soft-hash T3 bound: pre-review polish pass for external cryptographer

Four targeted edits before forwarding to dav1d:

1. Add §0 cover note — names the three things the reviewer should
   confirm (decomposition, per-surface derivations, conservative-
   constant choice) and what's explicitly out of scope (empirical
   validation against a real adversarial-training run).

2. Tighten §2 decomposition. The previous text invoked DPI to
   produce an additive split I(A;C) ≤ I(A;Θ) + I(Θ;C), which DPI
   alone doesn't justify. Replace with a clean Markov-chain DPI
   statement (A → Θ → C(M) is a Markov chain conditional on
   (H_{≤t}, n_t); DPI gives I(A;C) ≤ I(A;Θ)) and frame the T1+T2
   baseline as threat-model-additive (disjoint adversary surfaces),
   not information-additive in the same MI sense.

3. Rename §3 'Apply Fano's inequality' → 'discrete-distinguishability
   counting'. The derivation log₂(SNR+1) is the discrete channel-
   capacity bound on K distinguishable outputs, not Fano's
   inequality (which bounds error probability from MI). Add an
   explanatory note that LR factors cancel per-step (LR's distinct
   channel contribution is §4, not double-counted here). Update §10
   item 1 cross-reference for the same naming consistency.

4. Resolve §5 conjecture. Move the random-shuffle conjecture out of
   the headline derivation; commit C_B3 = 1 strictly under the
   adversarial-order assumption stated in §5. The random-shuffle
   tightening C_B3 → O(1/√N_b) stays referenced via §10 + #000043
   as the formal tightening path operators can opt into via the
   --c-b3 calculator flag.

No numeric examples changed; no calculator behavior changed; no
reference list changed. Pure pre-review polish to remove three
specific things a careful cryptographer would catch and ask
about, plus a cover note that frames the kind of review wanted.

docs/soft-hash-channel-t3-bound.md

@@ -11,6 +11,48 @@ the closed-form bound.
 
 ---
 
+## §0. What we're asking the reviewer to confirm
+
+This document derives an upper bound on the per-window mutual
+information a T3 (hyperparameter) adversary can steer into the
+SHA-256 commitment `C(M_{t+1})`. The framework decomposes the
+channel across T3's three control surfaces (gradient bias,
+LR selection, batch order) and combines them into a closed-form
+bound consumed by `bench/scripts/t3_bound_calculator.py`.
+
+Three specific things to check:
+
+1. **§2 decomposition.** Is the Markov-chain DPI step (`A →
+   Θ_{t+1} → C(M_{t+1})`) correctly applied, and is the
+   T1 + T2 baseline inherited from `soft-hash-channel-analysis.md`
+   §4 cleanly separated from the T3 capacity bound this doc
+   adds?
+2. **§§ 3-5 derivations.** Is each per-surface bound (`C_B1`
+   gradient-bias, `C_B2` LR selection, `C_B3` batch order)
+   derived with a sound information-theoretic argument? §3 uses
+   discrete channel-capacity counting on the per-step
+   parameter-shift; §4 uses categorical-channel capacity on the
+   LR grid; §5 uses the Bottou-Bousquet adversarial-order
+   refinement.
+3. **Conservative-constant choice.** Are `C_B1 = C_B2 = C_B3 = 1`
+   genuinely upper-bounding (never optimistic)? Where would you
+   tighten? Empirical tightening paths are catalogued in §10
+   and tracked under #000043.
+
+What's *not* being asked: empirical validation against an actual
+adversarial-training run (out of scope per §10 item 5; opens as a
+future ticket once v7 plastic-training has a deployment target).
+
+The headline numeric example in §7 + §11 yields
+`I_window ≈ 626 bits/window` for a default deployment config —
+exceeding SHA-256's 256-bit output, which is the calculator's
+"reduce `W`" trigger condition. The framework's job is to make
+that trigger derivable from operator-measurable inputs; the
+constants' job is to be honest worst-case starting points
+operators can refine per-deployment.
+
+---
+
 ## §1. T3 model restatement
 
 From `docs/soft-hash-channel-analysis.md` §6, threat model T3
@@ -66,24 +108,42 @@ where:
 - `n_t` is the published per-checkpoint nonce (M2 mitigation).
 
 This is the standard mutual-information upper bound on
-distinguishing-from-baseline channel capacity. The data
-processing inequality lets us decompose:
+distinguishing-from-baseline channel capacity. Conditional on
+`(H_{≤t}, n_t)`, the random variables form a Markov chain:
 
 ```
-I_window ≤ I( A ; Θ_{t+1} | H_{≤t}, n_t )    (parameter-space proxy)
-         + I( Θ_{t+1} ; C(M_{t+1}) | H_{≤t}, n_t )    (φ-mapping)
+A  →  Θ_{t+1}  →  C(M_{t+1})
 ```
 
-The second term is bounded at the random-oracle baseline by
-the §4 reduction (when φ is φ_PRG per #000035, or φ_linear under
-NO_ALIGNMENT verdict per #000034). So:
+— T3's window inputs `A` affect the commitment only through the
+parameter state `Θ_{t+1}`. Markov-chain data-processing inequality
+gives the single-source bound:
 
 ```
-I_window ≤ I( A ; Θ_{t+1} | H_{≤t}, n_t ) + (random-baseline bits)
+I( A ; C(M_{t+1}) | H_{≤t}, n_t )  ≤  I( A ; Θ_{t+1} | H_{≤t}, n_t )
 ```
 
