chore(sync): mirror backend .py + Dockerfile to Space (hf-sync-backend)

Automated backend sync from szl-holdings/a11oy main via hf-sync-backend.
Updated (differed from the Space): Dockerfile, fundamental_limits.py, nav_coasting.py, pnt_resilience.py, quantum_sensing_limits.py, serve.py, szl_pnt_mesh.py
Deleted (gone from the repo + Dockerfile COPY set): (none)

Keeps the Space-built backend (serve.py + the Dockerfile-COPY'd .py
modules) identical to GitHub main so the Space never rebuilds from a
stale backend, new endpoints don't 404 there, and orphaned modules
removed from the repo don't linger in the Space tree.

Dockerfile

@@ -108,6 +108,11 @@ COPY a11oy_factory.py a11oy_constitution.py a11oy_nav_wireup.py ./
 # module honestly serves a SAMPLE certificate until Forge writes real ones on the box.
 COPY szl_pinn_bounds.py ./
 COPY physical_bounds_certificate.json agentic_decision_trail.json physical_bounds_certificate.dsse.json ./
+# PNT / quantum-sensing mesh (pure-stdlib closed-form web path; serves /api/a11oy/v1/pnt/*).
+# szl_pnt_mesh.py loads the 4 engine modules dynamically via importlib, so ALL FIVE MUST be
+# COPY'd or serve.py's guarded import falls back to a stub (merged-but-not-live) in the HF
+# image. Heavy numpy/UKF/PINN solves are the Forge/GPU path; this web path never solves.
+COPY szl_pnt_mesh.py quantum_sensing_limits.py pnt_resilience.py nav_coasting.py fundamental_limits.py ./
 # ADDITIVE (I4 gpu-quant): Sovereign VRAM-resident GPU-Quant engine (PCA-Risk / TDA-Fracture
 # / HJB-Kelly) backing /api/a11oy/v1/quant/* + the /quant tab. PURE-STDLIB (Jacobi eigen,
 # Gaussian solve, union-find Betti) so it runs in the numpy-less HF image; cuML/giotto-tda

fundamental_limits.py

@@ -0,0 +1,606 @@
+# SPDX-License-Identifier: Apache-2.0
+# © 2026 SZL Holdings · Doctrine v11 LOCKED · Λ = Conjecture 1 (advisory, NOT proven trust)
+# Sign-off: Stephen P. Lutar Jr. <stephenlutar2@gmail.com>
+"""fundamental_limits.py — the UNIFIED "fundamental-limits" library (SZL, clean-room).
+
+ONE clean API wrapping the estate's TWO hard-physics pillars:
+
+  PILLAR A — COMPUTE BOUNDS  (existing, on-metal-proven)
+    agentic_pinn/physics_bounds.py — Landauer (1961) / Margolus-Levitin (1998) /
+    Bremermann (1962) / Bekenstein (1981) / Bekenstein-Hawking (Hawking 1975).
+    The HONEST INVERSE of a free-energy claim: PROVE a real compute job sits FAR
+    BELOW the fundamental ceilings of physics. Energy DERIVED only from MEASURED
+    power × MEASURED time.
+
+  PILLAR B — QUANTUM-SENSING / PNT LIMITS  (new, this build)
+    Re-derived clean-room from the kshana method + the original papers
+    (Kasevich-Chu 1991; Peters et al. 2001; Freier et al. 2016; Cheinet et al. 2008):
+      * Dev1  quantum_sensing_limits — cold-atom-interferometer (CAI) accelerometer
+              shot-noise / standard-quantum-limit sensitivity from k_eff, T, N, C.
+      * Dev2  pnt_resilience         — fused multi-layer GNSS spoof detector verdict
+              (RAIM-consistency + AGC + SQM), deny-by-default.
+      * Dev3  nav_coasting           — GPS-denied coasting figure-of-merit (position
+              error growth), classical IMU vs quantum CAI.
+
+This module is a THIN unifying layer. It IMPORTS and WRAPS the sibling engines when
+present; when a sibling is NOT yet wired it returns an HONEST, clearly-labelled
+"module not wired yet" result — never a fabricated number, never a false green.
+
+`certify(kind=...)` is the single entry point covering:
+    compute_bounds | quantum_sensor | pnt_resilience | nav_coasting
+
+DOCTRINE v11 (HARD, never violated):
+  - NO free-energy / over-unity. The compute certificate is the honest INVERSE of a
+    free-energy claim; sensor limits are DERIVED from physics, never magic.
+  - Every result labelled MEASURED vs MODELED (vs SAMPLE). Honest "NOT MODELED" /
+    "module not wired yet" where physics is incomplete or a sibling engine is absent.
+  - Established physics bounds are CITED, not claimed as SZL's. Clean-room.
+  - Λ = Conjecture 1 (advisory governance gate, deny-by-default). NEVER "proven trust".
+  - Pure-stdlib where possible. The full numpy/heavy solves are the Forge/GPU path;
+    this layer aggregates and re-certifies, it does not block on heavy compute.
+"""
+from __future__ import annotations
+
+import importlib
+import math
+import os
+import sys
+from typing import Any, Optional
+
+# --------------------------------------------------------------------------- #
+# Doctrine constants carried by EVERY result                                  #
+# --------------------------------------------------------------------------- #
+DOCTRINE = (
+    "v11 LOCKED: NO free-energy/over-unity (compute certificate is the honest INVERSE; "
+    "sensor limits DERIVED from physics); MEASURED vs MODELED vs SAMPLE labels on every "
+    "result; honest 'NOT MODELED'/'module not wired yet' where physics is incomplete; "
+    "established bounds CITED not claimed as SZL's; clean-room (re-derived from papers, "
+    "kshana cited not copied); Λ=Conjecture 1 (advisory, deny-by-default, never 'proven "
+    "trust'); sovereign own-metal; no fabricated numbers."
+)
+
+LAMBDA_NOTE = (
+    "Λ = Conjecture 1 (advisory governance gate). ALLOW = 'passed SZL admission policy', "
+    "NEVER 'proven trust'. Deny-by-default. This library states physical FACTS/BOUNDS, "
+    "not trust."
+)
+
+# The honest-inverse-of-free-energy invariant is preserved across the unified surface.
+HONEST_INVERSE_OF_FREE_ENERGY = True
+
+LABELS = {
+    "MEASURED": "observed from a real exporter (e.g. NVML) or honestly-labelled sample",
+    "MODELED": "computed from first-principles physics formulas (CITED), not a live measurement",
+    "SAMPLE": "an honestly-labelled placeholder input — clearly NOT a measured value",
+    "NOT_MODELED": "physics is incomplete / out of validated regime — no number asserted",
+}
+
+KINDS = ("compute_bounds", "quantum_sensor", "pnt_resilience", "nav_coasting")
+
+# Physics lineage cited across the sensing pillar (clean-room, method-only).
+SENSING_ATTRIBUTION = {
+    "kasevich_chu_1991": (
+        "Kasevich, M. & Chu, S. (1991), 'Atomic interferometry using stimulated Raman "
+        "transitions', Phys. Rev. Lett. 67(2):181, doi:10.1103/PhysRevLett.67.181."
+    ),
+    "peters_2001": (
+        "Peters, A., Chung, K.Y. & Chu, S. (2001), 'High-precision gravity measurements "
+        "using atom interferometry', Metrologia 38(1):25, doi:10.1088/0026-1394/38/1/4."
+    ),
+    "freier_2016": (
+        "Freier, C. et al. (2016), 'Mobile quantum gravity sensor with unprecedented "
+        "stability', J. Phys. Conf. Ser. 723:012050, doi:10.1088/1742-6596/723/1/012050."
+    ),
+    "cheinet_2008": (
+        "Cheinet, P. et al. (2008), 'Measurement of the sensitivity function in a "
+        "time-domain atomic interferometer', IEEE Trans. Instrum. Meas. 57(6):1141, "
+        "doi:10.1109/TIM.2007.915148."
+    ),
+    "kshana": (
+        "AshfordeOU/kshana (Apache-2.0, DOI 10.5281/zenodo.20528627) — PNT-resilience "
+        "simulator. Method & physics studied and CITED; re-derived clean-room in SZL "
+        "Python. No verbatim code copied."
+    ),
+    "honesty": (
+        "Sensor limits are DERIVED from established physics (shot-noise / standard "
+        "quantum limit), labelled MODELED. NO free-energy claim. Clean-room."
+    ),
+}
+
+
+# --------------------------------------------------------------------------- #
+# Sibling-engine resolution — tolerate missing modules GRACEFULLY              #
+# --------------------------------------------------------------------------- #
+# Map each kind to its candidate sibling-engine module names and the entry the
+# unified layer expects. Resolution searches sys.path AND the conventional dev
+# sibling directories under pnt_build/. Missing → honest "module not wired yet".
+_THIS_DIR = os.path.dirname(os.path.abspath(__file__))
+_PNT_BUILD = os.path.dirname(_THIS_DIR)  # .../pnt_build
+
+# Make sibling dev dirs importable WITHOUT mutating global state permanently:
+# we add them lazily inside the resolver and remember which we added.
+_SIBLING_DIRS = {
+    "compute_bounds": [
+        os.path.join(os.path.dirname(_PNT_BUILD), "agentic_pinn"),
+    ],
+    "quantum_sensor": [os.path.join(_PNT_BUILD, "dev1_quantum_sensors")],
+    "pnt_resilience": [os.path.join(_PNT_BUILD, "dev2_spoof_sda")],
+    "nav_coasting": [os.path.join(_PNT_BUILD, "dev3_fusion_pinn")],
+}
+
+# Candidate module names per kind (first importable wins).
+_MODULE_CANDIDATES = {
+    "compute_bounds": ["physics_bounds"],
+    "quantum_sensor": ["quantum_sensing_limits", "quantum_imu", "dev1_quantum_sensing_limits"],
+    "pnt_resilience": ["pnt_resilience", "spoof_detect", "dev2_pnt_resilience"],
+    "nav_coasting": ["nav_coasting", "coasting", "dev3_nav_coasting"],
+}
+
+
+def _ensure_on_path(kind: str) -> None:
+    for d in _SIBLING_DIRS.get(kind, []):
+        if os.path.isdir(d) and d not in sys.path:
+            sys.path.insert(0, d)
+
+
+def _try_import(kind: str):
+    """Return (module, module_name) for the first importable candidate, else (None, None)."""
+    _ensure_on_path(kind)
+    for name in _MODULE_CANDIDATES.get(kind, []):
+        try:
+            mod = importlib.import_module(name)
+            return mod, name
+        except Exception:
+            continue
+    return None, None
+
+
+def _wired_status(kind: str) -> dict:
+    mod, name = _try_import(kind)
+    return {
+        "kind": kind,
+        "wired": mod is not None,
+        "module": name,
+        "note": (f"sibling engine '{name}' is present and importable"
+                 if mod is not None else
+                 "module not wired yet — honest placeholder; no number fabricated"),
+    }
+
+
+def status() -> dict:
+    """Report which pillars/engines are wired (honest discovery, no fabrication)."""
+    return {
+        "library": "szl/fundamental-limits/v1",
+        "pillars": {
+            "compute_bounds": _wired_status("compute_bounds"),
+            "quantum_sensor": _wired_status("quantum_sensor"),
+            "pnt_resilience": _wired_status("pnt_resilience"),
+            "nav_coasting": _wired_status("nav_coasting"),
+        },
+        "kinds": list(KINDS),
+        "doctrine": DOCTRINE,
+        "lambda_note": LAMBDA_NOTE,
+        "honest_inverse_of_free_energy": HONEST_INVERSE_OF_FREE_ENERGY,
+        "labels": LABELS,
+        "attribution": {"sensing": SENSING_ATTRIBUTION},
+    }
+
+
+# --------------------------------------------------------------------------- #
+# Honest "module not wired yet" envelope                                       #
+# --------------------------------------------------------------------------- #
+def _not_wired(kind: str, extra: Optional[dict] = None) -> dict:
+    out = {
+        "kind": kind,
+        "status": "MODULE_NOT_WIRED",
+        "label": "NOT_MODELED",
+        "wired": False,
+        "result": None,
+        "note": (f"The '{kind}' sibling engine is not present in this environment. "
+                 "Returning an HONEST placeholder — no number is fabricated, no false "
+                 "green. Wire the Dev sibling module to activate this kind."),
+        "doctrine": DOCTRINE,
+        "lambda_note": LAMBDA_NOTE,
+        "honest_inverse_of_free_energy": HONEST_INVERSE_OF_FREE_ENERGY,
+        "labels": LABELS,
+    }
+    if extra:
+        out.update(extra)
+    return out
+
+
+def _envelope(kind: str, label: str, result: dict, *, source: str,
+              attribution: Optional[dict] = None, extra: Optional[dict] = None) -> dict:
+    out = {
+        "kind": kind,
+        "status": "OK",
+        "label": label,                      # MEASURED | MODELED | SAMPLE
+        "wired": True,
+        "source": source,
+        "result": result,
+        "doctrine": DOCTRINE,
+        "lambda_note": LAMBDA_NOTE,
+        "honest_inverse_of_free_energy": HONEST_INVERSE_OF_FREE_ENERGY,
+        "labels": LABELS,
+    }
+    if attribution:
+        out["attribution"] = attribution
+    if extra:
+        out.update(extra)
+    return out
+
+
+# --------------------------------------------------------------------------- #
+# PILLAR A — compute bounds (wraps physics_bounds.py)                          #
+# --------------------------------------------------------------------------- #
+def _certify_compute_bounds(**kw) -> dict:
+    mod, name = _try_import("compute_bounds")
+    if mod is None:
+        return _not_wired("compute_bounds")
+    # physics_bounds.py exposes MeasuredJob + certify(job) -> PhysicalBoundsCertificate.
+    MeasuredJob = getattr(mod, "MeasuredJob", None)
+    certify_fn = getattr(mod, "certify", None)
+    if MeasuredJob is None or certify_fn is None:
+        return _not_wired("compute_bounds", {
+            "note": (f"sibling '{name}' present but missing MeasuredJob/certify — honest "
+                     "incompatible-engine state, no number fabricated"),
+        })
+    # Honest SAMPLE defaults (mirror nvml_hook.sample_job); caller may override.
+    defaults = dict(
+        avg_power_w=700.0, wall_time_s=10.0, temperature_k=350.0,
+        bit_operations=1e16, bits_erased=1e14, info_content_bits=1e12,
+        device_mass_kg=2.0, device_radius_m=0.15,
+        label="SAMPLE", source="fundamental_limits-sample",
+        note="In-sandbox SAMPLE; on metal Forge feeds REAL NVML readings.",
+    )
+    defaults.update({k: v for k, v in kw.items() if k in defaults})
+    job = MeasuredJob(**defaults)
+    cert = certify_fn(job)
+    # Normalise to a dict regardless of dataclass vs dict.
+    if hasattr(cert, "__dict__") and not isinstance(cert, dict):
+        try:
+            from dataclasses import asdict
+            cert_d = asdict(cert)
+        except Exception:
+            cert_d = {k: getattr(cert, k) for k in dir(cert) if not k.startswith("_")}
+    else:
+        cert_d = cert
+    label = "MEASURED" if defaults.get("label") == "MEASURED" else "SAMPLE"
+    return _envelope(
+        "compute_bounds", label, cert_d,
+        source=f"physics_bounds.certify (engine: {name})",
+        attribution=getattr(mod, "BOUNDS_ATTRIBUTION", None),
+        extra={"physically_bounded": cert_d.get("physically_bounded")},
+    )
+
+
+# --------------------------------------------------------------------------- #
+# PILLAR B helpers — local clean-room CAI physics (used only when Dev1 absent) #
+# These mirror the kshana method exactly so the unified surface still answers  #
+# honestly (MODELED) before the sibling engine lands. NOT a fabricated number; #
+# it is a CITED first-principles derivation.                                   #
+# --------------------------------------------------------------------------- #
+def _cai_sensor_limit(lambda_m: float, interrogation_time_s: float,
+                      atom_number: float, contrast: float,
+                      cycle_time_s: float) -> dict:
+    """Standard-quantum-limit CAI accelerometer sensitivity (MODELED, clean-room).
+
+    k_eff = 4π/λ ; Mach-Zehnder phase Φ = k_eff·a·T² ; shot noise σ_Φ = 1/(C·√N) ;
+    per-shot accel sensitivity σ_a = σ_Φ/(k_eff·T²) ; ASD n_a = σ_a·√T_c.
+    Lineage: Kasevich-Chu 1991, Peters 2001, Freier 2016, Cheinet 2008.
+    """
+    k_eff = 4.0 * math.pi / lambda_m
+    sigma_phi = 1.0 / (contrast * math.sqrt(atom_number)) if (contrast > 0 and atom_number > 0) else float("inf")
+    denom = k_eff * interrogation_time_s ** 2
+    sigma_a = (sigma_phi / denom) if denom > 0 else float("inf")
+    asd_a = sigma_a * math.sqrt(cycle_time_s) if cycle_time_s > 0 else float("inf")
+    return {
+        "k_eff_per_m": k_eff,
+        "shot_noise_phase_rad": sigma_phi,
+        "per_shot_accel_sensitivity_m_s2": sigma_a,
+        "accel_asd_m_s2_per_sqrt_hz": asd_a,
+        "inputs": {
+            "laser_wavelength_m": lambda_m,
+            "interrogation_time_s": interrogation_time_s,
+            "atom_number": atom_number,
+            "contrast": contrast,
+            "cycle_time_s": cycle_time_s,
+        },
+        "formulas": {
+            "k_eff": "k_eff = 4*pi/lambda",
+            "mach_zehnder_phase": "Phi = k_eff * a * T^2",
+            "shot_noise": "sigma_Phi = 1/(C*sqrt(N))  (standard quantum limit)",
+            "per_shot_accel": "sigma_a = sigma_Phi/(k_eff*T^2)",
+            "asd": "n_a = sigma_a*sqrt(T_c)",
+        },
+    }
+
+
+def _to_dict(obj):
+    """Normalise a dataclass/obj/dict to a plain dict for JSON envelopes."""
+    if isinstance(obj, dict):
+        return obj
+    try:
+        from dataclasses import asdict, is_dataclass
+        if is_dataclass(obj):
+            return asdict(obj)
+    except Exception:
+        pass
+    if hasattr(obj, "__dict__"):
+        return {k: v for k, v in vars(obj).items() if not k.startswith("_")}
+    return {"value": obj}
+
+
+def _certify_quantum_sensor(**kw) -> dict:
+    mod, name = _try_import("quantum_sensor")
+    # Prefer Dev1 engine: certify_sensor(MeasuredSensor) -> QuantumSensingCertificate.
+    if mod is not None:
+        certify_sensor = getattr(mod, "certify_sensor", None)
+        MeasuredSensor = getattr(mod, "MeasuredSensor", None)
+        honest_sample = getattr(mod, "honest_sample_sensor", None)
+        if callable(certify_sensor) and MeasuredSensor is not None:
+            try:
+                if kw:
+                    # Map our generic kwargs onto Dev1's MeasuredSensor field names.
+                    field_map = {
+                        "lambda_m": "wavelength_m", "wavelength_m": "wavelength_m",
+                        "interrogation_time_s": "interrogation_time_s",
+                        "atom_number": "atom_number", "contrast": "contrast",
+                        "cycle_time_s": "cycle_time_s", "accel_psd": "accel_psd",
+                    }
+                    base = honest_sample() if callable(honest_sample) else None
+                    defaults = _to_dict(base) if base is not None else {}
+                    sensor_kw = {}
+                    valid = getattr(MeasuredSensor, "__dataclass_fields__", {})
+                    for k, v in defaults.items():
+                        if k in valid:
+                            sensor_kw[k] = v
+                    for k, v in kw.items():
+                        tgt = field_map.get(k)
+                        if tgt and tgt in valid:
+                            sensor_kw[tgt] = float(v)
+                    sensor_kw["label"] = "SAMPLE"
+                    sensor_kw["source"] = "fundamental_limits-query"
+                    sensor = MeasuredSensor(**sensor_kw)
+                else:
+                    sensor = honest_sample() if callable(honest_sample) else MeasuredSensor(
+                        wavelength_m=780e-9, interrogation_time_s=0.1, atom_number=1e6,
+                        contrast=0.5, cycle_time_s=0.5, accel_psd=1e-8, label="SAMPLE",
+                        source="fundamental_limits-sample")
+                cert = certify_sensor(sensor, strict=False) if "strict" in getattr(
+                    certify_sensor, "__code__", type("x", (), {"co_varnames": ()})).co_varnames \
+                    else certify_sensor(sensor)
+                return _envelope("quantum_sensor", "MODELED", _to_dict(cert),
+                                 source=f"{name}.certify_sensor (Dev1 engine)",
+                                 attribution=SENSING_ATTRIBUTION)
+            except Exception as e:
+                # Fall through to clean-room fallback, but record why.
+                kw = dict(kw)
+                kw["_dev1_error"] = repr(e)
+        # Older/other entry shapes:
+        for entry in ("certify", "sensor_limit", "cai_limit", "compute"):
+            fn = getattr(mod, entry, None)
+            if callable(fn):
+                try:
+                    res = fn(**{k: v for k, v in kw.items() if not k.startswith("_")})
+                    return _envelope("quantum_sensor", "MODELED", _to_dict(res),
+                                     source=f"{name}.{entry} (Dev1 engine)",
+                                     attribution=SENSING_ATTRIBUTION)
+                except Exception:
+                    continue
+    # Honest fallback: local clean-room CAI derivation (still MODELED, CITED).
+    p = dict(lambda_m=780e-9, interrogation_time_s=0.1, atom_number=1e6,
+             contrast=0.5, cycle_time_s=0.5)
+    p.update({k: float(v) for k, v in kw.items() if k in p})
+    kw = {k: v for k, v in kw.items() if not str(k).startswith("_")}
+    res = _cai_sensor_limit(**p)
+    note = ("Computed by the unified layer's own clean-room CAI derivation because the "
+            "Dev1 'quantum_sensing_limits' engine is not wired yet. MODELED first-principles "
+            "physics (CITED), NOT a fabricated number." if mod is None else
+            "Dev1 engine present but exposed no compatible entry; used clean-room fallback.")
+    return _envelope("quantum_sensor", "MODELED", res,
+                     source="fundamental_limits clean-room CAI fallback",
+                     attribution=SENSING_ATTRIBUTION, extra={"fallback_note": note})
+
+
+def _certify_pnt_resilience(**kw) -> dict:
+    mod, name = _try_import("pnt_resilience")
+    if mod is not None:
+        # Dev2 engine: detect(PntObservables)->SpoofVerdict, or assess_scenario(name).
+        try:
+            scenario = kw.get("scenario")
+            lib = getattr(mod, "TEXBAT_LIBRARY", {})
+            assess = getattr(mod, "assess_scenario", None)
+            detect = getattr(mod, "detect", None)
+            PntObservables = getattr(mod, "PntObservables", None)
+            if scenario and callable(assess) and scenario in lib:
+                v = assess(lib[scenario], seed=int(kw.get("seed", 0)))
+                return _envelope("pnt_resilience", "MODELED", _to_dict(v),
+                                 source=f"{name}.assess_scenario (Dev2 engine, scenario={scenario})",
+                                 attribution=SENSING_ATTRIBUTION,
+                                 extra={"lambda_gate": "deny-by-default"})
+            if callable(detect) and PntObservables is not None and any(
+                    k in kw for k in ("power_advantage_db", "sqm_early_minus_late",
+                                      "clock_bias_leap_m", "pr_residuals_m")):
+                import numpy as _np  # heavy import isolated to the engine path
+                n_sv = int(kw.get("n_sv", 8))
+                resid = kw.get("pr_residuals_m")
+                if resid is None:
+                    resid = _np.zeros(n_sv)
+                else:
+                    resid = _np.asarray([float(x) for x in str(resid).split(",")], dtype=float)
+                obs = PntObservables(
+                    pr_residuals_m=resid, n_sv=n_sv,
+                    power_advantage_db=float(kw.get("power_advantage_db", 0.0)),
+                    sqm_early_minus_late=float(kw.get("sqm_early_minus_late", 0.0)),
+                    carrier_phase_aligned=str(kw.get("carrier_phase_aligned", "")).lower()
+                    in ("1", "true", "yes"),
+                    clock_bias_leap_m=float(kw.get("clock_bias_leap_m", 0.0)),
+                    clock_drift_implied_m=float(kw.get("clock_drift_implied_m", 0.0)),
+                )
+                v = detect(obs)
+                return _envelope("pnt_resilience", "MODELED", _to_dict(v),
+                                 source=f"{name}.detect (Dev2 engine)",
+                                 attribution=SENSING_ATTRIBUTION,
+                                 extra={"lambda_gate": "deny-by-default"})
+            # No specific inputs: run the clean 'NOMINAL' baseline scenario honestly.
+            if callable(assess) and "clean" in lib:
+                v = assess(lib["clean"])
+                return _envelope("pnt_resilience", "MODELED", _to_dict(v),
+                                 source=f"{name}.assess_scenario (Dev2 engine, scenario=clean baseline)",
+                                 attribution=SENSING_ATTRIBUTION,
+                                 extra={"lambda_gate": "deny-by-default"})
+        except Exception:
+            pass  # fall through to clean-room stdlib fusion
+    # Honest fallback: a transparent multi-layer monitor fusion (MODELED, deny-by-default).
+    # raim_consistency_m: pseudorange residual consistency (m); larger = more suspect.
+    # agc_db: automatic-gain-control level vs nominal (dB drop); larger drop = suspect.
+    # sqm_ratio: signal-quality-monitor early-late metric; deviation from 1 = suspect.
+    raim = float(kw.get("raim_consistency_m", 0.0))
+    agc = float(kw.get("agc_db", 0.0))
+    sqm = float(kw.get("sqm_ratio", 1.0))
+    raim_thr = float(kw.get("raim_threshold_m", 30.0))
+    agc_thr = float(kw.get("agc_threshold_db", 6.0))
+    sqm_dev_thr = float(kw.get("sqm_dev_threshold", 0.15))
+    flags = {
+        "raim_flag": raim > raim_thr,
+        "agc_flag": agc > agc_thr,
+        "sqm_flag": abs(sqm - 1.0) > sqm_dev_thr,
+    }
+    n_flags = sum(1 for v in flags.values() if v)
+    # Deny-by-default fusion: any single layer raises SUSPECT; >=2 raises SPOOF_LIKELY.
+    if n_flags >= 2:
+        verdict = "SPOOF_LIKELY"
+    elif n_flags == 1:
+        verdict = "SUSPECT"
+    else:
+        verdict = "NOMINAL"
+    res = {
+        "verdict": verdict,
+        "n_layers_flagged": n_flags,
+        "layers": flags,
+        "inputs": {"raim_consistency_m": raim, "agc_db": agc, "sqm_ratio": sqm},
+        "thresholds": {"raim_threshold_m": raim_thr, "agc_threshold_db": agc_thr,
+                       "sqm_dev_threshold": sqm_dev_thr},
+        "fusion": ("multi-layer deny-by-default: >=2 layers -> SPOOF_LIKELY, "
+                   "1 layer -> SUSPECT, 0 -> NOMINAL"),
+    }
+    note = ("Computed by the unified layer's clean-room monitor fusion because the Dev2 "
+            "'pnt_resilience' engine is not wired yet. MODELED, deny-by-default; the "
+            "verdict is advisory (Λ=Conjecture 1), never 'proven trust'."
+            if mod is None else
+            "Dev2 engine present but exposed no compatible entry; used clean-room fallback.")
+    return _envelope("pnt_resilience", "MODELED", res,
+                     source="fundamental_limits clean-room spoof-fusion fallback",
+                     attribution=SENSING_ATTRIBUTION,
+                     extra={"lambda_gate": "deny-by-default", "fallback_note": note})
+
+
+def _certify_nav_coasting(**kw) -> dict:
+    mod, name = _try_import("nav_coasting")
+    if mod is not None:
+        for entry in ("certify", "coast", "figure_of_merit", "fom", "coasting_fom"):
+            fn = getattr(mod, entry, None)
+            if callable(fn):
+                try:
+                    clean = {k: v for k, v in kw.items() if not str(k).startswith("_")}
+                    res = fn(**clean) if clean else fn()
+                    return _envelope("nav_coasting", "MODELED", _to_dict(res),
+                                     source=f"{name}.{entry} (Dev3 engine)",
+                                     attribution=SENSING_ATTRIBUTION)
+                except Exception:
+                    continue
+    # Honest fallback: position-error growth during GPS-denied coasting, classical vs
+    # quantum. Random-walk-dominated INS error from accel noise ASD n_a:
+    #   position error sigma_x(t) ≈ n_a * t^(3/2) / sqrt(3)  (double-integration of a
+    #   white-acceleration-noise random walk; standard INS coasting scaling).
+    # We compare a classical MEMS/navigation-grade IMU ASD vs a quantum CAI ASD.
+    t = float(kw.get("coast_time_s", 60.0))
+    n_classical = float(kw.get("classical_asd_m_s2_per_sqrt_hz", 1e-3))  # nav-grade-ish
+    # quantum ASD: take from a default CAI derivation unless caller provides it.
+    if "quantum_asd_m_s2_per_sqrt_hz" in kw:
+        n_quantum = float(kw["quantum_asd_m_s2_per_sqrt_hz"])
+    else:
+        cai = _cai_sensor_limit(780e-9, 0.1, 1e6, 0.5, 0.5)
+        n_quantum = cai["accel_asd_m_s2_per_sqrt_hz"]
+
+    def pos_err(n_a: float) -> float:
+        return n_a * (t ** 1.5) / math.sqrt(3.0)
+
+    err_c = pos_err(n_classical)
+    err_q = pos_err(n_quantum)
+    improvement = (err_c / err_q) if err_q > 0 else float("inf")
+    res = {
+        "coast_time_s": t,
+        "classical": {
+            "accel_asd_m_s2_per_sqrt_hz": n_classical,
+            "position_error_m": err_c,
+        },
+        "quantum": {
+            "accel_asd_m_s2_per_sqrt_hz": n_quantum,
+            "position_error_m": err_q,
+        },
+        "quantum_over_classical_improvement_factor": improvement,
+        "model": ("GPS-denied coasting position-error growth from white-acceleration-noise "
+                  "random walk: sigma_x(t) ~= n_a * t^1.5 / sqrt(3). MODELED scaling."),
+    }
+    note = ("Computed by the unified layer's clean-room coasting model because the Dev3 "
+            "'nav_coasting' engine is not wired yet. MODELED scaling, not a fabricated "
+            "number." if mod is None else
+            "Dev3 engine present but exposed no compatible entry; used clean-room fallback.")
+    return _envelope("nav_coasting", "MODELED", res,
+                     source="fundamental_limits clean-room coasting fallback",
+                     attribution=SENSING_ATTRIBUTION, extra={"fallback_note": note})
+
+
+# --------------------------------------------------------------------------- #
+# THE single unified entry point                                              #
+# --------------------------------------------------------------------------- #
+_DISPATCH = {
+    "compute_bounds": _certify_compute_bounds,
+    "quantum_sensor": _certify_quantum_sensor,
+    "pnt_resilience": _certify_pnt_resilience,
+    "nav_coasting": _certify_nav_coasting,
+}
+
+
+def certify(kind: str, **kwargs) -> dict:
+    """Unified certify entry covering both pillars.
+
+    kind ∈ {compute_bounds, quantum_sensor, pnt_resilience, nav_coasting}.
+
+    Wraps the relevant sibling engine when present; otherwise returns an honest,
+    clearly-labelled clean-room MODELED result (sensing pillar) or a MODULE_NOT_WIRED
+    placeholder (compute pillar, which has no safe local stand-in here). NEVER fabricates
+    a number and NEVER emits a false green. Every result carries the doctrine, the
+    Λ-advisory note, and the honest-inverse-of-free-energy invariant.
+    """
+    fn = _DISPATCH.get(kind)
+    if fn is None:
+        return {
+            "kind": kind,
+            "status": "UNKNOWN_KIND",
+            "label": "NOT_MODELED",
+            "error": f"unknown kind '{kind}'. Valid: {list(KINDS)}",
+            "doctrine": DOCTRINE,
+            "lambda_note": LAMBDA_NOTE,
+            "honest_inverse_of_free_energy": HONEST_INVERSE_OF_FREE_ENERGY,
+            "labels": LABELS,
+        }
+    return fn(**kwargs)
+
+
+__all__ = [
+    "certify", "status", "KINDS", "DOCTRINE", "LAMBDA_NOTE",
+    "HONEST_INVERSE_OF_FREE_ENERGY", "LABELS", "SENSING_ATTRIBUTION",
+]
+
+
+if __name__ == "__main__":
+    import json
+    print("SZL UNIFIED FUNDAMENTAL-LIMITS LIBRARY — status\n" + "=" * 60)
+    print(json.dumps(status(), indent=2, default=str)[:2000])
+    print("\n--- certify(quantum_sensor) ---")
+    print(json.dumps(certify("quantum_sensor"), indent=2, default=str)[:1500])
+    print("\n--- certify(nav_coasting) ---")
+    print(json.dumps(certify("nav_coasting"), indent=2, default=str)[:1200])

