BATMAN-009 · BATMAN-009 · Jul 21, 2026 · Jul 21, 2026 · Jul 21, 2026 · Jul 21, 2026
diff --git a/academy/Module-16-Medical-Regulatory/C15-GATE-RECORD.md b/academy/Module-16-Medical-Regulatory/C15-GATE-RECORD.md
@@ -0,0 +1,55 @@
+# Competency-15 Gate Record — PASSED
+
+> **Date closed:** 2026-07-21 · **Candidate:** Vinay (Founder) · **Examiner:** Claude (adversarial; grades, never answers)
+> This record closes the 15-competency core arc and freezes Academy v1.0 per the README freeze policy.
+
+## Process (as agreed during the gate)
+
+The gate was split into two parts — a founder-proposed refinement, adopted on its merits:
+- **Conviction Gate** (Q6, Q7 core): founder-only, non-delegable. AI exemplars prohibited.
+- **Technical Mastery Gate** (Q1–Q5): teachable; study exemplars were provided; certification required **own-words answers defended under adversarial follow-up** (changed numbers, changed jurisdiction, novel classification exercises) — the grade lives in the defense, not the recitation.
+
+An earlier AI-drafted submission was **failed on provenance** (it opened by disclaiming its own validity). The passing answers below were the founder's own, defended live.
+
+## Outcomes
+
+| Question | Result | Decisive moment |
+|---|---|---|
+| Q1 claim-determines-burden | PASS | "Intended-use statements belong under configuration control exactly like source code" |
+| Q2 sens/spec/PPV/NPV + prevalence | PASS | Computed PPV 15.3% (p=1/1000) and 47.5% (p=1/200) correctly, steps shown; detector/evidence-standard global, escalation policy household-aware, **detector thresholds never household-lowered** |
+| Q3 staged claims ladder | PASS | Ladder prevents both claims-without-evidence AND evidence-without-claims |
+| Q4 PCCP | PASS | "Engineering artifacts today, regulatory evidence tomorrow" — replay/baselines/versioning as pre-built change control |
+| Q5 equitable validation | PASS | "The deployment population must already exist inside the validation population" |
+| Q6 deserve to exist — prove it | PASS after 3-probe defense | License condition + falsifiers + independent adjudication; concessions on kill-criteria unification and the invisible denominator |
+| Q7 single most likely failure | PASS after 3-probe defense | Trust-collapse-through-calibration for the company; **conceded scientific constraint binds first on the cleared-claim path** (E-17) |
+| F3 India | PASS | CDSCO, Medical Devices Rules 2017; position held as unsettled; claim-language embargo until A3 counsel clears: "claims remain narrower than evidence — not broader than law" |
+| F4 claims classification | PASS | Identified "continuously keeps your loved ones safe" as gray AND factually dishonest per own register (E-10 night-charging hole falsifies "continuously"); produced compliant honest rewrite |
+
+## Decision-bearing artifacts produced during the defense (founder decisions, to be applied)
+
+1. **Kill-register unification** — one canonical Failure/Kill Register implementing Roadmap 14 Part E; the Q6 falsification list references it; no duplicate definitions of failure.
+2. **Intervention-time proof spec** — per confirmed incident: T₀ (evidence threshold crossed) → T₁ (notification) → T₂ (ack) → T₃ (contact attempt) → T₄ (human arrival/verified welfare). Primary metric Δ = T₄−T₀; success = ≥25% median reduction without exceeding the false-escalation threshold; **independent incident review board adjudicates** — the company never grades its own success.
+3. **Independent outcome registry** — families periodically report hospitalizations/EMS/falls **including incidents RAXHA never alerted on**. Negative evidence is the only honest path to a sensitivity estimate (H-01 is not naturally observable); also the mechanism that eventually accumulates cleared-claim evidence.
+4. **RFC-007 founder position (personally given):** the wearer owns visibility; guardians receive **state, not location** (OK / Unknown / Needs attention / Emergency); routine reassurance is deliberately lower-resolution than emergency response; elders = revocable consent vs minors = delegated authority → **split policy engines** ("same architecture, different ethics"). Open edge for counsel: capacity-decline (when the ability to revoke is itself declining).
+5. **Cleared-claim risk ranking:** the scientific constraint (externally valid sensitivity in the frail-elderly deployment population) binds **before** trust — founder withdrew the prior ranking on the evidence.
+6. **Calibration governance:** confidence drift routes to **model review before threshold manipulation**; thresholds are never the correction mechanism for dishonest probabilities.
+7. **Operational invariant (doctrine-grade):** *"Metrics may trigger investigation. They may never directly trigger suppression."* The structural antibody to the predecessor's stillness veto.
+8. **Charter principle:** *"RAXHA is obligated to seek disconfirming evidence with the same intensity that it seeks confirming evidence. Every metric that can justify shipping must also be capable of justifying stopping."*
+9. **Claims under configuration control:** intended-use/marketing language is versioned in the repository like source code; VV-801 becomes a diff-gated check, not a periodic audit.
+
+Closing principles recorded verbatim: *"If the evidence no longer supports the claim, the claim must shrink before the evidence grows again"* and *"When legal uncertainty exists, claims remain narrower than evidence — not broader than law."*
+
+> Doctrine/Canon amendments arising from artifacts 7–8 follow the frozen Academy's RFC path (supersede, never edit) — they do not retro-edit chapters.
+
+## Founder Principle 0 (advisor-recommended for permanent preservation; founder-endorsed at gate close)
+
+> **Evidence outranks conviction.**
+> Conviction is sufficient to start a company. Only evidence earns the right for the company to continue making the same claims. When evidence weakens, claims contract before confidence expands. Every metric that justifies shipping must also be capable of justifying stopping.
+
+*Standing note: if Principle 0 is to enter the frozen Doctrine itself (as D00), that is the Academy's first superseding-RFC — the freeze policy's mechanism, used as designed. Until then, this record is its permanent home, and the engineering tier may cite it directly.*
+
+## Effect
+
+- **Academy v1.0 FROZEN** as of this record (README freeze policy: immutable, versioned, RFC-superseded only).
+- Certificate 15 refreshed for founder signature (signature line remains the founder's alone).
+- The C15 line in the founder queue is closed permanently.
diff --git a/academy/README.md b/academy/README.md
@@ -3,8 +3,8 @@
 The teaching layer: the 16-module science curriculum (University A), the product-engineering curriculum (University B), the **Engineering Doctrine (D01–D22)**, the **Canon**, the Knowledge Graph, and the amendment/expansion governance. This is where the *philosophy* RAXHA is built on lives.
 
