# Companion Methods (BLIND scaffold): The Unique-Bridge / Mix Mechanism (RQ2-P3) and Churn-Resilient Agent Selection (RQ3) **Draft — companion methods. Both tracks have cleared their human gates (RQ2-P3 freeze; RQ3 operator-GO); Results/Discussion are UN-BLINDED and filled from the sealed records only.** > **Paper-structure note (deliberately left OPEN).** Whether this material ships as a second > standalone paper, as extension sections folded into the lead paper > (`docs/stage-07-paper-draft.md`), or as a short mechanism note is an **operator editorial > decision** and is **not** pre-committed here. The two methods tracks below are therefore > written as **self-contained sections** that can be lifted into either structure. > > **Blinding & gating status (binding).** > - **RQ2-P3 mechanism study — FROZEN + SEALED; its Results/Discussion are now UN-BLINDED below.** > The prereg (`docs/rq2p3-mechanism-prereg.md`, own slug `sor-consent-rq2p3`) was **frozen > 2026-07-21** (§10 signed; full-file SHA-256 `8db4e8a7ac60f8b2861f2387249db68a3fd44822f6b3d9c7c6990ff65f261a3b` > in the sidecar `docs/rq2p3-mechanism-prereg.sha256`). The confirmatory battery then ran > **offline + deterministic** and its record is **sealed** (`output/sor-rq2p3-confirmatory/…`, > results SHA-256 `5fdcb379d8a2…`). §5/§6 for RQ2-P3 are filled **from that sealed record only**, > the same post-seal discipline the lead paper used. > - **RQ3 companion — RUN + UN-BLINDED.** Hypotheses, gates, and analysis are **frozen** in the lead > prereg (`sor-consent-prereg.md`, SHA-256 > `f22331a72e0d0ccf38b787e63acabbe9d666456ec76076787a6d545c3193425b`, §3/§4/§6); the two open > `[APPROVAL]` execution params were pinned blind in `docs/rq3-companion-run-brief.md`. The > confirmatory battery ran **operator-GO'd on the live isolated docker grid** (3 arms × R=30 × > C=50 = 4,500 real circuits, `live-docker-e2e`) and its record is **sealed** > (`output/sor-rq3-confirmatory/…`, battery SHA-256 `5b61e461…`, analysis SHA-256 `e09c66ef…`). > §5/§6 for RQ3 are filled **from that sealed record only**. > - **All Results / Discussion below are now UN-BLINDED, filled from the sealed records only.** Both > tracks have cleared their human gates (RQ2-P3 freeze; RQ3 operator-GO); the **authoritative > Holm-7** over the frozen size-7 family is computed. The frozen lead prereg is authoritative and > **unedited**; the lead RQ1/RQ2-P1 findings are not re-litigated. --- ## Abstract *(both tracks UN-BLINDED — confirmatory findings folded in from the sealed records)* The lead study measured a consent-gated, federated, nested-SSH relay instrument and reported two honest non-confirmations: no measurable entry↔exit linkability leak (RQ1) and a Holm-significant **shrink** of the per-circuit anonymity set under federation (RQ2-P1). This companion pursues the two questions the lead paper could not close. **First (RQ2-P3′, a mechanism study):** the lead "shrink" may be an **instrument artifact** — the bridge-federated topology assigns a *fresh* willing bridge per circuit seed, so every adversary-observable exit signature is unique, every anonymity set collapses to size 1, and entropy is driven to ≈0 by construction rather than by funnelling. We re-instrument the willing-bridge layer as a **finite shared pool** with skewed willingness and treat bridge **concentration as a manipulated independent variable** (a 3×3 dose-response over pool size and skew), asking **two-sided** whether concentration *reduces* (funnel) or *raises* (mix) the anonymity set. **Second (RQ3, churn resilience):** we measure whether a **local open-weight agent** path-selector (`qwen2.5:3b`) retains throughput and adds tolerable latency under a pinned churn schedule, without leaving a classifiable **rebuild fingerprint**. Both tracks are pre-registered, detector-frozen, and calibration-gated before any confirmatory cell. *(Confirmatory findings, now un-blinded: **RQ2-P3 resolves MIX** — shared-pool concentration raises the anonymity set, correcting the lead "shrink" as a unique-bridge artifact; **RQ3 is a null on both counts** — on this grid every selector heals ~all churn (no +10 pp agent margin) and the rebuild-timing fingerprint cannot be excluded at n=30. The authoritative Holm-7 leaves RQ1-P1, RQ2-P1, and RQ2-P3 surviving.)