hack-house/docs/prereg/sor-consent-prereg.md

Pre-registration — sor-consent (FROZEN)

STATUS: FROZEN — human-approved at the stage-03 checkpoint on 2026-07-19. The SHA-256 of this file is recorded in sor-consent-prereg.sha256 and must be echoed into every run manifest (R2). Every item previously marked [APPROVAL] is hereby approved as stated. From here, no change edits this file — any deviation appears only in stage 05's sor-consent-deviations.md (§8). No confirmatory data-collecting run may occur until the instrument-validation gate (§5) passes green. Per shared/GOAL-sor-consent.md the prereg freeze (now done) and any containment-boundary change are the human gates; the paid frontier-model selector arm is off the confirmatory path (decision D1, §9 — the agent arm runs on a local model at $0) and only re-engages the budget gate if run as an EXPLORATORY contrast.

1. Study information

• Title: Consent-Gated Federated Onion Routing: Linkability, Anonymity Set, and Churn Resilience of an In-Band Accept/Reject Relay Model
• Slug: sor-consent · Draft date: 2026-07-19 · Author: operator + Claude (sci-method pipeline)
• Hypotheses: normative in ../../02-hypothesis/output/sor-consent-hypothesis.md §H-RQ1, §H-RQ2, §H-RQ3 (each H1/H0, predictions P1–P3, falsification condition, operational definitions, scope). That file is authoritative; no rewording here. Reproduced references below point to it by section, not by copy.
• Build dependency: every DV is gated behind shared/roadmap-sor-consent.md items R1–R7 [REQUIRED-for-H1]. hack-house has no data plane today; the instrument is built in the worktree /home/dell/coding/learning/hack-house-sor-consent (branch feat/sor-consent-relay) before any confirmatory run. sci-method and hack-house main are never modified.

2. Design

• Type: Confirmatory factorial controlled comparison (systems measurement / simulation), three RQ families sharing one instrument, each with its own control arm. Traffic is self-generated to our own fixtures; measurement is on our own lab grid only.
• Justification vs alternatives:
  • Analytical modelling alone (e.g., entropy bounds from a graph model) cannot capture the consent-gating funnel effect or a real nested-SSH rebuild fingerprint — the phenomena under test are emergent from the actual data plane, so a built instrument is required.
  • Single-factor A/B per RQ would miss cross-factor interactions (e.g., topology × selector) and force three separate underpowered studies; a shared factorial instrument amortizes the (large) build cost across all three DV families.
  • Internet-scale / live-network measurement is out of scope and out of the containment envelope; the claim is deliberately scoped to the local grid (§7 External).
• Design matrix (confirmatory cells):
  • RQ1 (linkability): bridge {off, on, on+padding} — 3 levels.
  • RQ2 (anonymity set): topology {1-house-N, bridge-federated, directory-federated} at matched total node count N — 3 levels.
  • RQ3 (churn resilience): selector {static, random, agent} × churn schedule {seeded set, §4} — 3 selector levels.
  • Full crossing is not run; cells are organized per RQ with the other factors held at their declared control (RQ1 at single-house/static; RQ2 at bridge-off/static; RQ3 at single-house/bridge-off). N/A cells are declared here, not dropped ad hoc: padding is only defined for bridge-on (bridge-off+padding is N/A). The agent selector runs on a pinned local/open-weight model from the hackhouse agent fabric (decided 2026-07-19, §Design decisions), so RQ3 is confirmatory at $0 with no paid-budget gate; a paid frontier model is an optional EXPLORATORY "stronger-model" contrast only. If the local model fails the §5 latency/quality calibration, RQ3's agent arm falls back to a funded follow-on — a data-driven fallback at the gate, not a pre-commitment.
• Assignment / order: materials are fixed (no unit randomization); run order is randomized within each cell and controls are interleaved with treatments (control arm of each RQ scheduled before and after its treatments) so calibration drift on the grid is caught. All stochastic elements are seed-controlled (§4, R1).
• Blinding: the correlator/entropy/classifier code (R7) is written and calibrated on the instrument-validation fixtures (§5) — known-linked/known-unlinked control pairs and equiprobable-sender synthetic sets — before any confirmatory cell is run; no per-cell tuning of any detector is permitted (deviations policy §8). No human inspects confirmatory intermediate results before the full battery completes.