nav_coasting.py

@@ -0,0 +1,696 @@
+# SPDX-License-Identifier: Apache-2.0
+# © 2026 SZL Holdings · Doctrine v11 LOCKED · Λ = Conjecture 1 (advisory, NOT proven trust)
+# Sign-off: Stephen P. Lutar Jr. <stephenlutar2@gmail.com>
+"""nav_coasting — SZL-NATIVE GPS-DENIED NAVIGATION COASTING / HOLDOVER model,
+governed and tied to the SZL agentic-PINN + deny-by-default Λ-gate.
+
+THE LANE (Dev 3 of 4): the honest "how long can a quantum-equipped system coast
+when GPS is denied" number. When GNSS is denied, position is dead-reckoned from
+inertial sensors and time is held over from the local clock. Both error sources
+GROW with time; the figure-of-merit is the TIME-TO-EXCEED a position/timing
+accuracy threshold. The whole point of a quantum (cold-atom interferometer)
+accelerometer is that its noise PSD is LOWER, so coasting error grows slower and
+the time-to-exceed is LONGER. This module computes that delta honestly.
+
+CLEAN-ROOM: the METHOD & PHYSICS are re-derived from the open literature and from
+the published METHOD of AshfordeOU/kshana (Apache-2.0, DOI 10.5281/zenodo.20528627,
+GNSS/INS fusion + clock holdover). NO kshana Rust is copied — see ATTRIBUTION.
+
+WHAT IS MODELED (honest, Doctrine v11):
+  * 1-DOF (single straight axis) strapdown dead-reckoning error growth. 1-DOF is
+    a deliberate, declared simplification: it captures the dominant accelerometer
+    noise → velocity → position double-integration and the clock holdover terms,
+    which is exactly what sets the coasting horizon to first order.
+  * Position error variance from (i) velocity-random-walk (VRW), (ii) acceleration
+    random walk / white-accel PSD (the q_va that Dev1's quantum sensor model
+    produces), and (iii) a deterministic accelerometer bias term (∝ t²).
+  * Clock TIMING holdover from initial phase/frequency offset + frequency drift +
+    Allan stochastic terms (white-FM and random-walk-FM), expressed in metres via
+    the speed of light so position and timing live on one budget.
+
+WHAT IS NOT MODELED (declared, never faked):
+  * 3-axis / full strapdown INS (attitude/tilt → gyro-bias t^3 coupling, Schuler
+    84-min loop, Coriolis, gravity-deflection) — marked NOT MODELED. The t^3 gyro
+    term is the dominant long-coast term in the real 3-D system; ignoring it makes
+    our 1-DOF horizon an OPTIMISTIC (upper-ish) bound, and we say so on the receipt.
+  * No Kalman/UKF fusion update is run here (kshana's 17-state tightly-coupled UKF
+    is NOT MODELED); we model the OPEN-LOOP coasting growth, which is the relevant
+    quantity once aiding (GNSS) is denied.
+
+GOVERNANCE: the coasting estimate is produced under a DENY-BY-DEFAULT Λ-gate that
+mirrors agentic_pinn.py / innovations/lambda_gate.py. The estimate is ACCEPTED
+only when the numerical integration passes a residual/convergence self-check
+against the closed-form variance growth. Each run emits an UNSIGNED, signer-ready
+receipt (STRUCTURAL-ONLY: content-addressed inputs hash, no cryptographic sig).
+
+Pure numpy → sovereign, own-metal, auditable.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import math
+import time
+from dataclasses import asdict, dataclass, field
+from typing import Any, Optional
+
+import numpy as np
+
+# --------------------------------------------------------------------------- #
+# Constants                                                                    #
+# --------------------------------------------------------------------------- #
+C_LIGHT = 299792458.0       # speed of light, m/s (SI exact) — couples timing<->range
+G0 = 9.80665                # standard gravity, m/s^2 (for bias expressed in 'g')
+
+METHOD = ("szl_nav_coasting (1-DOF GNSS/INS open-loop dead-reckoning error growth + "
+          "clock holdover; time-to-exceed FoM for CLASSICAL vs QUANTUM sensor "
+          "coefficients; governed under a deny-by-default Lambda-gate with a "
+          "residual-checked integration and a per-run STRUCTURAL-ONLY receipt)")
+
+# Method/physics attribution ONLY — clean-room. No kshana Rust copied or consulted
+# beyond its PUBLIC method/equation surface (its docs/README/CLAIMS labels).
+ATTRIBUTION = {
+    "ins_error_growth_method": (
+        "Strapdown inertial error propagation re-derived clean-room from standard "
+        "public references: Woodman, O.J., 'An introduction to inertial navigation', "
+        "Univ. Cambridge Tech. Report UCAM-CL-TR-696 (2007) — accelerometer bias gives "
+        "position error s(t)=b*t^2/2, double-integrated white accel noise gives a "
+        "position random walk; Groves, P.D., 'Principles of GNSS, Inertial, and "
+        "Multisensor Integrated Navigation Systems', 2nd ed., Artech House (2013) — "
+        "VRW/ARW PSD bookkeeping. METHOD/MATHEMATICS attribution only."
+    ),
+    "clock_holdover_method": (
+        "Clock time-error / holdover model x(t)=x0+y0*t+0.5*D*t^2 plus Allan stochastic "
+        "terms re-derived clean-room from: Allan, D.W. (1966) Proc. IEEE 54(2):221 "
+        "(Allan variance); IEEE Std 1139-2008 (frequency-stability definitions); "
+        "ITU-T/ETSI TIE & MTIE holdover definitions (ETSI EN 300 462). White-FM noise "
+        "(sigma_y(tau)=h0/sqrt(tau)) integrates to a TIE random walk (var ∝ t); "
+        "random-walk-FM integrates to var ∝ t^3. METHOD/MATHEMATICS attribution only."
+    ),
+    "quantum_sensor_coupling": (
+        "Consumes the accelerometer noise PSD q_va (units (m/s^2)^2/Hz, equivalently "
+        "ASD^2) produced by the SZL cold-atom-interferometer sensor model (Dev1), "
+        "itself a clean-room re-derivation of the kshana inertial/quantum_imu method "
+        "(Kasevich & Chu 1991; Peters et al. 2001; Freier et al. 2016; Cheinet et al. "
+        "2008). This module is agnostic to how q_va was produced; it only needs the PSD."
+    ),
+    "kshana_method_source": (
+        "AshfordeOU/kshana — open PNT-resilience simulator (Apache-2.0, DOI "
+        "10.5281/zenodo.20528627): GNSS/INS fusion (fusion/ukf.rs, tightly_coupled17.rs), "
+        "clock holdover (allan.rs, timetransfer*.rs), and the 'how long can a "
+        "quantum-equipped system coast when GPS is denied' question. METHOD source only; "
+        "NO Rust copied. Cited under its Apache-2.0 licence, clean-room re-derivation."
+    ),
+    "governance": (
+        "Deny-by-default Λ-gate posture mirrored from the SZL agentic_pinn.py and "
+        "innovations/lambda_gate.py (clean-room, SZL-native). Λ = Conjecture 1 — "
+        "advisory governance, not proven trust."
+    ),
+}
+
+DOCTRINE = (
+    "v11 LOCKED: Λ=Conjecture 1 (ADVISORY gate, NOT proven trust); NO free-energy/"
+    "over-unity (sensor noise floors are DERIVED from physics PSDs, never invented); "
+    "the coasting horizon is MODELED, not MEASURED, unless a real q_va/clock spec is "
+    "supplied and labelled MEASURED; 1-DOF is a DECLARED simplification and 3-axis/"
+    "full-INS (gyro t^3, Schuler, Coriolis) is NOT MODELED; no fabricated coasting "
+    "number — the integration really runs and is residual-checked; cite-never-plagiarize."
+)
+
+# Verdict vocabulary (mirrors innovations/lambda_gate.py exactly).
+VERDICT_ALLOW = "ALLOW"
+VERDICT_ADVISORY = "ADVISORY"
+VERDICT_DENY = "DENY"
+
+
+def _hash_inputs(obj: dict) -> str:
+    canon = json.dumps(obj, sort_keys=True, separators=(",", ":"), default=str)
+    return "sha256:" + hashlib.sha256(canon.encode()).hexdigest()
+
+
+# --------------------------------------------------------------------------- #
+# Sensor / clock coefficient bundle (CLASSICAL vs QUANTUM)                     #
+# --------------------------------------------------------------------------- #
+@dataclass
+class SensorCoeffs:
+    """The error-growth coefficients for one sensor+clock configuration.
+
+    All fields are INPUTS (MEASURED from a datasheet/lab, or honest SAMPLE/MODELED).
+    The accelerometer white-noise term `q_va` is the PSD that Dev1's quantum sensor
+    model emits; everything else is the surrounding INS/clock budget.
+
+    Units:
+      q_va        : accelerometer white-noise PSD, (m/s^2)^2 / Hz  (== ASD^2).
+                    This is the single field Dev1 feeds us. ASD n_a = sqrt(q_va).
+      accel_bias  : residual deterministic accelerometer bias, m/s^2 (after calib).
+      vrw_psd     : velocity-random-walk PSD added directly to the velocity state,
+                    (m/s)^2 / s  (m^2/s^3). Captures integrated-rate / quantisation
+                    that is not already inside q_va. Default 0 (folded into q_va).
+      clock_h0    : white-FM coefficient; sigma_y(tau) = sqrt(h0 / (2*tau)) form,
+                    here we use the convenient sigma_y(tau)=clock_adev1s/sqrt(tau)
+                    parameterisation via `clock_adev_1s` below instead, and keep h0
+                    available for advanced callers (dimensionless^2 * s).
+      clock_adev_1s : Allan deviation at tau=1 s (dimensionless, df/f). White-FM.
+      clock_rwfm  : random-walk-FM rate (dimensionless / sqrt(s)) — long-term clock
+                    wander. Drives a TIE variance ∝ t^3 term.
+      clock_drift : deterministic fractional frequency drift D (1/s), aging.
+      clock_y0    : initial fractional frequency offset y0 (dimensionless) at the
+                    moment GNSS is denied (post-sync residual).
+      label       : "MEASURED" | "MODELED" | "SAMPLE" (honest provenance).
+      name        : human label, e.g. "classical-MEMS" / "quantum-CAI".
+    """
+    q_va: float                      # (m/s^2)^2 / Hz  — from Dev1 quantum sensor model
+    accel_bias: float = 0.0          # m/s^2
+    vrw_psd: float = 0.0             # (m/s)^2 / s
+    clock_adev_1s: float = 0.0       # Allan deviation at 1 s (white-FM), df/f
+    clock_rwfm: float = 0.0          # random-walk-FM rate, 1/sqrt(s)
+    clock_drift: float = 0.0         # fractional frequency drift D, 1/s
+    clock_y0: float = 0.0            # initial fractional frequency offset
+    clock_h0: float = 0.0            # optional white-FM PSD coefficient (advanced)
+    label: str = "MODELED"
+    name: str = "unnamed"
+    source: str = "honest-sample"
+
+    @property
+    def accel_asd(self) -> float:
+        """Accelerometer amplitude spectral density, (m/s^2)/sqrt(Hz) = sqrt(q_va)."""
+        return math.sqrt(max(self.q_va, 0.0))
+
+
+# --------------------------------------------------------------------------- #
+# Closed-form 1-DOF error-growth variances (the derived physics)              #
+# --------------------------------------------------------------------------- #
+def position_error_sigma(c: SensorCoeffs, t: np.ndarray | float) -> np.ndarray:
+    """1-DOF horizontal POSITION error std-dev (m) after coasting time t (s).
+
+    Re-derived clean-room. Three contributions, added in QUADRATURE for the
+    stochastic parts and arithmetically for the deterministic bias term:
+
+      (A) White accelerometer noise PSD q_va, double-integrated:
+          Var_x(t) = q_va * t^3 / 3.   (random-walk-of-velocity -> position)
+          [matches the kshana vibration phase variance shape sigma^2 ∝ S_a*T^3/3
+           re-expressed in metres; Woodman 2007 random-walk result.]
+      (B) Velocity-random-walk PSD vrw_psd, single state on velocity then integrated:
+          Var_x(t) = vrw_psd * t^3 / 3 as well for a white velocity-rate; we keep it
+          separate so a caller can split quantisation noise from sensor white noise.
+      (C) Deterministic residual accel bias b, double-integrated (NOT a variance —
+          a systematic offset): x_bias(t) = 0.5 * b * t^2.
+
+    sigma_pos(t) = sqrt(Var_x_stoch(t)) + |x_bias(t)|   (conservative sum: random
+    1-sigma plus the systematic offset, an honest upper-ish envelope).
+    """
+    t = np.asarray(t, dtype=float)
+    var_stoch = (c.q_va + c.vrw_psd) * np.power(t, 3) / 3.0
+    sigma_stoch = np.sqrt(np.maximum(var_stoch, 0.0))
+    x_bias = 0.5 * abs(c.accel_bias) * np.power(t, 2)
+    return sigma_stoch + x_bias
+
+
+def timing_error_seconds(c: SensorCoeffs, t: np.ndarray | float) -> np.ndarray:
+    """1-DOF clock TIMING (time-interval) error std-dev-equivalent (s) at coast t.
+
+    x(t) = x0 + y0*t + 0.5*D*t^2 (deterministic)  +  Allan stochastic terms.
+    Re-derived clean-room from the time-error/holdover definition and Allan-noise
+    integration (ETSI EN 300 462; IEEE Std 1139; Allan 1966):
+      * deterministic frequency offset:  |y0| * t           (linear TIE)
+      * deterministic frequency drift D:  0.5 * |D| * t^2   (parabolic TIE)
+      * white-FM (ADEV = adev_1s / sqrt(tau)) integrates to a TIE RANDOM WALK whose
+        std grows ~ adev_1s * t / sqrt(t) * sqrt(t) ... we use the standard holdover
+        result sigma_TIE_whiteFM(t) = adev_1s * t / sqrt(... )  -> we adopt the
+        widely-used engineering holdover approximation: TIE_whiteFM(t) ≈ adev_1s *
+        sqrt(t) * t_ref with t_ref=1s normalisation, i.e. sigma ∝ t for the
+        accumulated phase; to stay strictly honest and simple we use the conservative
+        sigma_whiteFM(t) = adev_1s * t (frequency offset held for the whole interval),
+        which is the standard worst-case holdover envelope for white-FM.
+      * random-walk-FM: sigma_rwfm(t) = clock_rwfm * t^1.5 / sqrt(3) (var ∝ t^3).
+    All combined as a deterministic-plus-stochastic envelope (sum), honestly
+    conservative. Returned in SECONDS.
+    """
+    t = np.asarray(t, dtype=float)
+    det = abs(c.clock_y0) * t + 0.5 * abs(c.clock_drift) * np.power(t, 2)
+    whitefm = c.clock_adev_1s * t                      # holdover envelope (s), ∝ t
+    rwfm = c.clock_rwfm * np.power(t, 1.5) / math.sqrt(3.0)
+    sigma_stoch = np.sqrt(whitefm ** 2 + rwfm ** 2)
+    return det + sigma_stoch
+
+
+def timing_error_meters(c: SensorCoeffs, t: np.ndarray | float) -> np.ndarray:
+    """Clock timing error expressed as an equivalent RANGE error (m) = c * dt.
+
+    A timing holdover error dt seconds maps to a pseudorange/position error of
+    c*dt metres (the clock bias enters the navigation solution as a common-mode
+    range error). This lets position and timing share ONE accuracy budget.
+    """
+    return C_LIGHT * timing_error_seconds(c, t)
+
+
+def combined_error_meters(c: SensorCoeffs, t: np.ndarray | float) -> np.ndarray:
+    """Total coasting error envelope (m): INS position error + clock range error,
+    combined in quadrature (independent error sources)."""
+    p = position_error_sigma(c, t)
+    k = timing_error_meters(c, t)
+    return np.sqrt(p ** 2 + k ** 2)
+
+
+# --------------------------------------------------------------------------- #
+# Time-to-exceed figure-of-merit                                              #
+# --------------------------------------------------------------------------- #
+@dataclass
+class TimeToExceed:
+    """The coasting figure-of-merit for one configuration."""
+    threshold_m: float
+    t_exceed_s: float                 # first time the combined error >= threshold
+    error_channel: str                # "position" | "timing" | "combined"
+    config_name: str
+    config_label: str                 # MEASURED | MODELED | SAMPLE
+    found: bool                       # True if threshold crossed within the horizon
+    horizon_s: float                  # search horizon used
+
+    def to_dict(self) -> dict:
+        return asdict(self)
+
+
+def time_to_exceed(c: SensorCoeffs, threshold_m: float, *,
+                   channel: str = "combined", horizon_s: float = 7200.0,
+                   n_grid: int = 200001) -> TimeToExceed:
+    """First coasting time t at which the chosen error channel reaches threshold_m.
+
+    Monotone-increasing error -> we locate the crossing by a dense grid scan then
+    refine with a bisection on the (monotone) error function. Honest: if the
+    threshold is not crossed inside `horizon_s`, found=False and t_exceed_s=horizon_s.
+    """
+    if channel == "position":
+        f = position_error_sigma
+    elif channel == "timing":
+        f = timing_error_meters
+    else:
+        channel = "combined"
+        f = combined_error_meters
+
+    ts = np.linspace(0.0, horizon_s, n_grid)
+    errs = f(c, ts)
+    over = np.where(errs >= threshold_m)[0]
+    if over.size == 0:
+        return TimeToExceed(threshold_m=threshold_m, t_exceed_s=horizon_s,
+                            error_channel=channel, config_name=c.name,
+                            config_label=c.label, found=False, horizon_s=horizon_s)
+    # bisection refine between the last point below and the first at/above
+    i = int(over[0])
+    lo = ts[i - 1] if i > 0 else 0.0
+    hi = ts[i]
+    for _ in range(60):
+        mid = 0.5 * (lo + hi)
+        if float(f(c, mid)) >= threshold_m:
+            hi = mid
+        else:
+            lo = mid
+    return TimeToExceed(threshold_m=threshold_m, t_exceed_s=0.5 * (lo + hi),
+                        error_channel=channel, config_name=c.name,
+                        config_label=c.label, found=True, horizon_s=horizon_s)
+
+
+def quantum_advantage(classical: SensorCoeffs, quantum: SensorCoeffs,
+                      threshold_m: float, *, channel: str = "combined",
+                      horizon_s: float = 7200.0) -> dict:
+    """The honest 'how much longer does quantum buy you' number.
+
+    Returns both time-to-exceed values and their delta/ratio. If either config does
+    not cross the threshold inside the horizon, the corresponding `found` flag is
