Cycle 7 Stage A: collapse-resistant durable transforms

docs/cycle7/README.md

@@ -0,0 +1,73 @@
+# Cycle 7 — durable transform development
+
+Cycle 6 is **frozen**. Formal outcome: `NONZERO_RESIDUAL` **7/192**, not 0/192.
+
+This directory starts Cycle 7 development. It does not retune Cycle 6 and does not authorize a new formal confirmation.
+
+## Live state (verified 2026-08-25)
+
+See `docs/cycle7/live-state-audit.md`. Independent GitHub inspection matched the Cycle 6 freeze:
+
+- `main` HEAD `ddccd74a9e0e710085b385fed98959f2730b9d60`
+- PR #93 and PR #94 merged
+- Recovery run `32886342498` success
+- Aggregate hash `30577aafaffd0c50f0ddb384a4509eb0bb93e4374bf39704869ddbf5053186a4`
+
+## Spent-corpus rule
+
+Do not use as Cycle 7 development, tuning, or confirmation data:
+
+- `720000`, `730000` (earlier development)
+- `760000`, `770000`, `780000` (formal confirmation; the 7 residuals are spent)
+
+The 7 formal residuals may be used only for high-level forensic classification. They must not be used as development examples.
+
+## Seed ledger
+
+See `docs/cycle7/seed-ledger.md` and `fuckmark/cycle7/ledger.py`.
+
+| Role | Seed base | Status |
+| --- | --- | --- |
+| Exploratory development (Stage A) | `810000` | in use |
+| Validation development (Stage B) | `820000` | reserved, unused |
+| Confirmation reserved | `830000`, `840000`, `850000` | must not be inspected |
+
+Confirmation seeds were chosen as unused 10k blocks before any Cycle 7 detector look.
+
+## Whitespace-collapse sanitizer
+
+See `docs/cycle7/whitespace-collapse-v1.md`.
+
+Cycle 7 evaluation arms:
+
+`raw`, `nfkc`, `cf_strip`, `nfkc_cf_strip`, `ws_collapse`, `ws_collapse_nfkc_cf_strip`
+
+The Cycle 6 frozen sanitizer module is unchanged.
+
+## Durable transform families
+
+See `docs/cycle7/durable-families.md`. Catalog `cycle7-durable-rule-catalog-v2`.
+
+1. Unambiguous contractions and closed orthography (Family 1).
+2. Attested open ↔ hyphenated compounds (Family 2).
+3. In-word ASCII apostrophe ↔ U+2019 (Family 3).
+
+These change tokens without relying on repeated U+0020. They survive ASCII whitespace collapse by construction. Family 3 also survives NFKC and Cf-strip.
+
+Quote interiors may receive these durable edits under `quote-container-durable-v1` without changing quote delimiters. Cycle 6 `quote-container-surface-spacing-v1` still admits only spacing inside quotes.
+
+## Stage A result
+
+Family 1 detector attachment on seed `810000` was **`INSUFFICIENT_EVIDENCE`**: Cycle 6 spacing 0/4 raw / 4/4 after collapse; durable 4/4 raw and 4/4 after collapse.
+
+Families 2–3 raise candidate density on the same frozen texts (see `evidence/cycle7-stage-a-2026-08-25/family2-density.json`). Detector rescore of those texts under catalog v2 remains **`INSUFFICIENT_EVIDENCE`**: durable 4/4 raw and 4/4 after collapse; Cycle 6 spacing 0/4 raw and 4/4 after collapse; combined 1/4 raw and 4/4 after collapse.
+
+Details: `docs/cycle7/stage-a-decision.md`.
+
+Not claimed:
+
+- Cycle 7 formal confirmation
+- ZERO_RESIDUAL
+- Human-fidelity validation
+- Threshold or FPR manipulation
+- Neural rewriting

