Consolidation step 5: institution merger audit — phantoms resolved, mergers honestly rejected (P-076)

docs/annexes/ANNEX_AM.md

@@ -39,7 +39,7 @@ An automatic constitutional review is triggered, without requiring the governing
 
 - A founding institution seat is unfilled for more than **90 days**.
 - Post-mortem publication (Article VII) lapses for more than **30 days**.
-- Oracle accreditation count drops below the methodology-class minimum (Annex AL §3.1).
+- Oracle accreditation count drops below the methodology-class minimum (Annex AL §3.4).
 - Article VII dashboard publication is delayed by more than **14 days** beyond its stated cadence.
 
 The review is initiated by the constitutional body (AM1) and is self-executing. It is published in the Article VII dashboard at the moment of trigger.

docs/annexes/ANNEX_AQ.md

@@ -44,7 +44,7 @@ When the oracle system loses full accredited quorum (fewer than the N=5 BFT-tole
 
 Conservative Hold is the **designed default**, not a failure state — it is explicitly the correct system response to oracle silence during Shared Storehouse. Detection-side alarms fire; operational-side behavior holds.
 
-**Quorum-loss sensing mechanism:** Conservative Hold cannot activate without a defined detection path. The oracle monitoring system must: (a) poll each accredited oracle node on a published cadence (maximum 15-minute intervals during active Shared Storehouse); (b) detect quorum loss — defined as fewer than 5 responsive accredited nodes or an unresolvable consensus dispute persisting beyond one full deliberation cycle — within one polling cadence after the event; (c) automatically set system state to `CONSERVATIVE_HOLD` within the same cycle; and (d) fire the Article VII dashboard indicator and notify the REB within 15 minutes of state change. Quorum loss from **clean failure** (node goes offline and stops responding) and from **degraded-output failure** (node continues responding but with outputs inconsistent with the rest of the quorum by more than the FC-032 correlation threshold or the Annex AL directional-bias threshold) are both treated as quorum-loss events. A degraded-output node is flagged for accreditation review while Conservative Hold is active; it does not count toward quorum. The body responsible for the oracle monitoring system (named in ANNEX_AL §3) holds formal authority to declare Conservative Hold; the system generates the declaration automatically when polling confirms quorum loss, and the named authority publishes confirmation within one hour.
+**Quorum-loss sensing mechanism:** Conservative Hold cannot activate without a defined detection path. The oracle monitoring system must: (a) poll each accredited oracle node on a published cadence (maximum 15-minute intervals during active Shared Storehouse); (b) detect quorum loss — defined as fewer than 5 responsive accredited nodes or an unresolvable consensus dispute persisting beyond one full deliberation cycle — within one polling cadence after the event; (c) automatically set system state to `CONSERVATIVE_HOLD` within the same cycle; and (d) fire the Article VII dashboard indicator and notify the REB within 15 minutes of state change. Quorum loss from **clean failure** (node goes offline and stops responding) and from **degraded-output failure** (node continues responding but with outputs inconsistent with the rest of the quorum by more than the FC-032 correlation threshold or the Annex AL directional-bias threshold) are both treated as quorum-loss events. A degraded-output node is flagged for accreditation review while Conservative Hold is active; it does not count toward quorum. The RCS accreditation body — the declaring authority for Shared Storehouse suspension under ANNEX_AL §AL-CORR (Suspension Declaration) — holds formal authority to declare Conservative Hold; the system generates the declaration automatically when polling confirms quorum loss, and the named authority publishes confirmation within one hour. The automatic `CONSERVATIVE_HOLD` state change is operative upon polling-confirmed quorum loss regardless of whether confirmation has been published; failure of the RCS accreditation body to publish confirmation within one hour is a logged process breach, notified to the Federated Ombuds within 24 hours (mirroring the ANNEX_AL §AL-CORR Ombuds-notification rule). A declaration of Conservative Hold absent polling-confirmed quorum loss, and a refusal or failure to confirm one, are each materially adverse determinations appealable on the ANNEX_L §L7 spine; neither suspends the FC-100 restoration clock nor the §2–§3 authority-transfer schedule.
 
