docs: define combined human-control pilot

docs/BUILD_LOG.md

@@ -383,3 +383,13 @@ Evidence: `docs/v0.3/ADR-008-EVIDENCE-CARRYING-GENERATION.md`; updated PRD, thes
 - Added a three-arm ablation against autonomous explanation and shadow-only prediction. No product-effectiveness, live-influence, or skill-retention result is claimed.
 
 Evidence: `docs/v0.3/ADR-009-DECISION-FUTURES.md`; updated PRD, thesis, research, project state, completion audit, and v0.3 index. Implementation remains gated by the complete two-rater R7 expert audit.
+
+## 2026-08-01 — Combined R8 human-control protocol
+
+- Replaced the outdated three-condition delayed-transfer design with a draft four-condition protocol: Autonomous, fixed Active comparator, Shadow control, and Full PureFlow with genuine Decision Futures.
+- Mapped the original product goal to behavioral evidence for autonomy throughput, total change accountability, executable control, real integration authority, voluntary attention, and AI-off takeover.
+- Defined an intention-to-treat primary contrast of Full PureFlow versus Active comparator, followed by frozen mechanism tests of Full versus Shadow and Takeover Envelope calibration against confidence/exposure baselines.
+- Added delayed AI-off transfer, longer-delay and field boundaries, privacy/minimization rules, ordered analysis, event contracts, and kill criteria that remove mechanisms when they do not add behavioral value.
+- Grounded the design in current coding-skill and human-agency research without treating immediate quizzes, surveys, interviews, or target thresholds as product evidence.
+
+Evidence: `docs/v0.3/R8_COMBINED_PILOT_PROTOCOL.md` and updated experiment/execution handoff documents. No participants were enrolled, no target was measured, and implementation remains gated by the complete R7 expert audit plus R5/R6 runtime.

docs/PROJECT_STATE.md

@@ -36,6 +36,7 @@ Branch `codex/shadow-cockpit-rnd` resets the product R&D thesis around **Dual-Co
 - The preregistered R7 collector froze 30 eligible patches from six repositories after evaluating 457 bounded eligibility records. Manifest `a4ef6cbfa48c66cb9d384bcc2834ecbfae8ff08810abfd1863b395b8aa47d149` contains 12 development and 18 held-out patches; `docs/v0.3/results/R7_CORPUS_COLLECTION.md` reports repository and first-match exclusion counts. No compiler or human outcome influenced selection.
 - The frozen R7 automatic audit passed its preregistered automatic threshold: 17/18 held-out identities compiled and 16/18 were valid end-to-end. The frozen blind expert packet set and deterministic rating join exist, but two independent ratings and adjudication remain pending. Full R7 has not passed; R5/R6 stay gated.
 - ADR-007 proposes an Executable Operator Model and shadow-control protocol. ADR-008 adds a bidirectional Intent Ledger for artifact accountability. ADR-009 adds Decision Futures and a Takeover Envelope so an on-time pre-reveal human commitment can determine a live integrated branch while agents retain implementation. Together they cover artifact accountability, demonstrated control, and real decision authority; none is implementation evidence.
+- `docs/v0.3/R8_COMBINED_PILOT_PROTOCOL.md` now defines the draft four-condition human study needed to test the combined architecture against ordinary autonomous use and a fixed active-review comparator. It has no participants or measured outcomes and cannot be frozen until full R7 and the R5/R6 runtime exist.
 - `GOAL_COMPLETION_AUDIT.md` maps the original product goal to current evidence. It explicitly records that the live agent plane, v0.3 cockpit, cold relay, delayed-transfer study, and skill-preservation claim remain incomplete.
 - The readiness ledger and v0.3 cockpit do not exist yet. R0–R4.5 remain a closed reviewed-fixture mechanism and do not execute arbitrary participant or workspace code.
 - No skill-retention or speed metric has been measured. Values in the PRD are predeclared R&D targets.
@@ -155,9 +156,9 @@ No external input blocks the repository-owned fixture R0–R4.5 mechanism in `do
 ## Next ordered actions
 
