docs: state the dual-leg diversity claim accurately (not an over-correction)

The prior pass swung too far: it answered "does running both give diversity?"
with a flat "No, both are Module-LWE." That under-credits the real security.

Accurate, layered claim now installed in design-decisions / README / SUBMISSION /
nist-mptc-category:
- Pulsar and Corona are distinct SCHEMES at different PARAMETER regimes
  (Pulsar = FIPS-204 ML-DSA deterministic FS-with-aborts, q=8380417; Corona =
  Ringtail/Raccoon masked threshold, q=0x1000000004A01, params tuned for
  threshold). In AND-mode an adversary must forge BOTH; a cryptanalytic,
  parameter-specific, or implementation flaw in one does not transfer — the pair
  is strictly stronger than either leg alone ("both have to be cracked").
- What it is NOT: hardness-ASSUMPTION diversity. Both rest on Module-LWE/SIS, so a
  fundamental Module-LWE break threatens both lattice legs; assumption-disjoint
  diversity is the hash-based Magnetar (SLH-DSA) leg.

Docs-only; go build green; no shims.

README.md

@@ -47,10 +47,15 @@ gaps:
 Corona is independently usable: a chain can pick Corona as its
 sole PQ threshold layer, no cross-dependency on Pulsar. Lux primary-
 network QuasarCert combines both Module-LWE schemes as a **Double Lattice**
-layered defence so a break in one *construction or implementation* does not
+layered defence: Pulsar and Corona are distinct schemes at different
-break finality. (Both legs are Module-LWE, so this is construction- and
+parameter regimes (Pulsar = FIPS-204 ML-DSA; Corona = the Ringtail/Raccoon
-implementation-diversity, not lattice-family diversity — a break of the
+threshold, parameters tuned for threshold signing), so an adversary must
-shared Module-LWE problem would affect both legs):
+break **both** independently — a construction-, parameter-, or
+implementation-specific flaw in one does not break finality (both have to be
+cracked). This is construction/parameter/implementation diversity, not
+hardness-assumption diversity — both rest on Module-LWE, so a break of
+Module-LWE itself would affect both legs; assumption-disjoint diversity
+comes from the hash-based Magnetar (SLH-DSA) leg:
 
 ```
 QuasarCert {

SUBMISSION.md

@@ -273,13 +273,17 @@ What Corona DOES offer at submission-time:
 | Boschini et al. (academic upstream) | Module-LWE | 2 | Construction-level; trusted-dealer Gen only | not submitted as MPTC |
 
 The Corona / Pulsar pair is intentional. Both are Module-LWE, but they
-are distinct constructions (Corona is the Ringtail/Raccoon-line threshold;
+are distinct schemes at different parameter regimes (Corona is the
+Ringtail/Raccoon-line threshold, parameters tuned for threshold signing;
 Pulsar is FIPS-204 ML-DSA made threshold). Lux's primary-network
-QuasarCert MAY combine them as a **Double Lattice** layered defence so a
+QuasarCert MAY combine them as a **Double Lattice** layered defence: an
-break in one *construction or implementation* does not break finality.
+adversary must forge **both**, and a construction-, parameter-, or
-Because both legs are Module-LWE, a break of the shared Module-LWE problem
+implementation-specific flaw in one does not transfer to the other, so the
-would affect both — the diversity is at the construction/implementation
+pair is strictly stronger than either leg alone (both have to be cracked).
-layer, not the lattice family. That layered combination is the consumer's
+Because both legs are Module-LWE, a fundamental break of the shared
+Module-LWE problem would affect both — so this is construction/parameter/
+implementation diversity, not hardness-assumption diversity (the
+assumption-disjoint leg is hash-based Magnetar, SLH-DSA). That layered combination is the consumer's
 design choice and is not part of this submission. Corona stands alone as
 an MPTC Class N1 + N4 candidate.
 

docs/mptc/design-decisions.md

@@ -14,7 +14,7 @@ threshold construction; Pulsar is FIPS-204 ML-DSA made threshold.
 |---|---|
 | Why ship Corona when ML-DSA (Pulsar) is the NIST standard? | Corona's 2-round *threshold* construction (Boschini et al. 2024/1113, the Ringtail/Raccoon line) was published with a peer-reviewed 2-round threshold analysis a year before the ML-DSA threshold path matured. Lux deployed it first because it was the only construction with a published peer-reviewed 2-round threshold signature analysis for lattice-based signatures at the time of consensus design. |
 | Why keep Corona after the ML-DSA path (Pulsar) is ready? | Lux's primary-network QuasarCert is designed to consume BOTH as a **Double Lattice** layered defence: two *independent constructions and codebases* (threshold-Raccoon vs ML-DSA) so that a construction- or implementation-specific flaw in one does not break finality. The two are complementary, not interchangeable. |
-| Does running both give lattice-family diversity? | No. Both legs are Module-LWE, so a break of the Module-LWE problem itself would affect both. The diversity is at the *construction and implementation* layer, not the hardness assumption. Hardness-assumption diversity in the stack comes from the (research-stage) hash-based Magnetar (SLH-DSA), not from Corona-vs-Pulsar. The cost of running both is wire-size overhead (Corona certs are variable-size; Pulsar certs are fixed-size); the benefit is construction and implementation diversity. |
+| Does running both give diversity worth the cost? | Yes — at the *construction, parameter, and implementation* layer, though not the hardness *assumption*. Pulsar and Corona are distinct schemes at different parameter regimes (Pulsar = FIPS-204 ML-DSA, deterministic Fiat-Shamir-with-aborts, q=8380417; Corona = the Ringtail/Raccoon-line masked threshold, q=0x1000000004A01, parameters tuned for threshold signing). In AND-mode QuasarCert an adversary must forge **both**, and a cryptanalytic, parameter-specific, or implementation flaw in one does not transfer to the other — so the pair is strictly stronger than either leg alone (both have to be cracked). What it does *not* give is hardness-assumption diversity: both rest on Module-LWE / Module-SIS, so a fundamental break of Module-LWE at secure parameters would threaten both lattice legs. Assumption-disjoint diversity comes from the (research-stage) hash-based Magnetar (SLH-DSA) leg, whose security rests on hash hardness, not lattices. The cost of running both is wire-size overhead (Corona certs are variable-size; Pulsar certs are fixed-size). |
 
 ## §2 Why this parameter set?
 

docs/mptc/nist-mptc-category.md

@@ -150,10 +150,12 @@ FIPS / AWS-LC / OpenSSL 3.0 PQ. Pulsar's submission is at
 <https://github.com/luxfi/pulsar>.
 
 The Corona / Pulsar pair is intentional: both are Module-LWE but
-distinct constructions, so Lux's primary-network QuasarCert may combine
+distinct schemes at different parameter regimes, so Lux's primary-network
-them as a **Double Lattice** layered defence — construction- and
+QuasarCert may combine them as a **Double Lattice** layered defence — an
-implementation-diversity, not lattice-family diversity (separate
+adversary must break both independently (construction/parameter/
-consumer-side design choice; not part of this submission).
+implementation diversity; both have to be cracked), though not hardness-
+assumption diversity since both rest on Module-LWE (separate consumer-side
+design choice; not part of this submission).
 
 ## Status