 ## Freeze policy
-- **Status: Academy v1.0 — pending the Competency-15 gate close.** The 15-competency core arc is materially complete on disk.
-- **On Competency-15 close → Academy v1.0 is FROZEN — as an RFC 1.0, not as "finished":** **immutable, versioned, historically preserved.** Improvements become numbered RFCs (`RFC-001`, `RFC-002`, …) that *supersede* — never "I edited the old chapter." The reasoning history is preserved because it is often as valuable as the final decision.
+- **Status: Academy v1.0 — FROZEN 2026-07-21.** The Competency-15 gate closed with the founder's oral defense — see **[C15-GATE-RECORD.md](Module-16-Medical-Regulatory/C15-GATE-RECORD.md)**.
+- **Frozen as an RFC 1.0, not as "finished":** **immutable, versioned, historically preserved.** Improvements become numbered RFCs (`RFC-001`, `RFC-002`, …) that *supersede* — never "I edited the old chapter." The reasoning history is preserved because it is often as valuable as the final decision.
 - **The Doctrine and Canon are the authority** the `engineering/` tier derives from (via `../../academy/…` links). They are part of the frozen foundation (`engineering/00-foundation/00A-FOUNDATION-LOCK.md`).
 
 ## Index
@@ -14,4 +14,4 @@ The teaching layer: the 16-module science curriculum (University A), the product
 - **[03-KNOWLEDGE-GRAPH.md](03-KNOWLEDGE-GRAPH.md)** · **[02-AMENDMENT-QUEUE.md](02-AMENDMENT-QUEUE.md)** · **[04-ACADEMY-EXPANSION-PLAN.md](04-ACADEMY-EXPANSION-PLAN.md)**
 - `Module-*/` — University A chapters · `University-B-Product-Engineering/` — University B chapters.
 
