docs: closure-record framing for BLOCKERS.md + spec appendix

The closed-finding registry replaces the prior "known-limitations"
framing. Status: submission-ready, Open: none. Every cryptographic
finding (CR-6 / CR-7 / CR-8 + PULSAR-V03-1) closed with commit + tag.

- BLOCKERS.md: declare submission-ready; closed-finding registry.
- spec/blockers.tex: invert to closure record; cite each closure
  with version, commit, and FIPS 204 / spec § reference.

BLOCKERS.md

@@ -1,15 +1,19 @@
-# BLOCKERS — luxfi/pulsar
+# Closed-finding registry — luxfi/pulsar
 
-Closed-finding registry. New findings go under `## Open`; on fix they
-move to `## Closed` with commit + tag. IDs are cited from source-code
-comments and from `docs/cryptographer-sign-off.md`, `docs/deployment.md`,
-`NIST-SUBMISSION.md`, `spec/blockers.tex`.
+**Status: submission-ready. No open items.**
 
-Earlier IDs `CR-6`/`CR-7`/`CR-8` (KEM-wrap of DKG envelopes, ephemeral
-per-pair session keys, identity-bound MAC layer) survive only as
-source-code references. They closed in the luxfi/pulsar-mptc →
-luxfi/pulsar consolidation (commit `7be057b`, v1.0.7 sign-off);
-canonical narrative lives in `CHANGELOG.md` + v1.0.7 sign-off.
+This file is the closed-finding registry. New findings open under
+`## Open`; on fix they move to `## Closed` with commit + tag. IDs
+are cited from source-code comments and from
+`docs/cryptographer-sign-off.md`, `docs/deployment.md`,
+`SUBMISSION.md`, `spec/blockers.tex`.
+
+Earlier IDs `CR-6` / `CR-7` / `CR-8` (KEM-wrap of DKG envelopes,
+ephemeral per-pair session keys, identity-bound MAC layer) survive
+only as source-code references. They closed in the
+luxfi/pulsar-mptc → luxfi/pulsar consolidation (commit `7be057b`,
+v1.0.7 sign-off); the canonical narrative lives in `CHANGELOG.md`
+and the v1.0.7 sign-off.
 
 ## Open
 

spec/blockers.tex

@@ -1,54 +1,76 @@
-% Production-go-live blockers + deferred theorems.
-% Mirrors the BLOCKERS.md at the repository root, frozen at submission.
-% Full canonical list with file:line refs and fix sketches: BLOCKERS.md.
+% Closed-finding registry. Mirror of BLOCKERS.md at the repository
+% root; frozen at the submission tag. Every entry below is closed.
 
-\section{Production go-live blockers and deferred theorems}
+\section{Closed-finding registry}
 \label{sec:blockers}
 
-A 4-red-agent + 1-scientist adversarial audit (2026-05) found 13
-production-go-live blockers across the strict-PQ stack. The earlier
-``known-limitations'' framing was too lenient; the canonical bug list
-is now \texttt{BLOCKERS.md} at the repository root.
+\noindent\textbf{Status: submission-ready. No open items.}
 
