design — INN encoder rationale

Why patch-tile adapter, α=1 fixed, smooth α-ramp curriculum, single canonical trim — and what was tried and rejected. Companion to docs/inn_arch_notes.md + docs/arch_notes.md.

requirement	target	deployed (`idea097/d001`)
bit accuracy	≥ 0.99 on WeChat chain @ 1024×1024 (worst real-platform pipeline at native capture scale); ≥ 0.95 floor across the full 14-attack × 7-size sweep. Crop / rotate / large resize / noise / blur = reject by design.	0.992 on `chain_wechat` @ 1024² (≈ target); avg 0.995 / min 0.955 over 7-size sweep; 0.999 / 0.992 at 1024² alone
container fidelity vs cover	indistinguishable to human eyes — both high PSNR and high SSIM (PSNR alone misses structural artefacts that SSIM catches)	PSNR 37.4 dB · SSIM 0.940 (clean, 1024²)
inference	≤ 1 s per 12 MP image on a flagship phone NPU (~17 TFLOPS fp16)	~25 ms est (12 MP fp16) — 40× under budget
model size	≤ TrustMark Q (21 M params, 85 MB)	0.167 M params · 0.7 MB fp32 (130× under)

§2Architecture

Two halves of a coupling INN are invertible only if both halves of the output are kept. Steganography drops half (z) at the encoder; the verifier supplies zeros and the network learns to make the bits recoverable from the container alone.

                EMBED (camera)                              EXTRACT (verifier)
        ┌────────────────────────────┐         ┌──────────────────────────────────┐
bits ─→ │ PatchBitAdapter (fixed)    │  attack │ PatchBitAdapter (fixed)          │ ─→ bits'
host →  │ Haar DWT                   │  ───→   │ Haar DWT (same)                  │ ←─ container
        │ concat host_dwt ⊕ secret   │         │ concat c_dwt ⊕ zeros (z=0)       │
        │ DKiS INN — 8 or 16 fwd     │         │ DKiS INN — 8 or 16 reverse       │
        │ split → keep 1st half      │         │ split → keep 2nd half            │
        │ inverse Haar DWT           │         │                                  │
        └─────────────┬──────────────┘         └──────────────────────────────────┘
                      ▼
                  container ──── transmission / attacks ─────────┘

Why DWT first

Edges and texture (LH / HL / HH subbands) have low energy in natural images and survive JPEG well — ideal hosts for low-amplitude bit signal. LL is left mostly untouched so the cover's structure is preserved. Haar DWT is reversible by construction with zero learnable params.

Why coupling INN

Strict invertibility by construction: x1, x2 = INN_reverse(y1, y2) is exact arithmetic, no learning involved. The decoder is the encoder run backwards — no asymmetric learned encoder/decoder pair to fall out of sync.

DKiS coupling-block math

# forward (DKiS_block.forward)
y1 = x1 + α · f(x2)           # host absorbs residual from secret
x2 = x2 · k1                  # fixed sign mask
x2 = shuffle(x2, k2)          # fixed channel-tile permutation
y2 = exp(g(y1)) · x2 + h(y1)  # secret rescaled and offset by host

f, g, h are subnets — LightConvBlock in the deployed model (~10 k params each); ResidualDenseBlock_out in the legacy heavy baseline (~250 k params each)
α_i = 0.6^i decays geometrically; early blocks dominate mixing
k1, k2 are fixed per-block permutation keys (deterministic seed 0xDB15; make_dkis_keys in src/inn_model.py). Both are present in the deployed model — every one of the 8 coupling blocks gets its own ±1 channel sign-mask k1 and 4×4 channel-tile permutation k2. They're fixed (no learned params), buffered into the checkpoint, and identical between embed and extract.

INN init detail

DKiS originally zero-initializes each subnet's conv5 output layer, making the INN start as exact identity — f(x2) = g(x2) = h(x2) = 0, so the secret never reaches the host half and bit gradients can't escape the BCE = ln(2) fixed point. INNCodec.__init__ re-initializes all conv5 weights with kaiming_normal × 0.1 so residuals start small but non-zero. Load-bearing for the network to ever leave the random-prediction floor.