-*One open item before the freeze: the Competency-15 mastery gate (Medical AI / Clinical Validation / Regulatory).*
+*The Competency-15 mastery gate closed 2026-07-21 (founder passed under adversarial defense). No open items; the Academy changes only by superseding RFC.*
diff --git a/engineering/15-ENGINEERING-READINESS-CERTIFICATE.md b/engineering/15-ENGINEERING-READINESS-CERTIFICATE.md
@@ -14,15 +14,17 @@
 
 The complete engineering document chain exists, is internally consistent, and is traceable end-to-end:
 **Doctrine (D01–D22) → North Star → PRD → PDR-000 → ADR-000 (+Traceability Matrix) → Blueprint → 08A Responsibility Matrix → 08B Data Dictionary → SRS → 10A/10B Hazards & Controls → ADR-101–112 → Interface Spec → V&V Plan (VV-1xx–8xx + VA register) → Readiness Roadmap.**
-Phase 0's *entry* conditions (14 Part B) are met: the foundation is locked (00A), the vocabulary is frozen (08B-A), every subsystem has an owner boundary (08A), every hazard has controls with VV coverage defined (10B→13), and no RFCs are open against the foundation. Phase 0's *exit* gates (VV-101/VV-110 operational) are what Phase 0 builds.
+Phase 0's *entry* conditions (14 Part B) are met: the foundation is locked (00A), the vocabulary is frozen (08B-A), every subsystem has an owner boundary (08A), every hazard has controls with VV coverage defined (10B→13).
+
+**Refresh (2026-07-21) — correcting claims that reality overtook:** the original "no RFCs are open against the foundation" claim went stale the day AUDIT-001 landed. Current truth: RFC-001/002/003/006/008 FOUNDER-DECIDED (accept, pending APPLIED), RFC-004/005/007 partially/conditionally decided — none contradicts Phase-0 scope; all are tracked in the [RFC Register](rfcs/RFC-REGISTER.md). Phase 0 itself was **built and verified under founder instruction** (exit gate VV-101/VV-110 green after AUDIT-002 verifier repair; baseline `phase0-baseline`, repository phase archived at `repository-phase-complete`). This certificate therefore now records an authorization exercised-and-validated rather than pending — the signature below remains the acceptance of responsibility, not a permission slip.
 
 ## Remaining blockers
 
 **For Phase 0 code: none.**
 
 Open items, tracked, **not blockers to Phase 0**:
-1. **Competency-15 mastery gate** — the Academy v1.0 freeze condition (intellectual foundation). Closes Phase 1; strongly recommended before implementation *consumes* the Academy as frozen reference. Owner: Founder.
-2. **Founder approval below** — this certificate is *prepared*, not *in force*, until signed.
+1. ~~Competency-15 mastery gate~~ — **CLOSED 2026-07-21: founder PASSED under adversarial defense; Academy v1.0 FROZEN** ([gate record](../academy/Module-16-Medical-Regulatory/C15-GATE-RECORD.md)).
+2. **Founder approval below** — this certificate is *prepared*, not *in force*, until signed. This is now the **only** open human gate item.
 3. Phase-gate items that are execution-dependent by design (VV suites go from defined → PASS as phases run; TD register expiries armed; VA register goes live at Shadow).
 
