SS3: RQ2 rule RATIFIED + offline sender-posterior loader (synthetic-tested)

Flip docs/stage-05-rq2-posterior-clarification.md PROPOSED->RATIFIED (operator
Andre, 2026-07-20, ratified while BLIND to RQ2 data — honest prereg-completion of
a gap the freeze left, not HARKing). Substance of the construction unchanged.

Add cmd_chat/sor/analysis/confirm_load_rq2.py: reconstructs each circuit's spec
OFFLINE from the persisted per_circuit_seeds via deterministic assemble(), derives
the observation-consistent anonymity set A_i (uniform / max-entropy -> [1]*m_i),
per-circuit Miller-Madow H_i, and the willing-bridge concentration series — the
exact inputs confirm.rq2_p1_delta_h (ΔH, two-sided) and rq2_p3_funnel (Spearman ρ)
consume. Grounded only in the ratified rule ([Serjantov2002]/[Diaz2002]).

BLINDING preserved (prereg §2): ratification unblocks CODE, not results. The
collect_* real-data entrypoints are BLIND-GATED and NOT run; the reconstruction is
unit-tested on SYNTHETIC specs/seeds only (test_sor_confirm_load_rq2.py, 6 passed;
full SOR suite 172 passed). Frozen prereg untouched; no RQ2 statistic computed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

OVERSEER-STATUS.md

@@ -1,6 +1,6 @@
 # OVERSEER-STATUS — sor-consent build agent
 
-NEEDS-OPERATOR: How is the RQ2 per-circuit adversary sender-posterior constructed from a measured confirmatory circuit? The frozen prereg pins RQ2's DV as "Shannon entropy of the adversary's posterior over candidate senders PER CIRCUIT" (§3 L84-88), unit = "the circuit (entropy of the per-circuit sender posterior)" (§4 L108-110), Miller–Madow, BOOTSTRAP OVER CIRCUITS, and RQ2-P3 (§6 L205-207) needs a PER-CIRCUIT H for its Spearman ρ. But (a) the frozen prereg gives no explicit formula for building that per-circuit candidate-sender posterior from an observed circuit (it cites [Serjantov2002] S=2^H and [Diaz2002] d=H/log2 N for effective-size/normalization only), and (b) the built+committed executor (ce68d41) measures RQ2 as ONE per-RUN Shannon entropy of the realized entry-node FREQUENCY across the C=50 circuits — not a per-circuit posterior, and it yields no per-circuit H, so RQ2-P3 is uncomputable as-collected. I will NOT invent a posterior/adversary model post-freeze (that is HARKing + fabrication on a confirmatory DV). Need a ruling, one of: (A) ratify an explicit per-circuit posterior-construction rule (e.g. posterior mass over candidate senders as a function of the observed exit-bridge/house) logged as a stage-05 clarification like the Holm one → RQ2-P1/P3 then computable OFFLINE from the immutable raw records; (B) confirm the per-run realized-frequency entropy IS the intended RQ2 op (still leaves RQ2-P3's per-circuit H undefined); or (C) scope/relabel RQ2-P3. NOTE: the running battery is NOT wasted under any ruling — per_circuit_seeds are persisted + assemble() is deterministic, so every circuit's path/bridge/house is recoverable and RQ2 can be recomputed offline; RQ1 is fully specified and proceeds now. Battery left RUNNING.
+RQ2 RATIFIED (operator Andre, 2026-07-20, while blind) — observation-consistent-set + uniform-mass per-circuit posterior; docs/stage-05-rq2-posterior-clarification.md flipped PROPOSED→RATIFIED. Offline loader built + synthetic-tested. BLIND HOLD REMAINS: no real RQ2 result until the battery completes.
 
 
 - 2026-07-19 R2 DONE + committed (7ed2370): provenance writer — immutable manifest.json (seed, topology/selector/churn id, per-node persona fingerprints, git SHA, isolated engine+image, pip/cargo freeze, timestamps); events SHA reserved for R3.
@@ -47,3 +47,5 @@ NEEDS-OPERATOR: How is the RQ2 per-circuit adversary sender-posterior constructe
 - BATTERY MONITORING CAVEAT (for the loop): the SS2 launch wrapper reported a benign exit-1 (a trailing `echo > .current-ts` error) — the battery itself is VERIFIED HEALTHY and progressing (spot-checked 66→69 circuits/25s, docker hops cycling, python PID 2539198 alive under wrapper 2539195). Because that background task is now closed, COMPLETION WILL NOT AUTO-NOTIFY. Detect completion by: `output/sor-confirmatory/20260720T060132Z/confirmatory-data/battery-results.json` present AND hop0.pcap count == 9000 (currently ~69). Do NOT re-launch (would duplicate/waste progress). Resume SS3 analysis (post-blinding) only after completion + the RQ2 ruling.
 - 2026-07-20 SS4 (data-independent draft) DONE + committed: docs/stage-07-paper-draft.md — lead paper (G4+RQ1+RQ2). Written BLIND (battery still running, zero confirmatory numbers seen): Abstract skeleton, Intro (G4 consent-gate novelty + RQ1 bridge-leak / RQ2 funnelling motivation), Related Work (onion/SOR [Egners2012], correlation [NasrBH18/OhYMH22], anonymity metrics [Serjantov2002/Diaz2002], social-trust G4 neighbours), full Methods from frozen prereg §2-§6 (design matrix, DVs, R=30×C=50, frozen detectors + §5 gate, Holm family=7 report-4), Limitations from §7, References. Results §5 + Discussion §6 = HELD-BLIND placeholders; RQ2 subsections additionally RATIFICATION-GATED (posterior proposal pending). No prereg edit; no RQ2 number.
 - DRIVE STATE: SS1 ✅ SS2 firing ✅ SS3-RQ1 ✅ RQ2-proposal ✅ SS4-skeleton ✅. Battery: 492/9000, RUNNING healthy (PID 2539198). REMAINING GATES: SS3-RQ2 + RQ1-P2 pairing on Andre's RQ2 ratification; SS4 Results/Discussion + SS5 review on (a) battery completion (blinding) AND (b) RQ2 ratification. All data-independent overnight work now exhausted without fabricating or breaking blinding.
+- 2026-07-20 RQ2 RATIFIED + offline loader DONE + committed: docs/stage-05-rq2-posterior-clarification.md flipped PROPOSED→RATIFIED (operator Andre, while BLIND — 0 RQ2 stats computed). Built cmd_chat/sor/analysis/confirm_load_rq2.py: reconstructs each circuit's spec OFFLINE from per_circuit_seeds via deterministic assemble(), derives the observation-consistent anonymity set A_i (uniform/max-entropy → [1]*m_i), per-circuit H_i=Miller–Madow, and the willing-bridge concentration series — feeding confirm.rq2_p1_delta_h (ΔH two-sided) + rq2_p3_funnel (Spearman). Unit-tested on SYNTHETIC specs/seeds ONLY (test_sor_confirm_load_rq2.py, 6 passed; full SOR suite 172 passed). NEEDS-OPERATOR banner removed (resolved).
+- HARD BLIND HOLD STILL ON: collect_rq2_p1_arms/collect_rq2_p3 are BLIND-GATED — NOT run on real data; no RQ2-P1/P2/P3 result computed/inspected/reported until battery completes. Battery: 3816/9000 (~42%), alive, healthy. INSTRUMENT CAVEAT for SS5: bridge-federated assigns a fresh bridge per circuit seed ⇒ willing-bridge reuse is minimal ⇒ P3 concentration may be near-degenerate as-instrumented (an honest, reportable property — loader does not fix it).