 The Article VII public dashboard displays a prominent **Shared Storehouse-Active-With-Oracle-Failure** indicator in real time, so oracle failure during active Shared Storehouse is publicly visible — the existence of Conservative Hold cannot be hidden by the bodies operating it.
 

docs/constitution/SPECIFICATIONS.md

@@ -217,7 +217,7 @@ Plain meaning: oracles are the system's reality checkers. They confirm whether r
 - N ≥ 5 independent oracle nodes (FC-030 `ORACLE_N_MIN`)
 - At least 3 distinct methodology classes represented (FC-031 `METHODOLOGY_CLASS_MIN`): at least one node using institutional statistical modeling; at least one using community-based participatory research (CBPR); at least one using independent physical sampling (Tier 3, ground-truth)
 - Pairwise error-series correlation ≤ 0.30 Pearson (FC-032 `ORACLE_PAIRWISE_CORRELATION_MAX`)
-- At least 1 designated adversarial / red-team seat AND ≥20% of total oracle nodes must be adversarial (both conditions FC-033 `ORACLE_ADVERSARIAL_SEATS_MIN`; Tier 1). Any expansion of the oracle council must maintain the ≥20% adversarial proportion. Reducing the adversarial proportion below 20% is equivalent to a Tier 1 amendment.
+- At least 1 designated adversarial / red-team seat AND ≥20% of total oracle nodes must be adversarial (both conditions FC-033 `ORACLE_ADVERSARIAL_SEATS_MIN`; Tier 1). Any expansion of the oracle cohort must maintain the ≥20% adversarial proportion. Reducing the adversarial proportion below 20% is equivalent to a Tier 1 amendment.
 
 *Rationale: BFT theorem `n ≥ 3f + 1`; `f = 1` gives `n ≥ 4`; `N_MIN = 5` provides one-node margin above the BFT floor so single-node loss does not drop the cohort below tolerance.*
 
@@ -263,7 +263,7 @@ Plain meaning: oracles are the system's reality checkers. They confirm whether r
 | Minimum methodology classes | 3 | FC-031 | Tier 1 |
 | Independent physical sampling (Tier-3 ground-truth) | At least one node required, as one of the 3 methodology classes | FC-031 | Tier 1 |
 | Max pairwise oracle error correlation | 0.30 (Pearson) | FC-032 | Tier 1 |
-| Adversarial oracle seats per cohort | ≥1 adversarial node AND ≥20% of total oracle nodes must be adversarial (both conditions Tier 1). Any expansion of the oracle council must maintain the ≥20% adversarial proportion. Reducing the adversarial proportion below 20% is equivalent to a Tier 1 amendment. | FC-033 | Tier 1 |
+| Adversarial oracle seats per cohort | ≥1 adversarial node AND ≥20% of total oracle nodes must be adversarial (both conditions Tier 1). Any expansion of the oracle cohort must maintain the ≥20% adversarial proportion. Reducing the adversarial proportion below 20% is equivalent to a Tier 1 amendment. | FC-033 | Tier 1 |
 | Oracle quorum-loss restoration window | 14 days | FC-100 | Tier 1 |
 | Attestation stake ratio | 0.20 of attestor balance | FC-080 | Tier 2 |
 | Reserve window (CSM×pop×days) | 45 days | FC-070 | Tier 1 |

docs/governance/Capacity_Measurement_Evidence_Test_Package.md

@@ -51,7 +51,7 @@ Assume capacity numbers will be attacked because they move survival access, rati
 | Political actor | Suppresses shortage signals before elections or during politically sensitive periods to avoid emergency activation and the accountability that follows | Whether independence requirements and mandatory publication duties survive direct political pressure |
 | Commercial supplier | Inflates reported available capacity to retain supply contracts, avoid Shared Storehouse activation, and prevent investigation of logistics failures | Whether physical sampling and delivery-outcome data can contradict administrative self-reporting |
 | Measurement body insider | Biases methodology toward category definitions that favor incumbents, lower measured obligations, or obscure access failure behind acceptable-looking aggregates | Whether methodology-class audits and standards-body concentration reviews detect capture before it affects decisions |
-| Oracle council captor | Builds institutional alignment across a majority of oracle seats through shared funders, professional culture, or AI supply-chain dependency — making formal independence nominal | Whether pairwise error-correlation tests catch shared blind spots and whether adversarial seats produce genuine dissent |
+| Oracle cohort captor | Builds institutional alignment across a majority of oracle seats through shared funders, professional culture, or AI supply-chain dependency — making formal independence nominal | Whether pairwise error-correlation tests catch shared blind spots and whether adversarial seats produce genuine dissent |
 | Directional-bias cartel | Keeps pairwise correlations low while several nodes consistently overstate or understate capacity in the same direction | Whether the test checks direction of error, not only correlation strength |
 | Adversarial simulation designer | Selects test scenarios that avoid the edge cases most likely to expose measurement failure — logistics breakdowns, rapid supply shocks, uneven geographic access | Whether test design is reviewed by parties with no stake in a passing result |
 | Oracle vendor | Shares AI models, data feeds, or calibration training across multiple oracle nodes, creating correlated errors that defeat diversity requirements without violating formal rules | Whether supply-chain audits and independent physical sampling can detect correlated drift before it affects live decisions |
@@ -234,7 +234,7 @@ This section defines the standing operational thresholds that govern whether the
 
