C-83 — full-population hash sweep bounds the tampering residual to metadata, not bytes

[Polichinel]

Brings main up to date with the one commit on development since #166.

What this carries

#170 — the full-population hash sweep on C-83. 22 lines added to the register, one amendment
block under the existing verdict. No other file changes.

Every row in both delivery collections was re-downloaded and re-hashed, not only the eleven the
triage flagged: unfao 111/111 and production_forecasts 461/461 match their recorded
file_hash. sha256, confirmed empirically across all 572 rather than assumed. Read-only, GET only.

The amendment is explicit that it narrows the residual without correcting the triage — the
triage's prediction, that hashing the rest would add nothing against substituted bytes, held exactly.
What the sweep added is a fact sampling could not reach: rows and files are a perfect bijection,
0 files without a row and 0 rows without a file, in both buckets.

That closes the delete-and-recreate route. A count-preserving recreate must point its new row at a
file that already exists, since the buckets were never writable; pointing it at a file another row
claims leaves an orphan, and there are none.

What survives is smaller and still unfalsifiable: a delete-and-recreate preserving fileId and
file_hash while altering only descriptive fields (targets, name, description). The residual
is now bounded to metadata semantics rather than file bytes.

Gates

Docs-only change — carbon protocol §2 waiver applies to the bare-pytest gate, recorded here.
Everything else run on the merge base:

ruff check .                                    All checks passed!
pytest -m "guard and not crossrepo" tests/      36 passed, 22 deselected
bash docs/validate_docs.sh                      PASSED: no issues found
pytest -m falsification tests/                  10 failed, 6 passed   <- the expected baseline

Register counts reproduce by grep: 64 concerns, 12 resolved, unchanged — this amends an
existing entry rather than adding one, which also keeps epic #157's guardrail intact (no register
entry below Tier 2 created while the epic is open).

Context

The blocker on the rest of epic #157 cleared separately: views-pipeline-core#483 merged
2026-08-24, so #160 (S3) and #163 (S6) are now actionable. This PR is not part of that — it is the
C-83 evidence trail catching up to main.