docs(sor): PROPOSED stage-05 RQ2 per-circuit posterior clarification (blind)

Overseer ruled DIRECTION=A: fill the specification gap the frozen prereg
left on RQ2's per-circuit adversary sender-posterior, rather than
silently redefine the DV (B) or relabel a confirmatory test (C).

Proposes: adversary observes a circuit's exit-bridge/house and forms a
uniform posterior over the observation-consistent anonymity set A_i;
per-circuit H_i = Miller-Madow(log2 m_i), with S=2^H [Serjantov2002] and
d=H/log2 N [Diaz2002] as the cited normalizations. Makes RQ2-P1 (two-
sided ΔH) and RQ2-P3 (Spearman) computable OFFLINE from the immutable raw
records (per_circuit_seeds + deterministic assemble()).

Status PROPOSED — operator ratification pending. Pre-specified BLIND
(2026-07-20, battery running, zero RQ2 statistics computed) so this is
honest pre-registration completion, not HARKing. Frozen prereg untouched;
sign not presumed (honest-shrink reported with equal prominence).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

OVERSEER-STATUS.md

@@ -42,4 +42,6 @@ NEEDS-OPERATOR: How is the RQ2 per-circuit adversary sender-posterior constructe
 - 2026-07-20 SS3 (RQ1 half) DONE + committed: cmd_chat/sor/analysis/confirm_load.py reconstructs the RQ1 (entry,exit) circuit-pair set from the REAL per-hop pcaps (bin_pcap_bytes → score_matrix; diagonal=linked, off-diag=unlinked) so confirm.rq1_p1_leak scores measured data — the fully frozen-specified §4 unit. classify_run reads persisted metrics.json; collect_rq1_p1_pairs selects only bridge=on no-pad runs. Plumbing unit-tested on SYNTHETIC pcaps (test_sor_confirm_load.py, 3 passed) — no confirmatory data touched (prereg §2 blinding: no inspecting intermediate results before the battery completes). RQ1-P2 nopad/pad pairing + all RQ2 HELD for the ruling (top-of-file NEEDS-OPERATOR).
 - BATTERY PROGRESS: healthy + running; 1 full (cell,run)=50 circuits ≈ 14 min ⇒ full 180-run / 9000-circuit battery ETA ≈ 42h (frozen §4 R=30×C=50, NOT trimmed). This exceeds a single night — inherent to the frozen sample size; overseer/operator call whether to let it run to completion (~1.8 days) or intervene. No cells dropped; teardown clean each circuit.
 - DRIVE STATE: SS1 ✅, SS2 firing ✅, SS3-RQ1 ✅. GATED: SS3-RQ2 + RQ1-P2 pairing on the RQ2 ruling; SS4 paper + SS5 review on (a) battery completion (blinding) AND (b) the RQ2 ruling. Cannot proceed further without fabricating/guessing (forbidden) or breaking blinding (forbidden). Awaiting operator RQ2 ruling; loop to nudge.
+- 2026-07-20 OVERSEER RULED DIRECTION=A (fill the gap, reject B/C). DRAFTED docs/stage-05-rq2-posterior-clarification.md — PROPOSED (operator-ratification PENDING), blind pre-spec (battery still running, ZERO RQ2 numbers computed). Rule: adversary observes exit-bridge/house → uniform posterior over the observation-consistent anonymity set A_i → per-circuit H_i=MM(log2 m_i) [Serjantov2002 S=2^H, Diaz2002 d=H/log2 N]; makes RQ2-P1 (ΔH, two-sided) + RQ2-P3 (Spearman) computable OFFLINE from per_circuit_seeds + deterministic assemble(). Grounded in cited lit only; sign not presumed; frozen prereg untouched.
+- HARD HOLD honored: no RQ2 confirmatory statistic computed/inspected/reported until Andre ratifies. RQ1 loader ready; SS4 skeleton next (data-independent). Battery: 442→ /9000 circuits, RUNNING, healthy.
 - BATTERY MONITORING CAVEAT (for the loop): the SS2 launch wrapper reported a benign exit-1 (a trailing `echo > .current-ts` error) — the battery itself is VERIFIED HEALTHY and progressing (spot-checked 66→69 circuits/25s, docker hops cycling, python PID 2539198 alive under wrapper 2539195). Because that background task is now closed, COMPLETION WILL NOT AUTO-NOTIFY. Detect completion by: `output/sor-confirmatory/20260720T060132Z/confirmatory-data/battery-results.json` present AND hop0.pcap count == 9000 (currently ~69). Do NOT re-launch (would duplicate/waste progress). Resume SS3 analysis (post-blinding) only after completion + the RQ2 ruling.