* --- ## 1. Introduction (deltas beyond the lead paper) The lead paper (G4 + RQ1 + RQ2) established the consent-gate instrument and reported its linkability and anonymity-set readings. Two threads there were *raised but not resolved*, and this companion is scoped to exactly those. **(a) The unique-bridge / mix mechanism.** The lead RQ2-P1 result — federation **shrinks** the anonymity set (ΔH < 0) — was reported honestly, but the lead paper also flagged its RQ2-P3 mechanism test as **degenerate as-instrumented**: the bridge-federated arm assigns a fresh bridge per circuit seed, so top-3 bridge concentration is a constant `c_i = 1/C` with **zero variance** and Spearman ρ is undefined. The mechanistic reading (developed in `docs/note-unique-bridge-artifact.md`) is that the adversary's observable is an `exit_signature = (exit_house, bridge_label)`; a unique bridge per circuit makes every signature unique, so the observation-consistent anonymity set is size 1 and H≈0 **by injective construction, not by funnelling**. If that is right, a *finite shared* bridge pool should make circuits share signatures, enlarge the anonymity set, and act as a **mix** (concentration *raises* H) — the **opposite** of the naive funnel intuition. This makes RQ2-P3′ a test of whether the lead "shrink" headline is a unique-bridge artifact that a mechanism study can qualify or correct. This mix reading connects the consent-gate bridge to the classical mix [Chaum1981] and to information-theoretic set metrics [Serjantov2002; Diaz2002] the lead paper already adopts. **(b) Churn-resilient agent selection.** The lead paper held the selector at `static`; RQ3 asks whether an **adaptive** selector improves resilience when the relay pool churns. Two costs bound any such gain and are the confirmatory tension: (i) rebuilding a circuit after a dropped hop adds latency and can erode throughput, and (ii) the *timing pattern* of rebuilds is itself a side-channel — a rebuild-event classifier could fingerprint the selector, echoing website- and flow-fingerprinting results on onion transports [SirinamIJW18; RahmanSMGW20] and the rebuild/timing-classifier spirit of CLASI [Barton2025], and compounding statistical-disclosure exposure over repeated circuits [Danezis2003]. RQ3 therefore pairs a **performance** gate with an **anonymity** (non-fingerprint) gate: an agent selector only "helps" if it retains throughput at tolerable added latency **and** its rebuild pattern is not classifiable. ## 2. Related work (deltas) The lead paper's Related Work (onion routing / SOR [Egners2012], flow correlation [NasrBH18; OhYMH22], anonymity metrics [Serjantov2002; Diaz2002], social-trust G4 neighbours) is inherited unchanged. The companion adds two narrow deltas, citing **only** already-grounded references: - **Bridge-as-mix vs. bridge-as-funnel.** Concentrating flows through few willing bridges can be read either as a funnel (fewer distinct observation classes → smaller sets) or as a mix [Chaum1981] (shared observation class → larger sets). The set-size effect is quantified with the same entropy metrics the lead paper uses [Serjantov2002; Diaz2002]; the companion's contribution is a **manipulated-concentration dose-response** that adjudicates the sign, not a new estimator. - **Rebuild-timing as a fingerprint.** Churn-driven circuit rebuilds create a timing series an adversary may classify; this is the fingerprinting/timing lineage [SirinamIJW18; RahmanSMGW20; Barton2025] applied to *selector-induced* rebuild events rather than page loads. The companion adopts a **frozen, fixture-calibrated** rebuild classifier and reads its AUC as an instrument reading, mirroring the lead paper's frozen-correlator discipline (no correlator/classifier state-of-the-art is claimed). --- ## 3. Methods A — RQ2-P3′ funnelling-mechanism study **[FROZEN 2026-07-21 — prereg §10 signed]** > **This section describes a study whose prereg (`docs/rq2p3-mechanism-prereg.md`) is FROZEN.