§3Adapter design — patch tile (v3, locked)

Bits ↔ tensor by construction. The hardest design decision in the project, and the one that has changed most times. This section is the v3-base design rationale — the choices that led to the deployed model. The deployed carrier (idea097/d001) carries three small extensions on top of this base; see the "Deployed extensions" sub-section below for what diverges, and model § 2 for the paper-exact formal spec of the deployed pipeline.

step	operation (v3-base, design rationale)
1. bipolar	`bits ∈ {0,1}^N → ±1`
2. grid pad	place first N of 1024 slots in a 32×32 grid; pad unused slots with 0
3. scramble	fixed sign-mask multiply (deterministic PRNG)
4. tile	nearest-neighbor up-sample to DWT spatial dims `(H/2, W/2)`
5. broadcast	repeat across 12 DWT channels → `secret (B, 12, H/2, W/2)`
← decode	mean-pool over patch + sign-mask invert + sign-threshold → bit logits

The deployed carrier (idea097_design001) trains and serves at N = 1024 (full grid; secret_len=1024 in train_args.txt) — the inner BCH(127,99) + outer RS(128,100) ECC codeword fills every slot, no padding. The 896-bit MWIP data payload is wrapped by that ECC before hitting the adapter; from the adapter's view the channel is 1024 b. The N=896 path (use 896, ignore 128) is the earlier no-ECC pre-image; PatchBitAdapter still defaults to n_bits=896 in source, but train_args at load-time overrides it.

The v3-base adapter round-trip is mathematically perfect (validated on smoke test). On the v3-base path, bit recovery is bottlenecked solely by the INN's robustness to attacks, not by an asymmetric learned encoder/decoder pair. The deployed extensions below relax the strict "zero-parameter" framing for ~50 k extract-side params; see below.

Why a (nearly-)zero-parameter patch adapter

property	patch tile (v3-base)
Adapter params	0 on the embed side; ~24 on the deployed extract side (the idea031 expert bank, see below)
Easy collapse via adapter	no (bipolar signal is fixed; bank is initialized to a meaningful prior and lightly regularized)
Deep collapse via INN `f/g/h`	possible in principle but requires many params to align — much harder
Spatial structure of bits	uniform coverage by construction
Robustness mechanism	explicit — averaging over patch (repetition code)
JPEG alignment at 256² training	exact at 8×8 patches = JPEG blocks
Known tradeoff	INN must do all perceptual hiding — may yield lower PSNR than a learned encoder/decoder pair would

Earlier drafts paired the INN with a learnable ~5.4 M-param Linear adapter; that path collapsed (weights → 0 under attack pressure) and was dropped. The deployed model has no such adapter — patch tile only.

Deployed extensions on the v3-base adapter

The deployed carrier (autohide/.../idea097_design001/code/inn_model.py, verified against train_args.txt: --num_blocks 8 --subnet_type light --secret_len 1024 --no-amp) generalises three pieces of the v3-base picture above. The rationale is preserved; the implementation is richer. The full formal spec is in model § 2 — what follows is the one-paragraph "why" for each extension.

extension	v3-base picture	deployed behavior	why
12 balanced permutations encode side	nearest-neighbor tile, broadcast across 12 DWT channels — every channel carries the same bipolar copy	each DWT channel `c ∈ {0..11}` gets its own deterministic balanced permutation `π_c` that scatters slot values to disjoint pixel positions. Seed `0xD1FF5E ⊕ c ⊕ (h·1000003 + w)`.	bit redundancy now spreads across both space and DWT channel; per-channel decorrelation lets the coupling INN move secret energy into whichever subbands have local headroom rather than enforcing the same spatial pattern everywhere.
Subband-weighted MoE decode (`idea031`) decode side, +~12 k params	uniform mean across 12 channels	per-batch decode-weight vector `w_c = router(x̂) · expert_bank` with a learnable `(K=2, 12)` bank initialised to a `[4, 4, 4, 2, 2, 2, 2, 2, 2, 1, 1, 1] / sum` subband prior (LL × 4, LH/HL × 2, HH × 1) and a small router conv stack reading the container RGB.	JPEG / WeChat low-pass crushes HH harder than LL. The fixed subband prior already encodes that; the MoE adds an attack-conditioned tilt (two experts) so the decode can lean further into LL when the attack signature looks lossy.
DWT cover predictor (`idea034`) decode side, +~35 k params	reverse INN runs on `concat[c_dwt, 0]`	a small 3-block residual head estimates `host_dwt_est` from the container RGB; the reverse INN sees `c_dwt_aug = c_dwt + 0.5 · (c_dwt − host_dwt_est)` instead of `c_dwt`.	amplifies the residual that carries the bit signal before the INN tries to recover it. The predictor is zero-init at the head, so step 0 is mathematically identical to v3-base (`host_dwt_est = 0 → c_dwt_aug = c_dwt`); training only ever improves on the base.