 ## Approved by

diff --git a/engineering/audits/EVIDENCE-REGISTER.md b/engineering/audits/EVIDENCE-REGISTER.md
@@ -9,15 +9,15 @@
 | E-03 | Critical-alerts entitlement fits RAXHA's case | Apple docs: personal-safety/SOS approved category (SPIKE-001 F6) | ✅ docs / 🟡 grant | File A1 (both); record outcome | H1, IF-HUM-04 |
 | E-04 | `CMSensorRecorder` usable as live confirmer | Apple docs: retrospective batches; flaky long-window retrieval; **+ AUDIT-003: predecessor used it retrospective-only across 6 months of production (retro pickup on wake, never live)** | ❌ **False** (production-corroborated) | none — design moved | RFC-001 ✅ earned |
 | E-05 | Own high-rate sensing possible always-on | WWDC23: `CMBatchedSensorManager` requires active workout session; Series 8+; **+ AUDIT-003: predecessor's "always-on" was in fact workout-session-alive-only, wrist-off ended it, recovery best-effort (BAR observed skipped 37+ min); 1h45m silent blackout at low battery** | ❌ **False** (armed-modes only; production-corroborated) | SPIKE-009 endurance test | RFC-001 carve-out |
-| E-06 | Family Setup supports RAXHA's shape | Apple: requires **LTE watch**, no companion iPhone, independent watch apps installable | 🟡 | **SPIKE-002 (hardware)** — fall-detection API on managed watch | RFC-004, RFC-005 |
-| E-07 | Fall-detection API works on Family Setup managed watch | none | 🔴 | SPIKE-002 — the single most decision-heavy unknown | RFC-005 / possibly the whole v1 shape |
+| E-06 | Family Setup supports RAXHA's shape | Apple: requires **cellular watch** (Series 4+/any SE, watchOS 7+), no companion iPhone, apps installable from the watch's own App Store; **native fall detection documented on managed watches (18+)** — [SPIKE-002A](SPIKE-002A-DESK-DEVICE-CAPABILITY.md) D1/D2/D5 | 🟡 (strengthened 2026-07-21) | **SPIKE-002 (hardware)** — third-party API leg | RFC-004, RFC-005 |
+| E-07 | Fall-detection API works on Family Setup managed watch | **Native leg ✅ documented** (Apple's own fall detection + SOS run on managed watches — SPIKE-002A D2). **Third-party leg: no evidence exists in either direction** (SPIKE-002A D4 — gap confirmed as a gap) | 🔴 third-party leg | SPIKE-002 hardware run — still the single most decision-heavy unknown; pass/fail criterion unchanged | RFC-005 final form / the v1 shape |
 | E-08 | HealthKit real-time reads work on independent watch app w/o iPhone | Mixed dev reports (SPIKE-001 F5) | 🟡 | SPIKE-002 sub-test | RFC-005 architecture |
 | E-09 | The beachhead elder already owns Apple Watch + iPhone | Market reality (AUDIT-001 C5) | 🔄 **Revised** (business assumption replaced: funnel = adult-child-buys-bundle) | RFC-005 funnel remodel; pricing research | PDR-001/002 funnel |
 | E-10 | Night coverage exists with one watch | Physics of nightly charging (AUDIT-001 C3) | ❌ **False** structurally | RFC-004 decision (routine/fallback/positioning) | PRD promise scope |
 | E-11 | Context confidence-lowering cannot suppress a real event | SRS-403 as written (AUDIT-001 C4) | ❌ loophole confirmed by inspection | RFC-003 floor rule + VV-102 degraded-path test | D17 integrity |
 | E-12 | Acknowledgment ≈ help delivered | Pendant-industry behavior (AUDIT-001 H4) | ❌ **False** | Post-ack outcome-loop workstream | Response-layer moat |
 | E-13 | Automated voice/SMS reach a 3 a.m. phone | STIR/SHAKEN + A2P filtering realities (H5) | 🟡 risk-confirmed | **A2 registrations** + SPIKE-007 deliverability test | Ladder reliability |
-| E-14 | Always-on battery budget holds on Series-4-class | Bench estimates only (TD-7) | 🔴 | SPIKE-003 profiling matrix | Hardware floor, PRD claims |
+| E-14 | Always-on battery budget holds on Series-4-class | Bench estimates only (TD-7); documentation-level inputs recorded 2026-07-21: Ultra 3 rated 42 h, SE 3 fast-charges 2× (SPIKE-002A D3/D5 — marketing ratings, not workload profiles) | 🔴 | SPIKE-003 profiling matrix | Hardware floor, PRD claims, RFC-004 night strategy |
 | E-15 | Watch/phone reboot → RAXHA relaunches + journal recovers | Designed (ADR-105); untested on hardware | 🔴 | SPIKE-005 | VV-106/201 reality |
 | E-16 | Background execution windows suffice for the coordinator role | Docs qualitative; timing unmeasured | 🔴 | SPIKE-004 timing instrumentation | RFC-001 detail, latency budget |
 | E-17 | Shadow mode can measure *sensitivity* at v1 scale | Statistics: ~100 users ⇒ a handful of real falls/yr (H6) | ❌ **False** | Cold-start VV-402/403 gate variants | 13's exit gates |