** > Design and parameters were operator-approved and locked; the **human freeze checkpoint** (§10 > signed 2026-07-21, full-file SHA-256 `8db4e8a7ac60f8b2861f2387249db68a3fd44822f6b3d9c7c6990ff65f261a3b` > in the sidecar `docs/rq2p3-mechanism-prereg.sha256`) is complete. The confirmatory battery then > ran **offline + deterministic** and its record is **sealed** (results SHA-256 `5fdcb379d8a2…`). > Everything below is the pre-registered *plan* exactly as frozen; the §5/§6 numbers are read > **from that sealed record only**. **Design (manipulated-IV dose-response).** A new assembler topology, `bridge-federated-pool`, replaces the fresh-per-seed bridge with a **finite willing-bridge pool** of size `B` under a fixed Zipf willingness skew `alpha`: `weights = zipf_weights(B, alpha)` derived from the **cell** seed (so the willingness profile is fixed within a run), and each circuit draws `idx = weighted_draw(sha256("sor-bridge-pool|{circuit_seed}"), weights)` → `bridge#{idx:02d}`, a label **reused** across circuits so concentration genuinely varies. Everything downstream (hop structure, houses, exit-signature grouping, Miller–Madow entropy, BCa bootstrap) is **identical** to the frozen lead pipeline; the lead `bridge-federated` branch is **untouched and bit-reproducible**. The manipulation grid is **B ∈ {2, 4, 8} × alpha ∈ {0 (uniform), 1.0, 2.0}** = 9 concentration cells; run order randomized within cell from an ordering seed distinct from the data seeds. **Hypotheses (two-sided; direction not presumed).** - **H1 (within-cell association).** Spearman ρ between per-circuit top-3 willing-bridge concentration `c_i` and per-circuit entropy `H_i`. **Funnel** iff BCa 95% CI < 0; **mix** iff CI > 0; **inconclusive** iff CI spans 0. - **H2 (dose-response).** OLS slope β of per-run mean-H on per-run mean top-3 concentration over 9 cells × 30 runs = 270 clustered points; cell-level BCa CI; funnel iff slope CI < 0, mix iff CI > 0. - **H3 (joint, direction-agnostic).** Mechanism **RESOLVED** iff H1 and H2 agree in sign and both exclude 0 — the *sign* (funnel vs mix) is the finding; **unresolved** if either spans 0. **Dependent variables.** Per-circuit `H_i` (Miller–Madow entropy of the uniform posterior over the observation-consistent anonymity set, inherited verbatim) and per-circuit top-3 concentration `c_i` (`confirm_load_rq2.bridge_concentration`, unchanged). **Sampling.** R = 30 seeded runs/cell, C = 50 circuits/run (matched to the lead study); base seed S0 = 20260719, per-cell seed `SHA256(S0 ‖ cell_id ‖ run_index)`; fixed stopping rule (all 9 cells × R to completion; uninformative cell → inconclusive; no optional stopping). **Analysis.** Effect size + BCa 95% CI (10,000 resamples, α = 0.05) for every test; **run-level cluster bootstrap** (resample whole runs, not circuits) because circuits sharing a bridge have identical `c_i` and correlated `H_i` — the same pseudo-replication defect the lead paper flagged for RQ1-P1. Holm–Bonferroni over **this study's own family** {H1-pooled, H2-slope}; the lead family-of-7 is closed and **not** reopened here. Any per-cell ρ contrast or ΔH replication is labelled **EXPLORATORY**, never a re-run of the frozen RQ2-P1. **Instrument-validation gate (§7, re-worded pre-freeze — cite `docs/stage-05-rq2p3-gate-clarification.md`).