Why "zero-parameter adapter" still mostly holds. The embed side is genuinely zero-parameter: no learnable weights touch the bit signal between bipolar conversion and the INN forward pass. The ~50 k extra params live entirely on the extract side and are buffered into the verifier-side checkpoint. Camera-side embed latency is unaffected — the ~25 ms / 12 MP figure quoted in index and spec still applies. The deployed total trained-param count is ~0.21 M (0.167 M INN backbone + 0.04 M extract-side heads); the "0.167 M / 0.7 MB" framing communicates the deployable-on-camera budget, not the full trained-network size.

Honest framing. This is not spread-spectrum. Spread-spectrum uses a long pseudo-random sequence per bit; we use a constant ±1 over a patch (a low-entropy repetition code). The robustness story to claim is "averaging over many pixels denoises the bit" — not spread-spectrum theoretical guarantees.

Patch grid choice

crop	patch RGB	patch DWT	pixels/bit (RGB)
256×256	8×8	4×4	64
512×512	16×16	8×8	256
1024×1024	32×32	16×16	1024
12 MP (≈4032×3024 → 4032×3008 after trim)	~126×94	~63×47	~12 000

Grid fixed at 32×32 = 1024 slots regardless of input resolution. The deployed carrier uses all 1024 slots (ECC codeword fills the channel; the 896-b data payload is wrapped by BCH + RS before the adapter sees it). Patch size scales with the input. Requires H, W divisible by 64 (so DWT dims % 32 == 0).

JPEG alignment — the corrected story

JPEG always uses 8×8 DCT blocks regardless of image size. Whether the patch lines up depends on patch size:

Patch = 8 px aligned with grid (256² training): each patch is exactly one JPEG block. DC coefficient = patch mean, well preserved by quantization. Best case.
Patch = 8 px misaligned: patch overlaps 4 JPEG blocks. Mean depends on partial-block contributions which mix DC with low-spatial-frequency AC. Penalty exists but is small (~1–2 dB SNR on the patch mean).
Patch ≥ 16 px (any alignment): patch covers multiple full JPEG blocks. Patch mean averages over multiple block DCs (each well preserved); per-block AC noise cancels. Alignment essentially doesn't matter.
Patch < 8 px: catastrophic — can't even cover one block. Don't go here.

Earlier doc claimed alignment was load-bearing. Walked back too far in correction. Current claim: alignment is a soft preference at 8 px and a non-issue at 16 px and above. Under heavy compression (q < 30) and double-JPEG the misalignment penalty grows — needs empirical measurement (§11 ablation 4).

α = 1 fixed. An earlier draft had a learnable scalar α scaling the patch tile. Codex flagged it as a hidden collapse path — under attack pressure the optimizer can drive α → 0, recreating v1's "embed nothing" failure mode with one parameter instead of 5.4 M. Dropped. Reintroducing α as a fixed schedule (ramp 0.1 → 1.0) is listed in §11.

Sign-mask scramble

Fixed pseudo-random ±1 sign-mask applied to patch values before tiling. Deterministic from seed; verifier knows it. Zero learned params, breaks the bit-index-to-image-region coupling (otherwise bit #0 would always be top-left and an attacker could zero out that corner).

Pre-tile sign-mask is not spread-spectrum — it's a permutation/scrambler. Approaching SS-style localized-erasure robustness would require pseudo-random ±1 within each patch instead of constant; that's ablation 6 in §11.

§4Curriculum — smooth Bernoulli α-ramp

Replaces the 3-stage step function (clean → low → high) that collapsed runs 1 and 2 at the discrete A→B boundary at step ~5,800.

step range	α	what happens
0 → 5,000	0	clean — attack module is skipped entirely
5,000 → 15,000	linear 0 → 1	each kornia child op fires at `p_max · α`; encoder sees a continuously-increasing fraction of attacked batches
15,000 → 30,000	1	full target severity

A single AttackLayer(severity="high") instance is shared throughout. NoiseCurriculum.attack(step) mutates each child's Bernoulli p in place. At step 5,800 (the historical collapse point) α is now ~0.08 instead of 100% — the encoder sees ~8% of batches with attacks rather than 100%.