docs/cycle7/durable-families.md

@@ -0,0 +1,90 @@
+# Cycle 7 durable families
+
+Catalog identity: `cycle7-durable-rule-catalog-v2`.
+
+All families below are deterministic, detector-blind, key-blind, and non-neural. Cycle 6 `quote_safe_zrd` ruleset hash is unchanged.
+
+## Shared constraints
+
+- Protected spans (URLs, numbers, dates, code, identifiers, paths, hashes, citations, emails) block overlapping edits.
+- Quote interiors: durable families may edit quoted *content* under `quote-container-durable-v1` without changing delimiters. Cycle 6 `quote-container-surface-spacing-v1` still admits only spacing inside quotes.
+- Hard-invariant algorithm remains `hard-invariant-validator-v4`. Ambiguous `'d` / bare `it's` / `it's not` ↔ `it is not` stay excluded.
+- Whitespace-collapse-v1 is a first-class Cycle 7 sanitizer. A family is collapse-resistant only if the rewrite still differs after `ws_collapse` and `ws_collapse_nfkc_cf_strip`.
+
+## Family 1 — unambiguous contractions and closed orthography
+
+Precondition: existing `LiteralTransformRule` whole-word match, all-caps blocked.
+
+Rewrite: closed contraction/expansion pairs plus `towards`/`toward` and `amongst`/`among`. Cycle 7 additions: `I/you/we/they have` ↔ `I've/you've/we've/they've`, and bounded `it's like|important|a|an|the` ↔ `it is …`.
+
+Inverse: each pair has an explicit reverse rule.
+
+Tokenizer: contraction boundaries change GPT-2 BPE pieces. VERIFIED on fixtures.
+
+Whitespace collapse: no extra U+0020 is introduced. Survives by construction.
+
+Sanitizer: ASCII punctuation; NFKC/Cf-strip leave the rewrite in place.
+
+Conflict geometry: overlapping contraction sites conflict; scheduler remains detector-blind cover-greedy v4.
+
+Enumeration order: registry sort `(start, end, rule_id, candidate_id)`.
+
+REJECTED from this family: `he'd`/`she'd`/`I'd`, bare `it's`, `it's not` ↔ `it is not`, `it's been`, `while`/`whilst` (noun `while` is not gated).
+
+## Family 2 — attested open ↔ hyphenated compounds
+
+Construction: `attested_open_hyphen_compound`.
+
+Closed list (both directions):
+
+- proof of concept ↔ proof-of-concept
+- point of view ↔ point-of-view
+- step by step ↔ step-by-step
+- case by case ↔ case-by-case
+- end to end ↔ end-to-end
+- state of the art ↔ state-of-the-art
+- face to face ↔ face-to-face
+
+Precondition: whole-word match, plus no adjacent hyphen, slash, or alnum so `proof-of-concept-note` and path fragments do not match. Sentence-final punctuation is allowed (unlike sentence-initial lexical markers).
+
+Rewrite: replace the matched open phrase with the hyphenated phrase, or the reverse.
+
+Inverse: the opposite direction in the same list.
+
+Tokenizer: GPT-2 `proof of concept` → 3 tokens; `proof-of-concept` → 5 tokens. VERIFIED locally on frozen GPT-2 revision `607a30d783dfa663caf39e06633721c8d4cfcd7e`.
+
+Whitespace collapse: hyphens are not spaces. Survives.
+
+Sanitizer: ASCII hyphens. NFKC/Cf-strip leave the rewrite in place.
+
+Conflict geometry: open and hyphenated forms of the same phrase cannot both match the same span.
+
+Enumeration order: same registry sort.
+
+Not admitted: `one to one` ↔ `one-to-one` (range false positive `one to one hundred` without extra gating). POS-gated pairs such as `set up`/`setup` and `real time`/`real-time` are not admitted.
+
+## Family 3 — in-word ASCII apostrophe ↔ U+2019
+
+Construction: `inword_typographic_apostrophe`.
+
+Precondition: exactly one character `'` or U+2019 with alphabetic characters on both sides. Quote delimiters and plural possessives (`students'`) do not match. Both adjacent letters uppercase is rejected so `DON'T` does not fire.
+
+Rewrite: `'` → U+2019, or the reverse.
+
+Inverse: the opposite direction.
+
+Tokenizer: GPT-2 `It's not uncommon` tokens `[1026, 338, 407, 19185]` versus curly `[1026, 447, 247, 82, 407, 19185]`. VERIFIED on the frozen GPT-2 revision.
+
+Whitespace collapse: not whitespace. Survives.
+
+Sanitizer: U+2019 is category Pf, not Cf. NFKC leaves U+2019 unchanged. VERIFIED. Combined `ws_collapse_nfkc_cf_strip` therefore keeps the edit. NBSP and ZWSP were measured and rejected as channels: NBSP NFKC-maps to U+0020; ZWSP/soft hyphen are Cf.
+
+Hard invariants: `_WORD_RE` already treats `'` and U+2019 as equivalent after normalization. `don't` and `don’t` share the same negation atom.
+
+Conflict geometry: an apostrophe edit overlaps contraction expansion of the same word; cover-greedy v4 picks one.
+
+## Causal chain (what counts as promising)
+
+text change → tokenization change → n-gram/context change → observation replacement → g-value drift → score drop.
+
+Byte change or a one-off score drop is not enough. Family 1–3 have VERIFIED tokenization change and collapse survival on fixtures. Detector attachment on TinyDev 64-token text is a separate density question.