 1. Obtain and adjudicate two independent blind expert ratings for packet index `54d78382b3ddbe15cba1f8153275e8149d32ddaa5192163f99ca5f43d903e8fe`.
-2. If full R7 passes, review ADR-007, ADR-008, and ADR-009 together, then freeze the Operator Model, Intent Ledger, Decision Future, and Takeover Envelope schemas, hash domains, projections, evidence authorities, timing policy, and selector ablations before implementation.
+2. If full R7 passes, review ADR-007, ADR-008, ADR-009, and the R8 combined protocol together, then freeze the Operator Model, Intent Ledger, Decision Future, and Takeover Envelope schemas, hash domains, projections, evidence authorities, timing policy, selector ablations, and four-condition study contrasts before implementation.
 3. Add the local readiness ledger and minimal cockpit only after the complete R7 expert gate passes.
-4. Run the preregistered delayed-transfer pilot before making any skill-retention claim.
+4. Freeze and run the four-condition delayed-transfer pilot only after the technical runtime can instantiate every condition; run the longitudinal field pilot before making a sustained skill-retention claim.
 
 ## Recent milestone commits
 

docs/v0.3/AGENT_EXECUTION.md

@@ -373,6 +373,16 @@ Use the thresholds in `EXPERIMENTS.md`. If the compiler misses the gate, narrow
 
 Agents may prepare fixtures, instrumentation, recruitment copy, randomization code, and analysis notebooks. A real human study, consent, outcome labeling, and claims cannot be automated away.
 
+Use [`R8_COMBINED_PILOT_PROTOCOL.md`](R8_COMBINED_PILOT_PROTOCOL.md) as the preregistration template. It compares Autonomous, Active comparator, Shadow control, and Full PureFlow so executable practice, live decision authority, accountability, and readiness prediction can be falsified separately.
+
+### Entry gate
+
+- complete the frozen R7 expert ratings and adjudication;
+- implement one versioned R5/R6 runtime capable of all four conditions;
+- freeze ADR-007–009 schemas, hash domains, evidence authorities, invalidation, and timing rules;
+- pass technical fixtures for total changed-line reconciliation, operator-model invalidation, Decision Future integration integrity, and delayed-task isolation;
+- freeze the protocol, analysis code, task pairs, exclusions, and artifact hashes before enrollment.
+
 ### Required artifacts
 
 - preregistered hypotheses and exclusions;
@@ -382,6 +392,8 @@ Agents may prepare fixtures, instrumentation, recruitment copy, randomization co
 - delayed adjacent-task oracle;
 - blinded scoring rubric;
 - raw-data minimization plan;
+- frozen four-condition protocol and ordered mechanism contrasts;
+- Intent Ledger, Operator Model, Decision Future, and Takeover Envelope event schemas;
 - result report separating pilot targets from observed values.
 