3. Variables

• Independent variables (levels → how manipulated):
  • Bridge condition {off, on, on+padding} — R6 bridge mode + R1/R4 padding config.
  • Federation topology {1-house-N, bridge-federated, directory-federated} — R6 federation.
  • Selector strategy {static, random, agent} — R7 selector module; agent = local/open-weight model from the hackhouse agent fabric, [APPROVAL] exact model ID + weights digest pinned at freeze; confirmatory, no paid-budget gate (§Design decisions, 2026-07-19).
  • Churn schedule — seeded VM spin/kill schedule over the hackhouse VM fabric (R7 churn, R1 seed).
  • (EXPLORATORY — decided 2026-07-19, §Design decisions) transport arm {TCP-nested, QUIC-nested ssh3} — R1/R4. TCP-nested is the confirmatory workhorse; QUIC stays EXPLORATORY (orthogonal to all three RQs; a weak lit-gap; avoids doubling cells + build). Labeled EXPLORATORY in analysis and paper.
• Dependent variables (exact metric → measurement procedure):
  • RQ1 — correlation AUC: area under the ROC of the R7 flow-correlation detector (inherited from hh-agents R8/R10) scoring (entry-segment, exit-segment) pairs as same/different circuit. Computed from bridge_forward byte/latency events (R3) at the bridge node. 95% CI by bootstrap over circuit pairs.
  • RQ2 — anonymity-set entropy H: Shannon entropy of the adversary's posterior over candidate senders per circuit; effective set size S = 2^H per [Serjantov2002], normalized d = H/log2(N) per [Diaz2002]. Estimator [APPROVAL]: plug-in (MLE) entropy with Miller–Madow bias correction for finite-sample bias; 95% CI by bootstrap over circuits. ΔH = H(federated) − H(single-house, matched N).
  • RQ3 — throughput retention, added latency, rebuild-classifier AUC: throughput retention = (throughput under churn) / (no-churn baseline throughput), per selector; added latency = median end-to-end latency(selector) − median latency(best baseline), in ms; rebuild-classifier AUC = AUC of the R7 classifier on the rebuild-event time series (per [Barton2025] CLASI spirit). All from R3 event logs + R4 per-hop byte/latency events.
• Confounds → strategy:

  Confound	Strategy
  Background load / thermal throttling on grid devices (2 phones + laptop)	RANDOMIZE run order + interleave controls; MEASURE per-device idle baseline each session; report as covariate
  Device heterogeneity (phone vs laptop hop capacity)	HOLD CONSTANT — node-role→device mapping fixed across all cells of a comparison; documented in manifest (R2)
  Detector overfitting / tuning contamination	ELIMINATE — detectors frozen + calibrated on §5 fixtures pre-battery; no per-cell retuning (blinding, §2)
  Seed leakage / non-determinism	ELIMINATE — single base seed → per-cell derived seeds in config; R1 determinism acceptance check
  Wall-clock timestamps entering the correlator	HOLD CONSTANT — detector consumes only R3 event features declared at freeze; wall-clock excluded from features
  Self-generated traffic ≠ real user traffic	ACCEPT (construct) — scoped in §7; fixtures documented and versioned
  Isolation escape (forwarder on host)	ELIMINATE — assert engine != local or refuse (R4; bridge.py:528-529); containment gate §5
  Small number of houses/nodes for RQ2 entropy	MEASURE + ACCEPT — node counts reported; underpowered-for-large-N caveat → Limitations

4. Sampling & power

• Unit of analysis: RQ1 — the (entry, exit) circuit-segment pair (AUC over the pair set); RQ2 — the circuit (entropy of the per-circuit sender posterior); RQ3 — the seeded run (throughput/latency aggregate) and the rebuild event (classifier).
• Repetition count [APPROVAL]: R = 30 independent seeded runs per design cell; each run builds a fixed C = 50 circuits (→ ≥ 50 same-circuit and ≥ 50 different-circuit pairs per run for RQ1, ≥ 1500 pairs/cell). Rationale is a precision target, not a formal power analysis: with ≥ 1500 scored pairs per cell the bootstrap 95% CI half-width on AUC is expected ≤ 0.03, sufficient to resolve the RQ1 floor (§6) away from 0.5; 30 runs satisfies the CLT/dispersion requirement in _config/rigor-standards.md §Statistics for stochastic systems. Exact R, C confirmed at freeze against the §5 calibration CI widths.
• Seeds: one base seed S0 = 20260719 (fixed at freeze; the freeze date, no hidden structure); per-cell seed = SHA256(S0 ‖ cell_id ‖ run_index) truncated to u64, echoed into every manifest.json (R2) and events.jsonl (R3). Determinism verified by R1's acceptance check on a spot-checked cell.
• Stopping rule (fixed, pre-registered): all cells × R runs are run to completion; no optional stopping, no peeking-driven extension, no interim looks. If a cell's CI is uninformative at the frozen R, that cell is reported inconclusive — the battery is not extended to chase significance (rigor-standards §Statistics; GOAL Phase T).