docs/cycle7/literature.md

@@ -0,0 +1,36 @@
+# Cycle 7 literature notes
+
+Claim labels used below: VERIFIED, SOURCE-BOUND, HYPOTHESIS, UNKNOWN, REJECTED, EXTERNAL-VALIDATION-ONLY.
+
+## SynthID-Text
+
+SOURCE-BOUND. Google documents SynthID-Text as a logits-processor watermark using a keyed g-function and tournament sampling. Detectability uses n-gram context. Larger `ngram_len` is more detectable and more brittle to edits. Public docs state robustness to cropping, a few word changes, and mild paraphrasing, with large detector-confidence loss under thorough rewrite or translation.
+
+- https://ai.google.dev/responsible/docs/safeguards/synthid
+- https://huggingface.co/blog/synthid-text
+- Dathathri et al., *Scalable watermarking for identifying large language model outputs*, Nature (2024): https://www.nature.com/articles/s41586-024-08025-4
+
+This repository's Cycle 6 result is the local VERIFIED measurement for the frozen GPT-2 / mean-score protocol: 183/192 pristine detections reduced to 7/192 transformed detections, 0/192 transformed unwatermarked, `NONZERO_RESIDUAL`. That is not a claim about proprietary production detectors.
+
+## Edit-channel / synchronization
+
+SOURCE-BOUND / HYPOTHESIS. Context-hashed watermarks re-synchronize after a local edit once the sliding n-gram window has moved past the edit. Cycle 6 spacing inserts extra U+0020 tokens that change GPT-2 segmentation, then ordinary space-collapse removes those tokens and restores the original token sequence. That collapse failure is VERIFIED here as a mechanism class on fresh seed `810000`, not as a universal watermark theorem.
+
+EXTERNAL-VALIDATION-ONLY. Zhao-style or layer-inflation analyses of SynthID, and synonym/paraphrase/back-translation robustness papers (including arXiv:2508.20228 and arXiv:2603.03410), are not reproduced in this repository and must not be cited as FuckMark results. Neural paraphrasing is out of protocol for the attack itself.
+
+## Deterministic non-neural edits
+
+VERIFIED tokenizer effects on frozen GPT-2 `607a30d783dfa663caf39e06633721c8d4cfcd7e`:
+
+- `proof of concept` → 3 tokens; `proof-of-concept` → 5 tokens.
+- ASCII `It's not uncommon` → `[1026, 338, 407, 19185]`; U+2019 apostrophe form → `[1026, 447, 247, 82, 407, 19185]`.
+
+VERIFIED sanitizer fate:
+
+- U+2019 survives NFKC and is not Cf, so it survives `ws_collapse_nfkc_cf_strip`.
+- NBSP U+00A0 NFKC-maps to U+0020. REJECTED as a collapse-resistant channel.
+- U+200B / U+00AD are Cf. REJECTED against the frozen Cf-strip arm.
+
+HYPOTHESIS. Unambiguous contractions, attested hyphenation, and typographic apostrophes can destroy some observation windows. Whether they destroy enough windows on 64-token TinyDev GPT-2 text is a Cycle 7 measurement. Family 1 detector attachment on seed `810000` was INSUFFICIENT_EVIDENCE because natural site density was too low.
+
+REJECTED as a Cycle 7 direction: adding more U+0020 spaces to chase 7/192 → 0/192 on spent confirmation rows.