+    False and the ratio is reported as a LOWER BOUND (labelled).
+    """
+    tc = time_to_exceed(classical, threshold_m, channel=channel, horizon_s=horizon_s)
+    tq = time_to_exceed(quantum, threshold_m, channel=channel, horizon_s=horizon_s)
+    extra = tq.t_exceed_s - tc.t_exceed_s
+    ratio = (tq.t_exceed_s / tc.t_exceed_s) if tc.t_exceed_s > 0 else float("inf")
+    return {
+        "threshold_m": threshold_m,
+        "channel": channel,
+        "horizon_s": horizon_s,
+        "classical": tc.to_dict(),
+        "quantum": tq.to_dict(),
+        "extra_coasting_seconds": extra,
+        "coasting_ratio": ratio,
+        "ratio_is_lower_bound": (not tc.found) or (not tq.found),
+        "label": (
+            f"{classical.label}/{quantum.label}: quantum buys "
+            f"{extra:.1f} s extra coast ({ratio:.2f}x) before exceeding "
+            f"{threshold_m:g} m on the {channel} channel"
+        ),
+    }
+
+
+# --------------------------------------------------------------------------- #
+# Numerical integrator (so we have something to RESIDUAL-CHECK against)        #
+# --------------------------------------------------------------------------- #
+def integrate_position_variance(c: SensorCoeffs, horizon_s: float,
+                                 dt: float) -> tuple[float, float]:
+    """Forward-Euler accumulate the position-error VARIANCE from the white PSD,
+    so the governed solve has a NUMERICAL estimate to check against the closed form.
+
+    dVar_v/dt = (q_va + vrw_psd)         (velocity-variance grows at the PSD rate)
+    dVar_x/dt = 2 * Cov_xv               (exact for the integrated random walk)
+    dCov_xv/dt = Var_v
+    Returns (sigma_x_numeric_at_horizon, sigma_x_closedform_at_horizon)  [metres,
+    stochastic part only — the bias term is deterministic and added separately].
+    """
+    n = max(int(round(horizon_s / dt)), 1)
+    q = c.q_va + c.vrw_psd
+    var_x = 0.0
+    cov_xv = 0.0
+    var_v = 0.0
+    for _ in range(n):
+        d_var_x = 2.0 * cov_xv
+        d_cov = var_v
+        d_var_v = q
+        var_x += d_var_x * dt
+        cov_xv += d_cov * dt
+        var_v += d_var_v * dt
+    sigma_num = math.sqrt(max(var_x, 0.0))
+    sigma_cf = math.sqrt(max(q * horizon_s ** 3 / 3.0, 0.0))
+    return sigma_num, sigma_cf
+
+
+# --------------------------------------------------------------------------- #
+# Governed solve receipt (STRUCTURAL-ONLY, unsigned)                          #
+# --------------------------------------------------------------------------- #
+@dataclass
+class CoastingReceipt:
+    """Signer-ready (UNSIGNED, STRUCTURAL-ONLY) provenance for one governed run."""
+    receipt_type: str
+    # inputs (echoed, labelled)
+    config_name: str
+    config_label: str                 # MEASURED | MODELED | SAMPLE
+    q_va_psd: float                   # the Dev1-supplied accelerometer PSD
+    threshold_m: float
+    channel: str
+    horizon_s: float
+    # the figure-of-merit
+    time_to_exceed_s: float
+    threshold_found_in_horizon: bool
+    # integration self-check (the residual gate)
+    sigma_numeric_m: float
+    sigma_closedform_m: float
+    integration_rel_residual: float   # |num - closed| / closed
+    residual_tol: float
+    converged: bool                   # integration residual within tol
+    monotonic_check: bool             # error is monotone non-decreasing on the grid
+    # Λ verdict
+    lambda_verdict: str               # ALLOW | ADVISORY | DENY
+    lambda_advisory: bool
+    lambda_reason: str
+    accepted: bool                    # estimate admitted (ALLOW)
+    # honesty
+    modeled_not_measured: bool
+    one_dof_only: bool
+    three_axis_full_ins: str          # always "NOT MODELED"
+    schuler_coriolis_gyro_t3: str     # always "NOT MODELED"
+    inputs_hash: str
+    timestamp_utc: float
+    method: str = METHOD
+    attribution: dict = field(default_factory=lambda: ATTRIBUTION)
+    doctrine: str = DOCTRINE
+    lambda_label: str = ("Λ = Conjecture 1 — advisory governance, NOT 'proven trust'; "
+                         "ALLOW means passed SZL admission policy (integration converged "
+                         "+ monotone), not a guaranteed real-world coasting time.")
+    signature: None = None            # UNSIGNED — STRUCTURAL-ONLY content addressing
+
+    def to_dict(self) -> dict:
+        return asdict(self)
+
+    def to_json(self, indent: int = 2) -> str:
+        return json.dumps(self.to_dict(), indent=indent, default=str)
+
+
+# --------------------------------------------------------------------------- #
+# The deny-by-default Λ-gate (mirrors innovations/lambda_gate.gate_solve)      #
+# --------------------------------------------------------------------------- #
+@dataclass
+class GateVerdict:
+    verdict: str
+    advisory: bool
+    reason: str
+    rel_residual: Optional[float]
+    tol: Optional[float]
+    converged: Optional[bool]
+    monotonic: Optional[bool]
+    modeled_not_measured: Optional[bool]
+    lambda_label: str = ("Λ = Conjecture 1 — advisory governance, NOT 'proven trust'; "
+                         "ALLOW means passed SZL admission policy, not proven correct.")
+    deny_by_default: bool = True
+
+    def to_dict(self) -> dict:
+        return asdict(self)
+
+
+def gate_coasting(receipt: dict, *, tol: float = 1e-3,
+                  near_tol_frac: float = 0.85) -> GateVerdict:
+    """Deny-by-default Λ gate over a coasting-run receipt dict. Same posture as the
+    PINN gate: absence/weakness of evidence => DENY.
+
+      DENY    : missing/invalid receipt; integration not converged (residual > tol or
+                NaN); error not monotone; or a receipt that claims MEASURED energy/time
+                it did not honestly source (free-energy / fabrication guard).
+      ADVISORY: converged but the integration residual sits near the tolerance ceiling.
+      ALLOW   : integration converged within tol AND error monotone AND honestly
+                declared modeled_not_measured.
+    """
+    try:
+        rel = float(receipt["integration_rel_residual"])
+        converged = bool(receipt["converged"])
+        monotone = bool(receipt["monotonic_check"])
+        modeled = bool(receipt.get("modeled_not_measured", True))
+    except (KeyError, TypeError, ValueError) as e:
+        return GateVerdict(VERDICT_DENY, True,
+                           f"deny-by-default: missing/invalid receipt ({e})",
+                           None, tol, None, None, None)
+
+    # Free-energy / fabrication guard: a run that claims to be MEASURED but supplies
+    # no computed residual evidence is denied. We require an honest modeled flag OR a
+    # real residual; here modeled must be declared True for the in-sandbox sample.
+    if not modeled:
+        return GateVerdict(VERDICT_DENY, True,
+                           ("free-energy/fabrication guard: receipt does not declare "
+                            "modeled_not_measured — the coasting horizon is MODELED, "
+                            "not a measured field, unless a labelled MEASURED spec is "
+                            "supplied with evidence"),
+                           rel, tol, converged, monotone, modeled)
+
+    if (not converged) or (rel != rel) or (rel > tol) or (not monotone):
+        return GateVerdict(VERDICT_DENY, True,
+                           (f"integration rel-residual {rel:.3e} > tol {tol:.3e}, not "
+                            f"converged, or non-monotone error — coasting estimate not "
+                            f"admissible"),
+                           rel, tol, converged, monotone, modeled)
+
+    if rel >= near_tol_frac * tol:
+        return GateVerdict(VERDICT_ADVISORY, True,
+                           (f"converged but rel-residual {rel:.3e} near tol {tol:.3e} — "
+                            f"tighten dt before relying on the number"),
+                           rel, tol, converged, monotone, modeled)
+
+    return GateVerdict(VERDICT_ALLOW, False,
+                       "integration converged within tol; error monotone; passed SZL "
+                       "admission policy",
+                       rel, tol, converged, monotone, modeled)
+
+
+# --------------------------------------------------------------------------- #
+# Governed solve wrapper                                                       #
+# --------------------------------------------------------------------------- #
+def governed_coasting_solve(c: SensorCoeffs, threshold_m: float, *,
+                            channel: str = "combined", horizon_s: float = 7200.0,
+                            integ_dt: float = 0.05,
+                            residual_tol: float = 1e-3) -> CoastingReceipt:
+    """Run the coasting figure-of-merit UNDER the deny-by-default Λ-gate.
+
+    Steps (mirroring the agentic-PINN solve/measure/gate pattern):
+      1. SOLVE: compute time-to-exceed from the closed-form monotone error.
+      2. MEASURE: numerically integrate the position variance and compare to the
+         closed form (the residual / convergence self-check).
+      3. CHECK: confirm the error channel is monotone non-decreasing on the grid.
+      4. Λ-GATE: accept the estimate only if (2) converged within tol and (3) holds.
+      5. EMIT: an UNSIGNED, STRUCTURAL-ONLY receipt with the full decision trail.
+
+    The time-to-exceed number is ALWAYS computed from a real run; it is only marked
+    `accepted` when the gate returns ALLOW. No fabricated number is ever emitted.
+    """
+    tte = time_to_exceed(c, threshold_m, channel=channel, horizon_s=horizon_s)
+
+    # integration self-check on the stochastic position variance
+    sigma_num, sigma_cf = integrate_position_variance(c, horizon_s, integ_dt)
+    if sigma_cf > 0:
+        rel_resid = abs(sigma_num - sigma_cf) / sigma_cf
+    else:
+        # degenerate config (no white noise): both should be ~0; residual is 0 if so,
+        # else flag large so the gate denies.
+        rel_resid = 0.0 if abs(sigma_num) < 1e-12 else float("inf")
+
+    # monotonicity check on the actual error channel
+    ts = np.linspace(0.0, horizon_s, 4000)
+    if channel == "position":
+        errs = position_error_sigma(c, ts)
+    elif channel == "timing":
+        errs = timing_error_meters(c, ts)
+    else:
+        errs = combined_error_meters(c, ts)
+    monotone = bool(np.all(np.diff(errs) >= -1e-9))
+
+    converged = bool(np.isfinite(rel_resid) and rel_resid <= residual_tol)
+
+    inputs = {
+        "name": c.name, "label": c.label, "source": c.source,
+        "q_va": c.q_va, "accel_bias": c.accel_bias, "vrw_psd": c.vrw_psd,
+        "clock_adev_1s": c.clock_adev_1s, "clock_rwfm": c.clock_rwfm,
+        "clock_drift": c.clock_drift, "clock_y0": c.clock_y0,
+        "threshold_m": threshold_m, "channel": channel, "horizon_s": horizon_s,
+        "integ_dt": integ_dt, "residual_tol": residual_tol,
+    }
+
+    gate_input = {
+        "integration_rel_residual": rel_resid,
+        "converged": converged,
+        "monotonic_check": monotone,
+        "modeled_not_measured": (c.label != "MEASURED"),
+    }
+    verdict = gate_coasting(gate_input, tol=residual_tol)
+    accepted = (verdict.verdict == VERDICT_ALLOW)
+
+    return CoastingReceipt(
+        receipt_type="szl/nav-coasting-receipt/v1",
+        config_name=c.name,
+        config_label=c.label,
+        q_va_psd=c.q_va,
+        threshold_m=threshold_m,
+        channel=channel,
+        horizon_s=horizon_s,
+        time_to_exceed_s=tte.t_exceed_s,
+        threshold_found_in_horizon=tte.found,
+        sigma_numeric_m=sigma_num,
+        sigma_closedform_m=sigma_cf,
+        integration_rel_residual=rel_resid,
+        residual_tol=residual_tol,
+        converged=converged,
+        monotonic_check=monotone,
+        lambda_verdict=verdict.verdict,
+        lambda_advisory=verdict.advisory,
+        lambda_reason=verdict.reason,
+        accepted=accepted,
+        modeled_not_measured=(c.label != "MEASURED"),
+        one_dof_only=True,
+        three_axis_full_ins="NOT MODELED",
+        schuler_coriolis_gyro_t3="NOT MODELED",
+        inputs_hash=_hash_inputs(inputs),
+        timestamp_utc=time.time(),
+    )
+
+
+# --------------------------------------------------------------------------- #
+# Honest sample configs (clearly labelled SAMPLE/MODELED) + Dev1 q_va loader   #
+# --------------------------------------------------------------------------- #
+def load_dev1_q_va(default: float) -> tuple[float, str]:
+    """Try to read the accelerometer PSD q_va from Dev1's quantum sensor output.
+
+    Looks for /home/user/workspace/pnt_build/dev1_quantum_sensors/*.json with a
+    'q_va' / 'accel_psd' / 'n_a' field. If absent (Dev1 not built yet), returns the
+    supplied honest SAMPLE default so this module composes standalone NOW and will
+    automatically consume Dev1's real number once it lands.
+
+    Returns (q_va, source_label).
+    """
+    import glob
+    import os
+    base = "/home/user/workspace/pnt_build/dev1_quantum_sensors"
+    if os.path.isdir(base):
+        for path in sorted(glob.glob(os.path.join(base, "*.json"))):
+            try:
+                with open(path) as fh:
+                    data = json.load(fh)
+            except Exception:
+                continue
+            for key in ("q_va", "q_va_psd", "accel_psd_psd", "accel_psd"):
+                if isinstance(data, dict) and key in data:
+                    return float(data[key]), f"dev1:{os.path.basename(path)}:{key}"
+            # n_a is an ASD (m/s^2/sqrt(Hz)); square it to a PSD
+            for key in ("n_a", "asd", "accel_asd"):
+                if isinstance(data, dict) and key in data:
+                    return float(data[key]) ** 2, f"dev1:{os.path.basename(path)}:{key}^2"
+    return default, "honest-sample (Dev1 not present)"
+
+
+def sample_classical() -> SensorCoeffs:
+    """Honest SAMPLE classical MEMS/tactical INS + TCXO clock budget. MODELED.
+
+    Representative tactical-grade numbers (order-of-magnitude, declared SAMPLE):
+      accel ASD ~ 1e-3 (m/s^2)/sqrt(Hz)  -> q_va = 1e-6
+      residual accel bias ~ 1e-4 m/s^2 (after calib, ~10 ug)
+      TCXO Allan dev at 1 s ~ 1e-10; drift ~ 1e-9 / s
+    """
+    q, src = load_dev1_q_va(default=1.0e-6)
+    return SensorCoeffs(
+        q_va=q, accel_bias=1.0e-4, vrw_psd=0.0,
+        clock_adev_1s=1.0e-10, clock_rwfm=1.0e-12, clock_drift=1.0e-9, clock_y0=1.0e-11,
+        label="SAMPLE", name="classical-MEMS+TCXO", source=src,
+    )
+
+
+def sample_quantum() -> SensorCoeffs:
+    """Honest SAMPLE quantum cold-atom-interferometer accel + chip-scale/optical clock.
+
+    The CAI accelerometer PSD is MUCH lower (that is the whole point), and a better
+    clock lowers the holdover term:
+      accel ASD ~ 1e-6 (m/s^2)/sqrt(Hz) -> q_va = 1e-12 (≈1000x lower amplitude)
+      residual accel bias ~ 1e-7 m/s^2 (CAI is absolute/bias-stable)
+      clock Allan dev at 1 s ~ 1e-12; drift ~ 1e-12 / s
+    """
+    q, src = load_dev1_q_va(default=1.0e-12)
+    return SensorCoeffs(
+        q_va=q, accel_bias=1.0e-7, vrw_psd=0.0,
+        clock_adev_1s=1.0e-12, clock_rwfm=1.0e-14, clock_drift=1.0e-12, clock_y0=1.0e-13,
+        label="SAMPLE", name="quantum-CAI+optical", source=src,
+    )
+
+
+__all__ = [
+    "C_LIGHT", "G0", "METHOD", "ATTRIBUTION", "DOCTRINE",
+    "VERDICT_ALLOW", "VERDICT_ADVISORY", "VERDICT_DENY",
+    "SensorCoeffs", "position_error_sigma", "timing_error_seconds",
+    "timing_error_meters", "combined_error_meters",
+    "TimeToExceed", "time_to_exceed", "quantum_advantage",
+    "integrate_position_variance",
+    "CoastingReceipt", "GateVerdict", "gate_coasting", "governed_coasting_solve",
+    "load_dev1_q_va", "sample_classical", "sample_quantum",
+]
+
+
+if __name__ == "__main__":
+    print("SZL NAV COASTING — GPS-denied holdover figure-of-merit (1-DOF, governed)\n"
+          + "=" * 72)
+    classical = sample_classical()
+    quantum = sample_quantum()
+    THRESH = 50.0  # metres — example navigation accuracy threshold
+
+    print(f"classical: {classical.name}  q_va={classical.q_va:.3e}  src={classical.source}")
+    print(f"quantum  : {quantum.name}  q_va={quantum.q_va:.3e}  src={quantum.source}")
+    print()
+
+    adv = quantum_advantage(classical, quantum, THRESH, channel="combined")
+    print("QUANTUM ADVANTAGE (combined position+timing channel, MODELED):")
+    print(f"  classical time-to-exceed {THRESH:g} m : "
+          f"{adv['classical']['t_exceed_s']:.1f} s (found={adv['classical']['found']})")
+    print(f"  quantum   time-to-exceed {THRESH:g} m : "
+          f"{adv['quantum']['t_exceed_s']:.1f} s (found={adv['quantum']['found']})")
+    print(f"  extra coast: {adv['extra_coasting_seconds']:.1f} s  "
+          f"ratio: {adv['coasting_ratio']:.2f}x  "
+          f"(lower_bound={adv['ratio_is_lower_bound']})")
+    print()
+
+    rc = governed_coasting_solve(classical, THRESH)
+    rq = governed_coasting_solve(quantum, THRESH)
+    print("GOVERNED SOLVE RECEIPTS (Λ-gate, STRUCTURAL-ONLY / unsigned):")
+    for r in (rc, rq):
+        print(f"  [{r.config_name}] verdict={r.lambda_verdict} accepted={r.accepted} "
+              f"rel_resid={r.integration_rel_residual:.2e} "
+              f"t_exceed={r.time_to_exceed_s:.1f}s monotone={r.monotonic_check}")
+    print()
+    print("HONESTY: 1-DOF only; 3-axis/full-INS (gyro t^3, Schuler, Coriolis) = NOT "
+          "MODELED; horizon is MODELED not MEASURED; Λ advisory.")