 **Evidence basis:** Proposed precautionary — no field analogue for a ledger-linked capacity oracle system. The 30-day figure is drawn from analogy to IPC and IEA update cycles, not from operational experience with this architecture.
 
-**Breach response:** If a material change is not reflected in a published update within 30 days: (1) the oracle council must publish a written explanation of the delay within 5 business days of the breach being identified; (2) the conservative prior (most recently published figure, or a downward-adjusted estimate if shortage direction is known) governs issuance and threshold decisions until the update is published; (3) three consecutive latency breaches in any 12-month period trigger a mandatory governance review of oracle resourcing, measurement methodology, and update obligations.
+**Breach response:** If a material change is not reflected in a published update within 30 days: (1) the oracle cohort must publish a written explanation of the delay within 5 business days of the breach being identified; (2) the conservative prior (most recently published figure, or a downward-adjusted estimate if shortage direction is known) governs issuance and threshold decisions until the update is published; (3) three consecutive latency breaches in any 12-month period trigger a mandatory governance review of oracle resourcing, measurement methodology, and update obligations.
 
 ---
 
@@ -244,15 +244,15 @@ This section defines the standing operational thresholds that govern whether the
 
 **Trigger threshold:** A **5% divergence** between any two oracle node outputs for the same category, period, and geographic unit initiates the review process. The 5% threshold is proposed precautionary — no field analogue. It is chosen to be tight enough to catch systematic drift before it propagates into issuance decisions, while being loose enough to accommodate legitimate methodological variation between sources.
 
-**Who adjudicates:** The oracle council (as defined in ANNEX_AL.md), including the adversarial oracle seat. The adversarial seat may not be excluded from disagreement review. If the oracle council cannot reach resolution within 10 business days, the matter escalates to the independent Measurement Oversight Body (or equivalent governance body defined in the constitutional architecture).
+**Who adjudicates:** The oracle cohort for the affected category (as defined in ANNEX_AL §3.4), including the adversarial oracle seat. The adversarial seat may not be excluded from disagreement review. If the oracle cohort cannot reach resolution within 10 business days, the matter escalates to an independent methodology-review panel constituted under ANNEX_AL §4.1 (composition per P-017 oracle-independence standards, independent of the RCS accreditation body). The panel must be constituted within 14 days of escalation and publish its written finding within 30 business days of constitution; the conservative estimate continues to govern until the finding publishes, and any constitution delay beyond 14 days is logged as a process breach in the public disagreement register.
 
 **Fallback while review is underway:** The **conservative estimate** applies. For categories where lower capacity is harmful (food, water, energy), the lower of the two divergent values governs issuance and threshold decisions during review. For categories where over-reporting triggers premature rationing (shelter count), the lower value likewise applies, because false scarcity is preferable to false abundance during unresolved disagreement. The fallback value and its basis must be published on the public dashboard for the duration of the review, explicitly labeled as "under disagreement review."
 
-**Review outputs:** The oracle council must publish: the two divergent source values, the resolution method used, the agreed figure (or the continued conservative prior if resolution fails), and whether the disagreement exposed a methodological defect requiring protocol revision.
+**Review outputs:** The oracle cohort must publish: the two divergent source values, the resolution method used, the agreed figure (or the continued conservative prior if resolution fails), and whether the disagreement exposed a methodological defect requiring protocol revision.
 
 **Evidence basis:** The 5% threshold is proposed precautionary. The IPC classification process uses structured expert consensus to resolve inter-analyst disagreement, but does not specify a numeric divergence trigger. The conservative-estimate fallback is consistent with the Conservative Hold principle already present in the oracle failure architecture.
 
