docs: fold Dav1d review (2026-05-26) into ticket stack

Three doc-only housekeeping items from Dav1d's de-novo reconciliation
of the architecture stack (no code changes; the active build is
#000061 cold-pack work, which is unaffected by this review):

1. Accepted-error formula. Dav1d corrected p_raw × (1-d)(1-r) to
   p_raw × (1 - dr) where r is conditional on detection. Searched
   docs/ and arborist/ — the wrong form does NOT appear in this
   tree (it lives in the external recursive-truth-maintenance / RCO
   manuscripts Dav1d cited). Nothing to fix here; recorded for the
   manuscript authors.

2. #000060 H-ABCDEFG split. Folded the M/C/X axis split into the
   harness scope: M (mechanism — does the substrate's plumbing work),
   C (capability — does it improve task performance), X (external
   adversarial — does it generalize outside author-designed fixtures).
   ACCEPT requires clearing all three. Without X, the harness risks
   self-validating benchmark theology — passing tests its own designers
   picked. Tagged at fixture-definition time; aggregator emits per-axis
   pass rates + combined ACCEPT verdict. Doesn't change the existing
   BatteryResult row schema.

3. #000062 Mechanistic Witness — new scaffold-only ticket. Specifies
   a content-addressed MechanisticWitnessRoot over (model_config,
   capture_policy, contrastive_prompts, features/neurons, intervention
   result, behavioral delta, safety policy) as a DIAGNOSTIC sidecar
   feeding SelfModel + benchmark fixtures. Four hard guardrails:
   diagnostic-only by default; sandbox intervention only; no production
   steering without governance ACCEPT via #000060 M+C+X; feature labels
   never become semantic proof. No code until a real falsifier use case
   exists + guardrails are CLAUDE.md rules + #000060 harness gates
   promotion. The dual-use risk (Pan et al. 2025: 0.1% MLP ablation
   breaks refusal in 72B models) makes governance-first framing
   load-bearing.

Next ID bumped to 000063.

No code change to arborist/. The in-flight v3 SPV corpus pack
(bmq47x6t3) continues unaffected.

docs/tickets/ticket-000060-habcdefg-same-model-substrate-delta-harness.md

@@ -114,3 +114,52 @@ over the batteries and reports per-battery delta + `J_norm` + curvature,
 with gate numbers from bench-qa pipeline output (n≥3); the jaggedness
 and curvature outputs are consumable by the #000012 ForkScore
 extension. `docs/benchmarks.md` gains the new harness + metric schema.
+
+## 7. Scope refinement — H-ABCDEFG-M / -C / -X split (2026-05-26)
+
+Folded in from Dav1d's de-novo review of the architecture stack
+(§1.2, §4.7, §9.1). The harness output is split along three axes so
+"the harness ACCEPTed the upgrade" can't mean "we passed the tests we
+designed for ourselves":
+
+- **H-ABCDEFG-M (mechanism)** — does the substrate work?  
+  Cache-key invalidation correctness, audit-chain integrity, π*
+  canonicalization round-trip, falsification-state transitions, ForkScore
+  scoring on synthetic per-axis deltas. These are tests of the
+  *plumbing* — pass/fail tells you whether the substrate's primitives
+  function as specified, not whether they help cognition.
+
+- **H-ABCDEFG-C (capability)** — does the substrate improve task
+  performance?  
+  The current 5S / 5T / 5F / 5R bench surface over real fixtures.
+  This is the "does it actually help?" axis. ACCEPT here on its own
+  is the load-bearing improvement claim — but only one of three.
+
+- **H-ABCDEFG-X (external adversarial)** — does it generalize outside
+  author-designed fixtures?  
+  Held-out / mechanism-agnostic / adversarial variants drawn from
+  outside the substrate's own design parameters. Fixtures that the
+  substrate's designers did NOT pick. Without this axis, the harness
+  is at risk of self-validating benchmark theology (§27.2 in the
+  ABCDEFG report; Erratum 4 / Anomaly 4 already noted in §5 of this
+  ticket but stated weaker than Dav1d's framing).
+
+ACCEPT requires clearing all three axes. M-only or M+C with X failing
+is a *partial* acceptance that should still surface in the harness
+output, but cannot trigger ForkScore ACCEPT for substrate upgrades.
+
+The split doesn't change `BatteryResult` row schema (already carries
+`carrier` / `domain` / `pi_star_ref`); it changes what the harness
+aggregator reports + what ForkScore consumes. Each fixture is tagged
+with its axis at fixture-definition time; the harness reports per-axis
+roll-ups + a combined verdict.
+
+Implementation order when this ticket gates open:
+1. Tag every existing 5S/5T/5F/5R fixture with `{M, C}` (current
+   fixtures are mechanism + capability by construction; X is the new
+   bucket).
+2. Add X axis fixtures: held-out variants, prompt rewording, adversarial
+   carrier swaps, π*-collision attempts.
+3. Aggregator emits `M_pass_rate`, `C_pass_rate`, `X_pass_rate` +
+   combined `ACCEPT_M_C_X` boolean. ForkScore consumes the per-axis
+   numbers (already lined up with the reserved weight slots in #000012).