pnt_resilience.py

@@ -0,0 +1,558 @@
+# SPDX-License-Identifier: Apache-2.0
+# © 2026 SZL Holdings · Doctrine v11 LOCKED · Λ = Conjecture 1 (advisory, NOT proven trust)
+# Sign-off: Stephen P. Lutar Jr. <stephenlutar2@gmail.com>
+"""pnt_resilience — SZL-NATIVE fused GNSS SPOOF-DETECTION / PNT-RESILIENCE engine.
+
+WHAT THIS IS
+============
+A deny-by-default, multi-layer GNSS spoof detector. Four INDEPENDENT monitor
+layers each emit a calibrated statistic + a fire/no-fire decision; a
+Λ-gate-style governor fuses them. The governor is DENY-BY-DEFAULT: it returns
+ALLOW only when NO layer fires AND a fused-confidence floor is cleared. The Λ
+verdict is ADVISORY governance (Λ = Conjecture 1), it is NEVER "proven trust".
+
+The four layers (each grounded in published method, cited below):
+  1. multi-SV RAIM consistency  — pseudorange-residual parity / χ² test
+  2. AGC / power-advantage      — received-power-advantage (dB) of a spoofer
+  3. SQM (signal-quality)       — early/late correlator + carrier-phase alignment
+  4. clock-aided time-spoof     — clock-bias vs position-push self-consistency
+
+HONEST SCOPE (Doctrine v11, HARD — read this)
+=============================================
+This is a SIMULATOR that operates on **PARAMETERISED OBSERVABLES**, NOT raw IQ.
+It is NOT an SDR and does NOT process baseband samples, correlator I/Q, or live
+RF. The inputs are *summary observables* a real receiver would expose:
+pseudorange residuals, an AGC-derived power-advantage estimate in dB, an SQM
+early-minus-late metric, a carrier-phase-alignment flag, and clock-bias/position
+push terms. A TEXBAT record is described to us by three classifier knobs (power
+advantage dB, carrier-phase alignment, time/position push); we map those knobs
+onto the observables the same way the literature characterises the records.
+Anything we cannot derive from these observables is labelled NOT MODELED. We
+NEVER label a record "detected" without a real triggering statistic crossing a
+documented threshold (see SpoofVerdict.detected and the honesty test).
+
+CLEAN-ROOM
+==========
+Method/physics re-derived from the open literature and cited. We studied the
+EXISTENCE and SHAPE of kshana's fused multi-layer detector (Apache-2.0) as prior
+art and CITE it; we copied NONE of its Rust. This is the SDA bridge into our
+khipu-sda-core / mosaic anomaly engine and sits under the Λ-gate governor.
+
+Pure numpy → sovereign, own-metal, auditable.
+"""
+from __future__ import annotations
+
+import math
+from dataclasses import dataclass, field, asdict
+from typing import Optional
+
+import numpy as np
+
+# --------------------------------------------------------------------------- #
+# Provenance — method/physics CITED, never claimed as SZL's own.               #
+# --------------------------------------------------------------------------- #
+ATTRIBUTION = {
+    "kshana": (
+        "Baweja, C. (2026). 'Kshana — a PNT-resilience simulator with quantum-sensor "
+        "performance models', Ashforde OÜ, Apache-2.0, DOI:10.5281/zenodo.20528627 "
+        "(v0.16.0). Studied as PRIOR ART for the SHAPE of a fused multi-layer GNSS "
+        "spoof detector (RAIM-consistency parity + RF AGC-power monitor + SQM "
+        "early-minus-late monitor, χ²/Neyman-Pearson statistics). CLEAN-ROOM: no Rust "
+        "copied; re-derived from the cited primary literature below."
+    ),
+    "texbat": (
+        "Humphreys, T.E. et al. (2012), 'The Texas Spoofing Test Battery (TEXBAT)', "
+        "ION GNSS 2012. Defines the canonical spoofing records (ds1..ds8) classified "
+        "by power advantage, carrier-phase alignment, and time/position push — the "
+        "parameterisation used here to drive the monitor observables."
+    ),
+    "texbat_hifi": (
+        "ION (2016), 'Detailed Analysis of the TEXBAT Datasets Using a High Fidelity "
+        "Receiver' — characterises per-scenario power biases and time offsets; basis "
+        "for the dB / time-push numbers attached to each scenario class."
+    ),
+    "raim": (
+        "RTCA DO-229 / Receiver Autonomous Integrity Monitoring: redundant-pseudorange "
+        "parity / least-squares-residual chi-square fault detection over >=5 SVs. "
+        "Re-derived here as the RAIM-consistency layer."
+    ),
+    "agc_rpm": (
+        "Garbin & Manfredini (2018, ION ITM), 'Effective GPS Spoofing Detection "
+        "Utilizing Metrics from Commercial Receivers'; and ENAC hal-02907360 (2020), "
+        "'Assessment of GPS Spoofing Detection via Radio Power and Signal Quality' — "
+        "AGC / received-power monitoring detects overpowered spoofers."
+    ),
+    "sqm": (
+        "Phelts; Garbin & Manfredini (2018) — Signal Quality Monitoring observes "
+        "early-minus-late correlator asymmetry; powerful against power-matched "
+        "spoofers during the code-phase pull-off (transient indicator)."
+    ),
+    "clock": (
+        "Sensors (2023) PMC10007427, 'Characterization of the Ability of Low-Cost "
+        "GNSS Receiver to Detect Spoofing' and SCV-RCS (Sensors 2026, PMC12845604): "
+        "a spoofing attack induces a leap/inconsistency in the receiver clock bias "
+        "vs the position solution — clock-aided time-spoof detection."
+    ),
+    "doctrine": (
+        "SZL Doctrine v11 — clean-room, cite-never-plagiarize, MEASURED/MODELED "
+        "labels, deny-by-default, Λ = Conjecture 1 (advisory governance gate, NOT "
+        "proven trust). Λ-gate posture matches agentic_pinn / physics_bounds estate."
+    ),
+}
+
+# Λ verdict labels (match the estate's lambda_gate vocabulary).
+VERDICT_ALLOW = "ALLOW"        # no layer fired AND fused confidence passed
+VERDICT_ADVISORY = "ADVISORY"  # ambiguous: weak/conflicting evidence -> hold
+VERDICT_DENY = "DENY"          # >=1 layer fired -> deny-by-default
+
+LAMBDA_LABEL = (
+    "Λ = Conjecture 1 — the spoof governor is ADVISORY governance, NOT 'proven "
+    "trust'. ALLOW means the PNT fix passed SZL admission policy (no monitor fired "
+    "and fused confidence cleared the floor); it does NOT certify the signal is "
+    "authentic. DENY/ADVISORY are deny-by-default holds."
+)
+
+SCOPE_LABEL = (
+    "OBSERVABLE-DOMAIN SIMULATOR — operates on parameterised receiver observables "
+    "(pseudorange residuals, AGC power-advantage dB, SQM early-minus-late, "
+    "carrier-phase-alignment flag, clock-bias/position push). NOT an SDR; does NOT "
+    "process raw IQ / baseband. Items not derivable are labelled NOT MODELED."
+)
+
+
+# --------------------------------------------------------------------------- #
+# Calibrated thresholds. All DOCUMENTED, all tunable, none magic.              #
+# --------------------------------------------------------------------------- #
+@dataclass(frozen=True)
+class DetectorConfig:
+    # RAIM: false-alarm prob for the chi-square test on the residual sum-of-squares.
+    raim_pfa: float = 1e-3
+    raim_sigma_m: float = 3.0          # nominal 1-sigma pseudorange noise [m] (MODELED)
+    # AGC/power: a spoofer must overpower; below ~1.5 dB is within nominal AGC drift.
+    agc_advantage_db_thresh: float = 1.5   # power-advantage fire threshold [dB]
+    agc_nominal_sigma_db: float = 0.4      # nominal AGC fluctuation 1-sigma [dB]
+    # SQM: early-minus-late metric is ~0 for a clean symmetric correlation peak.
+    sqm_metric_thresh: float = 0.12        # dimensionless asymmetry fire threshold
+    sqm_nominal_sigma: float = 0.03        # nominal SQM fluctuation 1-sigma
+    # Clock/time: inconsistency between clock-bias leap and position push [m-equiv].
+    clock_resid_thresh_m: float = 8.0      # clock-bias/position self-consistency [m]
+    clock_nominal_sigma_m: float = 2.0     # nominal clock-residual 1-sigma [m]
+    # Fused-confidence floor: ALLOW requires fused confidence >= this AND no fire.
+    fused_confidence_floor: float = 0.60
+
+
+CFG = DetectorConfig()
+
+
+# --------------------------------------------------------------------------- #
+# Observable container — the parameterised inputs (NOT raw IQ).                 #
+# --------------------------------------------------------------------------- #
+@dataclass
+class PntObservables:
+    """Summary observables a real receiver exposes. NOT baseband IQ."""
+    # RAIM layer: per-SV pseudorange residuals [m] after the LS position fix,
+    # and the number of redundant SVs (DOF = n_sv - 4 for a 3D+clock fix).
+    pr_residuals_m: np.ndarray
+    n_sv: int
+    # AGC/power layer: estimated received-power advantage of the strongest
+    # component over the nominal authentic floor [dB]. ~0 dB when clean.
+    power_advantage_db: float = 0.0
+    # SQM layer: early-minus-late correlator asymmetry metric (dimensionless),
+    # plus a carrier-phase-alignment flag (True => spoofer phase-aligned to truth,
+    # which SUPPRESSES SQM asymmetry — the hard, stealthy case).
+    sqm_early_minus_late: float = 0.0
+    carrier_phase_aligned: bool = False
+    # Clock/time layer: the directly-estimated clock-bias leap [m-equiv] and the
+    # clock-bias implied by integrating clock drift over the window [m-equiv];
+    # their difference is the self-consistency residual. A time-push attack
+    # breaks this consistency even with no obvious position jump.
+    clock_bias_leap_m: float = 0.0
+    clock_drift_implied_m: float = 0.0
+
+    def __post_init__(self):
+        self.pr_residuals_m = np.asarray(self.pr_residuals_m, dtype=float)
+
+
+# --------------------------------------------------------------------------- #
+# Per-layer result.                                                            #
+# --------------------------------------------------------------------------- #
+@dataclass
+class LayerResult:
+    name: str
+    statistic: float          # the calibrated detection statistic
+    threshold: float          # documented fire threshold for this statistic
+    fired: bool               # statistic crossed threshold
+    confidence: float         # in [0,1]: how confident this layer is the fix is CLEAN
+    detail: str               # human-readable, honest detail
+    modeled: bool = True      # False => NOT MODELED placeholder
+
+
+@dataclass
+class SpoofVerdict:
+    verdict: str                          # ALLOW | ADVISORY | DENY
+    advisory: bool                        # Λ is always advisory governance
+    detected: bool                        # True ONLY if >=1 layer fired on a real stat
+    fired_layers: list                    # names of layers that fired
+    fused_confidence: float               # fused clean-confidence in [0,1]
+    layers: list                          # list[LayerResult] as dicts
+    reason: str
+    lambda_label: str = LAMBDA_LABEL
+    scope_label: str = SCOPE_LABEL
+    attribution: dict = field(default_factory=lambda: ATTRIBUTION)
+
+
+# --------------------------------------------------------------------------- #
+# Layer 1 — multi-SV RAIM consistency (pseudorange-residual chi-square).       #
+# --------------------------------------------------------------------------- #
+def _chi2_threshold(dof: int, pfa: float) -> float:
+    """Upper-tail chi-square threshold for given DOF and false-alarm prob.
+
+    Pure-numpy Wilson-Hilferty inverse-CDF approximation (no scipy). The
+    chi-square parity test is the textbook RAIM fault-detection statistic:
+    a spoofer that is not perfectly self-consistent across SVs inflates the
+    sum-of-squared pseudorange residuals beyond the noise-only chi-square tail.
+    """
+    if dof <= 0:
+        return float("inf")  # cannot run RAIM without redundancy
+    # Standard-normal upper quantile for pfa via inverse erf.
+    z = math.sqrt(2.0) * _erfinv(1.0 - 2.0 * pfa) if pfa < 0.5 else 0.0
+    # Wilson-Hilferty: chi2 ~ dof*(1 - 2/(9 dof) + z*sqrt(2/(9 dof)))^3
+    t = 1.0 - 2.0 / (9.0 * dof) + z * math.sqrt(2.0 / (9.0 * dof))
+    return dof * t ** 3
+
+
+def _erfinv(y: float) -> float:
+    """Inverse error function (rational approx, Winitzki). Pure-stdlib."""
+    if y <= -1.0:
+        return -float("inf")
+    if y >= 1.0:
+        return float("inf")
+    a = 0.147
+    ln = math.log(1.0 - y * y)
+    term = 2.0 / (math.pi * a) + ln / 2.0
+    return math.copysign(math.sqrt(math.sqrt(term * term - ln / a) - term), y)
+
+
+def raim_layer(obs: PntObservables, cfg: DetectorConfig = CFG) -> LayerResult:
+    """RAIM-consistency parity test on pseudorange residuals.
+
+    Statistic: SSE/sigma^2 ~ chi^2_(n_sv-4). Fires if it exceeds the upper-tail
+    threshold at the configured false-alarm probability. DOF = n_sv - 4
+    (3 position + 1 clock unknowns). With <5 SVs there is no redundancy ->
+    NOT MODELED (cannot run RAIM); we honestly do not fire on it.
+    """
+    dof = int(obs.n_sv) - 4
+    sse = float(np.sum((obs.pr_residuals_m / cfg.raim_sigma_m) ** 2))
+    if dof <= 0:
+        return LayerResult(
+            name="raim_consistency",
+            statistic=sse,
+            threshold=float("inf"),
+            fired=False,
+            confidence=0.5,  # cannot vouch either way without redundancy
+            detail="NOT MODELED: <5 SV, no RAIM redundancy (DOF<=0); cannot test.",
+            modeled=False,
+        )
+    thr = _chi2_threshold(dof, cfg.raim_pfa)
+    fired = sse > thr
+    # confidence the fix is CLEAN: how far below threshold we sit (smooth).
+    conf = float(np.clip(1.0 - sse / (thr + 1e-12), 0.0, 1.0))
+    return LayerResult(
+        name="raim_consistency",
+        statistic=sse,
+        threshold=thr,
+        fired=fired,
+        confidence=conf,
+        detail=(f"chi2 parity SSE={sse:.2f} vs thr={thr:.2f} (DOF={dof}, "
+                f"Pfa={cfg.raim_pfa:g}); fired={fired}."),
+    )
+
+
+# --------------------------------------------------------------------------- #
+# Layer 2 — AGC / received-power-advantage monitor.                            #
+# --------------------------------------------------------------------------- #
+def agc_power_layer(obs: PntObservables, cfg: DetectorConfig = CFG) -> LayerResult:
+    """Received-power-advantage monitor (AGC-derived).
+
+    An overpowered spoofer drives the receiver AGC and shows up as a positive
+    power advantage in dB over the authentic floor. Statistic is the dB
+    advantage; fires above the configured threshold. Power-MATCHED spoofers
+    (advantage ~0 dB) intentionally evade this layer — that is the documented
+    blind spot SQM/RAIM/clock layers cover (defence-in-depth).
+    """
+    adv = float(obs.power_advantage_db)
+    thr = cfg.agc_advantage_db_thresh
+    fired = adv > thr
+    # z-score of advantage vs nominal AGC drift -> clean-confidence.
+    z = adv / max(cfg.agc_nominal_sigma_db, 1e-9)
+    conf = float(np.clip(1.0 - z / 4.0, 0.0, 1.0))  # 4-sigma -> 0 confidence
+    return LayerResult(
+        name="agc_power_advantage",
+        statistic=adv,
+        threshold=thr,
+        fired=fired,
+        confidence=conf,
+        detail=(f"power advantage={adv:.2f} dB vs thr={thr:.2f} dB; fired={fired}. "
+                f"Power-matched (~0 dB) spoofers evade this layer by design."),
+    )
+
+
+# --------------------------------------------------------------------------- #
+# Layer 3 — SQM (signal-quality / carrier-phase alignment) monitor.            #
+# --------------------------------------------------------------------------- #
+def sqm_layer(obs: PntObservables, cfg: DetectorConfig = CFG) -> LayerResult:
+    """SQM early-minus-late correlator asymmetry monitor.
+
+    During a spoofer's code-phase pull-off the authentic and counterfeit
+    correlation peaks coexist and distort the correlation function, producing
+    a measurable early-minus-late asymmetry. Statistic is the |asymmetry|;
+    fires above threshold.
+
+    HONEST CAVEAT: if the spoofer is carrier-phase-aligned to the truth
+    (the stealthy power-matched, phase-aligned case, e.g. TEXBAT ds7), the two
+    peaks merge and SQM asymmetry collapses -> this layer cannot fire. We model
+    that by suppressing the effective metric when carrier_phase_aligned=True,
+    and we say so. That blind spot is precisely why fusion + deny-by-default
+    matters; we do NOT pretend SQM caught it.
+    """
+    raw = abs(float(obs.sqm_early_minus_late))
+    # Phase-aligned merge collapses the observable asymmetry.
+    eff = 0.0 if obs.carrier_phase_aligned else raw
+    thr = cfg.sqm_metric_thresh
+    fired = eff > thr
+    z = eff / max(cfg.sqm_nominal_sigma, 1e-9)
+    conf = float(np.clip(1.0 - z / 4.0, 0.0, 1.0))
+    if obs.carrier_phase_aligned:
+        detail = ("carrier-phase-aligned: peaks merged, SQM asymmetry suppressed "
+                  "(eff=0); this layer CANNOT fire on a phase-aligned spoofer.")
+        conf = 0.5  # honest: SQM neither vouches nor accuses here
+    else:
+        detail = (f"SQM early-minus-late |asym|={eff:.3f} vs thr={thr:.3f}; "
+                  f"fired={fired}.")
+    return LayerResult(
+        name="sqm_signal_quality",
+        statistic=eff,
+        threshold=thr,
+        fired=fired,
+        confidence=conf,
+        detail=detail,
+    )
+
+
+# --------------------------------------------------------------------------- #
+# Layer 4 — clock-aided time-spoof monitor.                                    #
+# --------------------------------------------------------------------------- #
+def clock_time_layer(obs: PntObservables, cfg: DetectorConfig = CFG) -> LayerResult:
+    """Clock-bias vs position-push self-consistency (time-spoof) monitor.
+
+    A time-push attack injects a clock-bias leap that is NOT consistent with the
+    clock bias implied by integrating the receiver's own clock drift. The
+    self-consistency residual |clock_bias_leap - clock_drift_implied| (in
+    metre-equivalents, 1 ns ~ 0.2998 m) is the statistic; fires above threshold.
+    This is the layer that catches a stealthy time-only push that leaves the
+    position solution and power untouched.
+    """
+    resid = abs(float(obs.clock_bias_leap_m) - float(obs.clock_drift_implied_m))
+    thr = cfg.clock_resid_thresh_m
+    fired = resid > thr
+    z = resid / max(cfg.clock_nominal_sigma_m, 1e-9)
+    conf = float(np.clip(1.0 - z / 4.0, 0.0, 1.0))
+    return LayerResult(
+        name="clock_time_spoof",
+        statistic=resid,
+        threshold=thr,
+        fired=fired,
+        confidence=conf,
+        detail=(f"clock-bias/position self-consistency residual={resid:.2f} m "
+                f"vs thr={thr:.2f} m; fired={fired}."),
+    )
+
+
+# --------------------------------------------------------------------------- #
+# Λ-gate-style fusion governor — DENY-BY-DEFAULT.                              #
+# --------------------------------------------------------------------------- #
+def fuse(layers: list, cfg: DetectorConfig = CFG) -> SpoofVerdict:
+    """Fuse independent monitor layers under a deny-by-default Λ governor.
+
+    POLICY (deny-by-default):
+      * If ANY layer fired on a real triggering statistic  -> DENY (detected=True).
+      * Else if fused clean-confidence >= floor            -> ALLOW (advisory).
+      * Else (no fire, but weak/ambiguous confidence)      -> ADVISORY (hold).
+
+    Fused clean-confidence is the MINIMUM across MODELED layers (a chain is only
+    as trustworthy as its weakest honest monitor) blended toward the mean; using
+    the min keeps the gate conservative. NOT-MODELED layers are excluded from the
+    confidence floor (we don't let an un-runnable layer manufacture trust) but a
+    record is NEVER marked detected without a real fire.
+    """
+    fired = [L.name for L in layers if L.fired]
+    modeled_conf = [L.confidence for L in layers if L.modeled]
+    if modeled_conf:
+        # conservative blend: weight the weakest layer heavily.
+        fused_conf = 0.7 * min(modeled_conf) + 0.3 * float(np.mean(modeled_conf))
+    else:
+        fused_conf = 0.0  # nothing runnable -> cannot vouch -> deny-by-default holds
+
+    if fired:
+        verdict = VERDICT_DENY
+        detected = True
+        reason = (f"DENY (deny-by-default): {len(fired)} monitor layer(s) fired "
+                  f"-> {', '.join(fired)}. Λ advisory: spoof indicated.")
+    elif fused_conf >= cfg.fused_confidence_floor:
+        verdict = VERDICT_ALLOW
+        detected = False
+        reason = (f"ALLOW: no layer fired and fused clean-confidence "
+                  f"{fused_conf:.2f} >= floor {cfg.fused_confidence_floor:.2f}. "
+                  f"Λ advisory ONLY — not proven trust.")
+    else:
+        verdict = VERDICT_ADVISORY
+        detected = False
+        reason = (f"ADVISORY HOLD (deny-by-default): no layer fired but fused "
+                  f"clean-confidence {fused_conf:.2f} < floor "
+                  f"{cfg.fused_confidence_floor:.2f}; insufficient evidence to ALLOW.")
+
+    return SpoofVerdict(
+        verdict=verdict,
+        advisory=True,                 # Λ is ALWAYS advisory governance
+        detected=detected,
+        fired_layers=fired,
+        fused_confidence=float(fused_conf),
+        layers=[asdict(L) for L in layers],
+        reason=reason,
+    )
+
+
+def detect(obs: PntObservables, cfg: DetectorConfig = CFG) -> SpoofVerdict:
+    """Run all four independent layers and fuse under the deny-by-default Λ gate."""
+    layers = [
+        raim_layer(obs, cfg),
+        agc_power_layer(obs, cfg),
+        sqm_layer(obs, cfg),
+        clock_time_layer(obs, cfg),
+    ]
+    return fuse(layers, cfg)
+
+
+# --------------------------------------------------------------------------- #
+# TEXBAT-style scenario parameterisation.                                      #
+# --------------------------------------------------------------------------- #
+@dataclass
+class TexbatScenario:
+    """A TEXBAT-style record described by the three classifier knobs the
+    literature uses: power advantage (dB), carrier-phase alignment, and
+    time/position push. We map those knobs onto receiver observables. These
+    numbers are MODELED parameterisations of the published record classes
+    (Humphreys 2012; ION 2016 hi-fi analysis), NOT measured IQ captures.
+    """
+    name: str
+    power_advantage_db: float
+    carrier_phase_aligned: bool
+    position_push_m: float        # how hard the fix is pulled in space [m]
+    time_push_m: float            # clock-bias leap injected [m-equiv]
+    description: str = ""
+
+
+# Canonical TEXBAT-style classes (parameterised from the cited characterisations).
+TEXBAT_LIBRARY = {
+    "clean": TexbatScenario(
+        name="clean", power_advantage_db=0.0, carrier_phase_aligned=False,
+        position_push_m=0.0, time_push_m=0.0,
+        description="Authentic signal, no spoofer. Expect ALLOW.",
+    ),
+    "ds2_time_push": TexbatScenario(
+        name="ds2_time_push", power_advantage_db=8.0, carrier_phase_aligned=False,
+        position_push_m=0.0, time_push_m=40.0,
+        description="Overpowered time-push, no phase alignment (TEXBAT ds2 class).",
+    ),
+    "ds3_overpower": TexbatScenario(
+        name="ds3_overpower", power_advantage_db=10.0, carrier_phase_aligned=False,
+        position_push_m=60.0, time_push_m=0.0,
+        description="Gradual/strong power-advantage takeover (TEXBAT ds3 class).",
+    ),
+    "ds4_seamless": TexbatScenario(
+        name="ds4_seamless", power_advantage_db=2.0, carrier_phase_aligned=False,
+        position_push_m=80.0, time_push_m=0.0,
+        description="Seamless lift-off; modest power, code-phase pull (ds4 class).",
+    ),
+    "ds7_matched_aligned": TexbatScenario(
+        name="ds7_matched_aligned", power_advantage_db=0.4,
+        carrier_phase_aligned=True, position_push_m=70.0, time_push_m=0.0,
+        description=("Power-matched, carrier-phase-aligned stealth spoof "
+                     "(TEXBAT ds7 class) — defeats AGC and SQM; caught only by "
+                     "RAIM-consistency parity on the position push."),
+    ),
+}
+
+
+def observables_from_scenario(sc: TexbatScenario, n_sv: int = 8,
+                              seed: int = 0,
+                              cfg: DetectorConfig = CFG) -> PntObservables:
+    """Synthesise parameterised observables for a TEXBAT-style scenario.
+
+    Mapping (MODELED, documented):
+      * position_push -> inflates pseudorange residuals (RAIM sees inconsistency).
+        A counterfeit constellation that pushes the fix by D metres leaves a
+        residual signature ~ D scattered across SVs; we model the per-SV residual
+        as nominal noise + a push-driven inconsistency term.
+      * power_advantage_db -> AGC layer observable directly.
+      * code-phase pull -> SQM early-minus-late asymmetry, UNLESS phase-aligned.
+      * time_push -> clock-bias leap inconsistent with clock-drift integration.
+    """
+    rng = np.random.default_rng(seed)
+    # Nominal clean residuals: zero-mean Gaussian at the modelled sigma.
+    resid = rng.normal(0.0, cfg.raim_sigma_m, size=n_sv)
+    if sc.position_push_m > 0:
+        # A spoofer pulling the fix injects a coherent-but-inconsistent push:
+        # part of it is absorbed by the LS fix, the inconsistent remainder
+        # (~30% of the push, spread over redundant SVs) shows in residuals.
+        inconsistency = 0.30 * sc.position_push_m
+        push_sig = rng.normal(0.0, inconsistency / math.sqrt(max(n_sv, 1)), size=n_sv)
+        resid = resid + push_sig + inconsistency / n_sv
+    # SQM asymmetry tracks the code-phase pull; scale with position push,
+    # suppressed if phase-aligned (handled inside sqm_layer too).
+    sqm_metric = 0.0
+    if sc.position_push_m > 0 and not sc.carrier_phase_aligned:
+        sqm_metric = min(0.5, 0.004 * sc.position_push_m + abs(rng.normal(0, 0.01)))
+    # Clock: bias leap = time_push; drift-implied stays at the clean value.
+    clock_leap = sc.time_push_m + rng.normal(0.0, cfg.clock_nominal_sigma_m * 0.3)
+    clock_drift_implied = rng.normal(0.0, cfg.clock_nominal_sigma_m * 0.3)
+    return PntObservables(
+        pr_residuals_m=resid,
+        n_sv=n_sv,
+        power_advantage_db=sc.power_advantage_db + rng.normal(0, cfg.agc_nominal_sigma_db * 0.2),
+        sqm_early_minus_late=sqm_metric,
+        carrier_phase_aligned=sc.carrier_phase_aligned,
+        clock_bias_leap_m=clock_leap,
+        clock_drift_implied_m=clock_drift_implied,
+    )
+
+
+def assess_scenario(sc: TexbatScenario, n_sv: int = 8, seed: int = 0,
+                    cfg: DetectorConfig = CFG) -> SpoofVerdict:
+    """Convenience: parameterise a TEXBAT-style record and run the fused detector."""
+    obs = observables_from_scenario(sc, n_sv=n_sv, seed=seed, cfg=cfg)
+    return detect(obs, cfg)
+
+
+# --------------------------------------------------------------------------- #
+# Demo / CLI.                                                                  #
+# --------------------------------------------------------------------------- #
+def _print_verdict(name: str, v: SpoofVerdict) -> None:
+    print(f"\n=== {name} ===")
+    print(f"  verdict   : {v.verdict}  (detected={v.detected}, advisory={v.advisory})")
+    print(f"  fired     : {v.fired_layers or 'none'}")
+    print(f"  fused conf: {v.fused_confidence:.3f}")
+    for L in v.layers:
+        flag = "FIRE" if L["fired"] else ("n/m" if not L["modeled"] else "ok ")
+        print(f"    [{flag}] {L['name']:<22} stat={L['statistic']:.3f} "
+              f"thr={L['threshold']:.3f}")
+    print(f"  reason    : {v.reason}")
+
+
+if __name__ == "__main__":
+    print("SZL PNT-RESILIENCE — fused deny-by-default GNSS spoof detector")
+    print(SCOPE_LABEL)
+    print(LAMBDA_LABEL)
+    for key, sc in TEXBAT_LIBRARY.items():
+        v = assess_scenario(sc, seed=42)
+        _print_verdict(f"{sc.name} — {sc.description}", v)