-**Breach response:** Failure to initiate a formal review within 5 business days of a detected 5% divergence constitutes a process breach. The conservative estimate continues to apply and the breach is logged in the public disagreement register. Repeated failures to initiate review trigger an audit of the oracle council's operating procedures.
+**Breach response:** Failure to initiate a formal review within 5 business days of a detected 5% divergence constitutes a process breach. The conservative estimate continues to apply and the breach is logged in the public disagreement register. Repeated failures to initiate review trigger an audit of the oracle cohort's operating procedures.
 
 ---
 
@@ -270,7 +270,7 @@ This section defines the standing operational thresholds that govern whether the
 
 **Evidence basis:** Proposed precautionary. The 20% figure has no field precedent for this architecture. It should be refined based on actual cost and logistical findings from the Physical Sampling Pilot (Test 4.3).
 
-**Breach response:** (1) Immediate publication of the sampling gap and affected categories on the public dashboard; (2) conservative priors apply to all under-sampled categories that are in watch or scarcity status; (3) oracle council must publish a corrective plan within 15 business days; (4) three consecutive quarterly sampling failures trigger a mandatory external audit of the oracle council's physical verification capacity.
+**Breach response:** (1) Immediate publication of the sampling gap and affected categories on the public dashboard; (2) conservative priors apply to all under-sampled categories that are in watch or scarcity status; (3) oracle cohort must publish a corrective plan within 15 business days; (4) three consecutive quarterly sampling failures trigger a mandatory external audit of the oracle cohort's physical verification capacity.
 
 ---
 
@@ -280,15 +280,15 @@ This section defines the standing operational thresholds that govern whether the
 
 **Definition of control:** An entity controls a measurement dimension if its data, methodology, or AI model is the primary input used by the oracle to produce a published capacity figure for that category. Control is assessed at the oracle-input level, not at the public-facing output level. Shared funding is a yellow flag, not a bright-line trigger, but must be documented.
 
-**Audit mechanism:** The oracle council must publish an annual **Measurement Concentration Report** that maps, for each essential basket category: the entities providing primary data, primary methodology, and AI model supply; their estimated share of oracle input; and any financial or institutional connections between them. The adversarial oracle seat has the right to commission an independent audit of the Measurement Concentration Report at any time.
+**Audit mechanism:** The oracle cohort must publish an annual **Measurement Concentration Report** that maps, for each essential basket category: the entities providing primary data, primary methodology, and AI model supply; their estimated share of oracle input; and any financial or institutional connections between them. The adversarial oracle seat has the right to commission an independent audit of the Measurement Concentration Report at any time.
 
 **Rationale:** Standards bodies and AI model vendors can concentrate influence across formally independent oracle nodes without violating diversity requirements (see Abuse Model §3, "Oracle vendor" row). A 33% ceiling per category prevents any single entity from controlling more than one-third of any category's measurement without triggering a review. This does not guarantee independence, but it creates a surface against which concentration can be measured.
 
 **Proposed value basis:** The 33% ceiling is proposed precautionary — no field analogue for oracle-linked measurement systems. It is derived by analogy from antitrust concepts of significant market influence (typically 25–33% in concentrated-market analysis) rather than from measurement-specific precedent. It should be reviewed after the first Measurement Concentration Report is produced.
 
 **Evidence basis:** Proposed precautionary. No analogous concentration threshold exists in the IPC, WHO SARA, or IEA frameworks reviewed in Section 2.
 
-**Breach response:** If any entity exceeds 33% concentration in any category: (1) the breach is published in the Measurement Concentration Report with the affected category and entity named; (2) the oracle council must submit a de-concentration plan within 60 days; (3) issuance and threshold decisions for the affected category shift to conservative priors until concentration falls below 33% or the governance body approves a documented exception with time-limited justification; (4) the exception cannot be renewed more than twice without a constitutional review.
+**Breach response:** If any entity exceeds 33% concentration in any category: (1) the breach is published in the Measurement Concentration Report with the affected category and entity named; (2) the oracle cohort must submit a de-concentration plan within 60 days; (3) issuance and threshold decisions for the affected category shift to conservative priors until concentration falls below 33% or the governance body approves a documented exception with time-limited justification; (4) the exception cannot be renewed more than twice without a constitutional review.
 
 ---