Caveat. Smoothing alone delays the slide rather than removing the embed-nothing basin. If a future run still collapses, the next layer is the embedding-energy floor relu(rms_floor − ‖container − cover‖_rms) — outlaws the basin in the loss landscape rather than delaying the slide. Optional companion: bit-weight ramp ×2–5 across the α-ramp window.

Collapse signature (what we're avoiding)

Runs 1 (56248029) and 2 (56250090) both collapsed at the same A→B step-function boundary at ~step 5,800 in 2026-04-25:

run	job	stage A end (~4,600)	post-transition (~5,800)
1	`56248029`	bit_acc 1.0, PSNR 49	bit_acc 0.5, PSNR 63, secret pathway killed (no diagnostic yet)
2	`56250090`	bit_acc 1.0, PSNR 49, `secret_rec_rms` 93	bit_acc 0.5, PSNR 64, `secret_rec_rms` 0.019, `secret_rec_err_rms` 0.94

Run 2 confirmed via the new diagnostics that the recovered secret tensor was driven 5,000× toward zero in the very first 1,200 steps after attacks turned on — unambiguous "embed nothing" basin.

AttackLayer (severity="high", α=1)

op	Q range / scale	Bernoulli p
`resize` (down-then-up)	scale ~ U(0.5, 1.0)	0.5
`jpeg1`	Q ~ U(40, 95)	0.9
`jpeg2` (chained)	Q ~ U(20, 40)	0.3

Forward order: resize first, then JPEG — matches platform pipelines. Output spatial dims preserved by construction. Geometric (crop, rotate) and other photometric (blur, noise, color jitter, grayscale) attacks intentionally absent.

§5Diagnostics & collapse signals

Logged per --log_every step. Both secret_rec_rms and secret_rec_err_rms were added 2026-04-25 to catch embed-nothing collapse the moment it starts.

metric	healthy	collapse signal
`bit_acc`, `bit_acc_ema`	→ 1.0	flat at 0.5
`psnr(container, cover)`	30–35 dB	rises past ~50 dB = container ≈ cover, secret discarded
`l1_container_cover`	~0.01–0.02	drops toward 0 with bit_acc still 0.5
`secret_rec_rms`	large + stable through ramp (run 1 saw ~93 in clean phase)	drops toward 0 = INN killed the secret pathway
`secret_rec_err_rms`	small relative to `secret_rec_rms`	rises toward `secret_rms` (~1.0) = recovered tensor uncorrelated
`alpha`	matches curriculum schedule	discontinuities = curriculum bug
`img_loss`, `bit_loss`	finite, decreasing	NaN

Kill criterion. L1 nosedive while bit_acc stays at 0.5 = deep "embed nothing" collapse. PSNR jumping up under noise is the giveaway. Cancel and root-cause; don't wait for an optimizer recovery (it won't come).

§6Threat-model scope

Compression-only. The training and eval attack suites are limited to canonical-delivery transforms — resize + JPEG + JPEG chains. Geometric attacks (crop, rotate) and other photometric attacks (blur, noise, color) are out of scope by design.

Why no resize-invariance, even though resize is in training

Adding resize to training gives a robustness margin against small in-pipeline resampling (recipient-app re-rendering, DPI tweak, format conversion within canonical-resolution range), not full resize-tolerance. Two architectural binders prevent that regardless of how well the encoder learns:

The 32×32 patch grid is not scale-invariant. After a 0.27× resize, patch boundaries no longer align to integer pixels — the verifier's mean-pool decode lands on the wrong cells.
Cryptographic content-binding requires bit-exactness. Recovered bits must hash to the same H that was signed; resize changes pixel values, hence H. Tolerant mode (Hamming threshold τ on H) helps within ~10% scale; large platform resizes blow past τ.

Realistic deployment for large resizes: "verify against the original-resolution camera file, not the social-media-resized derivative." Feed-scraped copies are intentionally unverifiable, which is consistent with the provenance argument — a re-uploaded resize cannot impersonate the original because it cannot carry the signature.