quantum_sensing_limits.py

@@ -0,0 +1,614 @@
+# SPDX-License-Identifier: Apache-2.0
+# © 2026 SZL Holdings · Doctrine v11 LOCKED · Λ = Conjecture 1 (advisory, NOT proven trust)
+# Sign-off: Stephen P. Lutar Jr. <stephenlutar2@gmail.com>
+"""quantum_sensing_limits — FUNDAMENTAL-LIMITS CERTIFIER for a cold-atom interferometer.
+
+THE SECOND PILLAR (founder's doctrine): next to ``physics_bounds.py`` — which proves a
+*compute* job sits below the Landauer/Margolus-Levitin/Bremermann/Bekenstein ceilings —
+this module proves a *quantum sensor's* noise floor is set by, and sits at or above, the
+STANDARD QUANTUM LIMIT (shot / atom-projection noise). Same philosophy: derive performance
+from first-principles physics, certify it, label MEASURED vs MODELED, never fabricate.
+
+This is a CLEAN-ROOM SZL-NATIVE re-derivation of the cold-atom interferometer (CAI)
+accelerometer physics. The METHOD/structure (a first-principles CAI noise model rather
+than a datasheet lookup) is cited to AshfordeOU/kshana (Apache-2.0, DOI
+10.5281/zenodo.20528627). NO kshana Rust source is copied; only the established physics
+below is implemented, in our own Python. The physics itself is ESTABLISHED and CITED to
+the original papers — it is NOT claimed as SZL's:
+
+  * Kasevich & Chu (1991): light-pulse (stimulated-Raman) atom interferometry; the
+    three-pulse (π/2 – π – π/2) Mach-Zehnder geometry as an inertial sensor.
+  * Peters, Chung & Chu (2001): high-precision absolute gravimetry with a CAI;
+    Φ = k_eff·a·T² scaling and systematic-effect accounting.
+  * Cheinet et al. (2008): the sensitivity function g(t) and the vibration/laser-phase
+    transfer function |H(ω)| = (4/ω²)·sin²(ωT/2); white-acceleration-noise phase
+    variance σ_Φ² = k_eff²·S_a·T³/3.
+  * Freier et al. (2016): mobile/transportable quantum gravimeter — ASD figure-of-merit
+    n_a = σ_a·√T_c, the real-device performance metric.
+
+HONESTY (Doctrine v11, HARD): every INPUT is labelled MEASURED (only if it came from a
+real instrument reading) vs the DERIVED/MODELED limits. We assert NO measured quantity we
+did not receive. We NEVER fabricate numbers. We make NO over-unity / sub-shot-noise
+("squeezed beyond physics") claim — the certificate is the HONEST INVERSE of a free-energy
+claim: it states the sensor is BOUNDED by the standard quantum limit. A maintained
+"NOT MODELED" list names the systematics this engine does NOT capture, so the certificate
+can never be mistaken for a full error budget. Λ is advisory: this states physical FACTS,
+not "proven trust".
+
+Pure stdlib + math (numpy optional) → sovereign, own-metal, auditable. Real instrument
+inputs feed in via ``MeasuredSensor``; in-sandbox we use HONEST, CLEARLY-LABELLED sample
+inputs. Designed to UNIFY with physics_bounds.py into one SZL "fundamental-limits" library
+(compute-bounds pillar + sensing-limits pillar).
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import math
+import time
+from dataclasses import asdict, dataclass, field
+from typing import Optional
+
+# --------------------------------------------------------------------------- #
+# Fundamental physical constants (SI, CODATA-style). Exact where SI defines.   #
+# Shared, byte-for-byte, with physics_bounds.py so the two pillars unify.       #
+# --------------------------------------------------------------------------- #
+K_B = 1.380649e-23          # Boltzmann constant, J/K (SI exact)
+H_PLANCK = 6.62607015e-34   # Planck constant, J·s (SI exact)
+HBAR = H_PLANCK / (2.0 * math.pi)
+C_LIGHT = 299792458.0       # speed of light, m/s (SI exact)
+PI = math.pi
+
+# Provenance: this is ESTABLISHED CAI physics, CITED — NOT claimed as SZL's. The METHOD
+# (first-principles CAI noise model) is cited to kshana (Apache-2.0); only physics is used.
+SENSING_ATTRIBUTION = {
+    "method_source_kshana": (
+        "AshfordeOU/kshana — open PNT-resilience simulator (Apache-2.0, "
+        "DOI:10.5281/zenodo.20528627). Cited as the METHOD source: a first-principles "
+        "cold-atom interferometer accelerometer noise model (src/inertial/quantum_imu.rs). "
+        "SZL re-derived the physics CLEAN-ROOM in Python; NO kshana Rust source is copied."
+    ),
+    "kasevich_chu_1991": (
+        "Kasevich, M. & Chu, S. (1991), 'Atomic interferometry using stimulated Raman "
+        "transitions', Phys. Rev. Lett. 67(2):181-184, doi:10.1103/PhysRevLett.67.181. "
+        "Light-pulse (π/2–π–π/2) Mach-Zehnder atom interferometer as an inertial sensor; "
+        "effective two-photon wavevector k_eff and the phase response to acceleration."
+    ),
+    "peters_2001": (
+        "Peters, A., Chung, K.Y. & Chu, S. (2001), 'High-precision gravity measurements "
+        "using atom interferometry', Metrologia 38(1):25-61, doi:10.1088/0026-1394/38/1/4 "
+        "(see also Nature 400:849, 1999). Interferometer phase Φ = k_eff·a·T² with the T² "
+        "interrogation-time lever; systematic-effect accounting for absolute gravimetry."
+    ),
+    "cheinet_2008": (
+        "Cheinet, P., Canuel, B., Pereira Dos Santos, F., Gauguet, A., Yver-Leduc, F. & "
+        "Landragin, A. (2008), 'Measurement of the sensitivity function in a time-domain "
+        "atomic interferometer', IEEE Trans. Instrum. Meas. 57(6):1141-1148, "
+        "doi:10.1109/TIM.2007.915148. Sensitivity function g(t); acceleration transfer "
+        "function |H(ω)| = (4/ω²)·sin²(ωT/2); white-noise phase variance "
+        "σ_Φ² = k_eff²·S_a·T³/3 (dominant real-device vibration term)."
+    ),
+    "freier_2016": (
+        "Freier, C., Hauth, M., Schkolnik, V., Leykauf, B., Schilling, M., Wziontek, H., "
+        "Scherneck, H.-G., Müller, J. & Peters, A. (2016), 'Mobile quantum gravity sensor "
+        "with unprecedented stability', J. Phys.: Conf. Ser. 723:012050, "
+        "doi:10.1088/1742-6596/723/1/012050. Transportable CAI; amplitude spectral "
+        "density n_a = σ_a·√T_c as the real-device figure of merit."
+    ),
+    "standard_quantum_limit": (
+        "Shot / atom-projection noise: for N uncorrelated atoms read out with fringe "
+        "contrast C, the minimum resolvable interferometer phase is σ_Φ = 1/(C·√N). This "
+        "is the STANDARD QUANTUM LIMIT (SQL). Surpassing it requires entanglement/spin "
+        "squeezing (Wineland 1992, Kitagawa-Ueda 1993) — explicitly NOT modeled here."
+    ),
+    "honesty": (
+        "These are ESTABLISHED physics relations, cited by source. They are NOT SZL "
+        "conjectures and NOT claimed as SZL's. This certificate is the HONEST INVERSE of "
+        "a free-energy claim: it shows the sensor is BOUNDED by the standard quantum "
+        "limit, asserts no sub-SQL/over-unity performance, fabricates no number, and "
+        "carries an explicit NOT-MODELED list so it is never mistaken for a full budget."
+    ),
+}
+
+DOCTRINE = (
+    "v11 LOCKED: NO free-energy/over-unity and NO sub-standard-quantum-limit claim (this "
+    "certificate shows the sensor is BOUNDED by the SQL — the honest inverse); a value is "
+    "labelled MEASURED ONLY if it came from a real instrument reading, else MODELED/DERIVED; "
+    "established CAI physics is CITED (Kasevich-Chu 1991, Peters 2001, Cheinet 2008, Freier "
+    "2016), method cited to kshana (Apache-2.0), NOT claimed as SZL's; an explicit NOT-MODELED "
+    "list is carried; Λ=Conjecture 1 (advisory); sovereign own-metal; no fabricated numbers."
+)
+
+# Systematics this first-principles engine does NOT capture. Carried in every certificate
+# so a reader can NEVER mistake the SQL/vibration figure for a complete error budget.
+NOT_MODELED = [
+    "Laser phase noise of the Raman/Bragg beams (frequency-comb / OPLL residual) — a "
+    "leading real-device noise term; couples through the SAME |H(ω)| as vibration "
+    "(Cheinet 2008) but its drive PSD S_φ(ω) is an instrument property not modeled here.",
+    "AC-Stark / light-shift systematics (one-photon and two-photon light shifts) and their "
+    "intensity/detuning dependence — a dominant ACCURACY (bias) term, not modeled.",
+    "Full 3-axis mechanization / strapdown coupling, gravity-gradient & rotation-rate "
+    "cross terms beyond the single Coriolis lead term, and platform attitude dynamics.",
+    "Detection (electronic/technical) noise, atom-number normalization noise, and "
+    "intensity noise of the readout — separate from the SQL atom-projection floor.",
+    "Wavefront aberration / Coriolis-from-transverse-velocity beyond the lead Φ_cor term, "
+    "magnetic-field (2nd-order Zeeman) gradients, blackbody/AC-Stark drifts, and aliasing "
+    "of high-frequency vibration through the finite duty cycle (Dick effect).",
+    "Mean-field / cold-collision shifts, finite-pulse-duration corrections to g(t), and "
+    "any spin-squeezing/entanglement enhancement BELOW the SQL (explicitly out of scope).",
+]
+
+
+# --------------------------------------------------------------------------- #
+# MEASURED inputs (clearly labelled) — fed by a real instrument or honest sample #
+# --------------------------------------------------------------------------- #
+@dataclass
+class MeasuredSensor:
+    """Inputs describing one cold-atom interferometer operating point.
+
+    HONESTY RULE: a field is MEASURED ONLY if it is a real reading from the instrument
+    (e.g. observed fringe contrast, counted atom number, recorded cycle time, measured
+    vibration PSD). Design/spec parameters (wavelength, interrogation time setpoint) are
+    CONFIG. ``label`` records which: "MEASURED" (real instrument) vs "SAMPLE"/"DESIGN"
+    (honest, clearly-labelled placeholder). The certifier validates these before use and
+    NEVER silently promotes a garbage/placeholder input to "MEASURED".
+    """
+    wavelength_m: float           # Raman/Bragg optical wavelength λ (m) — CONFIG
+    interrogation_time_s: float   # interferometer pulse separation T (s) — CONFIG/MEASURED
+    atom_number: float            # N atoms contributing to the fringe — MEASURED count
+    contrast: float               # fringe contrast C in [0,1] — MEASURED
+    cycle_time_s: float           # T_c, full measurement cycle time (s) — MEASURED
+    accel_psd: float              # S_a, vibration acceleration PSD (m²/s⁴/Hz) — MEASURED
+    accel_input: Optional[float] = None     # a, true input acceleration (m/s²) if known
+    omega_rad_s: float = 2.0 * math.pi      # ω for transfer-function eval (rad/s) — CONFIG
+    transverse_velocity_ms: float = 0.0     # v_⊥ for Coriolis term (m/s) — MEASURED
+    rotation_rate_rad_s: float = 0.0        # Ω, platform rotation rate (rad/s) — MEASURED
+    contrast0: Optional[float] = None       # C₀ initial contrast for decay model — CONFIG
+    coherence_time_s: Optional[float] = None  # τ_c contrast-decay time const (s) — MEASURED
+    label: str = "MEASURED"       # MEASURED (real instrument) | SAMPLE | DESIGN (honest)
+    source: str = "unspecified"   # e.g. "cai-readout", "honest-sample"
+    note: str = ""
+
+    def measured_accel(self, label_is_measured: bool) -> Optional[float]:
+        """Return accel_input ONLY if it is a genuine instrument reading (label MEASURED).
+        Otherwise None — a MODELED accel must NOT be reported as MEASURED.
+        """
+        if self.accel_input is None:
+            return None
+        return self.accel_input if label_is_measured else None
+
+
+# --------------------------------------------------------------------------- #
+# First-principles relations (all DERIVED / MODELED from the inputs)           #
+# Each function names its citation in the docstring.                           #
+# --------------------------------------------------------------------------- #
+def k_eff(wavelength_m: float) -> float:
+    """Effective two-photon wavevector k_eff = 4π/λ.
+
+    Kasevich-Chu (1991): a stimulated-Raman π/2–π–π/2 sequence imparts two photon recoils
+    per pulse, so the effective momentum kick uses k_eff = 2·k_photon = 2·(2π/λ) = 4π/λ.
+    """
+    if not (wavelength_m > 0.0):
+        raise ValueError("wavelength_m must be > 0")
+    return 4.0 * PI / wavelength_m
+
+
+def mach_zehnder_phase(keff: float, accel: float, T: float) -> float:
+    """Mach-Zehnder interferometer phase Φ = k_eff·a·T².
+
+    Peters et al. (2001) / Kasevich-Chu (1991): for the three-pulse geometry the leading
+    inertial phase shift is k_eff·a·T², where T is the pulse separation (interrogation
+    time). The T² dependence is the interrogation-time lever that drives sensitivity.
+    """
+    return keff * accel * T * T
+
+
+def shot_noise_phase(contrast: float, atom_number: float) -> float:
+    """Standard-quantum-limit phase noise σ_Φ = 1/(C·√N).
+
+    Atom-projection (shot) noise: N uncorrelated atoms read out at fringe contrast C give
+    a minimum resolvable phase 1/(C·√N). This is the SQL; sub-SQL needs entanglement and
+    is explicitly NOT modeled (see NOT_MODELED).
+    """
+    if not (contrast > 0.0):
+        raise ValueError("contrast must be > 0 for a defined shot-noise limit")
+    if not (atom_number > 0.0):
+        raise ValueError("atom_number must be > 0")
+    return 1.0 / (contrast * math.sqrt(atom_number))
+
+
+def accel_sensitivity_per_shot(sigma_phi: float, keff: float, T: float) -> float:
+    """Per-shot acceleration sensitivity σ_a = σ_Φ / (k_eff·T²).
+
+    Invert the Mach-Zehnder phase response (Peters 2001): a phase uncertainty σ_Φ maps to
+    an acceleration uncertainty σ_Φ/(k_eff·T²) per measurement shot.
+    """
+    denom = keff * T * T
+    if not (denom > 0.0):
+        raise ValueError("k_eff·T² must be > 0")
+    return sigma_phi / denom
+
+
+def asd_accel(sigma_a: float, cycle_time_s: float) -> float:
+    """Amplitude spectral density n_a = σ_a·√T_c (units m/s²/√Hz).
+
+    Freier et al. (2016): the real-device figure of merit. A per-shot uncertainty σ_a at a
+    cycle time T_c corresponds to an acceleration ASD of σ_a·√T_c. The PSD is n_a².
+    """
+    if not (cycle_time_s > 0.0):
+        raise ValueError("cycle_time_s must be > 0")
+    return sigma_a * math.sqrt(cycle_time_s)
+
+
+def contrast_decay(contrast0: float, t: float, tau_c: float) -> float:
+    """Contrast decay C(t) = C₀·exp(−t/τ_c).
+
+    Empirical/decoherence loss-of-fringe-visibility model: contrast decays exponentially
+    with a coherence time τ_c (dephasing, expansion, finite detection). Used to model how
+    contrast — and hence the SQL phase noise σ_Φ = 1/(C·√N) — degrades with T.
+    """
+    if not (tau_c > 0.0):
+        raise ValueError("tau_c must be > 0")
+    return contrast0 * math.exp(-t / tau_c)
+
+
+def vibration_transfer_magnitude(omega: float, T: float) -> float:
+    """Acceleration transfer-function magnitude |H(ω)| = (4/ω²)·sin²(ωT/2).
+
+    Cheinet et al. (2008): Fourier transform of the three-pulse sensitivity function gives
+    the interferometer's response to acceleration/phase noise at angular frequency ω. The
+    low-frequency limit |H| → T² recovers the DC Mach-Zehnder response.
+    """
+    if not (omega > 0.0):
+        raise ValueError("omega must be > 0 for the transfer function")
+    return (4.0 / (omega * omega)) * (math.sin(omega * T / 2.0) ** 2)
+
+
+def vibration_phase_variance(keff: float, accel_psd: float, T: float) -> float:
+    """White-acceleration-noise phase variance σ_Φ² = k_eff²·S_a·T³/3.
+
+    Cheinet et al. (2008): integrating the squared acceleration transfer function against a
+    WHITE acceleration PSD S_a yields k_eff²·S_a·T³/3. This is the dominant real-device
+    (vibration-limited) phase-noise term in unshielded operation.
+    """
+    return keff * keff * accel_psd * (T ** 3) / 3.0
+
+
+def coriolis_phase(keff: float, v_perp: float, omega_rot: float, T: float) -> float:
+    """Coriolis (rotation) phase Φ_cor = 2·k_eff·v_⊥·Ω·T².
+
+    Peters et al. (2001) / Kasevich-Chu (1991): a transverse atom velocity v_⊥ in a frame
+    rotating at Ω produces a Coriolis acceleration that biases the interferometer by
+    2·k_eff·v_⊥·Ω·T². This is the LEAD rotation term only; full 3-axis rotation coupling
+    is NOT modeled (see NOT_MODELED).
+    """
+    return 2.0 * keff * v_perp * omega_rot * T * T
+
+
+# --------------------------------------------------------------------------- #
+# The QUANTUM-SENSING-LIMITS CERTIFICATE                                       #
+# --------------------------------------------------------------------------- #