 ### Gate
@@ -404,6 +416,7 @@ flowchart LR
     R7 --> R6["R6 Cockpit"]
     R5 --> R6
     R7 --> R8["R8 Human pilot"]
+    R5 --> R8
     R6 --> R8
 ```
 

docs/v0.3/EXPERIMENTS.md

@@ -28,6 +28,18 @@ A narrow compiler can generate coherent, deterministic episodes from normal test
 
 An event-triggered Explain-to-Break pulse selected from a causally important seam will produce better delayed adjacent-task performance per minute of attention than asking the developer to explain a randomly selected function.
 
+### H6 — Live decision authority adds value beyond shadow control
+
+A pre-reveal Decision Future that can determine a real integrated path will improve delayed takeover and calibrated engineering agency beyond an otherwise identical shadow-control episode, without breaching the production-speed or attention margins.
+
+### H7 — The Takeover Envelope predicts blackout performance
+
+Project-scoped, time-stamped control evidence will predict delayed AI-off takeover better than self-confidence, diff exposure, episode count, or immediate explanation quality.
+
+### H8 — Evidence-carrying generation makes large changes accountable
+
+The Intent Ledger will let developers locate the relevant intent, invariant, and evidence in generated changes faster than raw diffs or AI summaries, without false `supported` provenance. Navigation success is an accountability outcome, not proof of skill retention.
+
 ## What does not count as success
 
 - more questions answered correctly immediately after generation;
@@ -157,6 +169,8 @@ Each participant completes three short project-derived episodes:
 2. diagnose and repair a change-derived fault;
 3. direct an intervention through a cold agent that receives only requested evidence.
 
+Across the set, include one Intent Ledger evidence-navigation task and one genuine Decision Future whose on-time pre-reveal commitment can alter the integrated path. These additions test interaction integrity only; this small pilot cannot establish H6–H8.
+
 The production agent runs a separate real task concurrently to test interruption and attention switching.
 
 ### Measures
@@ -206,6 +220,8 @@ H5 requires a separately powered confirmatory comparison of policy 1 versus poli
 
 ## Experiment 3 — Controlled delayed-transfer study
 
+The complete preregistration template is [`R8_COMBINED_PILOT_PROTOCOL.md`](R8_COMBINED_PILOT_PROTOCOL.md). Freeze it before enrollment; this section is the decision summary.
+
 ### Research design
 
 Run a randomized controlled study on unfamiliar but realistic modules. Use a power analysis after the pilot to choose sample size; do not present a small convenience sample as definitive.
@@ -214,9 +230,10 @@ Run a randomized controlled study on unfamiliar but realistic modules. Use a pow
 
 1. **Autonomous:** full agent execution plus normal result view.
 2. **Active comparator:** autonomous agent plus a fixed 10-minute protocol containing the same diff, a standardized explanation, and three preregistered post-hoc questions. Do not substitute a manual seam after seeing results.
-3. **Dual control:** autonomous agent plus a compiled prediction–diagnosis–recovery episode.
+3. **Shadow control:** autonomous agent plus Intent Ledger navigation, an Operator Model snapshot, and a compiled prediction–diagnosis–recovery episode that cannot affect production.
+4. **Full PureFlow:** the same shadow-control mechanisms plus one genuine Decision Future whose on-time pre-reveal commitment can determine the integrated production path.
 
-All groups get the same agent model, task, time budget, repository state, and production tests.
+All groups get the same agent model, task, time and token budgets, repository state, documentation access, and production tests. Active comparator, Shadow control, and Full PureFlow receive the same maximum active-attention budget.
 
 ### Phase A — Production task
 
@@ -236,7 +253,7 @@ The task must share the underlying invariant or data path but not the exact prac
 
 ### Primary outcomes
 
-- **Primary estimand:** intention-to-treat risk difference between Dual control and Active comparator in the proportion completing a regression-free adjacent change within 45 minutes;
+- **Primary estimand:** intention-to-treat risk difference between Full PureFlow and Active comparator in the proportion completing a regression-free adjacent change within 45 minutes;
 - successful regression-free adjacent change in the Autonomous condition is exploratory;
 - time to first valid causal hypothesis;
 - fault localization;
@@ -247,6 +264,9 @@ The task must share the underlying invariant or data path but not the exact prac
 
 - confidence calibration;
 - architecture explanation scored blind by experts;
+- Intent Ledger navigation accuracy and false-provenance rate;
+- live-influence, false-fork, skip, late, default, and speculative-compute rates;
+- Takeover Envelope calibration against confidence and exposure baselines;
 - retention after an additional delay;
 - subjective workload and product preference.
 
@@ -260,9 +280,19 @@ The task must share the underlying invariant or data path but not the exact prac
 - distinguish immediate performance from delayed transfer.
 - randomize before the production task and analyze participants in their assigned condition;
 - count missing primary outcomes as unsuccessful in the conservative primary analysis and report a preregistered missing-data sensitivity analysis;
-- cap both Active comparator and Dual control at 10 active minutes during Phase A so attention, not just elapsed time, is comparable;
+- cap Active comparator, Shadow control, and Full PureFlow at 10 active minutes during Phase A so attention, not just elapsed time, is comparable;
 - standardize the delay and task timeout above rather than selecting them post hoc.
 
+### Ordered mechanism tests
+
+Run comparisons in this frozen order:
+
+1. Full PureFlow versus Active comparator tests the combined product claim;
+2. Full PureFlow versus Shadow control tests whether real live authority adds value beyond matched executable practice;
+3. the Takeover Envelope is compared with self-confidence, diff exposure, and episode-count baselines.
+
+The pilot estimates variance. Freeze the confirmatory sample size, minimum worthwhile Full-versus-Shadow effect, and predictive-calibration margin before enrollment. Do not select the best arm post hoc.
+
 ### Mechanism ablation
 
 Before scale-up, run a separately powered or explicitly exploratory ablation across equivalent tasks:
@@ -275,14 +305,14 @@ This tests whether prediction and evidence selection add transfer beyond executi
 
 ### Product gate
 
-Proceed to a longitudinal field pilot only if dual control:
+Proceed to a longitudinal field pilot only if Full PureFlow:
 
 - improves delayed adjacent-task success over the fixed Active comparator by at least 20 percentage points and the 95% confidence interval for the primary risk difference excludes zero;
 - does not increase median production critical-path time by more than 5% and p90 by more than 10%;
 - stays within a median 10-minute human attention budget;
 - outperforms the active comparator on behavior, not just confidence.
 
-If only immediate recall improves, reclassify the feature as a tutor and reject the revolutionary-IDE claim.
+If Full PureFlow and Shadow control are equivalent within the frozen worthwhile-effect margin, remove Decision Futures from the product core or retain them only as an optional agency feature. If the Takeover Envelope does not outperform simple confidence/exposure baselines, remove readiness and routing claims. If only immediate recall improves, reclassify the feature as a tutor and reject the revolutionary-IDE claim.
 
 ## Experiment 4 — Longitudinal field pilot
 
@@ -339,6 +369,17 @@ Every generated episode must pass these checks before presentation:
 The pilot should capture event types, not raw private content by default:
 