** The §7 items were **re-worded before freeze** because the original items 1–2 encoded the naive-funnel prior and were mechanically wrong under the ratified posterior (transparent deviation logged; no hypothesis changed — H1/H2/H3 stay two-sided). The re-worded gate validates the **instrument**, not a sign: 1. the **frozen** `bridge-federated` branch (not the pool) still shows the lead degeneracy — unique signatures → `m_i = 1` → `H_i ≈ 0`, constant `c_i = 1/C` (a pool draws with replacement and *cannot* reproduce the injective fresh-bridge degeneracy, so the regression teeth live on the untouched branch); 2. the **B = 1 boundary** yields `c = 1.0` (concentration tooth) **and**, under the ratified posterior, `H` at the **high** end (maximal mix) — the naive "low H" gloss is refuted by construction; 3. realized mean top-3 concentration is **monotone** (decreasing in B, increasing in alpha); 4. entropy calibration inherited (H = log₂N on equiprobable synthetic senders). A **§7 scope note** records that the gate **must not** pre-assert the H-vs-concentration sign — that sign *is* the two-sided confirmatory question; baking it in would be funnel-circular. **Pre-registered calibration finding (NOT a confirmatory result).** The dry §7 pass — synthetic, offline, no confirmatory record read — already **previews a mix**: across the sweep Spearman ρ runs from ≈0 up to **+0.838** (all cells ρ ≥ 0), the B = 1 boundary sits at high entropy (≈2.54 bits vs the fresh-bridge reference ≈0.0), and monotonicity + entropy calibration pass. This is surfaced **openly as a pre-registered calibration preview**, per the §7 scope note; it does **not** relax the two-sided pre-commitment, and the confirmatory sign remains withheld until after freeze. Honest disclosure the eventual write-up must carry: because the dry pass already previews the mix direction, the confirmatory battery **quantifies a dose-response already visible at calibration**; the two-sided pre-commitment stands and the lead RQ2-P1 headline is not re-litigated. ## 4. Methods B — RQ3 churn-resilient agent selector (frozen prereg) > Hypotheses, gates, DVs, and analysis are **frozen** in `sor-consent-prereg.md` (§3/§4/§6) and are > restated, not redefined. The two open `[APPROVAL]` execution params were pinned **blind** to RQ3 > outcomes (`docs/rq3-companion-run-brief.md` §2). **Design.** Selector strategy {`static`, `random`, `agent`} at the RQ3 control cell (single-house / bridge-off) under a pinned churn schedule; `static` is the interleaved control, and control runs are bracketed before and after the {`random`, `agent`} treatments to catch grid drift. The cells are enumerated **separately** from the frozen 6-cell lead lattice so the lead battery stays bit-reproducible. **Pinned execution parameters (blind).** - **Agent = `qwen2.5:3b`** via local Ollama (`agent_selector.OllamaAgentPolicy`, temperature 0, per-run seed, `(seed, state-hash)` decision cache, deterministic heuristic fallback on query failure). Local / open-weight, **$0**; the Claude/frontier arm (`ClaudeExploratoryPolicy`) stays **inert / EXPLORATORY / budget-gated** and is not wired. - **Reproducibility caveat (accepted; must be stated in the paper).** Ollama at temperature 0 is **not bit-identical across machines** (quantization / GPU logit drift). The agent arm is reproducible via the **committed decision-log + `(seed, state-hash)` cache replay**, *not* via independent model re-execution on other hardware — the same honesty class as the RQ1 timing caveat. The decision log + cache are committed as the reproducibility anchor. - **Churn = `kill_prob_pct = 30`, `steps = 20`**, one deterministic schedule per run seeded from the same `SHA256(S0 ‖ cell ‖ run)` family; low-churn calibration baseline `kill_prob_pct = 5`. **Dependent variables (frozen).** Throughput retention (throughput under churn / no-churn baseline); added latency = median end-to-end latency(agent) − median latency(best baseline arm), in ms — a **live** measurement only; and rebuild-classifier AUC over the rebuild-event time series (the per-run mean inter-rebuild-gap signal), per the [Barton2025] CLASI spirit. **Confirmatory gates (frozen, family-of-7).