5. Materials & procedure

• Instrument (built, worktree): R1–R7 in hack-house-sor-consent @ branch feat/sor-consent-relay; git SHA recorded per run (R2). Components: seed plumbing (R1), provenance writer (R2), immutable JSONL event log + SHA-256 (R3), nested-SSH data plane (R4), consent handshake + X25519 hop credentials (R5), federation/bridge (R6), churn generator + selector + correlator/entropy/classifier (R7).
• Compute grid: 2 Android phones + laptop as nested-SSH relay hops (SSH); hackhouse VM fabric as churn source. Node-role→device mapping pinned per comparison and recorded in R2.
• Isolation / containment (binding at every cell): every forwarder runs in an isolated engine only (docker/multipass via bridge.py:517-530); assert engine != local or the run refuses. All traffic is self-generated to our own fixtures, lab-only across our own houses/VMs. No external target, no live-network relay — a hard stop requiring explicit human approval (GOAL envelope (b)). Fixtures (payload streams, synthetic sender sets) versioned in the worktree and checksummed.
• Models: static/random selectors need no model — RQ1 and RQ2 use no selector model at all (selector held at static for their controls), so the lead paper (G4+RQ1+RQ2) is fully pinned by this freeze. The agent selector arm (RQ3 only) uses a single pinned local/open-weight model served from the hackhouse agent fabric. Bounded instrument-pin (the one value not nameable at freeze): the exact model ID + weights digest + sampling params (temperature, top_p, max tokens) are fixed at the §5 RQ3 calibration gate — before any RQ3 confirmatory run — recorded in the run manifest (R2), and immutable for the entire RQ3 battery; any change is a §8 deviation. This bound touches RQ3 alone and never RQ1/RQ2. This supersedes the roadmap's "frontier-model arm" assumption: choosing a local model eliminates the paid-frontier budget gate (GOAL envelope (c)) rather than bypassing it, and improves reproducibility (pinned weights vs a moving hosted endpoint). A paid frontier model, if ever run, is an EXPLORATORY contrast, separately budget-gated. The arm's prompt text is versioned and included in the paper appendix (rigor-standards §LLM/agent).
• Instrument-validation HARD GATE (must pass before ANY confirmatory run; boolean, from GOAL "Done" and roadmap Phase IV — each maps to an R-item acceptance check):
  1. End-to-end delivery: a 3-hop self-traffic circuit across the grid delivers a known payload end-to-end; each hop's pcap exists and checksums (R4).
  2. Seeded reproducibility: smoke-e2e.sh-style bringup is reproducible from a seed — same seed + same churn script → identical circuit-build sequence and selector choices, diff-clean modulo wall-clock (R1).
  3. Correlator calibration (= P3-RQ1): the R7 correlator scores a known-linked control pair at AUC ≈ 1 and a known-unlinked pair at AUC ≈ 0.5.
  4. Entropy calibration (= P2-RQ2): the estimator returns H = log2(N) (within MC error) for N equiprobable synthetic senders.
  5. Isolation: forwarders confirmed isolated engine only — assert engine != local or refuse (R4; bridge.py:528-529).
  6. Provenance integrity: replaying a fixture circuit yields a schema-valid events.jsonl whose SHA-256 matches manifest.json; log is append-only (R2/R3). Gate is boolean; any red → back to the failing R-item; no confirmatory cell runs until all green (GOAL; roadmap Phase IV).
• Procedure (numbered; becomes the stage-04/05 run spec):
  1. Build R1–R7; pass every [REQUIRED-for-H1] acceptance check as a test where feasible.
  2. Run the §5 instrument-validation gate; record the gate report.
  3. Freeze seeds + thresholds (this document, on approval) and hash.
  4. Run the confirmatory battery: all §2 cells × R runs, controls interleaved, order randomized within cell. Each run writes manifest.json (R2), appends events.jsonl (R3), writes per-hop pcap/hop<N>.pcap (R4) — all SHA-256'd and immutable.
  5. R7 analysis reads events.jsonl + pcaps → metrics.json (AUC, H, throughput/latency, rebuild AUC) per cell.
  6. Lock raw outputs (stage 05 immutability). No edits; cleaning only in analysis code on copies.