+@dataclass
+class QuantumSensingCertificate:
+    """Signer-ready certificate. MEASURED inputs vs MODELED limits, clearly split.
+
+    Every numeric field carries an explicit role: a value derived from a MEASURED input is
+    MODELED (computed via a cited formula); only echoed instrument readings are MEASURED.
+    """
+    certificate_type: str
+    # --- inputs echoed, each tagged MEASURED or CONFIG/SAMPLE ---
+    inputs: dict
+    # --- MODELED first-principles limits (all DERIVED from inputs via cited formulas) ---
+    k_eff_per_m: float                      # MODELED: 4π/λ
+    mz_phase_per_unit_accel_rad: float      # MODELED: k_eff·T² (phase per 1 m/s²)
+    mz_phase_modeled_rad: Optional[float]   # MODELED iff an accel input was provided
+    accel_was_measured: bool                # True only if accel came from a real reading
+    shot_noise_phase_rad: float             # MODELED: σ_Φ = 1/(C·√N) (SQL)
+    accel_sensitivity_per_shot: float       # MODELED: σ_a = σ_Φ/(k_eff·T²)
+    accel_asd: float                        # MODELED: n_a = σ_a·√T_c (m/s²/√Hz)
+    accel_psd_from_asd: float               # MODELED: n_a²
+    vibration_transfer_magnitude: float     # MODELED: |H(ω)| at the eval ω
+    vibration_phase_variance: float         # MODELED: k_eff²·S_a·T³/3
+    vibration_phase_rms_rad: float          # MODELED: sqrt of the above
+    coriolis_phase_rad: float               # MODELED: 2·k_eff·v_⊥·Ω·T²
+    contrast_at_T: Optional[float]          # MODELED iff a decay model (C₀,τ_c) was given
+    # --- honest verdict ---
+    at_or_above_standard_quantum_limit: bool  # noise floor not claimed below the SQL
+    summary: str
+    not_modeled: list = field(default_factory=lambda: list(NOT_MODELED))
+    attribution: dict = field(default_factory=lambda: SENSING_ATTRIBUTION)
+    doctrine: str = DOCTRINE
+    honest_inverse_of_free_energy: bool = True
+    labels: dict = field(default_factory=lambda: {
+        "MEASURED": "a real reading from the instrument (contrast, atom count, cycle time, "
+                    "vibration PSD, etc.) — NEVER a placeholder or modeled value",
+        "MODELED": "computed from inputs via a CITED established-physics formula",
+        "CONFIG": "a design/setpoint parameter (wavelength, T setpoint), not a reading",
+    })
+    lambda_note: str = ("Λ = Conjecture 1 (advisory). This certificate states physical "
+                        "FACTS (limits), not 'proven trust'. It makes NO sub-SQL / "
+                        "over-unity claim and carries an explicit NOT-MODELED list.")
+    inputs_hash: str = ""
+    timestamp_utc: float = 0.0
+    signature: None = None
+
+    def to_json(self, indent: int = 2) -> str:
+        return json.dumps(asdict(self), indent=indent, default=str)
+
+
+def _hash_inputs(sensor: MeasuredSensor) -> str:
+    canon = json.dumps(asdict(sensor), sort_keys=True, separators=(",", ":"), default=str)
+    return "sha256:" + hashlib.sha256(canon.encode()).hexdigest()
+
+
+# Accept only these honest labels for a value to be treated as a real instrument reading.
+_MEASURED_LABELS = {"MEASURED"}
+
+
+def _validate_sensor(sensor: MeasuredSensor) -> list:
+    """Return a list of HONESTY/physics problems. Empty list ⇒ inputs are usable.
+
+    This is the guard that prevents a fabricated/garbage input from being silently
+    accepted and labelled MEASURED. It checks finiteness, physical ranges, and label sanity.
+    """
+    problems = []
+
+    def _finite_pos(name, val, allow_zero=False):
+        if val is None:
+            return
+        if isinstance(val, bool) or not isinstance(val, (int, float)):
+            problems.append(f"{name} is not a real number ({val!r})")
+            return
+        if not math.isfinite(val):
+            problems.append(f"{name} is not finite ({val!r}) — fabricated/garbage input")
+            return
+        if val < 0 or (val == 0 and not allow_zero):
+            problems.append(f"{name} is out of physical range ({val!r})")
+
+    _finite_pos("wavelength_m", sensor.wavelength_m)
+    _finite_pos("interrogation_time_s", sensor.interrogation_time_s)
+    _finite_pos("atom_number", sensor.atom_number)
+    _finite_pos("cycle_time_s", sensor.cycle_time_s)
+    _finite_pos("accel_psd", sensor.accel_psd, allow_zero=True)
+    _finite_pos("omega_rad_s", sensor.omega_rad_s)
+    # contrast must be a real fraction in (0, 1]
+    c = sensor.contrast
+    if isinstance(c, bool) or not isinstance(c, (int, float)) or not math.isfinite(c):
+        problems.append(f"contrast is not a finite number ({c!r}) — fabricated/garbage")
+    elif not (0.0 < c <= 1.0):
+        problems.append(f"contrast {c!r} is outside the physical fringe range (0, 1]")
+    # optional fields that, if present, must be finite real numbers
+    for nm, v in (("accel_input", sensor.accel_input),
+                  ("transverse_velocity_ms", sensor.transverse_velocity_ms),
+                  ("rotation_rate_rad_s", sensor.rotation_rate_rad_s),
+                  ("coherence_time_s", sensor.coherence_time_s),
+                  ("contrast0", sensor.contrast0)):
+        if v is not None and (isinstance(v, bool) or not isinstance(v, (int, float))
+                              or not math.isfinite(v)):
+            problems.append(f"{nm} is not a finite number ({v!r}) — fabricated/garbage")
+    # label sanity: a value can only be MEASURED under an honest measured label
+    if sensor.label not in _MEASURED_LABELS | {"SAMPLE", "DESIGN"}:
+        problems.append(
+            f"label {sensor.label!r} is not an allowed honest label "
+            f"(MEASURED | SAMPLE | DESIGN)"
+        )
+    return problems
+
+
+def _rejected_certificate(sensor: MeasuredSensor, problems: list,
+                          msg: str) -> QuantumSensingCertificate:
+    """Build a clearly-REJECTED certificate for fabricated/garbage inputs (non-strict).
+
+    No physics is computed from the bad inputs and NOTHING is labelled MEASURED. The
+    certificate exists only to RECORD the honesty failure so it can never be mistaken for
+    a valid result. NaN sentinels mark fields that were NOT computed.
+    """
+    nan = float("nan")
+    return QuantumSensingCertificate(
+        certificate_type="szl/quantum-sensing-limits-certificate/v1/REJECTED",
+        inputs={
+            "label": sensor.label,
+            "source": sensor.source,
+            "REJECTED": True,
+            "atom_number_MEASURED": None,
+            "contrast_MEASURED": None,
+            "cycle_time_s_MEASURED": None,
+            "accel_psd_MEASURED": None,
+            "accel_input_MEASURED": None,
+            "validation_problems": problems,
+            "note": sensor.note,
+        },
+        k_eff_per_m=nan,
+        mz_phase_per_unit_accel_rad=nan,
+        mz_phase_modeled_rad=None,
+        accel_was_measured=False,
+        shot_noise_phase_rad=nan,
+        accel_sensitivity_per_shot=nan,
+        accel_asd=nan,
+        accel_psd_from_asd=nan,
+        vibration_transfer_magnitude=nan,
+        vibration_phase_variance=nan,
+        vibration_phase_rms_rad=nan,
+        coriolis_phase_rad=nan,
+        contrast_at_T=None,
+        at_or_above_standard_quantum_limit=False,
+        summary="REJECTED — " + msg + " No limits were computed; nothing labelled MEASURED.",
+        inputs_hash=_hash_inputs(sensor),
+        timestamp_utc=time.time(),
+    )
+
+
+def certify_sensor(sensor: MeasuredSensor, strict: bool = True) -> QuantumSensingCertificate:
+    """Compute the QUANTUM-SENSING-LIMITS CERTIFICATE for one CAI operating point.
+
+    Returns a certificate stating: this sensor's effective wavevector k_eff, its
+    Mach-Zehnder phase response, its standard-quantum-limit (shot-noise) phase floor and
+    the per-shot / ASD acceleration sensitivity it implies, the vibration-limited phase
+    variance σ_Φ² = k_eff²·S_a·T³/3, and the lead Coriolis bias — every value labelled
+    MEASURED (only if a real reading) vs MODELED, with an explicit NOT-MODELED list.
+
+    HONESTY GUARD: if ``strict`` (default), a fabricated/garbage or out-of-range input
+    raises ValueError rather than being silently certified. An accel input is reported as
+    MEASURED ONLY if the whole record is labelled MEASURED; otherwise it is MODELED.
+    """
+    problems = _validate_sensor(sensor)
+    if problems:
+        msg = ("HONESTY GUARD: sensor inputs rejected (will NOT be silently labelled "
+               "MEASURED): " + "; ".join(problems))
+        if strict:
+            raise ValueError(msg)
+        # NON-STRICT: do NOT fabricate or compute limits from garbage. Return a clearly
+        # REJECTED certificate that records the problems and labels NOTHING as MEASURED.
+        return _rejected_certificate(sensor, problems, msg)
+
+    label_is_measured = sensor.label in _MEASURED_LABELS
+    lam = sensor.wavelength_m
+    T = sensor.interrogation_time_s
+    N = sensor.atom_number
+    C = sensor.contrast
+    Tc = sensor.cycle_time_s
+    Sa = sensor.accel_psd
+
+    keff = k_eff(lam)
+    phase_per_accel = keff * T * T  # MODELED: rad per (m/s²)
+
+    # MEASURED vs MODELED accel: only honour an accel reading if the record is MEASURED.
+    measured_a = sensor.measured_accel(label_is_measured)
+    accel_for_phase = sensor.accel_input  # may still model a phase for a DESIGN/SAMPLE a
+    mz_phase = (mach_zehnder_phase(keff, accel_for_phase, T)
+                if accel_for_phase is not None else None)
+
+    sigma_phi = shot_noise_phase(C, N)                      # SQL
+    sigma_a = accel_sensitivity_per_shot(sigma_phi, keff, T)
+    n_a = asd_accel(sigma_a, Tc)
+    psd_from_asd = n_a * n_a
+
+    H_mag = vibration_transfer_magnitude(sensor.omega_rad_s, T)
+    vib_var = vibration_phase_variance(keff, Sa, T)
+    vib_rms = math.sqrt(vib_var)
+
+    cor_phase = coriolis_phase(keff, sensor.transverse_velocity_ms,
+                               sensor.rotation_rate_rad_s, T)
+
+    contrast_T = None
+    if sensor.contrast0 is not None and sensor.coherence_time_s is not None:
+        contrast_T = contrast_decay(sensor.contrast0, T, sensor.coherence_time_s)
+
+    # Honest verdict: the reported noise floor σ_Φ is AT/ABOVE the SQL by construction
+    # (we never assert a sub-shot-noise figure). True ⇒ no sub-SQL/over-unity claim made.
+    at_or_above_sql = sigma_phi >= shot_noise_phase(C, N) - 1e-18
+
+    a_phase_str = (f"{mz_phase:.4g} rad ({'MEASURED-fed' if measured_a is not None else 'MODELED-input'})"
+                   if mz_phase is not None else "n/a (no acceleration input supplied)")
+    summary = (
+        f"Cold-atom interferometer @ λ={lam:g} m, T={T:g} s, N={N:.4g} atoms, C={C:g} "
+        f"(label={sensor.label}, source={sensor.source}). MODELED: k_eff={keff:.6g} m⁻¹ "
+        f"(=4π/λ, Kasevich-Chu 1991); Mach-Zehnder response {phase_per_accel:.4g} rad per "
+        f"m/s² (=k_eff·T², Peters 2001); phase for the supplied acceleration = {a_phase_str}. "
+        f"STANDARD QUANTUM LIMIT phase floor σ_Φ={sigma_phi:.4g} rad (=1/(C·√N)) ⇒ per-shot "
+        f"σ_a={sigma_a:.4g} m/s² ⇒ ASD n_a={n_a:.4g} m/s²/√Hz (=σ_a·√T_c, Freier 2016). "
+        f"Vibration-limited phase: |H(ω)|={H_mag:.4g} s² at ω={sensor.omega_rad_s:g} rad/s, "
+        f"σ_Φ²={vib_var:.4g} rad² (=k_eff²·S_a·T³/3, Cheinet 2008) ⇒ σ_Φ,vib={vib_rms:.4g} "
+        f"rad. Lead Coriolis bias Φ_cor={cor_phase:.4g} rad (=2·k_eff·v_⊥·Ω·T²). VERDICT: "
+        f"the sensor is BOUNDED by the standard quantum limit — the honest inverse of a "
+        f"free-energy claim. NO sub-SQL/over-unity claim. {len(NOT_MODELED)} systematic "
+        f"classes are explicitly NOT MODELED (laser-phase noise, AC-Stark/light-shift, "
+        f"full 3-axis mechanization, detection noise, Dick aliasing, mean-field shifts) — "
+        f"this is a noise-floor certificate, NOT a complete error budget."
+    )
+
+    return QuantumSensingCertificate(
+        certificate_type="szl/quantum-sensing-limits-certificate/v1",
+        inputs={
+            "label": sensor.label,
+            "source": sensor.source,
+            "wavelength_m_CONFIG": lam,
+            "interrogation_time_s_CONFIG": T,
+            "atom_number_MEASURED": N if label_is_measured else None,
+            "atom_number_value": N,
+            "contrast_MEASURED": C if label_is_measured else None,
+            "contrast_value": C,
+            "cycle_time_s_MEASURED": Tc if label_is_measured else None,
+            "cycle_time_s_value": Tc,
+            "accel_psd_MEASURED": Sa if label_is_measured else None,
+            "accel_psd_value": Sa,
+            "accel_input_MEASURED": measured_a,  # None unless a genuine reading
+            "accel_input_value": sensor.accel_input,
+            "omega_rad_s_CONFIG": sensor.omega_rad_s,
+            "transverse_velocity_ms": sensor.transverse_velocity_ms,
+            "rotation_rate_rad_s": sensor.rotation_rate_rad_s,
+            "contrast0_CONFIG": sensor.contrast0,
+            "coherence_time_s": sensor.coherence_time_s,
+            "validation_problems": problems,  # empty unless strict=False let issues through
+            "note": sensor.note,
+        },
+        k_eff_per_m=keff,
+        mz_phase_per_unit_accel_rad=phase_per_accel,
+        mz_phase_modeled_rad=mz_phase,
+        accel_was_measured=(measured_a is not None),
+        shot_noise_phase_rad=sigma_phi,
+        accel_sensitivity_per_shot=sigma_a,
+        accel_asd=n_a,
+        accel_psd_from_asd=psd_from_asd,
+        vibration_transfer_magnitude=H_mag,
+        vibration_phase_variance=vib_var,
+        vibration_phase_rms_rad=vib_rms,
+        coriolis_phase_rad=cor_phase,
+        contrast_at_T=contrast_T,
+        at_or_above_standard_quantum_limit=bool(at_or_above_sql),
+        summary=summary,
+        inputs_hash=_hash_inputs(sensor),
+        timestamp_utc=time.time(),
+    )
+
+
+def honest_sample_sensor() -> MeasuredSensor:
+    """An HONEST, CLEARLY-LABELLED sample operating point (NOT a real instrument reading).
+
+    Values are representative of a Rb-87 fountain CAI (λ≈780 nm, T≈0.1 s) but the record is
+    labelled SAMPLE so the certifier will NOT report them as MEASURED. No fabricated claim.
+    """
+    return MeasuredSensor(
+        wavelength_m=780.0e-9,        # Rb-87 D2 line, design wavelength
+        interrogation_time_s=0.1,     # 100 ms pulse separation
+        atom_number=1.0e6,            # ~10^6 atoms
+        contrast=0.5,                 # 50% fringe contrast
+        cycle_time_s=0.5,             # 0.5 s cycle (2 Hz)
+        accel_psd=1.0e-8,             # m²/s⁴/Hz, representative ground vibration
+        accel_input=9.81,            # g, supplied as DESIGN input (NOT a reading)
+        omega_rad_s=2.0 * math.pi * 1.0,   # evaluate |H| at 1 Hz
+        transverse_velocity_ms=0.01,
+        rotation_rate_rad_s=7.292115e-5,   # Earth rotation rate (sidereal)
+        contrast0=0.6,
+        coherence_time_s=0.3,
+        label="SAMPLE",
+        source="honest-sample",
+        note="Representative Rb-87 CAI operating point. SAMPLE label ⇒ not MEASURED.",
+    )
+
+
+__all__ = [
+    "K_B", "H_PLANCK", "HBAR", "C_LIGHT", "PI",
+    "SENSING_ATTRIBUTION", "DOCTRINE", "NOT_MODELED",
+    "MeasuredSensor", "QuantumSensingCertificate", "certify_sensor",
+    "k_eff", "mach_zehnder_phase", "shot_noise_phase", "accel_sensitivity_per_shot",
+    "asd_accel", "contrast_decay", "vibration_transfer_magnitude",
+    "vibration_phase_variance", "coriolis_phase", "honest_sample_sensor",
+]
+
+
+if __name__ == "__main__":
+    sensor = honest_sample_sensor()
+    cert = certify_sensor(sensor)
+    print("SZL QUANTUM-SENSING-LIMITS CERTIFICATE (honest sample)\n" + "=" * 60)
+    print(cert.summary)
+    print("=" * 60)
+    print(f"k_eff                 : {cert.k_eff_per_m:.6g} m⁻¹")
+    print(f"SQL phase floor σ_Φ   : {cert.shot_noise_phase_rad:.4g} rad")
+    print(f"per-shot σ_a          : {cert.accel_sensitivity_per_shot:.4g} m/s²")
+    print(f"ASD n_a               : {cert.accel_asd:.4g} m/s²/√Hz")
+    print(f"vibration σ_Φ² (T³/3) : {cert.vibration_phase_variance:.4g} rad²")
+    print(f"Coriolis Φ_cor        : {cert.coriolis_phase_rad:.4g} rad")
+    print(f"contrast C(T)         : {cert.contrast_at_T}")
+    print(f"at/above SQL (honest) : {cert.at_or_above_standard_quantum_limit}")
+    print(f"NOT MODELED classes   : {len(cert.not_modeled)}")

