Security analysis: TMTO reconciliation, validated sims, lower-bound notes

[dcondrey]

Reviewed, honest security analysis of PoSME's memory-hardness. Nothing here is a certified result; the formal constants are explicitly not proven. Merge at your discretion.

Draft sync (commit 1): rewrites the draft's stale TMTO section (three conflicting formulas, an inflated 197x-3137x table) to match the published arXiv paper's Theorems 3-5, plus an empirical Amortization Resistance section. Renders clean (kramdown-rfc + xml2rfc).

Analysis + evidence (commit 2):

• Lattice (MLWE/MSIS) framing is wrong-foundation and rejected (the paper has zero lattice content; binding reduces to hash collision resistance).
• Four reproducible simulations. The pebbling engine is validated against ROMix's proven S*T = Theta(N^2) before being trusted on PoSME.
• Findings that are robust (metric-independent, empirical): reconstruction cost grows ~N^0.93 (memory-hardness is genuine and unbounded in N, scrypt-class); reconstruction depth is ~15-21, so the paper's 'terminates at depth rho' claim is off by ~4.5x, meaning Theorem 3's W(alpha,rho) formula and Table III constants do not match the DAG and need re-derivation.
• POSME-LOWER-BOUND.md is a reduction draft toward cc_mem = Theta(K^2/rho), not a proof: a metric mismatch (cc_mem vs S*T) and a log N factor mean it does not establish a correction to the paper's Omega(K^2) at the recommended rho=4, and the two hard lemmas (embedding faithfulness, parallel-ROM non-amortization) are asserted, not derived. All gaps are flagged in the doc.

The empirical findings are trustworthy (validated engine); the formal bound wants a cryptographer. This is the natural artifact to put in front of EKR / a CFRG reviewer.