6. Analysis plan

Effect size + 95% CI reported for every comparison (rigor-standards §Statistics); p-values never reported alone. All confirmatory tests below; anything else EXPLORATORY.

• RQ1 (H-RQ1 P1, P2):
  • P1 (leak): bridge-on correlation AUC with bootstrap 95% CI. Confirmation gate = the CI excludes 0.5 (a leak is present); NULL/refute if the CI includes 0.5. This mirrors the stage-02 falsification condition exactly and removes a dead zone (see below). Materiality is a separate pre-registered label, not the gate: AUC CI-lower-bound ≥ 0.60 [APPROVAL] ⇒ "material leak"; between 0.5 and 0.60 ⇒ "weak-but-real leak." Raw AUC + CI are reported in every case. (Refines the stage-02 P1 operationalization pre-data — legitimate, not HARKing: the original "AUC > AUC_floor AND CI excludes 0.5" created an un-adjudicable zone where a real leak, e.g. AUC 0.57 / CI [0.53, 0.61], was neither confirmable nor refutable; §Design decisions.)
  • P2 (padding efficacy): ΔAUC = AUC(bridge-on, no-pad) − AUC(bridge-on, +pad); paired bootstrap 95% CI. Padding effective iff ΔAUC CI > 0.
• RQ2 (H-RQ2 P1, P3):
  • P1 (two-sided): ΔH = H(federated) − H(single-house, matched N), bootstrap 95% CI; the design does not presume the sign. CONFIRM-grow if ΔH CI > 0; CONFIRM-shrink (honest null, published with equal prominence) if ΔH CI < 0; inconclusive if the CI spans 0. Matched-N rule [APPROVAL]: single-house arm sized so its node count equals the total consenting nodes of the federated arm.
  • P3 (mechanism, confirmatory): Spearman ρ between top-k bridge concentration (fraction of circuits through the top-k willing bridges) and per-circuit H, with 95% CI; negative ρ quantifies funneling. k = 3 [APPROVAL].
• RQ3 (H-RQ3 P1, P2, joint P3):
  • P1 (perf): throughput_retention(agent) − max(static, random), bootstrap 95% CI, plus added-latency(agent) 95% CI. Perf holds iff retention-margin CI lower bound ≥ X% AND added-latency CI upper bound ≤ Y ms. X = 10 percentage points; Y = 100 ms [APPROVAL] (grid is a LAN of phones+laptop; Y is the added-latency budget over the best baseline; both reconfirmed against §5 baseline latencies at freeze).
  • P2 (anonymity): rebuild-classifier AUC with 95% CI. Anonymity holds iff the CI upper bound ≤ AUC_ceiling. AUC_ceiling = 0.60 [APPROVAL] (symmetric with the RQ1 floor: a rebuild pattern discriminable at ≤ 0.60 is not a usable fingerprint).
  • P3 (joint): CONFIRM iff P1 AND P2 both hold; H0 if either fails.
• Multiple-comparison correction [APPROVAL]: the confirmatory hypothesis tests across all three RQ families are corrected together by Holm–Bonferroni (rigor-standards §Statistics default). Test family (7 confirmatory tests): {RQ1-P1, RQ1-P2, RQ2-P1, RQ2-P3, RQ3-P1-perf, RQ3-P1-latency, RQ3-P2}. RQ3-P3 is a logical AND of already-corrected tests, not a new test. CIs are reported at the Holm-adjusted level for the confirmatory family. EXPLORATORY results (transport arm; any post-hoc contrast) are labeled and excluded from the confirmatory column.
• Assumption checks + fallbacks: all inference is bootstrap/permutation-based and therefore assumption-light by construction; no normality assumed. Bootstrap: 10,000 resamples, BCa intervals; seed spot-check (3 seeds must agree to MC error). Entropy bias handled by Miller–Madow (§3); sensitivity to a second estimator (NSB) reported EXPLORATORY.
• Data exclusion rules (pre-data): a cell/run is quarantined (logged, never silently dropped) only if its data-integrity check fails — events.jsonl SHA-256 ≠ manifest, a pcap fails checksum, an in-place edit is detected, or the seed does not reproduce the logged circuit-build sequence for that spot-checked cell. No performance-based exclusions.
• Outcome mapping (decision rule, frozen now; thresholds frozen on approval):
  • RQ1: P1 confirm ⇒ bridge linkability leak (motivates the padding artifact); P1 null ⇒ headline null (bridge present, no measurable leak — reportable). P2 sign gives padding efficacy.
  • RQ2: ΔH CI > 0 ⇒ federation grows the anonymity set; ΔH CI < 0 ⇒ honest null / shrink, reported as prominently as growth; spans 0 ⇒ inconclusive. Expectation-bias guard binding (rigor-standards; GOAL honest-expectation).
  • RQ3: P1 ∧ P2 ⇒ agent selector helps without a rebuild fingerprint; either fails ⇒ H0 (perf gain cancelled by teardown overhead, or rebuild timing is classifiable).