docs/cycle7/live-state-audit.md

@@ -0,0 +1,64 @@
+# Cycle 7 live-state audit
+
+Audit time: 2026-08-25 (America/New_York). Live GitHub overrides any stale handoff.
+
+## Repository
+
+- Remote: `https://github.com/byte271/FuckMark`
+- Verified `main` HEAD: `ddccd74a9e0e710085b385fed98959f2730b9d60`
+- Commit subject: `Freeze Cycle 6 formal NONZERO_RESIDUAL confirmation evidence (#94)`
+- Committer date: 2026-08-25 19:07:20 UTC
+
+Local `origin/main` matched this SHA after `git fetch`.
+
+## Pull requests
+
+| PR | State | Merged | Merge commit |
+| --- | --- | --- | --- |
+| #93 Recover Cycle 6 run 16 freeze artifacts | closed | yes, 2026-08-25 18:52:36 UTC | `1e86be770ae231046055647689a4836d221d8274` |
+| #94 Freeze Cycle 6 formal NONZERO_RESIDUAL evidence | closed | yes, 2026-08-25 19:07:20 UTC | `ddccd74a9e0e710085b385fed98959f2730b9d60` |
+
+Open PRs at audit time: **none**.
+Open issues at audit time: **none**.
+
+PR #93 had CodeRabbit review comments (3). PR #94 had no review comments. Both PRs are merged; those threads are not open Cycle 7 blockers.
+
+## GitHub Actions
+
+| Run | Workflow | Conclusion |
+| --- | --- | --- |
+| `32873260399` | Cycle6 Sealed Confirmation (original freeze) | **failure** (cross-check after freeze; science already frozen) |
+| `32886342498` | Cycle6 Frozen Artifact Recovery | **success** |
+| `32887767052` | CI on `main` @ `ddccd74` | **success** |
+| `32887767017` | Release Engineering on `main` | **success** |
+| `32887767000` | Release Readiness Baseline on `main` | **success** |
+
+Handoff vs live GitHub: **no contradiction**.
+
+## Cycle 6 frozen evidence (rehashed locally)
+
+Directory: `evidence/cycle6-sealed-confirmation-recovery-2026-08-25/`
+
+SHA256SUMS.txt verified for every listed file.
+
+| Binding | Verified value |
+| --- | --- |
+| Formal outcome | `NONZERO_RESIDUAL` |
+| Pooled transformed WM | 7/192 on all four frozen sanitizer arms |
+| Pooled transformed UW | 0/192 |
+| Aggregate hash | `30577aafaffd0c50f0ddb384a4509eb0bb93e4374bf39704869ddbf5053186a4` |
+| Contract hash | `8bff80151c1be33a9f4bedf0b00abab1fffd9b04c0572aef1381be58530e1cef` |
+| Recovery cross-check hash | `8a65367d6aebecd26028150a58722c69cd47deb55df15e7dca24a56366306207` |
+| Recovery manifest hash | `d0639498103b2322576c99108d00a3eed7a6d99f317491fab558e6b49055ff99` |
+| Scientific commit | `bfd9a4d81f0561a17f5ac4daa3858e97ebd811f1` |
+| Recovery orchestration commit | `1e86be770ae231046055647689a4836d221d8274` |
+| Original freeze artifacts 760/770/780 | IDs and digests match the recovery manifest |
+
+Do not describe Cycle 6 as `ZERO_RESIDUAL`.
+
+## Continuation (2026-08-25, after PR #95 opened)
+
+Live GitHub still has `main` at `ddccd74a9e0e710085b385fed98959f2730b9d60`. Open PR: [#95](https://github.com/byte271/FuckMark/pull/95) on `research/cycle7-durable-transforms`. Open issues: none.
+
+Hygiene-only follow-up `6e587ea016cf5a2f4e7845a5550f97e0b5d92b34` made Release Readiness Baseline and CI succeed after `tests/test_repository_hygiene.py` rejected comments/docstrings in new Python. Cycle 6 sealed confirmation on that SHA succeeded. Codex review was usage-limited, not a code finding. CodeRabbit did not auto-review (repository star threshold).
+