-The random-baseline term is constant-bounded; the per-window
-**adversarial** capacity is the first term, which we now bound
+The right-hand side — T3's per-window capacity to encode adversarial
+bits into the parameter state — is what this document bounds in
+§§ 3-5.
+
+**Inherited T1 + T2 baseline.** Independent of T3, the φ-mapping
+`Θ → C(M)` itself admits a constant random-oracle baseline channel
+under the §4 reduction in `soft-hash-channel-analysis.md` (when φ
+is φ_PRG per #000035, or φ_linear under the NO_ALIGNMENT verdict
+per #000034). That baseline is bounded by SHA-256 partial-preimage
+hardness and is independent of A. Threat-model-additive (T3 capacity
++ T1+T2 baseline = total per-window leak budget) but not
+information-additive in the same MI sense — the two contributions
+come from disjoint adversary surfaces:
+
+```
+total per-window bits  ≤  I( A ; Θ_{t+1} | H_{≤t}, n_t )   ← T3, this doc
+                        + (T1 + T2 baseline)               ← § 4, inherited
+```
+
+The baseline term is constant-bounded by §4 unchanged; the per-
+window adversarial capacity is the first term, which we now bound
 by decomposing across T3's three control surfaces.
 
 ---
@@ -96,8 +156,8 @@ adversarial signal `g_s` is bounded in norm by `g · ‖∇L_max‖`
 where `‖∇L_max‖` is the per-step gradient-norm cap (gradient
 clipping, in practice).
 
-**Information bound.** Apply Fano's inequality to the
-per-step parameter-shift channel.
+**Information bound.** Per-step parameter-shift channel
+capacity by discrete-distinguishability counting.
 
 For one SGD step with learning rate `lr_s`:
 
@@ -106,8 +166,13 @@ For one SGD step with learning rate `lr_s`:
 ```
 
 The adversarial component `lr_s · g · ∇L_adv` is the parameter
-shift in the adversary's chosen direction. By
-data-processing-inequality argument:
+shift in the adversary's chosen direction. The honest stochastic
+gradient contributes noise of standard deviation `σ_grad`. At each
+step the parameter shift falls in one of approximately
+`SNR_grad + 1` distinguishable buckets — the noise-only level plus
+`SNR_grad` adversarial-signal levels resolvable above the noise
+floor. The single-symbol channel-capacity bound on a discrete
+channel with `K` distinguishable outputs is `log₂ K`:
 
 ```
 I( g_s ; Δ Θ_s ) ≤ log₂( ‖adversarial step‖ / ‖noise step‖ + 1 )
@@ -115,9 +180,12 @@ I( g_s ; Δ Θ_s ) ≤ log₂( ‖adversarial step‖ / ‖noise step‖ + 1 )
                 = log₂( g · ‖∇L_max‖ / σ_grad + 1 )
 ```
 
-where `σ_grad` is the standard deviation of the honest stochastic
-gradient at this step. The `+1` keeps the log finite when the
-adversarial step is below the noise floor.
+The `+1` corresponds to the noise-only level (no signal injected);
+it keeps the log finite when the adversarial step is below the
+noise floor. (The `lr_s` factor cancels — LR scales signal and
+noise identically per-step, so the bound is LR-independent at the
+per-step level. LR's distinct channel contribution is the §4
+LR-selection capacity, not double-counted here.)
 
 Define:
 
@@ -225,10 +293,18 @@ For `N_b = 1024`, `σ_grad/‖∇L_max‖ ≈ 0.1`: `0.5 · log₂(102.4) ≈
 ```
 B3 contribution ≤ C_B3 · ⌈W / E⌉ · log₂( N_b · σ_grad / ‖∇L_max‖ ) / 2
 
-with C_B3 ≤ 1 (data processing inequality; conjecture is tighter
-under the Bottou-Bousquet random-shuffle baseline; see §10).
+with C_B3 = 1 (data-processing inequality; tight under the
+adversarial-order assumption made in this section).
 ```
 
+Tightening to the random-shuffle baseline gives `C_B3 →
+O(1/√N_b)` — substantially below 1 for typical `N_b`. That
+tightening is **deferred to §10** + #000043; the headline bound
+above stays at the adversarial-order ceiling so operators
+choosing `W` get the upper-bound conservative number unless
+they explicitly opt into the random-shuffle constant via
+`--c-b3` on the calculator.
+
 For `W = 10000`, `E = 1024`, the contribution is `1 · 9.77 · 3.34
 ≈ 32.6 bits/window` — substantially less than the naive
 `log₂(N_b!)` bound of `~8000+ bits/epoch`.
@@ -357,8 +433,9 @@ is the explicit form. Reference: this doc §6.
 The framework is conservative; tightening any of these refines
 the bound without invalidating it:
 
-1. **C_B1 below the data-processing limit.** The Fano bound
-   `log₂(SNR_grad + 1)` is a per-step capacity ceiling; tighter
+1. **C_B1 below the data-processing limit.** The discrete
+   channel-capacity bound `log₂(SNR_grad + 1)` is a per-step
+   ceiling derived under uniform-prior signal levels; tighter
    bounds are possible if the loss surface has reduced
    adversary-controllable directions (e.g. Hessian rank
    deficiency). Empirical measurement via #000034's probe