** | Test | Frozen gate | |---|---| | RQ3-P1-perf | throughput-retention(agent) − max(static, random): 95% CI lower bound **≥ 10 pp** | | RQ3-P1-latency | added-latency(agent): 95% CI upper bound **≤ 100 ms** | | RQ3-P2 | rebuild-classifier AUC: 95% CI upper bound **≤ 0.60** | | RQ3-P3 | logical AND: **CONFIRM** iff P1 ∧ P2 (perf gain *without* a rebuild fingerprint); else H0 | R = 30 runs/cell, C = 50 circuits/run, fixed stopping rule (inherited unchanged). **Analysis + multiplicity (Holm-7 supersedes note).** The three RQ3 tests were always in the frozen size-7 family {RQ1-P1, RQ1-P2, RQ2-P1, RQ2-P3, RQ3-P1-perf, RQ3-P1-latency, RQ3-P2}. Once all seven p-values exist, the companion computes the **exact Holm-7** step-down over the whole family; this is the **authoritative** final correction and **supersedes** the lead paper's deliberately conservative *partial* embedding (7/6/5/4 report-4) — both remain valid, the partial never under-corrects, and the lead paper's already-published RQ1-P1 / RQ2-P1 survive regardless (their reported raw p ≈ 0 — a lead-paper result, not a companion figure). Effect size + BCa 95% CI for every test; nulls reported honestly (a selector that does **not** beat baselines, or a rebuild pattern that **is** classifiable, is the finding). The QUIC / `ssh3` transport arm stays **EXPLORATORY and deferred** (design decision D3), never in the Holm family. **Calibration gates (already green; NOT confirmatory results).** Two boolean gates block the RQ3 confirmatory battery and have both passed on a **dry, synthetic, offline** pass: - **Churn-bites** — at the pinned `kp = 30 / steps = 20` the churn genuinely bites (non-zero drops/rebuilds across every RQ3 cell), so the retention and classifier tests are not degenerate. - **Rebuild-classifier calibration** — churned (`kp = 30`) vs low-churn baseline (`kp = 5`) is **separable** on the per-run mean inter-rebuild-gap signal (calibration AUC ≈ **0.93**), while baseline-vs-baseline is **not** (null AUC ≈ **0.52**); plus an agent cache-replay reproducibility check and the inherited entropy calibration. These are **calibration** readings on labelled control signals, **not fit to confirmatory cells**; the frozen instrument (`rebuild_interval_gaps`, `rebuild_classifier_auc`) is unchanged. --- ## 5. Results *(both tracks UN-BLINDED — filled from the sealed records only)* - **RQ2-P3′ (H1 / H2 / H3) — RESOLVED: MIX.** From the sealed confirmatory record (9 cells × R=30 × C=50, offline + deterministic, S0 = 20260719): - **H1 (within-cell association).** Pooled Spearman **ρ = +0.6244**, BCa 95% CI **[+0.5941, +0.6545]** (run-level cluster bootstrap, 10,000 resamples). CI excludes 0 on the **positive** side → **mix**. - **H2 (dose-response).** OLS slope of per-run mean-H on per-run mean concentration **β = +0.7052**, BCa 95% CI **[+0.6195, +0.7903]** over n = 270 run-level points. CI positive → **mix**. - **H3 (joint).** H1 and H2 **agree in sign (both +)** and **both exclude 0** → mechanism **RESOLVED = MIX**. - **Holm (own family {H1-pooled, H2-slope}, size 2).** Both tests **reject** at α = 0.05 after Holm correction. *(p carried only for Holm ordering; the effect + CI above are the reported quantities — never a bare p.)* - Across the sweep, as pool size B rises concentration falls **and** entropy H falls together (e.g. B=2/α=0: conc ≈ 1.00, H ≈ 2.54; B=8/α=0: conc ≈ 0.51, H ≈ 2.19) — concentration and H move **together, positively**: higher concentration ⇒ higher anonymity (mix), not lower (funnel). - **RQ3-P1-perf / RQ3-P1-latency / RQ3-P2 / RQ3-P3 — H0 (honest null).** From the sealed live battery (3 selector arms × R=30 × C=50 = 4,500 real isolated-docker circuits, `measured_from = live-docker-e2e`; agent = `qwen2.5:3b` local Ollama; run-level multi-arm bootstrap, 10,000 BCa resamples, α = 0.05; results SHA-256 `e09c66ef…`): - **RQ3-P1-perf — FAILS the +10 pp gate.** Throughput-retention margin = retention(agent) − max(static, random) = **−0.6 pp**, BCa 95% CI **[−1.58 pp, +0.39 pp]**. Every selector heals ~all churn drops (mean retention ≈ 0.99 across arms), so the agent shows **no** ≥ +10 pp gain. - **RQ3-P1-latency — WITHIN the ≤ 100 ms budget.