docs(adr-0244-d4): correct Phase 3 SHA ref to f3702ad4 (post-amend)

docs/handoff/ADR-0244-D4-IMPLEMENTATION-PLAN.md

@@ -150,7 +150,7 @@ Dependencies: `0 → {1, 4}` · `1 → 2 → 3` · `5 after 0` · `6 last`. Each
 **Steps:** define a `BoundedUnimodalObjective` over reference traces (ID traces pass, adversarial fail); run the Fibonacci search; emit an audit-logged tuning certificate; pin the calibrated threshold; flip the Phase-2 flag on once evidenced.
 **Acceptance:** calibrated threshold separates ID vs adversarial reference sets; certificate reproducible + deterministic; flag-on run keeps eval suites green.
 **Gate:** smoke + fast lane + calibration tests.
-**Status:** ✅ DONE — landed `323d61c5`. **The flag flip is NOT authorized (honest empirical finding); flag stays OFF.**
+**Status:** ✅ DONE — landed `f3702ad4`. **The flag flip is NOT authorized (honest empirical finding); flag stays OFF.**
 **Resume notes:** Shipped `evals/adr_0244_gamma_calibration/` (`run_gamma_calibration`, `calibrate_leakage_bound`, `leakage_separation_objective`, `collect_live_benign_leakages`, CLI) + `tests/test_adr_0244_gamma_calibration.py` (9 tests, 1 slow drift-guard). Pinned `identity._WAVE_LEAKAGE_BOUND = 0.2126624458513829` (cert `0079b5f201fbf616…`, objective `gamma_id_leakage` v1, budget 24, interval [0,1], sharpness 10) and **decoupled the wave path from `alignment_threshold`** (legacy path + hedge bands keep it; wave path now flags on `leakage_rms > _WAVE_LEAKAGE_BOUND`). The self-alignment floor stays 0.0 (geometric invariant, not calibrated).
   - **Two honest results, kept separate:** (1) the bracketed-local Fibonacci search **certifies** γ* separating the *geometric* attack signal — every in-subspace rotor admitted, every axis→e4/e5 tilt/boost flagged (inversions excluded from the leakage set — they're ~0-leakage, caught by the orientation floor); machinery validated + reproducible + deterministic. (2) **The same bound does NOT separate real live traffic.** Measured on the arc engine (`ChatRuntime`, wave flag on, 13 main-path benign turns): benign `final_state.F` leakage spans **0.14–0.81** (mean 0.55), self-alignment swings to **−0.52**; **12/13 benign turns would be false-refused at γ***, benign overlaps the attack range, and the **best achievable balanced error over all thresholds is 0.346**. No leakage bound gates live traffic without mass-refusing benign turns.
   - **Root cause (architectural gap, not an impl defect):** the shipped pack value axes (`truthfulness=e1`, `coherence=e2`, `reverence=e3`) are **nominal basis vectors, not the dynamically-preserved eigenmodes §2.1 presumes**. The current field evolution gives the identity subspace no dynamical anchoring, so an ordinary cognition versor rotates it freely. Closing this = making identity dynamically load-bearing = **the ADR-0246 induced-identity-action programme** (preflight brief already merged, `docs/briefs/ADR-0246-*`). The wave gate is therefore **validated, correctly flag-gated-off scaffolding**, not a live gate. A slow drift-guard test re-measures the live distribution and fails loudly if the engine ever starts preserving identity (→ re-calibrate + reconsider the flip). This resolves the last open question from §7 (`boundary_ids` predicate was Phase 2; the live-separation question was the real Phase-3 crux). The eval's CLI exit-0 means "certificate valid", explicitly **not** "flip the flag".
@@ -230,7 +230,7 @@ Forward-looking mechanical-sympathy items from the critique — a separate optim
 - **2026-07-17** — **Phase 2a landed `1c7ea26e`.** Pure `identity.py` capability: dual-mode wave gate + `IdentityGateRefusal` + boundary predicate + admit-or-abstain `C_id` + extended `IdentityScore` + 16 tests. No runtime behavior change (legacy path byte-identical). Gate: 16 new + smoke 176 + fast lane **11879 passed, 109 skipped** (8:39). Next: 2b (runtime wiring behind `identity_wave_gate` flag).
 - **2026-07-17** — **Phase 2b landed `c7e2b3b6`.** Runtime wiring: `identity_wave_gate` flag (`core/config.py`), two flag-gated touches in `chat/runtime.py` (`wave_field=final_state.F` at the identity check; post-verdict boundary supplement + geometric refusal fold), wave telemetry in `chat/telemetry.py` (emitted only when `wave_mode_active`). **Integration bug caught + fixed:** the live versor carries boost (e5) components → `F aᵢ F̃` is NOT Euclidean-norm-preserving → un-normalized leakage/self-align ran to 5.16 / −4.75. Fixed with per-axis normalization in `identity_manifold.py` (leakage fraction ∈ [0,1], signed cosine ∈ [−1,1]; Phase-1 unit-rotor results unchanged; boost test added; §4a updated). Gate: 74 targeted + smoke 176 + fast lane **11883 passed, 109 skipped** (8:26) — flag-off byte-identity confirmed. **Open reality for Phase 3:** value axes are placeholders (e1/e2/e3), so whether the geometric gate DISCRIMINATES adversarial vs benign is an empirical question — 2c measures it. Next: 2c (ablation eval).
