docs: estate-wide consistency pass (workflow audit, 36 findings, all verified before fixing)

Nine parallel readers audited every doc against measured ground truth; every
finding was re-verified against the file before any edit, and the sweep fixed
by PROPERTY, not by flag — wording the readers caught in one repo was hunted
in all siblings (the two-button README sentence existed in all four forks,
not the three flagged; likewise the cone-overclaim in TRUSTED-BASE item 1).

This repo: see the diff. Records were not rewritten; clarifications are
dated. Doc-only except where noted in the estate summary; every gated doc
change was followed by a green button run.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -5,12 +5,12 @@ path**, extracted from a pure-Rust implementation into Lean 4 via
 Charon/Aeneas — the same pipeline, discipline, and honesty rules as the
 four ed25519 campaigns (`dalek/anza/risc0/betrusted-ed25519-verified`).
 
-## STATUS: eleven certificates over the extracted verify model (external review rounds 1–6 applied)
+## STATUS: eleven certificates over the extracted verify model (external review rounds 1–9 applied)
 
 `verification/check.sh` is **green** (exit 0): the model compiles, the proofs
 compile, and the audit passes. It binds **seven** things, each added because an
-external reviewer *demonstrated* the button going green without it. Four are
+external reviewer *demonstrated* the button going green without it. Three are
-checked **inside Lean** by `verification/Proofs/Audit.lean`; the last three are
+checked **inside Lean** by `verification/Proofs/Audit.lean`; the other four are
 separate phases that deliberately do **not** rely on that file:
 
 - **axiom cones** — each certificate's cone is read from the kernel via
@@ -252,7 +252,9 @@ same boundary.
   vectors plus an expanded differential bridge. That commit is TEST-ONLY: no
   verify-path function changed, and re-running `extract.sh` against it
   reproduces the two Aeneas-generated model files byte-identically. Its
-  lineage is `bea1051` (de-plumbing round 2) → `797b4ef` (the round-2
+  lineage is `bea1051` (de-plumbing round 2) → `797b4ef` → `3153988` (NIST
+  ACVP vectors + randomized bridge) → `c945821` (vectors made re-derivable) →
+  `a3ce8e8` (extract-script wording); `797b4ef` is (the round-2
   reproducibility commit: committed `Cargo.lock` + pinned
   `rust-toolchain.toml`) → `a3ce8e8`; the model in this repo is extracted from
   it, and `verification/extract.sh` refuses any other commit. **No

verification/check.sh

@@ -5,8 +5,9 @@
 #
 #   Phase 0 — build hygiene + integrity: purge stale .olean (the verdict must
 #             depend on committed bytes, not untracked build state), forbid any
-#             .lean outside gen/ and Proofs/, and sha256-pin the four model files
+#             .lean outside gen/ and Proofs/, and sha256-pin the five model files,
-#             AND the compiler harness `lean-guard` to PROVENANCE.json.
+#             the committed SlhVerify.llbc, and the self-derived harness set
+#             (every executable here + Proofs/Audit.lean) to PROVENANCE.json.
 #   Phase 0d— template/model correspondence: every external Aeneas states the
 #             extracted Rust needs (FunsExternal_Template.lean, committed and
 #             pinned) must be answered by the hand-written model or by a real