serve.py

@@ -301,6 +301,20 @@ try:
 except Exception as _szl_pinn_e:  # pragma: no cover
     print(f"[a11oy] Agentic-PINN + physical-bounds mesh NOT registered: {_szl_pinn_e!r}", file=__import__("sys").stderr)
 
+# ── PNT / quantum-sensing mesh — clean-room re-derivation of the physics (quantum
+# sensor limits, GNSS spoof-resilience, GPS-denied coasting, fundamental limits).
+# PURE STDLIB closed-form web path (never blocks); the heavy numpy/UKF/PINN solves are
+# the Forge/GPU path on rtx-betterwithage + chaski. Every value labelled MEASURED/MODELED,
+# Λ=Conjecture 1 (advisory). The 4 engine modules are loaded dynamically by szl_pnt_mesh
+# (importlib) — they MUST be COPY'd into the image too or the mesh falls back to a stub.
+# Additive, try/except-guarded, before the SPA catch-all.
+try:
+    import szl_pnt_mesh as _szl_pnt_mesh
+    _szl_pnt_mesh.register(app, ns="a11oy")
+    print("[a11oy] PNT/quantum-sensing mesh registered: /api/a11oy/v1/pnt/*", file=__import__("sys").stderr)
+except Exception as _szl_pnt_e:  # pragma: no cover
+    print(f"[a11oy] PNT mesh NOT registered: {_szl_pnt_e!r}", file=__import__("sys").stderr)
+
 # ── Unified leader-formulas (thesis v6) — Sherman Morgan density-impulse/Tsiolkovsky,
 # Stewart LS12/CoRoL/Hugoniot, Wave24 coherence single-crossing. Each is REAL deterministic
 # Python with the ORIGINAL author cited; SZL borrows methodological structure only (no result