 - **2026-07-17** — **Phase 2c landed `c0ff4720` → Phase 2 COMPLETE.** `evals/adr_0244_identity_gate/` (detection-value ablation) + `tests/test_adr_0244_identity_gate_eval.py` (6 tests) + CLI. Measured: the wave gate separates a geometric-attack panel (2 inversions caught by orientation, 4 tilts/boosts caught by subspace leakage) from an aligned in-subspace panel — all attacks flagged, all aligned admitted, `min_attack_signal 0.35 > max_aligned_leakage 0.0`; wave adds detection value 6-vs-0 over the geometry-blind legacy path. Honest caveat baked in: separation is on the *designed* geometric signal; real-encoder separation is empirical (Phase 3). Additive-only (evals/ + test), off-serving (quarantine green). Gate: smoke 176 + fast lane. Next: Phase 3 (γ_id calibration).
-- **2026-07-17** — **Phase 3 landed `323d61c5` → calibration built + certified; live flag flip BLOCKED by empirical non-separation.** `evals/adr_0244_gamma_calibration/` + `tests/test_adr_0244_gamma_calibration.py` (9 tests). The bracketed-local Fibonacci search certifies `γ* = 0.2126624458513829` (cert `0079b5f201fbf616…`) separating the geometric attack signal; pinned as `identity._WAVE_LEAKAGE_BOUND` and **decoupled the wave path from `alignment_threshold`**. **Then measured the crux the whole arc deferred:** real benign live turns do NOT preserve `span(e1,e2,e3)` — leakage 0.14–0.81 (mean 0.55), self-align to −0.52, **12/13 benign false-refused at γ***, best-achievable balanced error **0.346**. So the calibration certifies `flag_flip_authorized=False`; **`identity_wave_gate` stays OFF**. Root cause: the shipped value axes are *nominal basis vectors, not dynamically-preserved eigenmodes* — no dynamical anchoring in the current field evolution; the fix is the **ADR-0246 induced-action programme** (brief already merged). The wave gate is validated, correctly-off scaffolding. A slow drift-guard test canaries any future change that starts preserving identity. Gate: smoke 176 + fast lane + 59 targeted (incl. wave/ablation/runtime unchanged). Next: Phase 4 (§2.5 cast) — independent of 1–3.
+- **2026-07-17** — **Phase 3 landed `f3702ad4` → calibration built + certified; live flag flip BLOCKED by empirical non-separation.** `evals/adr_0244_gamma_calibration/` + `tests/test_adr_0244_gamma_calibration.py` (9 tests). The bracketed-local Fibonacci search certifies `γ* = 0.2126624458513829` (cert `0079b5f201fbf616…`) separating the geometric attack signal; pinned as `identity._WAVE_LEAKAGE_BOUND` and **decoupled the wave path from `alignment_threshold`**. **Then measured the crux the whole arc deferred:** real benign live turns do NOT preserve `span(e1,e2,e3)` — leakage 0.14–0.81 (mean 0.55), self-align to −0.52, **12/13 benign false-refused at γ***, best-achievable balanced error **0.346**. So the calibration certifies `flag_flip_authorized=False`; **`identity_wave_gate` stays OFF**. Root cause: the shipped value axes are *nominal basis vectors, not dynamically-preserved eigenmodes* — no dynamical anchoring in the current field evolution; the fix is the **ADR-0246 induced-action programme** (brief already merged). The wave gate is validated, correctly-off scaffolding. A slow drift-guard test canaries any future change that starts preserving identity. Gate: smoke 176 + fast lane + 59 targeted (incl. wave/ablation/runtime unchanged). Next: Phase 4 (§2.5 cast) — independent of 1–3.
 
 ---
 
@@ -241,7 +241,7 @@ Forward-looking mechanical-sympathy items from the critique — a separate optim
 | 0 | Governance reconciliation (ADR-0244 edits + commit ADR-0245) | ✅ DONE | `ad37d03b` (+ `459280e3` §4a amend) |
 | 1 | §2.1 identity manifold primitive (operator-preservation) | ✅ DONE | `3c3d2c29` |
 | 2 | §2.2 fail-closed gate + boundary_ids + C_id + telemetry + eval | ✅ DONE | `1c7ea26e`+`c7e2b3b6`+`c0ff4720` |
-| 3 | §2.4 γ_id calibration (certified; **live flip BLOCKED — flag stays OFF**) | ✅ DONE | `323d61c5` |
+| 3 | §2.4 γ_id calibration (certified; **live flip BLOCKED — flag stays OFF**) | ✅ DONE | `f3702ad4` |
 | 4 | §2.5 / 0245 §2.2 serving-boundary cast | ⬜ NOT STARTED | — |
 | 5 | §2.7 residual + §2.9 wiring + §2.10 audit + 0245 §3 gate | ⬜ NOT STARTED | — |
 | 6 | Close-out (2 acceptance packets + 2 ratified flips) | ⬜ NOT STARTED | — |