Why no crop-tolerance

Whole-image design with H = RobustHash(image). Any crop changes H arbitrarily; PDQ drift is 20–50+ bits on small crops (per memory/project_mwip_ecc.md). Crop = tamper, by design. The verifier rejects.

This is an explicit trade for simplicity and smaller payload. Per-tile localization was considered in early drafts; rejected because payload exploded (~5 KB/image) and the tile-sync problem made graceful crop-recovery aspirational rather than concrete.

§7Mobile variant — Levers 2 + 3

Defaults flipped to (num_blocks=8, subnet_type="light") on 2026-04-28. The legacy 16/RDB baseline is still reachable; eval auto-detects the architecture from saved args, so 16/RDB checkpoints still load.

backbone	blocks	subnet	params	FLOPs vs baseline	status
16 / RDB	16	5-conv dense (RDB)	4.05 M	1×	legacy baseline. collapses on α-ramp at α≈0.16
8 / RDB	8	5-conv dense	2.03 M	0.5×	ablation: blocks only
16 / light	16	2-conv flat (Light)	0.334 M	~0.08×	ablation: subnet only
8 / light	8	2-conv flat (Light)	0.167 M	~0.04×	deployed mobile target — survived α-ramp without modification

LightConvBlock: Conv2d(in→32, 3×3) → LeakyReLU → Conv2d(32→out, 3×3). No dense concat — flat input/output channel profile that NPUs pipeline well (Apple Neural Engine, Qualcomm Hexagon). Per-block FLOPs ~12× lower than RDB at the same in/out channels.

Combined with halving the block count: ~24× FLOP reduction, ~24× param reduction.

Hyperparameters used by the deployed run (idea097_design001, in sibling autohide repo): lr=4e-4, bit_weight=20.0, img_weight=1.0, --no-amp, single-resolution 256² training, 30,000 steps. Curriculum: stage A 0–5,000 clean, stage B 5,000–15,000 Bernoulli α-ramp, stage C 15,000–30,000 at α=1 (autohide defaults; unchanged). The imagehide tree's multi-res sampler (pixel-budget 1.0 M, DPED + CLIC + COCO/DIV2K) is the in-flight research direction (idea084/d001 → idea112/d003), not what the deployed checkpoint used.

§9Rejected alternatives

From the two-round codex review (2026-04-25) and the design's history. Listed so future iterations don't redo a settled rejection without new evidence.

Learnable α scalar on the patch tile

A single learnable scalar scaling the bipolar patch signal. Under attack pressure the optimizer drives α → 0, recreating v1's "embed nothing" failure mode with one parameter instead of 5.4 M. Dropped 2026-04-25. α = 1 fixed. A fixed schedule (ramp 0.1 → 1.0) preserves the "start gentle" benefit without the collapse path — listed in §11.

Multi-shift verifier (1024 trim positions)

Existential acceptance ("any of 1024 trims decodes") widens the false-accept surface for free. Dropped in favor of single canonical center-trim. The multi-shift number is reported for the security discussion only — and is one reason we picked single-canonical.

Spread-spectrum framing of the patch design

Earlier draft described the patch tile as "spread-spectrum." Codex flagged: spread-spectrum uses a long pseudo-random sequence per bit; we use a constant ±1 over a patch (low-entropy repetition code). Don't overclaim. Robustness story: "averaging over many pixels denoises the bit." Approaching SS-style robustness would require pseudo-random ±1 within each patch — ablation 6 in §11.

"JPEG alignment is load-bearing"

Earlier doc claimed 8-px alignment was essential. Walked back too far in correction. Current claim: alignment is a soft preference at 8 px, a non-issue at ≥ 16 px. Under heavy compression (q < 30) and double-JPEG the misalignment penalty grows — needs empirical phase-sweep validation.

Hard receptive-field ceiling for multi-resolution inference

Codex initially framed multi-res training as required to make 1024+ inference work, citing a "hard receptive-field ceiling." User pushed back from experience: translation-equivariant CNNs without normalization layers handle resolution mismatches fine; the patch design's local-boundary nature means the receptive-field-vs-patch argument doesn't bind. Reverted. Multi-res training is now classified as an empirical optimization, gated on what the eval shows, not a correctness prerequisite.

Per-tile design (early draft)

Per-tile hash + per-tile signature, with localization. Payload exploded to ~5 KB/image, tile-sync problem made graceful crop-recovery aspirational, and localization was a stretch claim. Dropped 2026-04-24 in favor of whole-image MWIP. Crop = tamper, by design.