** Added-latency(agent) = median e2e latency(agent) − median latency(min-latency baseline = random) = **−13.5 ms**, BCa 95% CI **[−52.1, +34.9] ms**; CI upper 34.9 ms ≤ 100 ms — the agent is **not** slower than the best baseline (the perf gate, not latency, is what fails P1). - **RQ3-P2 — FAILS the ≤ 0.60 ceiling (fingerprint not excluded).** Rebuild-classifier AUC (agent per-run mean inter-rebuild-gap vs. the pooled baseline selectors) = **0.587**, BCa 95% CI **[0.458, 0.703]**; CI upper 0.703 **> 0.60**, so a rebuild-timing fingerprint of the agent **cannot be ruled out** at the pre-registered bar (the test is underpowered at n = 30 runs/arm). *(Disclosure: the green §3-4 **calibration** gate reported AUC ≈ 0.93 — but that was **churned-vs-low-churn regime** discrimination on labelled control signals, a **different** comparison from this confirmatory **agent-vs-baseline-selector** AUC of 0.587; the calibration validated the instrument and does **not** preview the confirmatory selector value.)* - **RQ3-P3 (joint) — H0.** P1 fails (perf) **and** P2 fails → the agent selector is **not** confirmed to help without a fingerprint. Reported as the finding, not spun. - **Holm-7 (companion, authoritative).** Over the frozen size-7 family {RQ1-P1, RQ1-P2, RQ2-P1, RQ2-P3, RQ3-P1-perf, RQ3-P1-latency, RQ3-P2}, exact Holm step-down (the RQ2-P3 slot carries the **mechanism-corrected** primary H1-pooled Spearman p, superseding the lead's degenerate as-instrumented RQ2-P3): **survivors = RQ1-P1 (rank 1 ×7), RQ2-P1 shrink (rank 2 ×6), RQ2-P3 mix (rank 3 ×5)** — all adjusted p = 0. **Do not survive:** RQ1-P2 (rank 4 ×4, adj p = 0.365), RQ3-P2 (rank 5 ×3, 0.511), RQ3-P1-perf (rank 6 ×2, 0.511), RQ3-P1-latency (rank 7 ×1, 0.511). *(Holm adjusted p-values are step-down **monotone-enforced** — a later rank never reports a smaller adjusted p than an earlier one — so ranks 6–7 inherit the rank-5 value rather than their smaller bare rank-products; this is standard Holm, not an arithmetic slip.)* This is the **authoritative** final correction and **supersedes** the lead paper's conservative *partial* embedding (report-4); both remain valid, the partial never under-corrects, and lead RQ1-P1 / RQ2-P1 survive regardless. ## 6. Discussion *(both tracks UN-BLINDED)* - **Does a shared bridge funnel or mix? — It mixes.** Both pre-registered two-sided tests resolve **positive** (H1 ρ = +0.6244 CI [+0.5941, +0.6545]; H2 β = +0.7052 CI [+0.6195, +0.7903]; H3 RESOLVED = mix; Holm both reject). Plainly: **concentrating circuits through a finite shared willing-bridge pool RAISES the per-circuit anonymity set** — circuits that share a bridge share an exit signature, so the observation-consistent set grows and entropy rises. This **refutes the naive funnel intuition** (that concentration would shrink the set) and, per the mechanism developed in `docs/note-unique-bridge-artifact.md`, **qualifies the lead RQ2-P1 "shrink" as a unique-bridge (fresh-bridge-per-circuit) instrument artifact**: the lead topology assigned a *fresh* bridge per circuit seed, making every exit signature unique, every anonymity set size 1, and H≈0 by injective construction rather than by funnelling. Under a finite shared pool the injectivity is removed and the true sign of the concentration→anonymity relationship is revealed to be a **mix**. This is an honest **qualification/correction** of the lead reading via the frozen mechanism prereg (SHA-256 `8db4e8a7ac60f8b2861f2387249db68a3fd44822f6b3d9c7c6990ff65f261a3b`), **not** an overwrite: the lead RQ2-P1 result and its frozen prereg stand as published and are not re-litigated. - **Mandatory disclosure (pre-registration honesty).** The §7 calibration dry-pass — synthetic, offline, no confirmatory record read — **already previewed this direction** (Spearman ρ running 0 → +0.838 across the sweep, B=1 boundary at high entropy). The confirmatory battery therefore **quantifies a dose-response that was already visible at calibration**; the pre-committed hypotheses were nonetheless **two-sided** and that pre-commitment is unchanged. We surface the calibration preview openly so no reader mistakes the confirmatory sign for a post-hoc choice. - **Does the agent selector help without leaking? — No (H0), on both counts.