-frame and camera-only;
4. mask/hull domains remain available only in deterministic Gate-0 diagnostics;
5. production apparatus rejects mask/unsealed/pruned/forged Q-domains before image preprocessing, foundation extraction, or learned execution.

Frozen negative regressions: tests/iris/test_iris_v2_privileged_input_firewall_v1.py.

Standalone source closure:

• run 33751592814, westcentralus: firewall 4/4 PASS, combined IRIS 24/24 PASS;
• run 33751730077, westus3: firewall 4/4 PASS, combined IRIS 24/24 PASS.

IRIS_PRIVILEGED_INPUT_FIREWALL_CROSS_REGION_REPLAY = PASS

Historical checkpoints/metrics produced under the superseded privileged-input contract remain QUARANTINED. This is source-contract closure, not learned-fit evidence.

Current architecture-freeze candidate

The Geppetto behavioral gates, Compiler proof gate, and IRIS privileged-input firewall are now mandatory architecture-freeze prerequisites.

Architecture-freeze run 33751730186, job 100636583064, northcentralus:

• compile: PASS;
• family-independent/freeze-eligible audit: PASS;
• expanded generic + behavioral prerequisites: 65/65 PASS;
• generic source count: 38;
• candidate fingerprint: 1c6878b2e1e8cbd30a055849a64c8fe68558924e0a874de2e8fffa2e24ad7575;
• candidate status: PASS_SOURCE_ELIGIBLE_FOR_FREEZE;
• family selection: BLOCKED;
• only workflow failure: expected FAMILY_SELECTION_BLOCKED__SOURCE_CHANGED_AFTER_FREEZE.

The fingerprint is a candidate, not a seal. Broader subsystem behavioral hardening continues before any global refreeze decision.

Provenance note

The original IRIS 2026-08-31 preregistration is preserved unchanged. Its RGBA learned-path / padded-hull assumptions are not retroactively rewritten; the valid chain is:

original prereg -> causal falsification -> repair ledger -> successor correction -> future explicit architecture seal.

Repo/branch naming cleanup is deliberately deferred until the hardening sequence is stable so provenance is not disrupted mid-stream.