board: backfill the four missing arc entries (#862/#875/#876/#879) + the pattern they share

.claude/board/EPIPHANIES.md

@@ -1,3 +1,19 @@
+## 2026-08-03 — E-THE-DEFECTS-LIVE-IN-THE-FALSIFIERS-NOT-THE-MEASUREMENTS-1 — across three consecutive probe PRs, every defect found by review was in a falsifier or a label; none was in a measurement
+
+**Status:** FINDING (observed, not designed). **Confidence:** High as a description of #862/#875/#876 — the three PRs' own review records are the evidence, and each states the pattern locally; what is new here is that the pattern is *consecutive and unbroken*, which only became visible when the three arc entries were written together during the 2026-08-03 backfill. Documentation-only.
+
+**The observation.** Reconstructing the missing arc entries for #862, #875 and #876 in one pass surfaced something none of them shows alone: across **three consecutive probe PRs and roughly a dozen review findings**, the measurements held every time and the machinery meant to be *capable of killing* them did not. #875 states it outright — *"a broken falsifier fails silently — it reports PASS"* — and #876 independently reports "eight defects, every one in a falsifier or a label, none in a measurement." #862's headline was retracted for two construction artifacts while its measurement discipline survived intact.
+
+**Why this is worse than the inverse.** A wrong measurement is loud: it contradicts something. A wrong falsifier is silent — it prints PASS and *looks like validation*. Three instances make the failure mode concrete: (a) **a permutation that isn't one** — #875's W1 shuffle arm was a cell-label bijection, so same-cell pairs survived it and the null scored **+0.645 on cell identity alone** while appearing to validate; (b) **a window too narrow to be real** — #875's W3 credited the anchor's own cell in both arms, capping the achievable ratio at 1.61 against a fire-threshold of 1.5 and a guard at 0.95, an **0.018-wide window** whose original pass was luck; (c) **a threshold that cannot bite** — #876's hand-tuned `flat_rate < 0.25` would have passed at 24.9 % while the prose claimed ≈1/17.
+
+**The compounding shape.** Fixing a falsifier defect twice reproduced it one level up: #876's mislabelled denominator was corrected and the correction repeated the same mislabel against the *population* instead of the *sample* — root cause being a thinning that bought nothing, ultimately **deleted rather than relabelled**. Separately, replacing a hand-tuned threshold with a declared null immediately falsified the author's *first formulation of the null itself*. Making the criterion explicit is what exposed both.
+
+**Consequences (already partly canon).** The workspace's falsifiability rule covers can-it-fire / can-it-stay-silent / inertness; these three PRs add the checks that fire *before* a run: **compute the maximum achievable value of the fire statistic under the silent guard** — a hair-wide window is mis-specified regardless of which side it lands on — and **both halves of a twin gate must measure the same quantity on the same basis**. Add: a null arm must be checked for *invariance leakage* (does the scramble preserve the thing being scored?), and when a sample keeps producing label errors and full enumeration is affordable, delete the sampling (#876 went exhaustive over all 32,640 pairs).
+
+**The CI corollary (#862, arguably the most consequential single item in the three).** `cargo test` **never executes an example's `main()`** — so every `assert!` in these probe examples had only ever run on a developer's local invocation. Until `rust-test.yml` was changed to run the probes explicitly, an entire class of falsifier was **decorative in CI**. A falsifier that never runs is the limit case of a falsifier that cannot fail.
+
+**Scope fence.** This says the *review-found* defects clustered in falsifiers; it does **not** claim the measurements were correct — only that no review round found a defect in one. That is an absence of evidence over three PRs, not proof, and the honest reading is that falsifier code got less scrutiny while being written than the numbers it guarded.
+
 ## 2026-08-02 — E-D-MBX-SPINE-IS-STRAIGHT-TRACK-VERSION-IS-NOT-A-FLEET-STEP-SIGNAL-1 — the D-MBX production ownership map is ratified, and P4's fleet-wide fan-step is corrected to sparse sealed-transition application
 
 **Status:** RATIFIED (operator ruling, 2026-08-02) + CORRECTION of a same-session drift. **Confidence:** High for the ownership map (verified against `Cargo.toml` deps) and the sparse correction (it removes a direct contradiction with `E-COMPLETE-CYCLE-IS-PHYSICALLY-SPARSE-NOT-A-FULL-REWRITE-1`). Documentation-only — no Rust/tests changed. Recorded in `.claude/plans/cycle-loop-closure-driver-v1.md` §3, §9–§11.