- Corrupt checkPasses in a capture now fails with a ParityFormatError
  diagnostic instead of a precondition SIGTRAP in the statistics layer.
- n=1 is never 'deterministic': one sample is vacuously identical to
  itself, and the exact short-circuit certified verdicts from single
  stochastic draws. Both output determinism and all-refusal determinism
  now require n >= 2; n=1 comparisons fall back to honest intervals.
- Suites reject duplicate checks per prompt (they double-counted into
  one checkPasses slot, silently recording passes > samples).
- summary() flattens newlines/tabs in example outputs — multi-line model
  output no longer breaks the line-oriented report.
- 'anthropic:' / 'gemini:' with an empty model are rejected instead of
  silently calling a model literally named 'anthropic'.
- --temperature on non-apple-fm providers is rejected instead of being
  silently ignored (captures would claim sampling that never happened).

Found by a 14-agent adversarial audit (5 probe surfaces, every claim
independently re-reproduced before acceptance). 40 tests.