docs/cycle7/seed-ledger.md

@@ -0,0 +1,26 @@
+# Cycle 7 seed ledger
+
+Ledger identity: `cycle7-seed-ledger-v1` (`fuckmark/cycle7/ledger.py`).
+
+Seeds were assigned **before** Cycle 7 detector scoring.
+
+## Spent (forbidden)
+
+| Seed | Why |
+| --- | --- |
+| 760000, 770000, 780000 | Cycle 6 formal confirmation. Spent. |
+| 720000, 730000 | Cycle 6 development 0/16. Spent. |
+| 401000, 402000, 500000, 61000 | Historic TinyDev / calibration / schedule bases |
+| 1120000–1160000 | Frozen effectiveness-profile schedule bases |
+
+## Cycle 7 roles
+
+| Role | Seed | May score detectors? |
+| --- | --- | --- |
+| Exploratory development (Stage A) | 810000 | yes, development only |
+| Validation development (Stage B) | 820000 | only after Stage A family freeze; not in this PR's detector run |
+| Confirmation reserved | 830000, 840000, 850000 | **no** until a later frozen confirmation protocol |
+
+Do not promote 810000 or 820000 into confirmation after seeing scores.
+
+Stage A generation uses 810000 with pair stride 32, matching TinyDev pairing, one pair per domain, topic `reproducibility` chosen without a detector look.

