{"bench":"Verity scoped re-bench of the FW-D1..D7 fix round (attacking the fix code with fresh shapes)","benched_at":"2026-10-26","card":"eclipse-flood-witness-mcp-2026-10-26-2","defect_dispositions":[{"disposition":"FIXED — independently verified","evidence":"Own recompute (canonical JSON implemented directly from canon doc section 1; no product imports) over every manifest + index present: Leon suffix bec93b592c31, Monroe 4776f79b6d7c, and all four index suffixes (37ebcb996c80, 3c5420685cb8, 71c48bf0e5c6, abd4c392bd16) reproduce under the amended canon section 9 strip sets, and the full preimage digests equal data/build_records/id-derivation-20261026.json byte-for-byte (6/6). Strip-set attack: for every document, keeping any PRESENT stripped field in the preimage (9-13 variants per document) and every extra-strip variant fails to reproduce the suffix; the old false rule (sealed digest prefix) also fails. The two derivation-field keep-variants 'collide' only vacuously because snapshot_id_derivation / index_id_derivation are absent from these pre-amendment seals. Amended canon section 9 and spec section 21 errata agree verbatim on the rule and the exclusion sets.","id":"FW-D1"},{"disposition":"FIXED — verified","evidence":"bazaar-manifest.json scope_at_p0 now reads '2 sealed Florida partitions (Leon, Monroe) + 67-partition Florida index grammar; Miami-Dade enumerated NOT_SEALED (pending); fixture-signed seals (spec O2 default)' — byte-compared against the operative index (current.json -> fw-index-202610-abd4c392bd16): sealed set is exactly {nfhl-fl-leon, nfhl-fl-monroe}, nfhl-fl-miami-dade is NOT_SEALED, 67 partitions enumerated. MATCH. Residual-claim sweep over README.md, bazaar-manifest.json, server.json, docs/, staging/: zero hits for any 3-sealed / Miami-sealed claim. The house catalog.json (read read-only) carries no Flood Witness entry at all, so no catalog claim exists to contradict.","id":"FW-D2"},{"disposition":"FIXED — verified with fresh shapes","evidence":"9 in-process fabrications (store.Snapshot stubbed; receipts fabricated with fresh case ids 88-26-1001P (2 records) and 88-26-2002P (4 records) and fresh record hashes, none present in the builder's tests): S1 identical sets + result flip -> no LOMR_EFFECTIVE, no case named. S2 one record changed -> fires, names only the changed case. S3 record added (2->3) -> fires, names the case. S4 one record removed (2->1) -> fires, names the case. S5 case P changes while 4-record case Q is identical -> fires, names P only. S6 same set, order shuffled -> silent. S7 change confined to an ISSUED_NOT_EFFECTIVE case -> silent. S9 duplicate-hash multiplicity (set-equal) -> silent. The set rule holds in both directions. One blind spot found by S8 is recorded as new defect FW-D8.","id":"FW-D3"},{"disposition":"FIXED — verified with fresh shapes","evidence":"5 fresh drift shapes (LOMR step inert): T1 result changed + features moved + panel effective AND revised dates unchanged -> FEATURE_CHANGE_UNATTRIBUTED with panel_dates_changed: false disclosed in the causal record. T2 only revised_date changed -> PANEL_RESTUDY (the gate reads effective OR revised, per algorithm section 7 step 3). T3 byte-identical receipts -> NO_CHANGE (FEATURE_CHANGE_UNATTRIBUTED does not fire when nothing changed). T4 features moved, result unchanged -> RESULT_CHANGED_SOURCE_ONLY, not the residual class. T5 result flip with zero feature movement and changed panel dates -> does NOT headline PANEL_RESTUDY (falls through to NO_CHANGE; see observation FW-O7).","id":"FW-D4"},{"disposition":"FIXED — verified with a fresh synthetic shape","evidence":"Minted a PAPER_FIRM_ONLY receipt through receipts.mint_receipt against a fresh synthetic partition nfhl-fl-benchsynth and fresh index id fw-index-209901-deadbeef1234 (save captured in memory): the claim reads 'from sealed NFHL partition index fw-index-209901-deadbeef1234, in which partition nfhl-fl-benchsynth is enumerated with status NO_COVERAGE_SOURCE, ...' — names the sealed index, the partition, and its enumerated status; the literal 'None' appears nowhere in the claim. Engine and verifier claim templates (both the snapshot form and the coverage form) are byte-identical strings in receipts.py and verifier/fwverify.py, so offline re-instantiation cannot diverge.","id":"FW-D5"},{"disposition":"FIXED at code level in both implementations — end-to-end run is an EVIDENCE DEBT (environmental)","evidence":"Direct read: engine.py lines 701-704 — 'if result == LOMC_OVERRIDE_APPLIES: out[\"bfe\"] = {\"kind\": \"BFE_NOT_DETERMINED\"} else: zone-derived _bfe_block', with the FW-D6 comment citing algorithm section 6; verifier/fwverify.py lines 1169-1172 implement the identical branch (parity). The unconditional zone-derived assignment cited in card -1 (old engine.py:697) is gone from both. The end-to-end check (synthetic LOMA-over-static-BFE snapshot through engine determine AND fwverify determine) could NOT be run in this bench: constructing the synthetic snapshot requires exec-side file writes and the VM write latch was closed for the entire bench (three spaced mkstemp probes, including one after a 45s gap, all failed in every candidate temp dir). The builder's suite carries both halves of this check (un-run here, see evidence debts). Graded evidence debt per the re-bench brief, not a defect: the code path is short, read first-hand in both implementations, and matches the algorithm text exactly.","id":"FW-D6"},{"disposition":"FIXED — grammar amended, bodies conform","evidence":"Spec section 8.1 (line 353) now names the slot: 'parcel_area_shares: { ... }?  # PARCEL subjects only (section 7.6, mandated data) ... (Slot named by FW-D7 amendment, section 21)'; spec section 21 carries the FW-D7 erratum. Grammar-vs-body key diff over all 3 stored receipts (2x POINT_IN_SFHA, 1x POINT_OUTSIDE_SFHA): zero body keys outside the amended grammar, zero grammar fields absent. The parcel-shaped body itself was live-proven in card -1 (shares present, summing to 1.0000, inside the sealed body) and the data was never removed.","id":"FW-D7"}],"evidence_debts":[{"evidence":"Attempted: TMPDIR=~/workspace/.fwtest-tmp python3 tests/run_tests.py died at tempfile.mkdtemp (line 53) — no usable temp directory in any candidate path. Three further spaced latch probes across the bench (including one after a 45s gap) all failed; the exec write latch was closed for the entire re-bench window. All bench exercises that could run in-process or read-only were run; the suite's synth builds are write-bound by construction (same failure graded environmental in card -1).","item":"Full builder suite re-run (192 + fix-round tests)","state":"OPEN — environmental"},{"evidence":"Blocked by the same latch (synthetic snapshot construction writes layer files). Code-level parity read first-hand in both implementations; see FW-D6 disposition.","item":"FW-D6 end-to-end run (engine + standalone verifier over a synthetic LOMA-over-static-BFE snapshot)","state":"OPEN — environmental"},{"evidence":"Working tree carries all fixes uncommitted (11 modified files); HEAD remains 31c6ae5. Git object writes are latch-blocked house-wide. The benched artifact is the working tree as found.","item":"Fix-round commit","state":"OPEN — environmental"}],"flag_1_qualifier":{"bazaar_manifest":"PRESENT — bazaar-manifest.json carries a dedicated lomc_override_scope field stating the branch is fixture-proven only, the LOMA layer is absent from the county distribution, and the branch has never fired on real sealed data.","cetech_card":"STILL OWED (not a product defect) — no Flood Witness card exists anywhere in the cetech-site tree (grep over the full tree: no match). The card is Rook's listing-pass surface; when it is created it must carry the Flag-1 qualifier per the card -1 adjudication.","readme":"PRESENT — README.md carries the adjudicated qualifier verbatim in substance: 'Scope qualifier (Verity bench Flag 1, adjudicated 2026-10-26): the LOMC_OVERRIDE_APPLIES branch is fixture-proven only at P0. The LOMA layer is absent from FEMA's county shapefile distribution ... so both sealed partitions carry LOMC tables made up entirely of LOMR records, and the override branch has never fired on real sealed data.'"},"gate":"~/workspace/cyan-eclipse/fema-flood-gate-20261026.md","head_at_bench":"31c6ae5 (working tree modified-uncommitted: README.md, bazaar-manifest.json, docs/algorithm-1.0.md, docs/flood-canon-1.0.md, engine.py, flood_ops.py, ingest.py, receipts.py, tests/run_tests.py, tests/spec_impl.py, verifier/fwverify.py)","new_defects":[{"evidence":"Fresh shape S8 in this re-bench: case 88-26-1001P holds 2 EFFECTIVE LOMR records in snapshot A and zero records in snapshot B (whole case removed), receipts otherwise result-flipped. Headline returned NO_CHANGE with no case named. Root cause (receipts.py drift, LOMR step): the loop iterates snap_b.lomc_state() and set-compares only cases reachable from B; a case absent from B is never compared. This is the mirror image of FW-D3 (under-attribution instead of false attribution). Latent until a second vintage of any partition seals (single-vintage today, so no published drift output can exhibit it yet); if the vanished case was applied to the subject, the receipt-level applied-set change is separately visible, but a non-applied case's disappearance is invisible to the classifier.","fix":"Iterate the union of case ids from both snapshots in the LOMR step; a case whose B-side set is empty and A-side set is non-empty (with EFFECTIVE records in A) is a set difference and must be named. CONDITION: must land before any second-vintage drift output is published; does not block certification at the current single-vintage scope.","id":"FW-D8","severity":"LOW","title":"Drift LOMR_EFFECTIVE step iterates snapshot B's records only; a case wholly removed in B never fires"}],"observations":["FW-O7 (new): a result flip with zero movement in features, panels, LOMC, community, and uncertainty falls through