Exact R5→R6 state-transition audit

What was tested?

Any reset-derived reduction that matters beyond T2₅ must remain visible after the complete state update into a6 and e6, rather than only inside an operand.

Why the test is meaningful

SHA-256 round state updates couple T1 and T2: a_{t+1}=T1+T2 and e_{t+1}=d_t+T1. A local T2 pattern may vanish in a6 yet persist in e6, so both state words and their carries must be audited.

How it was tested

Compose exact low-four-bit T1₅/T2₅ masks into the actual a6 and e6 transitions, record carry lanes 1–3 and nonlinear support, then compare fixed groups in original and fresh cohorts.

What happened

All 1,361 original and 300 fresh state transitions had zero semantic errors. Difference signs replicated for T2₅, a6 carry, e6 carry and e6 low4, but not for T1₅ or a6 low4. Fresh e6 low4 difference was −0.145 monomials versus −0.116 original.

Exactness and statistical controls

Direct state computation verified every mask. Six interfaces were predefined and all sign results were reported; four replicated, two did not. The claim remains an empirical fixed-group contrast, not a selector.

What the result means

A small attenuation reaches e6 in the observed groups, while the a6 output does not replicate it. This justifies one final complete-union audit but is too small and conditional to support a mining claim.

Limitations

• The replicated differences are small descriptive averages.
• Outcome-conditioned contrasts cannot be used prospectively without a selector.
• Only low-four-bit state semantics were tested.

Evidence trail

Reconstruct T1₅ and T2₅ exactly, compute a6/e6 masks and carries, compare with the full round oracle and repeat all six fixed contrasts on the fresh cohort.

Canonical variants

Source: internally audited canonical reports. Local filesystem structure, private headers and operational identifiers are excluded from publication.