Record locked v3 validation outcome

README.md

@@ -98,6 +98,9 @@ manuscript Results. The companion formula-linked workbook is
 The expanded v3 confirmation, network endpoint semantics, Stage-B calibration
 outcome, and frozen locked thresholds are recorded in
 `docs/calibration/V3_CONFIRMATION_AND_NETWORK_STAGE_B_2026-07-27.md`.
+The first locked execution passed stable contact and the active H4 challenge
+20/20, but the network final gate passed 199/200 because one 2% loss instance
+exceeded the frozen maximum source-age limit. The audit preserves that failure.
 
 ## Manuscript build
 

docs/calibration/V3_CONFIRMATION_AND_NETWORK_STAGE_B_2026-07-27.md

@@ -154,3 +154,124 @@ The proposed-only locked protocol is
 about the proposed loop under the registered emulator. It cannot support
 superiority over mapping baselines; that requires a separate locked comparison
 including `direct_energy` and `matched_wrench_energy`.
+
+## Locked execution outcome
+
+All three locked studies were executed from clean commit
+`3329939ddec2711460da0873443584bf403720b3`. The master and slave URDF hashes
+recorded in every batch manifest are respectively
+`3890cd584e190a92bbffc74137dc00f49eacf6183f4e5886816eb0203a47e788`
+and
+`c5e0cc947122fe3ee7737852cb6cc07f014e529e46c22e17031a582c29acf5ac`.
+Batch validation reported no structural errors or warnings.
+
+| Locked study | Registered outcome | Plan hash | Metric hash | Row hash |
+|---|---:|---|---|---|
+| Stable contact | 20/20 pass | `6da36a4853b227e8ca41c02589ff67a2edf90f4227dfa1aa980c20464a08988c` | `43d83c3e5482b2ed685accb5752b278fd3c7ecb60960376c4dc2a6d0b77a0e6f` | `437ae8670e8d3b4341b221835e3721a23f221e1e727e72a7ce8c9809480186fa` |
+| Synthetic H4 challenge | 20/20 pass | `0c29157753b6c2fb038253e1a26ea14f83af8c36ee3a37edb8a33e14a2177d86` | `5a28a13305f124282033888420ae865e536599ab7a46ccb1ef53b8cdb1e3a8cb` | `1615026b46700a22e96a5677c734e93b36a81fc9223c45d3091b7e9d2a7d786a` |
+| Proposed-only network | **199/200 final-gate pass** | `152df838b90582b3c1f4e5017e1cd0e7203e378b2be7931be70338b81b0bfd06` | `e65b738d2c05c8d146e837489d5047b102b04e22a98733b39717076f64b15c14` | `24432fcd8cde88cadc54b0e8557c5aeb3ac89851e1ed7216aeff08b747227b6e` |
+
+### Stage-A locked confirmation
+
+The stable-contact study passed all bilateral gates in all 20 disjoint-root
+instances. Master and slave tracking RMSE ranges were
+`0.03587–0.03615 rad` and `0.04586–0.04619 rad`; contact-active RMS was
+`0.10597–0.10755 N`. Energy projection was inactive, as intended for the
+stable-contact study.
+
+The synthetic challenge triggered the supervisor in every instance:
+
+- projection-intervention fraction: `0.04533–0.29500`;
+- projection distortion \(D_{\mathrm{proj}}\): `0.02781–0.14921`;
+- unsupervised shadow floor deficit:
+  `3.66e-5–1.32e-4 J`;
+- raw probe work: `0.00720–0.00756 J`;
+- downstream modification after energy projection: zero.
+
+All 15 challenge/audit outcomes passed in all 20 instances. The challenge is
+synthetic and explicitly ineligible for H3; it establishes neither human nor
+physical-device safety.
+
+### Network locked failure
+
+The network batch completed all 200 trials without an execution failure, and
+its paired-degradation gate passed 200/200. Nevertheless, its registered final
+result is a failure because the local network gate passed only 199/200.
+
+The sole failed trial was:
+
+```text
+trial_id:       trial-03311565ca2fa456
+trajectory:     free_space
+profile:        symmetric_40ms_loss_2pct
+replicate:      18
+failed gate:    network_forward_age_gate_pass
+observed max:   0.118 s
+frozen limit:   0.100 s
+```
+
+The received forward sequence jumped from 44 to 48. Three consecutive 50 Hz
+mapping updates were absent, so the held packet accumulated
+`40 ms` transport delay, `60 ms` of missed updates, and `18 ms` of ordinary
+mapping hold age. Its source age reached `118 ms` before the next packet
+arrived. Source age exceeded `100 ms` for nine 500 Hz samples (`18 ms`). The
+silence since the last packet arrival was only `78 ms`; the channel therefore
+remained active, its timeout fraction was zero, and the registered arrival
+timeout was `200 ms`. This is a stale-command tail event, not a disconnect. It
+remains a formal failure because source age and arrival timeout were
+deliberately separate endpoints.
+
+The failed trial still passed every tracking, paired-degradation, free-space
+contact, H4, and bilateral safety gate. Across the complete network study:
+
+- paired tracking and paired contact gates passed in all applicable trials;
+- the largest paired tracking degradation was `2.550 mrad`, below the frozen
+  `5 mrad` limit;
+- the largest absolute contact-RMS relative change was `1.727%`, below the
+  frozen `10%` limit;
+- H4 accounting and bilateral safety gates passed 200/200;
+- all recorded joint, velocity, acceleration, actuator, haptic, and wall-force
+  limit fractions were zero;
+- all forward and return timeout fractions were zero.
+
+These facts do not override the registered 199/200 final result.
+
+The fixed-RTT directional result was reproduced over 20 locked instances:
+changing `40/40 ms` to `20/60 ms` reduced mean contact reference-lag RMSE from
+`3.489 mrad` to `1.746 mrad`, while increasing mean return-feedback-lag RMSE
+from `14.952 mNm` to `18.302 mNm`.
+
+Local locked evidence is stored under:
+
+- `output/experiments/bilateral-locked-v3-stable-20260727`;
+- `output/experiments/bilateral-locked-v3-energy-20260727`;
+- `output/experiments/bilateral-network-v3-locked-20260727`.
+
+The network seed-provenance hash is
+`a7ea2be5f89ec0150c7dc3a78fc2e1cc01e685dd68f090a086eb411fd066bb08`.
+
+### Consequence for the next protocol
+
+The v3 network result must remain 199/200. The `0.100 s` limit must not be
+changed to `0.120 s` and retroactively applied to this batch.
+
+A subsequent protocol may be designed only as a new, explicitly post-v3 study
+with fresh disjoint root seeds. Before those seeds are generated, it should:
+
+1. separate a distributional freshness endpoint, such as predeclared p99
+   source age, from a hard maximum-age or timeout safety endpoint;
+2. justify the hard age limit from the intended command rate and real system
+   safety requirement rather than from the observed `118 ms` value;
+3. include registered burst-loss conditions or measured network traces, since
+   independent 2% loss can still produce consecutive losses;
+4. keep availability, freshness, and tracking degradation as separate
+   outcomes;
+5. if `100 ms` is intended as a safety boundary, implement and register an
+   online source-age guard with explicit degraded-mode, hold/deceleration, and
+   recovery behavior instead of relying only on the current `200 ms`
+   last-arrival timeout.
+
+Only after that proposed-loop protocol is settled should a new three-method
+locked comparison be registered. Such a comparison needs fresh seeds,
+method-specific nominal references, predeclared primary contrasts, and
+multiple-comparison control; it cannot be appended to the present batch.