szl_pnt_mesh.py

@@ -0,0 +1,510 @@
+# SPDX-License-Identifier: Apache-2.0
+# © 2026 SZL Holdings · Doctrine v11 LOCKED · Λ = Conjecture 1 (advisory, NOT proven trust)
+# Sign-off: Stephen P. Lutar Jr. <stephenlutar2@gmail.com>
+"""szl_pnt_mesh.py — a11oy MESH for the SZL PNT / QUANTUM-SENSING vertical.
+
+This is the live-mesh surface for the SECOND hard-physics pillar (sensing limits)
+next to the compute-bounds pillar already served by `szl_pinn_bounds.py`. It exposes
+the UNIFIED "fundamental-limits" library (compute bounds + quantum sensing) behind
+a11oy's governed `/api/<ns>/v1/pnt/*` route table.
+
+Routes (all GET, read-only / deterministic):
+
+  /api/<ns>/v1/pnt              capability index + doctrine + links (both pillars)
+  /api/<ns>/v1/pnt/sensor       quantum-sensor limit certificate from query params
+                                (cold-atom-interferometer shot-noise / SQL sensitivity;
+                                 Kasevich-Chu 1991, Peters 2001, Freier 2016, Cheinet 2008)
+  /api/<ns>/v1/pnt/resilience   fused multi-layer GNSS spoof-detector verdict from query
+                                params (RAIM-consistency + AGC + SQM), deny-by-default
+  /api/<ns>/v1/pnt/coast        GPS-denied coasting figure-of-merit: classical vs quantum
+  /api/<ns>/v1/pnt/limits       the UNIFIED fundamental-limits index (BOTH pillars:
+                                compute_bounds + quantum_sensor + pnt_resilience + nav_coasting)
+
+HONESTY (Doctrine v11, HARD):
+  - Sensor limits are DERIVED from established physics (shot-noise / standard quantum
+    limit), labelled MODELED. The compute-bounds certificate is the HONEST INVERSE of a
+    free-energy claim. NO over-unity, NO sub-SQL magic, NO fabricated number.
+  - Bounds/physics are CITED, re-derived clean-room from the papers and the kshana method
+    (Apache-2.0, DOI 10.5281/zenodo.20528627). No verbatim code copied.
+  - Λ = Conjecture 1 (advisory). ALLOW/NOMINAL = "passed SZL admission policy", never
+    "proven trust". Spoof governor is deny-by-default.
+  - HEAVY numpy solves (full UKF fusion, batched sensor sweeps, PINN solves) are the
+    Forge / GPU / own-metal path. This stdlib mesh READS & AGGREGATES the unified library
+    and re-derives the lightweight closed-form limits; it NEVER blocks on a heavy solve.
+  - If a sibling engine (Dev1 quantum_sensing_limits, Dev2 pnt_resilience, Dev3
+    nav_coasting) is not present, the unified library returns an HONEST "module not wired
+    yet"/clean-room-MODELED result; this mesh surfaces that honestly — never a false green.
+
+Matches the `szl_pinn_bounds.py` contract exactly: pure-stdlib request path, FastAPI
+`add_api_route` with a Starlette `Route` fallback, try/except-guarded `register(app, ns)`.
+"""
+import importlib
+import json
+import math
+import os
+import sys
+import time
+from datetime import datetime, timezone
+
+try:  # Starlette is present in the a11oy image (same as szl_pinn_bounds.py).
+    from starlette.requests import Request
+    from starlette.responses import JSONResponse
+except Exception:  # pragma: no cover - allows import in a bare env for tests
+    Request = object  # type: ignore
+
+    class JSONResponse:  # minimal shim so handlers can be unit-tested w/o starlette
+        def __init__(self, content, status_code=200):
+            self.body = content
+            self.status_code = status_code
+
+# Make the unified library importable from this directory regardless of CWD.
+_THIS_DIR = os.path.dirname(os.path.abspath(__file__))
+if _THIS_DIR not in sys.path:
+    sys.path.insert(0, _THIS_DIR)
+
+
+def _load_fl():
+    """Lazily import the unified fundamental-limits library. Honest None on failure."""
+    try:
+        return importlib.import_module("fundamental_limits")
+    except Exception:
+        return None
+
+
+# --------------------------------------------------------------------------- #
+# Doctrine strings (mirrors the unified library; carried on every response).   #
+# --------------------------------------------------------------------------- #
+DOCTRINE = (
+    "v11 LOCKED: NO free-energy/over-unity (compute certificate is the honest INVERSE; "
+    "sensor limits DERIVED from physics, never sub-SQL magic); MEASURED vs MODELED vs "
+    "SAMPLE labels on every result; honest 'NOT MODELED'/'module not wired yet' where "
+    "physics is incomplete; established bounds CITED not claimed as SZL's; clean-room "
+    "(re-derived from papers, kshana cited not copied); Λ=Conjecture 1 (advisory, "
+    "deny-by-default, never 'proven trust'); sovereign own-metal; no fabricated numbers."
+)
+
+LAMBDA_NOTE = (
+    "Λ = Conjecture 1 (advisory governance gate). ALLOW/NOMINAL = 'passed SZL admission "
+    "policy', NEVER 'proven trust'. Deny-by-default. States physical FACTS/BOUNDS, not trust."
+)
+
+SENSING_ATTRIBUTION = {
+    "kasevich_chu_1991": ("Kasevich, M. & Chu, S. (1991), Phys. Rev. Lett. 67(2):181, "
+                          "doi:10.1103/PhysRevLett.67.181."),
+    "peters_2001": ("Peters, A., Chung, K.Y. & Chu, S. (2001), Metrologia 38(1):25, "
+                    "doi:10.1088/0026-1394/38/1/4."),
+    "freier_2016": ("Freier, C. et al. (2016), J. Phys. Conf. Ser. 723:012050, "
+                    "doi:10.1088/1742-6596/723/1/012050."),
+    "cheinet_2008": ("Cheinet, P. et al. (2008), IEEE Trans. Instrum. Meas. 57(6):1141, "
+                     "doi:10.1109/TIM.2007.915148."),
+    "kshana": ("AshfordeOU/kshana (Apache-2.0, DOI 10.5281/zenodo.20528627) — method & "
+               "physics CITED, re-derived clean-room. No verbatim code copied."),
+}
+
+
+def _now_iso() -> str:
+    return datetime.now(timezone.utc).isoformat(timespec="seconds").replace("+00:00", "Z")
+
+
+# --------------------------------------------------------------------------- #
+# Pure-stdlib closed-form physics (used directly in the web path — no numpy).  #
+# Math mirrors the unified library / Dev1 so the live mesh and on-metal AGREE.  #
+# --------------------------------------------------------------------------- #
+def _sensor_limit(lambda_m, T, N, C, Tc):
+    """SQL CAI accelerometer sensitivity — pure stdlib (no numpy).
+
+    k_eff = 4π/λ ; σ_Φ = 1/(C·√N) ; σ_a = σ_Φ/(k_eff·T²) ; n_a = σ_a·√T_c.
+    Lineage: Kasevich-Chu 1991, Peters 2001, Freier 2016, Cheinet 2008.
+    """
+    k_eff = 4.0 * math.pi / lambda_m if lambda_m > 0 else float("inf")
+    sigma_phi = 1.0 / (C * math.sqrt(N)) if (C > 0 and N > 0) else float("inf")
+    denom = k_eff * T * T
+    sigma_a = (sigma_phi / denom) if denom > 0 else float("inf")
+    asd = sigma_a * math.sqrt(Tc) if Tc > 0 else float("inf")
+    return {
+        "k_eff_per_m": k_eff,
+        "shot_noise_phase_rad": sigma_phi,
+        "per_shot_accel_sensitivity_m_s2": sigma_a,
+        "accel_asd_m_s2_per_sqrt_hz": asd,
+        "inputs": {"wavelength_m": lambda_m, "interrogation_time_s": T,
+                   "atom_number": N, "contrast": C, "cycle_time_s": Tc},
+        "formulas": {"k_eff": "4*pi/lambda", "shot_noise": "1/(C*sqrt(N)) (SQL)",
+                     "per_shot_accel": "sigma_Phi/(k_eff*T^2)", "asd": "sigma_a*sqrt(T_c)"},
+        "label": "MODELED",
+        "at_or_above_standard_quantum_limit": True,
+    }
+
+
+def _spoof_verdict(raim_m, agc_db, sqm_dev, raim_thr, agc_thr, sqm_thr):
+    """Pure-stdlib deny-by-default multi-layer spoof fusion (RAIM + AGC + SQM).
+
+    A transparent web-path stand-in for the Dev2 engine: any single layer fired ->
+    SUSPECT; >=2 -> SPOOF_LIKELY (DENY); 0 -> NOMINAL (ALLOW). Advisory (Λ).
+    """
+    flags = {
+        "raim_consistency": raim_m > raim_thr,
+        "agc_power": agc_db > agc_thr,
+        "sqm_asymmetry": abs(sqm_dev) > sqm_thr,
+    }
+    n = sum(1 for v in flags.values() if v)
+    if n >= 2:
+        verdict, allow = "DENY", False
+    elif n == 1:
+        verdict, allow = "ADVISORY", False
+    else:
+        verdict, allow = "ALLOW", True
+    return {
+        "verdict": verdict,
+        "allow": allow,
+        "advisory": True,
+        "n_layers_fired": n,
+        "layers": flags,
+        "inputs": {"raim_consistency_m": raim_m, "agc_advantage_db": agc_db,
+                   "sqm_early_minus_late": sqm_dev},
+        "thresholds": {"raim_threshold_m": raim_thr, "agc_threshold_db": agc_thr,
+                       "sqm_threshold": sqm_thr},
+        "fusion": "deny-by-default: >=2 fired -> DENY, 1 -> ADVISORY, 0 -> ALLOW",
+        "label": "MODELED",
+    }
+
+
+def _coast_fom(t, n_classical, n_quantum):
+    """GPS-denied coasting position-error growth: sigma_x(t) ~= n_a * t^1.5 / sqrt(3)."""
+    def pe(n):
+        return n * (t ** 1.5) / math.sqrt(3.0)
+    ec, eq = pe(n_classical), pe(n_quantum)
+    return {
+        "coast_time_s": t,
+        "classical": {"accel_asd_m_s2_per_sqrt_hz": n_classical, "position_error_m": ec},
+        "quantum": {"accel_asd_m_s2_per_sqrt_hz": n_quantum, "position_error_m": eq},
+        "quantum_over_classical_improvement_factor": (ec / eq) if eq > 0 else float("inf"),
+        "model": ("white-acceleration-noise random walk, double-integrated: "
+                  "sigma_x(t) ~= n_a * t^1.5 / sqrt(3). MODELED scaling."),
+        "label": "MODELED",
+    }
+
+
+# --------------------------------------------------------------------------- #
+# Query-param helpers                                                          #
+# --------------------------------------------------------------------------- #
+def _f(qp, *keys, default=0.0):
+    for k in keys:
+        v = qp.get(k)
+        if v not in (None, ""):
+            try:
+                return float(v)
+            except Exception:
+                pass
+    return float(default)
+
+
+def _qp(req):
+    """Extract a query-param mapping from a Starlette Request OR a plain dict (tests)."""
+    if isinstance(req, dict):
+        return req
+    return getattr(req, "query_params", {}) or {}
+
+
+# --------------------------------------------------------------------------- #
+# Handlers                                                                     #
+# --------------------------------------------------------------------------- #
+def _h_index(req: Request):
+    ns = "a11oy"
+    if not isinstance(req, dict):
+        ns = getattr(req, "path_params", {}).get("_ns", "a11oy")
+    base = f"/api/{ns}/v1/pnt"
+    fl = _load_fl()
+    pillars = fl.status().get("pillars") if fl else {"error": "unified library not importable"}
+    return JSONResponse({
+        "capability": "SZL PNT / Quantum-Sensing vertical — the SECOND hard-physics pillar",
+        "frontier": ("quantum + classical sensing for Positioning-Navigation-Timing, "
+                     "unified with the compute-bounds certifier into one governed "
+                     "'fundamental-limits' surface — every result MEASURED/MODELED-labelled, "
+                     "Λ-gated, clean-room re-derived from the kshana method + the papers"),
+        "pillars": ["compute_bounds (Landauer/ML/Bremermann/Bekenstein — szl_pinn_bounds)",
+                    "quantum_sensor (cold-atom interferometer SQL — Dev1)",
+                    "pnt_resilience (fused spoof detector — Dev2)",
+                    "nav_coasting (GPS-denied coasting FoM — Dev3)"],
+        "engine_status": pillars,
+        "routes": {
+            f"{base}/sensor": ("quantum-sensor limit certificate "
+                               "(?wavelength_m=&interrogation_time_s=&atom_number=&contrast=&cycle_time_s=)"),
+            f"{base}/resilience": ("fused spoof-detector verdict "
+                                   "(?raim_consistency_m=&agc_advantage_db=&sqm_early_minus_late=  "
+                                   "or ?scenario=clean|ds2_time_push|ds3_overpower|ds4_seamless|ds7_matched_aligned)"),
+            f"{base}/coast": ("GPS-denied coasting FoM classical vs quantum "
+                              "(?coast_time_s=&classical_asd=&quantum_asd=)"),
+            f"{base}/limits": "the UNIFIED fundamental-limits index (both pillars)",
+        },
+        "attribution": {"sensing": SENSING_ATTRIBUTION},
+        "lambda_note": LAMBDA_NOTE,
+        "doctrine": DOCTRINE,
+        "honest_inverse_of_free_energy": True,
+        "ts": _now_iso(),
+    })
+
+
+def _h_sensor(req: Request):
+    qp = _qp(req)
+    lam = _f(qp, "wavelength_m", "lambda_m", default=780e-9)
+    T = _f(qp, "interrogation_time_s", "T", default=0.1)
+    N = _f(qp, "atom_number", "N", default=1e6)
+    C = _f(qp, "contrast", "C", default=0.5)
+    Tc = _f(qp, "cycle_time_s", "Tc", default=0.5)
+    # Try the unified library (which wraps the Dev1 engine when present); the closed-form
+    # stdlib derivation is the always-available web-path answer.
+    closed_form = _sensor_limit(lam, T, N, C, Tc)
+    engine = None
+    fl = _load_fl()
+    if fl is not None:
+        try:
+            res = fl.certify("quantum_sensor", wavelength_m=lam, interrogation_time_s=T,
+                             atom_number=N, contrast=C, cycle_time_s=Tc)
+            engine = {"source": res.get("source"), "label": res.get("label"),
+                      "wired": res.get("wired"), "certificate": res.get("result")}
+        except Exception as e:
+            engine = {"error": repr(e), "note": "unified library call failed; closed-form used"}
+    return JSONResponse({
+        "model": "SZL Quantum-Sensing-Limits — live CAI sensitivity certificate",
+        "status": "VERIFIED (MODELED physics) · UNSIGNED (STRUCTURAL-ONLY)",
+        "label": "MODELED",
+        "closed_form_stdlib": closed_form,
+        "engine": engine,
+        "attribution": SENSING_ATTRIBUTION,
+        "lambda_note": LAMBDA_NOTE,
+        "doctrine": DOCTRINE,
+        "honest_inverse_of_free_energy": True,
+    })
+
+
+def _h_resilience(req: Request):
+    qp = _qp(req)
+    scenario = qp.get("scenario")
+    engine = None
+    fl = _load_fl()
+    # Prefer the Dev2 engine via the unified library when a scenario is requested (it
+    # carries the calibrated chi-square monitor fusion). Heavy numpy stays in the engine;
+    # the mesh tolerates failure and always answers with the closed-form fusion.
+    if fl is not None and scenario:
+        try:
+            res = fl.certify("pnt_resilience", scenario=scenario, seed=int(_f(qp, "seed", default=0)))
+            engine = {"source": res.get("source"), "label": res.get("label"),
+                      "wired": res.get("wired"), "verdict": res.get("result")}
+        except Exception as e:
+            engine = {"error": repr(e)}
+    raim = _f(qp, "raim_consistency_m", "raim_m", default=0.0)
+    agc = _f(qp, "agc_advantage_db", "agc_db", default=0.0)
+    sqm = _f(qp, "sqm_early_minus_late", "sqm", default=0.0)
+    raim_thr = _f(qp, "raim_threshold_m", default=30.0)
+    agc_thr = _f(qp, "agc_threshold_db", default=1.5)
+    sqm_thr = _f(qp, "sqm_threshold", default=0.12)
+    closed_form = _spoof_verdict(raim, agc, sqm, raim_thr, agc_thr, sqm_thr)
+    return JSONResponse({
+        "model": "SZL PNT-Resilience — fused multi-layer spoof verdict",
+        "status": f"{closed_form['verdict']} (advisory, deny-by-default)",
+        "label": "MODELED",
+        "closed_form_stdlib": closed_form,
+        "engine": engine,
+        "note": ("RAIM-consistency + AGC-power + SQM-asymmetry fused deny-by-default. The "
+                 "full calibrated chi-square detector with TEXBAT-style scenarios runs in "
+                 "the Dev2 engine (numpy); this stdlib mesh answers with a transparent "
+                 "closed-form fusion and surfaces the engine verdict when present."),
+        "attribution": SENSING_ATTRIBUTION,
+        "lambda_note": LAMBDA_NOTE,
+        "doctrine": DOCTRINE,
+    })
+
+
+def _h_coast(req: Request):
+    qp = _qp(req)
+    t = _f(qp, "coast_time_s", "t", default=60.0)
+    n_c = _f(qp, "classical_asd", "classical_asd_m_s2_per_sqrt_hz", default=1e-3)
+    # Default quantum ASD comes from the closed-form CAI derivation unless supplied.
+    if any(k in qp for k in ("quantum_asd", "quantum_asd_m_s2_per_sqrt_hz")):
+        n_q = _f(qp, "quantum_asd", "quantum_asd_m_s2_per_sqrt_hz", default=1e-8)
+    else:
+        n_q = _sensor_limit(780e-9, 0.1, 1e6, 0.5, 0.5)["accel_asd_m_s2_per_sqrt_hz"]
+    closed_form = _coast_fom(t, n_c, n_q)
+    engine = None
+    fl = _load_fl()
+    if fl is not None:
+        try:
+            res = fl.certify("nav_coasting", coast_time_s=t,
+                             classical_asd_m_s2_per_sqrt_hz=n_c,
+                             quantum_asd_m_s2_per_sqrt_hz=n_q)
+            engine = {"source": res.get("source"), "label": res.get("label"),
+                      "wired": res.get("wired"), "result": res.get("result")}
+        except Exception as e:
+            engine = {"error": repr(e)}
+    return JSONResponse({
+        "model": "SZL Nav-Coasting — GPS-denied position-error FoM (classical vs quantum)",
+        "status": "VERIFIED (MODELED scaling) · UNSIGNED (STRUCTURAL-ONLY)",
+        "label": "MODELED",
+        "closed_form_stdlib": closed_form,
+        "engine": engine,
+        "note": ("The full INS/UKF error-covariance propagation (17-state, coupled clock) "
+                 "is the Dev3 / Forge GPU path. This mesh answers with the closed-form "
+                 "random-walk coasting scaling — MODELED, not a fabricated number."),
+        "attribution": SENSING_ATTRIBUTION,
+        "lambda_note": LAMBDA_NOTE,
+        "doctrine": DOCTRINE,
+    })
+
+
+def _h_limits(req: Request):
+    """The UNIFIED fundamental-limits index: BOTH pillars, honest wiring discovery."""
+    fl = _load_fl()
+    if fl is None:
+        return JSONResponse({
+            "model": "SZL Unified Fundamental-Limits index",
+            "status": "UNIFIED_LIBRARY_NOT_IMPORTABLE",
+            "note": ("fundamental_limits.py not importable in this environment — honest "
+                     "state, no fabricated number."),
+            "doctrine": DOCTRINE,
+            "lambda_note": LAMBDA_NOTE,
+        }, status_code=200)
+    st = fl.status()
+    return JSONResponse({
+        "model": "SZL Unified Fundamental-Limits index — both hard-physics pillars",
+        "library": st.get("library"),
+        "pillars": st.get("pillars"),
+        "kinds": st.get("kinds"),
+        "pillar_A_compute_bounds": ("Landauer 1961 / Margolus-Levitin 1998 / Bremermann "
+                                    "1962 / Bekenstein 1981 / Bekenstein-Hawking 1975 — the "
+                                    "HONEST INVERSE of a free-energy claim (szl_pinn_bounds)"),
+        "pillar_B_quantum_sensing": ("cold-atom interferometer SQL (Dev1) + fused spoof "
+                                     "detector (Dev2) + GPS-denied coasting FoM (Dev3) — "
+                                     "re-derived clean-room from the kshana method + papers"),
+        "labels": st.get("labels"),
+        "attribution": st.get("attribution"),
+        "honest_inverse_of_free_energy": st.get("honest_inverse_of_free_energy"),
+        "lambda_note": st.get("lambda_note"),
+        "doctrine": st.get("doctrine"),
+        "ts": _now_iso(),
+    })
+
+
+# --------------------------------------------------------------------------- #
+# Registration — mirrors szl_pinn_bounds.register exactly.                     #
+# --------------------------------------------------------------------------- #
+def register(app, ns="a11oy"):
+    """Wire the PNT / quantum-sensing mesh onto the app under /api/<ns>/v1/pnt/*.
+
+    Additive. Uses FastAPI's add_api_route when available (matches the sibling szl_*
+    modules so resolution order is correct vs the SPA catch-all); falls back to a
+    Starlette route append for a bare Starlette app.
+    """
+    base = f"/api/{ns}/v1/pnt"
+    handlers = [
+        (base, _h_index),
+        (f"{base}/sensor", _h_sensor),
+        (f"{base}/resilience", _h_resilience),
+        (f"{base}/coast", _h_coast),
+        (f"{base}/limits", _h_limits),
+    ]
+    add_api_route = getattr(app, "add_api_route", None)
+    for path, fn in handlers:
+        if callable(add_api_route):
+            app.add_api_route(path, fn, methods=["GET"])
+        else:
+            from starlette.routing import Route
+            app.router.routes.append(Route(path, fn))
+    return [p for p, _ in handlers]
+
+
+def _selftest() -> dict:
+    """No-server self-test: proves register() adds routes and handlers answer honestly.
+
+    Doctrine labels are checked end-to-end: MODELED/MEASURED carried, Λ=Conjecture 1
+    advisory present, honest-inverse-of-free-energy preserved.
+    """
+    out = {}
+
+    def _body(resp):
+        """Decode a handler response to a dict, whether real Starlette JSONResponse
+        (bytes body) or the test shim (dict body)."""
+        b = getattr(resp, "body", resp)
+        if isinstance(b, (bytes, bytearray)):
+            return json.loads(b.decode())
+        if isinstance(b, str):
+            return json.loads(b)
+        return b
+
+    # (a) register() adds exactly the 5 routes onto a FastAPI-like app.
+    class _FakeApp:
+        def __init__(self):
+            self.routes = []
+
+        def add_api_route(self, path, fn, methods=None):
+            self.routes.append((path, fn, tuple(methods or [])))
+
+    app = _FakeApp()
+    added = register(app, ns="a11oy")
+    expected = ["/api/a11oy/v1/pnt", "/api/a11oy/v1/pnt/sensor",
+                "/api/a11oy/v1/pnt/resilience", "/api/a11oy/v1/pnt/coast",
+                "/api/a11oy/v1/pnt/limits"]
+    assert added == expected, added
+    assert [r[0] for r in app.routes] == expected
+    assert all(r[2] == ("GET",) for r in app.routes)
+    out["register_adds_5_routes"] = True
+
+    # (b) Starlette-fallback path (no add_api_route) also wires routes.
+    class _BareRouter:
+        def __init__(self):
+            self.routes = []
+
+    class _BareApp:
+        def __init__(self):
+            self.router = _BareRouter()
+
+    try:
+        bare = _BareApp()
+        register(bare, ns="a11oy")
+        out["starlette_fallback_wires"] = len(bare.router.routes) == 5
+    except Exception:
+        # starlette.routing may be absent in a bare env — that's an honest skip.
+        out["starlette_fallback_wires"] = "skipped (starlette.routing unavailable)"
+
+    # (c) sensor handler returns a MODELED certificate with the SQL fields.
+    s = _body(_h_sensor({"wavelength_m": "780e-9", "contrast": "0.5", "atom_number": "1e6"}))
+    cf = s["closed_form_stdlib"]
+    assert cf["label"] == "MODELED"
+    assert cf["at_or_above_standard_quantum_limit"] is True
+    assert cf["k_eff_per_m"] > 0 and cf["accel_asd_m_s2_per_sqrt_hz"] > 0
+    assert s["honest_inverse_of_free_energy"] is True
+    out["sensor_modeled_sql"] = True
+
+    # (d) resilience handler: clean inputs -> ALLOW; spoof inputs -> DENY (deny-by-default).
+    clean = _body(_h_resilience({}))["closed_form_stdlib"]
+    assert clean["verdict"] == "ALLOW" and clean["allow"] is True
+    spoof = _body(_h_resilience({"raim_consistency_m": "100", "agc_advantage_db": "10"}))["closed_form_stdlib"]
+    assert spoof["verdict"] == "DENY" and spoof["allow"] is False
+    assert spoof["advisory"] is True
+    out["resilience_deny_by_default"] = True
+
+    # (e) coast handler: quantum beats classical (improvement factor > 1 for default ASDs).
+    c = _body(_h_coast({"coast_time_s": "60"}))["closed_form_stdlib"]
+    assert c["quantum_over_classical_improvement_factor"] > 1.0
+    assert c["label"] == "MODELED"
+    out["coast_quantum_advantage"] = True
+
+    # (f) limits index carries BOTH pillars and the doctrine labels.
+    lim = _body(_h_limits({}))
+    assert "pillars" in lim or lim.get("status") == "UNIFIED_LIBRARY_NOT_IMPORTABLE"
+    assert "free-energy" in lim["doctrine"].lower()
+    assert "advisory" in lim["lambda_note"].lower()
+    out["limits_both_pillars"] = True
+
+    # (g) doctrine labels carried across handlers (Λ=Conjecture 1, honest-inverse).
+    idx = _body(_h_index({}))
+    assert "Conjecture 1" in idx["lambda_note"]
+    assert idx["honest_inverse_of_free_energy"] is True
+    assert "clean-room" in idx["doctrine"].lower()
+    out["doctrine_labels_carried"] = True
+
+    out["ok"] = True
+    return out
+
+
+if __name__ == "__main__":
+    print(json.dumps(_selftest(), indent=2))