 ```text
+intent_ledger.opened
+intent_ledger.unit_selected
+intent_ledger.evidence_opened
+operator_model.snapshot
+takeover_envelope.snapshot
+decision_future.offered
+decision_future.committed
+decision_future.integrated
+decision_future.auto_defaulted
+decision_future.skipped
+decision_future.late
 experience.offered
 experience.started
 prediction.recorded

docs/v0.3/GOAL_COMPLETION_AUDIT.md

@@ -34,7 +34,7 @@ The original goal is broader than a compiler benchmark or an explanatory extensi
 - live Codex/Claude/OpenCode adapter accessible from this checkout;
 - context-starved relay on arbitrary supported project code;
 - Decision Futures with real bounded integration authority and an honest Takeover Envelope;
-- delayed-transfer human experiment;
+- frozen four-condition delayed-transfer human experiment and participant evidence;
 - longitudinal evidence of skill preservation;
 - evidence that developers voluntarily keep a non-zero attention budget;
 - any honest basis for saying PureFlow already preserves skills.
@@ -50,7 +50,7 @@ The active goal may be marked complete only when all of these are true:
 5. local Operator Model state invalidates correctly as the code changes;
 6. every changed line resolves through the local Intent Ledger to a bounded unit and an honest attribution state;
 7. a delayed adjacent task demonstrates takeover without answer-generating AI;
-8. a controlled study beats the active diff/explanation/question comparator while preserving production speed;
+8. the Full PureFlow condition beats the active diff/explanation/question comparator while preserving production speed, and its planned comparison with matched Shadow control isolates whether live decision authority adds value;
 9. the runtime, deletion/export, packaging, and protected CI pass on supported platforms.
 
 Green unit tests for any individual component are necessary evidence, not completion of this goal.