diff --git a/engineering/audits/SPIKE-002-PREREGISTERED-PREDICTIONS.md b/engineering/audits/SPIKE-002-PREREGISTERED-PREDICTIONS.md
@@ -0,0 +1,19 @@
+# Pre-Registered Predictions — SPIKE-002
+
+> *"Every assumption that justifies architecture must eventually face a measurement capable of disproving it."* — engineering-practice principle, adopted at pre-registration (complement to Principle 0). SPIKE-002 is not a prototype; it is a cross-examination of the architecture.
+>
+> **LOCK RULE:** This document is locked at the commit that lands it — **before hardware procurement**. Any edit after procurement voids the pre-registration. Observations go in the SPIKE-002 results report, which cites this file and scores each row. Two priors are recorded per row — **F** (founder/advisor, as given 2026-07-21) and **C** (Claude, evidence-grounded from the register) — so both reasoners' calibration is measurable, not just the system's.
+
+| # | Assumption (register/RFC) | Prediction | F | C | Falsified by | Consequence if false |
+|---|---|---|---|---|---|---|
+| P1 | **Third-party fall API on managed watch** (E-07, decides RFC-005) | Entitled independent app receives `didDetect` + resolution on a Family Setup watch | 60% | **65%** — native leg documented (SPIKE-002A D2), apps installable (D5), entitlement is per-app; but zero direct evidence | Simulated fall → native UI fires, callback never arrives | Family Setup v1 shape dies; iPhone-paired v1 stands (RFC-005 fallback branch) |
+| P2 | **Background execution** (E-16) | Post-event background window suffices for confirm + upload in foreground/background app states | 75% | **70%**; terminated-state reliable delivery separately: **55%** | Missed/late delivery under an expected state | Incident pipeline redesign: keep-alive strategy, armed-mode reliance, SRS-1002 revisit |
+| P3 | **LTE upload without phone** (E-06) | Event envelope uploads over watch cellular within the post-event window, no companion iPhone | — | **80%** — independent networking documented | Upload deferred/blocked until app foregrounded | Store-and-forward + dead-man carry more weight; ladder timing re-derived |
+| P4 | **Battery** (E-14, TD-7) | Coordinator-mode (event-driven, not armed) lasts a full waking day (≥18 h) on Series-4-class | 80% | **75%** — predecessor ran lighter duty cycles all-day, but its 1h45m low-battery blackout (AUDIT-003) is a warning | <18 h idle-coordinator runtime | Hardware floor re-tiered (kill criterion: battery→re-tier); RFC-004 night strategy re-shaped |
+| P5 | **Sensor/motion data quality** (VA-01/02, SPIKE-010) | Watch motion data (rates, gaps, wear artifacts) is consistent with replay-corpus assumptions | 85% | **70%** — predecessor showed real gaps: BAR skips 37+ min, wrist-off session death; corpus assumptions untested against our own recordings | Excessive noise/gaps vs corpus trace schema expectations | Corpus re-annotation; filter redesign; VA-01/02 downgraded until re-validated |
+| P6 | **HealthKit real-time reads, managed watch** (E-08) | Heart-rate stream readable by the independent app without iPhone | — | **50%** — dev reports genuinely mixed (SPIKE-001 F5) | Stream unavailable or wake-gated | Managed-tier HSE restricted to motion + platform events; Risk-v0 inputs narrowed |
+| P7 | **Reboot recovery** (E-15, ADR-105/RFC-008 — SPIKE-005 but observable during 002 week) | Relaunch + journal recovery resumes an in-flight incident without loss or duplication | — | **70%** — designed for, never exercised on device | Lost or duplicated incident across forced reboot | ADR-105 rework before Phase 5; RFC-008 implementation priority raised |
+
+**Scoring protocol (fixed now):** each row resolves CONFIRMED / FALSIFIED / PARTIAL(stated %) in the results report; each prior scored (Brier, informal); systematic overconfidence by either reasoner is itself a register-worthy finding (it means our *judgment*, not just our system, needs recalibration). A row that cannot be resolved by the spike is marked NOT-EXERCISED honestly — never silently dropped.
+
+**D00 note (advisor position, adopted):** Principle 0's promotion into frozen Doctrine is deliberately deferred until after SPIKE-002. The first superseding-RFC should be *needed*, not merely available — and if Principle 0 still feels foundational after reality's first cross-examination, that survival is the evidence that earns the RFC.