First Independent Replay Verification.
The open lock closes.

01The money quote

02The pattern — four money quotes, one corpus

The corpus pattern is now four lines deep, and unmistakable to an auditor.

Each proof's deepest claim arrives with its own honest limit. The pattern says, unambiguously: H33 produces evidence — not verdicts.

03The two tenants — one verified, one honestly not

04The verification primitive — what runs per event

verify_event_signature_record(rec) {
    // Step 1 — recompute the canonical signing message and confirm it
    // matches the supplied bytes (catches event tampering + sidecar mismatch).
    let recomputed = canonical_signing_message(rec.event);
    if recomputed != rec.signing_message { return SigningMessageMismatch }

    // Step 2 — ML-DSA-65 verification (NIST FIPS 204, Level 3).
    mldsa65::verify_detached_signature(rec.dilithium_sig, rec.signing_message, rec.dilithium_pk)?

    // Step 3 — FALCON-512 verification (NIST FIPS 206, Level 1, NTRU lattice).
    falcon512::verify_detached_signature(rec.falcon_sig, rec.signing_message, rec.falcon_pk)?

    // Step 4 — SLH-DSA-SHA2-128f verification (NIST FIPS 205, hash-based, Level 1).
    sphincssha2128fsimple::verify_detached_signature(rec.sphincs_sig, rec.signing_message, rec.sphincs_pk)?

    return Verified
}

All three NIST-finalist PQ families must agree. The 3-of-3 composite gives lattice + NTRU-lattice + hash-based independence — if one family falls to a future quantum break, the other two still hold.

05The schema (Eric Q1 LOCKED Option D — hybrid storage)

tenant_pq_keyrings                       (tenant_id, keyring_id, active_from_ms, revoked_at_ms)
principal_pq_keys                        (tenant_id, keyring_id, principal_id,
                                          dilithium_pk, falcon_pk, sphincs_pk,
                                          dilithium_pk_fp, falcon_pk_fp, sphincs_pk_fp)
canonical_auth_event_pq_signatures       (canonical_event_id → canonical_auth_events.id,
                                          tenant_id, keyring_id, principal_id,
                                          signing_message (32 bytes),
                                          dilithium_sig, falcon_sig, sphincs_sig)

Append-only. FK-linked to canonical_auth_events and to principal_pq_keys. The evidence-package arm exports identical content as public_keys.json and signatures.json — identical shape, identical verification result.

06What this proof IS and IS NOT

07Honest limits (5)

1. Signature verification ≠ signer identity. L9.1 proves a key signed; it does not prove the signer IS who they claim. PKI / signer-identity verification is Phase F.
2. Key compromise breaks verification going forward, not history. A future-stolen key does not retroactively invalidate prior signatures under the original valid key. Bounded-window compromises remain Phase F territory.
3. Algorithm agility. ML-DSA-65 / FALCON-512 / SLH-DSA-SHA2-128f are NIST-final today. Future quantum or mathematical breakthroughs against any one would force migration. The 3-of-3 composite gives resilience, not infinity.
4. Pre-L9.1 events on the canonical continuity tenant. Signed but key-unknown. Verifier reports honestly. State_ids untouched.
5. Verified ≠ True. The money quote.

08Where this proof sits

L9.1 is not on the continuity ladder. It is not on the computation axis. It is a hardening pass — it closes the open lock referenced on every prior proof page, raising Replay Confidence for new tenants from 72/100 to 100/100 while honestly reporting older tenants where the L9.1 sidecar wasn't yet written.

09Evidence appendix

10Readiness determination

What this unlocks: an independent 3rd-party auditor can now run the verifier against either path and arrive at the same verification verdict — without the DB, without the vendor, without trusting H33 at all. The category Eric named: trustless verification.

What this does not unlock: signer identity verification (Phase F), correctness claims, fairness verdicts, or judgments of any kind. Verified ≠ True.