A-strict (no H in pixels, recomputed at verify)

Ed25519 requires bit-exact input; robust hash drifts ≥ 1 bit under benign transforms; ECC wrapping fixes channel noise on embedded bits, not signer/verifier recomputation mismatch. Crypto-unsound. Tolerant mode (embedded H, Hamming threshold τ before Ed25519) is the only sound cheap option.

Hybrid sidechannel (manifest for cert / metadata)

Embedding the minimum payload in pixels and shipping certs / metadata in a C2PA-style manifest. Dropped: collapses the paper into the TrustMark+C2PA slot, loses the manifest-free novelty claim.

Trapdoor INN (sk to embed, pk to extract)

Would eliminate replay at embedding. Requires cryptographic primitives (lattices, SNARKs, pairings) incompatible with continuous tensor arithmetic. Open research problem. Future work, not this paper. Replay is blocked by content-binding instead.

DKiS-style symmetric key fusion

Same key for embed and extract → any verifier can forge. Incompatible with public verification. Dropped at v2. Asymmetric Ed25519 signatures replace the symmetric channel.

component	role
`Secret2Image.dense`	`Linear(secret_len → 16·16·3)` → reshape → upsample → concat with cover → U-Net encoder. Payload-dependent.
`SecretDecoder.decoder.fc`	final FC of the backbone (ResNet-18/50/DenseNet), resized to `Linear(fc.in_features → secret_len)`. Payload-dependent.
everything else	U-Net conv backbone, ResNet50, discriminator, noise layer, loss — all payload-independent

payload	final bit_acc_ema	stage	note
100 b	0.981	2	comfortable
256 b	0.913	2	marginal
512 b	0.795	0 (stall)	cliff
1024 b	0.682	0 (stall)	random+
2048 b	0.623	0 (stall)	random+

#	ablation	question
1	Patch adapter under noise	Does the v3 patch actually hold under noise? The whole motivation.
2	Deep-collapse detection	Watch `L1(container, cover)` per §5. If it nosedives at any stage transition while bit_acc stays at 0.5, INN `f/g/h` are collapsing toward identity. Kill criterion to be set empirically.
3	Crop-size ablation	Train at one size, eval at {256, 384, 512, 768, 1024}. If 768/1024 fail clean, the receptive-field ceiling is real and deployment scope narrows.
4	JPEG phase sweep	All 64 phase shifts × q ∈ {20, 30, 40, 50}. Measure actual misalignment penalty.
5	Trim-search vs single-canonical FA	"Single fixed center-trim" vs "try all 1024 trim shifts and accept if any decodes." Report FA delta.
6	PR ±1 within patches vs constant	SS-like (PR ±1 spreading code per patch) vs current (constant ±1), matched energy. Test under localized erasure.
7	Patch grid size	16 / 32 / 64 — capacity vs robustness tradeoff. 32 is default.
8	Mean-pool vs learned Wiener	A 1×1 conv pre-pool could weight-pool optimally if learned. Adds params; might recover lost SNR.
9	Per-channel sign mask	12 different DWT-channel sign masks instead of broadcasting one mask. Cross-channel redundancy.
10	Fixed α schedule	Ramp 0.1 → 1.0 (vs current α = 1 throughout). Preserves "start gentle" without the learnable collapse path.
11	INN-as-adapter	Replace patch-tile adapter with a small 4-block coupling INN. Tied weights, ~200 k params. Probably overkill given the 0-param patch design works.

INN encoder — design rationale

§1Goal

§2Architecture

Why DWT first

Why coupling INN

INN init detail

§3Adapter design — patch tile (v3, locked)

Why a (nearly-)zero-parameter patch adapter

Deployed extensions on the v3-base adapter

Patch grid choice

Sign-mask scramble

§4Curriculum — smooth Bernoulli α-ramp

Collapse signature (what we're avoiding)

AttackLayer (severity="high", α=1)

§5Diagnostics & collapse signals

§6Threat-model scope

§7Mobile variant — Levers 2 + 3

§8Trim & deployment

Camera (embed)

Verifier (extract)

§9Rejected alternatives

§10TrustMark baseline (for reference)

Exp 0 capacity sweep — what we learned

The information bottleneck

§11Open ablations load-bearing per codex