** RQ3-P3 requires the agent to clear the +10 pp retention / ≤ 100 ms latency bar **and** leave a non-classifiable rebuild pattern (AUC CI upper ≤ 0.60); it does neither decisively. On **performance**, the honest reason is that churn at kp = 30 / steps = 20 is **fully healed by every arm** — static, random, and the agent all rebuild ~all dropped hops (retention ≈ 0.99), so there is simply **no headroom** for an adaptive selector to win the +10 pp margin (margin −0.6 pp, CI [−1.58, +0.39] pp). The agent is not *worse* — added-latency is within budget (−13.5 ms, CI upper 34.9 ms ≤ 100 ms) — it is merely **not better**, because the baseline is already at the retention ceiling on this grid. On **anonymity**, the rebuild-timing classifier reaches AUC 0.587 with CI upper 0.703 > 0.60, so the pre-registered bar to certify "no usable fingerprint" is **not met**: at n = 30 runs/arm the test is **underpowered** to exclude a small rebuild-timing signal, and we report that limitation rather than a false all-clear. The honest reading: **on this lab grid the local open-weight agent selector neither beats the baselines nor is demonstrably fingerprint-free** — a null on both P1 and P2, exactly the outcome the design pre-committed to publish with equal prominence. - **Authoritative multiplicity (Holm-7).** With all seven pre-registered p-values now in hand, the companion's exact Holm-7 supersedes the lead paper's conservative partial embedding (operator decision D3). Three hypotheses survive: **RQ1-P1** (below-chance linkability AUC — no usable entry↔exit leak), **RQ2-P1** (federation *shrinks* the anonymity set, the lead headline null), and **RQ2-P3** (shared-pool concentration *mixes* — the mechanism correction). The four that do not survive are RQ1-P2 (padding efficacy), and all three RQ3 tests — consistent with the RQ3 H0 above. Note the RQ2-P3 slot now carries the **mechanism-corrected** primary statistic (H1-pooled Spearman, adj p = 0) rather than the lead's degenerate as-instrumented RQ2-P3 (adj p = 1): the companion's frozen-detector method both *caught* the unique-bridge artifact and *promotes* the corrected mechanism finding into the surviving family. Lead RQ1-P1 and RQ2-P1 survive regardless. - **Scope & limitations.** Both findings are scoped to the lab grid (1-house / bridge-off control, 2 phones + laptop, self-generated fixture traffic) and inherit the lead paper's external-validity caveats. Specific to this companion: (i) the RQ2-P3 mix is an **as-instrumented** concentration effect on the ratified exit-signature posterior, not an internet-scale claim; (ii) the RQ3 nulls are **grid-bound** — the perf null follows from a baseline retention ceiling under the pinned churn, and the P2 non-exclusion is an n = 30 **power** limitation, not a proof of a fingerprint; (iii) the agent arm carries the accepted **reproducibility caveat** (Ollama temp-0 is reproducible via the committed decision-log + (seed, state-hash) cache replay, *not* via cross-hardware model re-execution), stated with equal prominence to the RQ1 timing caveat. --- ## References Inherit the lead paper's reference list (`docs/stage-07-paper-draft.md` §References) unchanged. The companion cites only references already grounded in the frozen sources: **Chaum1981, Serjantov2002, Diaz2002, Egners2012, NasrBH18, OhYMH22, SirinamIJW18, RahmanSMGW20, Danezis2003** are in the lead paper's list; **Barton2025** (CLASI rebuild/timing-classifier spirit) is grounded in the frozen lead prereg's RQ3 dependent-variable definition (`sor-consent-prereg.md` §3) and carries into the companion's assembled list. No reference is added that cannot be grounded from the frozen prereg or stage-01 literature.