docs/tickets/ticket-000062-mechanistic-witness-governed-sidecar.md

@@ -0,0 +1,142 @@
+# Ticket #000062 — Mechanistic Witness: governed diagnostic sidecar
+
+**Status:** open · awaiting go/no-go · scaffold-only
+**Opened:** 2026-05-26
+**Scope:** Specification of a mechanistic-interpretability sidecar
+  (CNA / SAE / Neuronpedia-compatible) that produces a content-addressed
+  `MechanisticWitnessRoot` over (model, prompts, capture policy, neurons/
+  features, intervention deltas), used as a **diagnostic input** to
+  SelfModel + benchmark-fixture generation. **Never** a proof of semantic
+  truth; **never** a production-steering signal without explicit
+  governance promotion through ForkScore.
+**Audience:** dav1d (architectural inflection — first time arborist has
+  framed interpretability tooling as part of the substrate at all; needs
+  the four guardrails below to be load-bearing before any code lands).
+**Hard constraint:** soft signals never enter the hard proof path.
+  `audit_mode` does not move based on mechanistic-witness output;
+  `governance_policy_hash` only moves if/when a promotion is explicitly
+  ACCEPT'd via ForkScore with M+C+X axes passing (cf. #000060 §7).
+
+## Problem
+
+The recursive truth-maintenance framing (Dav1d review, 2026-05-26) puts
+arborist's verifier + falsifier layers at the "what" of truth: was a
+claim grounded, did its evidence support it, did a falsifier defeat it.
+None of that surfaces the *internal* "why" of a model's behavior — the
+neurons / SAE features / activation patterns that fire when the model
+produces a refusal, a hallucination, or a low-confidence answer.
+
+Two reasons this matters for arborist:
+
+1. **SelfModel calibration improves** when the system has internal
+   evidence of its own failure modes (e.g. "this question class
+   activates the refusal cluster — expect higher refusal rate"). The
+   5R workspace (#000017 SelfModel) currently relies on behavioral
+   evidence only; a mechanistic channel adds an orthogonal signal.
+
+2. **Benchmark fixtures become falsifiers.** Contrastive-neuron-
+   attribution work (Pan et al., 2025; the CNA paper Dav1d cited) shows
+   that ablating 0.1% of MLP neurons reduces refusal rate by >50%
+   across Llama / Qwen up to 72B. That kind of finding is itself a
+   *falsifier* for safety claims — "this model is safe because it
+   refuses X" is undermined by "ablating these N neurons breaks the
+   refusal." Treating that finding as a benchmark fixture lets the
+   substrate use it.
+
+But — and this is the load-bearing caveat — mechanistic interpretability
+is **dual-use** by construction. The same technique that identifies a
+refusal circuit can be used to break it. arborist must absorb the
+diagnostic value without giving up the governance discipline that keeps
+soft signals out of the hard proof path.
+
+## Design — four guardrails
+
+Dav1d's review (§4.7) frames the integration rule. Restated for this
+ticket:
+
+1. **Diagnostic only by default.** Mechanistic-witness output feeds
+   SelfModel + benchmark fixtures + safety audits. It does NOT promote
+   audit_mode, write to providence_cache, or move governance_policy_hash.
+
+2. **Sandbox intervention only.** Activation patching / neuron clamping
+   runs in a sandbox process, against a sandbox model load, against a
+   sandbox eval set. Production inference paths see no intervention.
+
+3. **No production steering without governance.** If a mechanistic
+   finding suggests "amplify these neurons to reduce hallucination,"
+   that's a *proposal*, not an action. The proposal goes through