7. Threats to validity

Threat	Type	Disposition
Background load / thermal throttling skews throughput & latency	Internal	MITIGATED — randomized order, interleaved controls, per-session idle baseline measured & modelled
Detector tuning contamination (correlator/classifier fit to confirmatory data)	Internal	ELIMINATED — detectors frozen + calibrated on §5 fixtures pre-battery; no per-cell retuning
Device heterogeneity confounds topology/selector effects	Internal	HOLD CONSTANT — node-role→device mapping pinned per comparison, recorded in R2 manifest
Local grid (2 phones + laptop, few houses) ≠ internet-scale; not a global passive adversary	External	ACCEPTED + scoped — claims restricted to the tested topology/scale → Limitations
Self-generated fixture traffic ≠ real user traffic patterns	Construct	ACCEPTED — inherent to a lab measurement; scoped → Limitations; fixtures versioned
A single detector's AUC as "linkability"; plug-in H as "anonymity"	Construct	MITIGATED — calibrated instruments (§5 P3/P2 gates); H reported with S=2^H and normalized d; second estimator (NSB) as EXPLORATORY sensitivity
Multiplicity across three RQ families	Statistical	Holm–Bonferroni over the 7 confirmatory tests (§6); EXPLORATORY family labeled
Small node/house counts → wide entropy CIs	Statistical	ACCEPTED + reported — node counts stated; underpowered-for-large-N caveat → Limitations
Bootstrap CI validity at small per-cell N	Statistical	MITIGATED — R=30 runs × C=50 circuits (§4); BCa intervals; seed spot-check
Agent-arm model non-determinism (temp>0)	Statistical	R repeated runs; variance reported; model ID + params pinned (§5)
Isolation escape / traffic leaving the lab	Internal/containment	ELIMINATED — assert engine != local or refuse; self-fixtures only; external target = human-gated hard stop
Dual-use of an onion-routing data plane	Construct/ethics	Defensive-measurement framing load-bearing; containment (scout §6) binding; stage-08 red-teams the framing

Citation-integrity notes (carried forward): [Stutzbach2006] session-count figures are secondary-sourced — re-confirm against the primary before any load-bearing use in the paper; [Constantinides2026] is a Feb-2026 preprint — re-confirm status/claims before citing as support. Neither is load-bearing for any confirmatory threshold above.