the drift decision order to NO_CHANGE while the record's result_changed field reads true. Unreachable from real determinations (a result flip implies some input moved) and pre-existing decision-order behavior, not an FW-D4 regression; noted so a future reader of a NO_CHANGE-with-result_changed record is not confused.","Index version hygiene: four index files sit in data/index/; the operative one is fixed by current.json -> fw-index-202610-abd4c392bd16. Two superseded versions (fw-index-202610-37ebcb996c80, fw-index-202610-71c48bf0e5c6, both sealed 09:00 during the fix-round exercises) enumerate Monroe as NOT_SEALED. No claim surface reads them and the pointer governs, but the fix handoff's claim that fw-index-202610-71c48bf0e5c6 is 'the current index' is wrong against current.json. Lineage of the four versions should be recorded at the next seal.","Fix-handoff naming: the handoff claimed 'id_preimage_fields recorded in every manifest + index'. No field of that name exists anywhere in the tree. The actual mechanism is the one the canon documents: in-band snapshot_id_derivation / index_id_derivation for seals minted from this round onward (flood_ops build_index already emits index_id_derivation), plus the data/build_records/id-derivation-20261026.json backfill for the existing seals — which this bench verified computationally. The mechanism is present and verifiable; only the handoff's field name was invented.","Carried from card -1 unchanged: FW-O1..FW-O6 (evidence-probe wording, ~1mm uncertainty widening, DEPTH sentinels, PARAM_INVALID naming, Monroe raw-extract retention, REVALIDATED/LiMWA/levee fixture-only branches) — none touched by this fix round and none blocking."],"prior_card":"~/workspace/cyan-eclipse/test-bench/results/eclipse-flood-witness-mcp-2026-10-26.json","product":"eclipse-flood-witness-mcp","scope_language_exact":"CERTIFIED(local) — flood-evidence witness at Florida scope for the two sealed partitions Leon (snapshot nfhl-fl-leon-20260611-bec93b592c31; 12,099 features) and Monroe (snapshot nfhl-fl-monroe-20261022-4776f79b6d7c; 9,664 features), operative index fw-index-202610-abd4c392bd16 (the target of data/index/current.json) enumerating all 67 Florida county partitions (65 NOT_SEALED, named). P0 partition completeness remains OPEN (2 of 3): Miami-Dade is NOT_SEALED in the operative index, with no snapshot directory present. All seals are FIXTURE_SIGNED (Herald fixture key; owner open item O2) and labelled as such. The LOMA/LOMR-F override branch (LOMC_OVERRIDE_APPLIES) is FIXTURE-PROVEN ONLY: the sealed corpus contains zero LOMA/LOMR-F records and the branch has never fired on real sealed data; the qualifier is carried on the README and the Bazaar manifest. The NO_COVERAGE_SOURCE / PAPER_FIRM_ONLY path is SYNTHETIC-PROVEN ONLY (zero such partitions in the Florida census). Drift classification is proven at the classifier level with fresh fabricated shapes; it remains latent until a second vintage of any partition seals, and carries one LOW defect (FW-D8: whole-case disappearance between vintages does not raise LOMR_EFFECTIVE) that MUST be fixed before any second-vintage drift output is published. Nothing in this verdict speaks to determination-of-record, SFHDF, lender, or insurance use: the product is an evidence-grade receipt witness only, per gate fence.","spec":"~/workspace/cyan-eclipse/fema-flood-evidence-spec-20261026.md","supersedes_verdict_of":"eclipse-flood-witness-mcp-2026-10-26 (PARTIAL(local))","tree":"~/workspace/cyan-eclipse/eclipse-flood-witness-mcp/","tree_note":"Fixes are UNCOMMITTED (git is write-latch-blocked house-wide); the working tree was benched as the artifact. HEAD remains 31c6ae5, predating the fixes. The fix commit is an open environmental debt, not a bench finding.","verdict":"CERTIFIED(local)","verdict_basis":"All seven defects from card -1 are FIXED and were verified against the fix code with fresh shapes, not the builder's regressions: FW-D1 by independent ID-derivation recompute from the documents alone over every manifest and index present (6/6 reproduce; ~60 strip-set variants never collide); FW-D2 by byte-comparison of the manifest scope string against the operative index plus a full public-copy sweep; FW-D3 by 9 fresh multi-record LOMR fabrications with case ids absent from the builder's tests (fires iff the per-case record set differs, names only truly differing cases); FW-D4 by 5 fresh drift shapes including a revised-date-only restudy; FW-D5 by minting a coverage receipt against a fresh synthetic partition/index and reading the claim; FW-D6 by direct read of both implementations (end-to-end run is an environmental evidence debt, see below); FW-D7 by a grammar-vs-body key diff over every stored receipt. One new LOW (FW-D8) was found by the fresh shapes and is carried as a printed pre-second-vintage condition, mirroring the pre-reseal condition pattern. Two environmental evidence debts remain open and are graded as such, not as product defects."}