[sethoshi18]

Documentation-only precision corrections from the independent review of PR #87 (W2 NS-3 deployment acceptance evidence) and the Devnet runbook. No code, verifier, or evidence changes.

Base (why this PR is stacked on PR #87)

docs/w2-ns3-acceptance/W2_ACCEPTANCE_REPORT.md exists only on the test/w2-ns3-deployment-acceptance branch — PR #87 is open, not merged, and main (eaaf935683a3a602bf34bfc0f52e199c571d1ad9) does not contain it. To correct PR #87's report without pushing anything into PR #87's branch and without duplicating its evidence into a new PR cut from main, this branch is cut from the exact PR #87 head commit c0eec861e094c4e43bf7ef48ea2158550ec419e1, and this PR uses test/w2-ns3-deployment-acceptance as its base — so the reviewable diff below is exactly the four documentation corrections and nothing else. This PR should merge after (and depends on) PR #87; once PR #87 merges it can be retargeted to main and will merge cleanly.

1–3. The three W2 report corrections (docs/w2-ns3-acceptance/W2_ACCEPTANCE_REPORT.md, +36/−13)

1. Authority comparison wording (§4). The report no longer implies that an incorrect upgrade authority was observed when the ProgramData account itself was absent: "Observed upgrade authority" now reads not observable (ProgramData account absent) and the authority comparison now reads "FAIL — required ProgramData account is absent; upgrade authority cannot be observed". The distinction between the expected initial deployer/upgrade authority (cfJKAzSpYhoKheLWzx7miTHp6HCt46E3oeU3CBo4831) and the expected governance/ProtocolConfig authority (BMnrpx9mSZDzCmM8aJipnzgfLzfxa5tfFgWi3ZvBUwf5) is preserved unchanged. The overall acceptance result remains REJECTED.
2. Verifier failures vs supplemental unverifiable evidence (§9). §9 now separates the three facts: (a) the existing verifier result — 3 PASS, 26 FAIL, 0 UNVERIFIED, 4 INFO — counts exactly as recorded, unchanged, no check reclassified; (b) the supplemental deployed-ELF digest check — UNVERIFIABLE because the GraveScanner and GraveVault program accounts and their ProgramData accounts are absent and there are no deployed ELF bytes to hash; (c) the overall W2 result — REJECTED because the required deployment accounts are absent. The previous wording ("the only unverifiable sub-item is the ELF digest comparison") is removed: the governance authority (B6/B13), dedicated oracles (C1/C2), pause state (D1/D2), and ProgramData-derived authority checks were equally unobservable, and the report now states explicitly that under the existing verifier's acceptance rules missing accounts cause every dependent check to FAIL.
3. Supplemental ELF evidence: provenance and reproducibility boundary (§2, §5, §11). The report now states explicitly: the existing verifier was unmodified; the collector was a separate one-off supplemental script, not a verifier extension; the collector used read-only account retrieval only (getAccountInfo); no deployed ELF bytes were available; no SHA-256 match is claimed; the collector's output is preserved in the evidence directory (elf_digest_check.json); and the collector script itself was not committed, so the exact collector execution is not independently reproducible from this PR alone. The original raw terminal output, JSON verifier output, and ELF-digest JSON were not touched.

4. Runbook ProgramData clarification (docs/DEVNET.md, +18/−4)

The opening NS-3 preparation note previously said ProgramData addresses "are NOT derivable offline" — stale and inconsistent with scripts/devnet/ns3_identities.mjs (programDataPda(), the upgradeable BPF loader / get_program_data_address convention), with scripts/devnet/ns3_derive_pdas.mjs (prints the ProgramData addresses as derived expectations), with scripts/devnet/verify_ns3_deployment.mjs (independently derives the expected ProgramData address and checks the program account's embedded pointer against it), and with the Mode 3 acceptance section of the same document. The corrected note states: the expected ProgramData PDA is derivable offline from the program ID via the upgradeable BPF loader convention; deriving it does not establish that the account exists; the actual program account must still be read from the approved cluster; its ProgramData pointer must match the independently derived address; the ProgramData account must exist with the expected loader ownership, valid structure, and the expected upgrade authority; the deployed ELF must be retrieved (read-only) and checked against the approved SHA-256 digest pinned in scripts/devnet/provenance.manifest.json; and if the account is absent or RPC evidence is unavailable, the corresponding acceptance check FAILs (or stays INCOMPLETE on transport failure) under the existing verifier/runbook rules. No acceptance requirement is weakened; the verifier implementation is not changed.

Files changed

File	Change
docs/w2-ns3-acceptance/W2_ACCEPTANCE_REPORT.md	+36/−13 (6 hunks: §2 collector disclosure, §4 two table rows, §5 provenance + no-match-claimed, §9 three-fact separation, §11 evidence-inventory entry)
docs/DEVNET.md	+18/−4 (1 hunk: opening NS-3 preparation note, ProgramData derivation)

Validation commands and actual results

• git diff --numstat / full git diff review → only the two files above changed; every hunk reviewed.
• sha256sum on the three raw evidence artifacts before and after the edits → identical: elf_digest_check.json eb4bd1a5e0191c3251796183ccfe90eeef6476b46ce214f85259a9efe1e833a4, verify_ns3_deployment.output.json 005f9c4055c50f71855b72146543b4a037f8d2f4db82af440e65ab298e1b3d35, verify_ns3_deployment.output.txt 19486704045b69d5e24bd97522fccb6e45b439337a744993c7286583857aefa7.
• bash scripts/doc-links-lint.sh → checked 143 relative link target(s) / ok: all relative markdown links resolve — PASS (same script CI runs).
• bash scripts/terminology-lint.sh → ok: no forbidden vocabulary detected — PASS (same script CI runs).
• Formatting gate scope verified: .prettierignore excludes *.md ("Prose is out of scope for the code formatter"); pnpm fmt:ts:check / eslint apply to the TS workspaces and no TS file changed — no further formatting check applies to a docs-only diff.
• Placeholder scan (【, XXX, TODO, FIXME, undefined, NaN) over both changed files → zero matches.

Untouched by design

• scripts/devnet/verify_ns3_deployment.mjs and every other file under scripts/ — unmodified (git status --porcelain scripts/ empty).
• The three raw W2 evidence artifacts — byte-identical (hashes above).
• PR docs: clarify W1 post-merge verification evidence #86 (docs/w1-review-precision-fixes @ 1a20bfe) — not touched.
• No on-chain action occurred: no transaction signed or submitted, no deployment, initialization, or upgrade, no authority/oracle/config/pause change, no custody path or key accessed. This PR is documentation-only.