8. Freeze block (ACTIVE)

• Freeze date: 2026-07-19 (human-approved at the stage-03 checkpoint). SHA-256: recorded in sor-consent-prereg.sha256 (external, so this file's own hash is well-defined) and echoed into every run manifest (R2). All [APPROVAL] values (§4/§6 thresholds, base seed S0, matched-N, top-k, X%, Y ms, ceilings, estimator, R and C, Holm family) are approved as stated. The one bounded post-freeze pin — the RQ3 local agent-model ID/digest — is fixed at the §5 calibration gate before any RQ3 confirmatory run and recorded immutably (§5); it does not affect RQ1/RQ2.
• Frozen on approval: the three RQ hypotheses (by reference to the stage-02 file); all IV levels (§2–3); all DV operationalizations (§3, R7 metrics); the numeric thresholds now marked [APPROVAL] — RQ1 confirmation gate (CI excludes 0.5) + the 0.60 materiality label, matched-N rule, top-k, X%, Y ms, AUC_ceiling, entropy estimator, local agent-model ID + weights digest, base seed S0, R and C; the Holm confirmatory family (§6); and the stopping rule (§4).
• Reporting/packaging (frozen intent, not a statistical commitment): all three RQs are pre-registered as confirmatory now; the lead paper = G4 + RQ1 + RQ2; RQ3 is a designated severable follow-on (§Design decisions). Packaging is finalized at stage 07 from the results; the shared prereg + Holm family are disclosed in whichever papers result.
• Post-freeze policy: any change of any kind — including promoting the transport arm or the paid frontier selector arm — appears only in stage 05's sor-consent-deviations.md with reason and expected impact; the frozen file is never edited. No HARKing; confirmatory ≠ exploratory.
• Attestation at freeze: detectors (correlator, entropy estimator, rebuild classifier) were calibrated only on the §5 instrument-validation fixtures, with no exposure to confirmatory-cell data, before the battery.

9. Design decisions (pre-freeze, 2026-07-19)

Recorded so the human approver and stage-08 reviewer can audit the reasoning and circle back if any assumption changes. All predate any confirmatory data. Full rationale + rejected-alternatives in sor-consent-design-notes.md.

#	Fork	Decision	Why
D1	Agent selector: paid frontier vs {static,random} only	Local/open-weight model from hackhouse fabric; confirmatory, $0	Answers RQ3's actual question; eliminates (not bypasses) the paid-budget gate; better reproducibility than a hosted endpoint. Fallback: funded follow-on only if it fails §5 calibration
D2	RQ1 confirmation gate	Gate = CI excludes 0.5; 0.60 becomes a materiality label	Removes an un-adjudicable dead zone (real leak that was neither confirmable nor refutable); mirrors the stage-02 falsification condition
D3	Transport arm (TCP vs QUIC/ssh3)	TCP-nested confirmatory; QUIC EXPLORATORY	Orthogonal to all three RQs; a weak lit-gap; avoids doubling cells, build, and multiplicity
D4	Containment boundary	Unchanged, verbatim	Isolated-engine-only / self-fixtures / lab-only is the dual-use ethical backbone; no reason to touch
D5	Freeze/hash	Deferred — remains DRAFT until explicit human "freeze"	Operator wants the packaging fork (D6) kept open to circle back before committing

D6 — Packaging fork: one paper vs several (the explicit "circle-back" record)

• The fork: bundle all three RQs into one paper, or split per-RQ into several.
• Structure of the evidence: RQ1 (bridge linkability) and RQ2 (federation's anonymity-set effect) are two halves of one story — the anonymity properties of the consent-gated federated topology, measured with the same anonymity metrics for the same reader. RQ3 (churn resilience + agent-managed rebuilds) is a different axis (availability / AI-network-control) with a different reviewer pool. Natural fracture line = RQ1+RQ2 | RQ3. Three papers = over-fragmented (RQ1 alone is thin, and salami-slicing RQ1 from RQ2 is unjustifiable).
• Decision (revisable at stage 07): Lead paper = G4 + RQ1 + RQ2; RQ3 = designated severable follow-on. Matches roadmap Phase P (2026-07-19), now on firmer footing because D1 makes RQ3 a $0 confirmatory arm rather than a budget-fragile one.
• Why this is safe to defer: the packaging choice lives at stage 07 (drafting), not here. We build once (R1–R7), pre-register all three RQs as confirmatory now, run the battery once, and only then decide packaging from the observed results. Deferring costs nothing and is not salami-slicing: they are one pre-registered instrument + battery, and the shared prereg + Holm-corrected family are disclosed in whichever papers result (which is more rigorous). The only property this preserves that dropping RQ3 would forfeit is RQ3's confirmatory eligibility.
• Circle-back triggers: revisit at stage 07 if — RQ3's results are strong enough to headline on their own (→ firm split), or thin enough to fold in as a section (→ single bundled paper); or if a target venue's scope forces a particular cut. Record any change in the stage-05 deviations log if it touches a frozen item, otherwise as a stage-07 drafting note.