docs/cycle7/stage-a-decision.md

@@ -0,0 +1,59 @@
+# Cycle 7 Stage A decision
+
+**Decision: `INSUFFICIENT_EVIDENCE`**
+
+This is development-only. It is not a Cycle 7 formal confirmation. Seeds `830000` / `840000` / `850000` were not inspected.
+
+Catalog `cycle7-durable-rule-catalog-v2` adds attested open/hyphen compounds and in-word typographic apostrophes on top of Family 1 contractions. The generated seed-`810000` texts were not regenerated.
+
+## What was measured
+
+Fresh exploratory seed `810000`, one pair per domain (8 texts), frozen GPT-2 revision, frozen Cycle 6 threshold `0.5570987654320988`, budget 14, detector-blind cover-greedy v4.
+
+Arms on the same texts:
+
+- Cycle 6 spacing-heavy B14 (`quote_safe_zrd_transform_registry`)
+- Cycle 7 durable (catalog v2; no extra spaces)
+- Combined durable + Cycle 6 spacing
+
+Sanitizer arms included `raw` and `ws_collapse`.
+
+## Detector counts (watermarked 4, unwatermarked 4)
+
+Catalog v2 (latest `detector-compare.json`):
+
+| Arm | Pristine WM | Raw WM | Raw UW | ws_collapse WM | ws_collapse UW | Raw WM mean |
+| --- | --- | --- | --- | --- | --- | --- |
+| Cycle 6 spacing B14 | 4/4 | **0/4** | 0/4 | **4/4** | 0/4 | 0.525449 |
+| Cycle 7 durable | 4/4 | **4/4** | 0/4 | **4/4** | 0/4 | 0.624884 |
+| Combined | 4/4 | **1/4** | 0/4 | **4/4** | 0/4 | 0.531142 |
+
+Family 1 copula snapshot remains `detector-compare-family1-copula.json` (durable 4/4 raw and collapse; combined 0/4 raw, 4/4 collapse).
+
+## VERIFIED (this Stage A)
+
+1. Cycle 6 spacing can drive raw detections from 4/4 to 0/4 on this tiny corpus.
+2. The same Cycle 6 outputs are detected 4/4 after `whitespace-collapse-v1`. Collapse restores the attack. Reproduced on **new** development data, not on spent 760000–780000 rows.
+3. Unwatermarked transformed controls stayed 0/4 on durable and Cycle 6 spacing. Combined unwatermarked stayed 0/4.
+4. On contraction-rich fixtures, durable edits remain after collapse; inside quotes, Cycle 6 spacing collapses away and Cycle 7 durable edits remain.
+5. Bare `it's not` ↔ `it is not` is not admitted.
+6. GPT-2 tokenization changes for Family 2 and Family 3 are real and collapse-resistant. Durable-only still leaves 4/4 detections because site density is too low (often 1 surviving non-space edit on a watermarked 64-token sample). Intact root windows remain ~44–53 of ~54–60.
+7. Combined raw moved from 0/4 (Family 1) to 1/4 (catalog v2) on this corpus: cover-greedy spent a budget slot on `proof-of-concept` opening instead of a space, and that watermarked technical sample scored 0.5606 (threshold 0.5571). This is not used to retune the scheduler on these rows. It is a high-level geometry note: mixing sparse durable edits into a spacing budget can reduce raw coverage.
+
+## SOURCE-BOUND forensic note (Cycle 6 spent residuals)
+
+Not used for tuning. High-level class only: most formal residuals looked like budget-limited leftover leak windows under a spacing-heavy attack.
+
+## Decision
+
+**`INSUFFICIENT_EVIDENCE`** as a Cycle 6 replacement. Collapse-survival of the durable *channel* is real. Detector-side replacement of Cycle 6 spacing is not demonstrated on this 8-text exploratory corpus.
+
+Do not open Cycle 7 formal confirmation. Do not chase 7/192 → 0/192 by adding U+0020 spaces.
+
+## Next development direction
+
+1. Keep Cycle 6 geometry/scheduler/protected-span machinery.
+2. Search a durable family with **high natural density on ordinary TinyDev prose**, not only contraction/compound/apostrophe sites. Apostrophe-free and compound-free samples still have almost no durable candidates.
+3. A detector-blind combined scheduler that fills spacing *after* durable ops is a hypothesis, not authorized from these four watermarked rows.
+4. Measure Stage B seed `820000` only after a family is frozen.
+5. REJECTED as durable channels: NBSP (NFKC→space), ZWSP/soft hyphen (Cf-strip).

docs/cycle7/whitespace-collapse-v1.md

@@ -0,0 +1,27 @@
+# whitespace-collapse-v1
+
+Sanitizer identity: `ascii-horizontal-run-collapse-preserve-newlines-v1`.
+
+This is a **new** Cycle 7 sanitizer. It does not modify frozen `fuckmark/sanitizer_robustness.py`.
+
+## Exact behavior
+
+1. Map CR LF and CR to LF.
+2. Preserve LF. Do not join lines.
+3. On each line, replace every maximal run of U+0020 SPACE and U+0009 HT with one U+0020 SPACE.
+4. Do not trim a leftover single leading or trailing space.
+5. Do not collapse other Unicode whitespace, including NBSP (U+00A0).
+6. Do not strip Cf characters (that is a separate arm).
+
+## Cycle 7 variant IDs
+
+| ID | Definition |
+| --- | --- |
+| `raw` | identity |
+| `nfkc` | Unicode NFKC (imported from the frozen Cycle 6 helper) |
+| `cf_strip` | drop Unicode category Cf |
+| `nfkc_cf_strip` | Cf-strip after NFKC |
+| `ws_collapse` | whitespace-collapse-v1 |
+| `ws_collapse_nfkc_cf_strip` | collapse, then NFKC, then Cf-strip, then collapse again so NFKC-introduced ASCII spaces also collapse |
+
+Whitespace robustness may be claimed only if the `ws_collapse` and `ws_collapse_nfkc_cf_strip` arms pass.