+   ForkScore acceptance (M+C+X axes per #000060 §7) with the result
+   logged as a separate `MechanisticWitnessRoot` and explicit policy
+   change.
+
+4. **Feature labels never become semantic proof.** A neuron labeled
+   "refusal_cluster" in Neuronpedia is a hypothesis about its function,
+   not a guarantee. `MechanisticWitnessRoot` records the LABEL provider
+   + version + evidence; the substrate treats labels as fallible
+   metadata, not as ground truth.
+
+## Artifact — `MechanisticWitnessRoot`
+
+Following the v9.8 content-addressing discipline, a witness is a Merkle
+root over the following preimages (TLV-encoded, hash-chained):
+
+```
+MechanisticWitnessRoot = hash_leaf(
+    model_config_root                # model name + version + weights hash
+  | activation_capture_policy_root   # which layers, which sites, what dtype
+  | contrastive_prompt_set_root      # the prompt pair the witness used
+  | feature_or_neuron_set_root       # the discovered features/neurons
+  | intervention_result_root         # ablation/amplification + delta
+  | behavioral_delta_root            # measured output change
+  | safety_policy_root               # what governance bucket this lives under
+)
+```
+
+Two writers running the same prompt set against the same model produce
+identical `MechanisticWitnessRoot`. Witnesses can be replayed
+(reproducibility), audited (governance), and gossiped (mesh) without
+trusting the producer — the same content-addressing discipline that
+already covers documents, chunks, and providence cache.
+
+## Restrictions in scope of this ticket
+
+This ticket is a **scaffold only**, like #000057. No code lands until:
+
+- An actual mechanistic finding is sitting in a fixture that arborist
+  could use as a SelfModel input or benchmark fixture. (Without a real
+  use case, this is speculative tooling.)
+- The four guardrails above are formally restated in CLAUDE.md (as
+  rules, not just doc).
+- An #000060 H-ABCDEFG-M+C+X harness exists to gate any promotion.
+
+Open before any of those land: this is a *placeholder* in the design
+log so the architectural framing is captured. Don't proliferate
+sub-tickets, don't write a `arborist/witness/` directory.
+
+## Explicitly NOT in scope
+
+- Replacing the verifier or falsifier layers. Mechanistic Witness is
+  **additive diagnostic**, never substitutive.
+- Direct integration with `providence_cache` or `audit_events` for
+  output rows. Witness data lives in its own table (when implemented)
+  with explicit hard-vs-soft separation per CLAUDE.md.
+- Adversarial robustness claims. The substrate does NOT make claims
+  like "this model is safe because the refusal cluster fires" — that
+  would itself be a mechanistic-as-proof regression.
+- LLM-as-judge over witness output. Witness analysis is deterministic
+  + transparent — labels can come from external tools (Neuronpedia
+  cross-references, SAE labels with provenance), but interpretation
+  stays in code-level rules, not in a model loop.
+
+## Status
+
+Scaffold. Not started. No code expected until the prerequisites land.
+Captured 2026-05-26 from Dav1d's de-novo review (§4.7, §9.1.F) so the
+framing is in the design log before the first real use case forces an
+implementation decision.
+
+If the use case never materializes, this ticket stays scaffold
+indefinitely — and that's the correct state. Mechanistic interpretability
+is one of the most-promised + least-delivered areas in ML; arborist's
+substrate is at risk of absorbing speculative tooling unless we keep
+the bar at "real falsifier in hand + four guardrails locked in CLAUDE.md."