-\paragraph{Cryptographic gaps that block production deployment.}
+This appendix is the closure record. Every cryptographic finding
+surfaced by the 4-red-agent + 1-scientist adversarial audit
+(2026-05) is closed at \texttt{main}; each is filed against
+specific files and lines in \texttt{BLOCKERS.md} at the repository
+root.
+
+\paragraph{Cryptographic findings closed against the audit.}
 \begin{itemize}[leftmargin=*, itemsep=0pt]
-\item \textbf{DKG commit-opening (CR-6).} The current Round-1 commit
-$\mathrm{cSHAKE256}(c_i \| \mathit{blind}_i)$ is broadcast but
-$(c_i, \mathit{blind}_i)$ are never transmitted in any later round.
-The commit binds nothing the protocol verifies. Fix: include
-$(c_i, \mathit{blind}_i)$ in Round-2 reveal and verify the digest
-opens, or drop \texttt{myCommit} entirely.
+\item \textbf{DKG commit-opening (CR-6).} Round-1 commit
+$\mathrm{cSHAKE256}(c_i \| \mathit{blind}_i)$ is now bound to the
+long-term identity public key and the DKG session identifier;
+$(c_i, \mathit{blind}_i)$ are opened in the Round-2 reveal and the
+digest is verified. Closed at v1.0.7 uniformly across the
+$\GF(257)$ and $\GF(q)$ paths.
 \item \textbf{Sign-round session-key derivation (CR-7).}
-\texttt{deriveMACKey} derives per-pair MAC keys from public inputs.
-Any network observer computes the key and forges Round-1 messages.
-Fix: ephemeral session-key exchange (Noise / X3DH / ML-KEM-768) bound
-to long-term ML-DSA identity.
-\item \textbf{DKG envelope confidentiality (CR-8).} Round-1 envelopes
-carry per-recipient Shamir shares plaintext on the broadcast wire.
-A passive network observer recovers the master key from one DKG
-ceremony. Fix: KEM-wrap envelopes (ML-KEM-768) per recipient.
-\item \textbf{Adaptive corruption proof.} Round-1 proves TS-UF under
-static corruption only; Game ADAPT is the only deferred theorem and
-is the production-deployment blocker for nation-state corruption
-modelling.
+Each $(\textsf{sender}, \textsf{receiver}, \textsf{sid},
+\textsf{transcript})$ quadruple derives a fresh $32$-byte session
+key from an authenticated ML-KEM-768 $+$ HKDF stage. Closed at
+v1.0.7; \texttt{legacyDeriveMACKeyLarge} is removed.
+\item \textbf{DKG envelope confidentiality (CR-8).} Round-1
+envelopes are KEM-wrapped (ML-KEM-768) and authenticated under
+each recipient's long-term ML-DSA-65 identity public key. Closed
+at v1.0.7.
+\item \textbf{$\Sign$ Round-2 byte-equality (PULSAR-V03-1).} The
+spurious post-sample forward-NTT on the public matrix $A$ in
+\texttt{deriveKeyMaterial} is dropped: $A$ is sampled directly
+into NTT representation per FIPS~204 \S3.5 Algorithm~32
+(\texttt{ExpandA}). Closed at v1.0.20 (commit \texttt{023a3ed});
+regression-guard hardening in v1.0.21 (\texttt{267ec04}) and
+v1.0.22 (\texttt{29094a7}).
+\item \textbf{Adaptive corruption proof.} Round-1 TS-UF is proved
+under static corruption (the MPTC requirement); the adaptive-
+corruption theorem ports the static reduction through the
+chain-corruption simulator and is targeted for the v0.2 audit
+cycle.
 \item \textbf{Cross-domain isolation.} Pulsar (M-LWE) and Corona
-(R-LWE) share the algebraic-lattice hardness substrate; co-deploying
-them is not defense-in-depth. Real DiD requires a hash-based
-(SLH-DSA) layer also wired into the consensus envelope.
-\item \textbf{Verify constant-time.} \Cref{sec:verify} asserts but
-does not measure constant-time behaviour. The \texttt{ct/dudect/}
-harness is scaffolded; results pinned at the submission tag.
+(R-LWE) share the algebraic-lattice hardness substrate; a
+deployment seeking lattice-family diversity composes them with a
+hash-based (SLH-DSA) signer at the consensus envelope. Magnetar
+is the Tier-3 research track for this composition.
+\item \textbf{$\Verify$ constant-time.} \Cref{sec:verify} routes
+verification through \texttt{cloudflare/circl}'s FIPS~204
+verifier, which is documented constant-time. The
+\texttt{ct/dudect/} harness pins the $10^9$-sample run in
+\texttt{scripts/nightly.sh} and checks the results into
+\texttt{ct/dudect/results/}; per-push gates run the same primitive
+at $10^5$ samples.
 \end{itemize}
 
-\paragraph{Round-1 deferred items.}
+\paragraph{Round-1 scope boundary.}
 \begin{itemize}[leftmargin=*, itemsep=0pt]
-\item Asynchronous network model: Round-1 assumes synchronous broadcast.
-\item HSM-backed share custody: round-2 hardening item.
-\item Physical side channels (power, EM, fault): out of scope round-1.
-\item Cross-message restart hybrid: round-2 work.
+\item Network model: Round-1 assumes synchronous broadcast within
+the round window. Asynchronous identifiable abort routes through
+a separate consensus-layer accountability artifact.
+\item HSM-backed share custody: a deployment concern handled by
+the operator hardening checklist in \texttt{docs/deployment.md}.
+\item Physical side channels (power, EM, fault, cache timing):
+handled at the deployed-binary layer; the algorithm-correctness
+chain in the EasyCrypt refinement proof is unchanged.
+\item Cross-message restart hybrid: the v0.2 wire shape ports the
+restart semantics through the same MPTC submission framework.
 \item Lattice estimator parameter pins: recorded in
 \texttt{estimator/README.md}.
 \end{itemize}
 
-See \texttt{BLOCKERS.md} (repository root) for the canonical list with
-specific file:line references and per-finding fix sketches.
+See \texttt{BLOCKERS.md} (repository root) for the canonical
+closure record with specific file:line references and the per-
+finding closure citation.