v2.7.2

An additive, advisory-only release: five lab-validated signals for the slow shapes join the opt-in tier, each re-measured on the shipped implementation with fresh seeds before inclusion. Nothing on the default path changes - no existing module imports the new ones, all 621 pre-existing tests pass unmodified, and the classic release round re-measured every cell against the 2.7.1 baseline with NO new regressions. One further candidate was excluded at the SDK stage (see the last bullet).

• Shrink-slope signal — C27 (createShrinkSlopeSignal, NEW, advisory): a per-identity empirical-Bayes detector for the persistent slow harvester. It estimates θ - the mean new records per day over an identity's own days 31-90 - under a robust mixture prior fitted per request-volume stratum on a host-supplied reference population, flagging when P(θ > c_s | data) >= 0.975 with c_s the stratum's reference q99. Lab record (pre-registered, seeded simulation): 0/1,200 false flags on legitimate and 0/1,200 on sale populations, steady plateaus at 7/20/50 new records a day flagged 300/300 each, a 7-to-20 ramp flagged 300/300, prior contamination at 5%/15% held false flags at 0.00%. The SDK re-measurement on fresh seeds reproduced every cell exactly (0/1,200; 0/1,200; 300/300/300; 300/300) at 0.003 ms per identity scored. One translation deviation, quantified in the recheck rather than absorbed: the port scores on an identity-relative day clock and takes the host's "now" through evaluateIdentity(identity, asOfTs) - a draft recheck run without it left 312/1,200 legitimate identities at 'insufficient_history', with asOfTs supplied past every identity's day 90, every recheck cell scored every identity (0 unscored). Declared structural blind spots, pinned by tests: identities younger than the late window are never scored (cold start is the budget layer's ground), and a front-load-then-idle shape is invisible to the late-window estimand (0/300). The perfect separation is a property of the lab's saturating legitimate generator - see LIMITATIONS for the unmeasured real-reader shape.
• Watchlist signal — C30 (createWatchlistSignal, NEW, advisory): a per-identity regularity statistic for machine-paced revisiting. For each resource visited on >= 5 distinct days it computes the coefficient of variation of the visit-day gaps; the identity's statistic is the median across its >= 3 eligible resources, flagging at median CV <= τau (default 0.613, the lab TRAIN q01; hosts can refit from their own reference traces). Lab record: false flags 1.33% legitimate / 0.83% sale; the SDK re-measurement on fresh seeds measured 1.67% legitimate (20/1,200) / 1.17% sale (14/1,200) - both under the locked 2% bar - flagged unjittered pollers 120/120 and jittered pollers 120/120 (jittering every interval by up to ±100% at 100%. The declared false-flag groups are habitual same-resource checkers (SDK 5.42%; lab 4.83%) and event-driven checkers (SDK 5.33%; lab 4.50%) - near-periodic humans are a named cost of the day scale, and sub-day polling is invisible by construction. The port's gap-CV divides by the population count exactly as the lab code does; no sd-convention deviation exists.
• Decoy tripwire — C35 (createDecoyTripwire, NEW, advisory): a touch tripwire over host-declared decoy resources - resources planted outside every discovery surface (no navigation, sitemap, listing or search index). A touch is reported as an enumeration event ('flagged = touched >= 1'), never as an intent verdict. With random placement - verified in the lab as the standard configuration and shipped as such - enumeration walkers touched a decoy in 100% of cells at every sweep size and order (540/540 walker cells in the SDK re-measurement), a learning evader still touched in 100% (60/60 at every sweep size), and legitimate browsing touched none (0/1,200 identities over 1,116,264 requests on the SDK re-measurement; 0/1,200 over 1,115,408 requests in the lab). With no decoy declaration the module disables itself and records nothing. The signal dies if a decoy leaks onto any discovery surface; that operating condition is part of the module's contract, stated in its header and in LIMITATIONS.
• Bunching monitor — C29 (createBunchingMonitor, NEW, advisory): a population-level calibration gauge for extraction that piles up just under a ceiling the host enforces. It reads the population's daily-novelty histogram and measures excess mass in the window below a host-known notch against a degree-5 polynomial counterfactual on log counts fitted outside an [n-3, n+2] donut, with a parametric-bootstrap standard error (200 Poisson draws from the smoothed fit). Lab record (pre-registered, seeded simulation): placebo z <= 2.17 across notches (10, 20, 25, 50) on legitimate and sale populations with a fresh-seed placebo maximum of 1.55, and a planted hard-calibrator control at z = 36.97, and the excess mass migrating to the new notch when the ceiling moved (z = 29.47). The SDK re-measurement on fresh seeds reproduced the verdict: placebo maximum z = 2.05 with no cell at or above the locked +3 bar across 24 legitimate/sale cells, and the control and migration cells matched the lab exactly (36.97 / 29.47); feeding the lab's cached legitimate histogram into the module reproduces its z/B/SE to every printed digit. The advice ceiling is structural, not a promise: the module has no identity-level API and no per-identity verdict field anywhere in its output - it reads population histograms only - populations under minIdentityDays (default 2,000 identity-days) are reported unscored, and the notch must be an integer in [4, 60]. Declared limits from the lab record: the measured control is a HARD calibrator (soft, probabilistic calibration is unmeasured), the estimator's sensitivity to polynomial and donut choices is declared but was never quantified, and a threshold-blind slow walker does not bunch by construction.
• Value watermark — C39 (createValueWatermark, NEW, advisory): a provenance verifier for derived totals a host publishes (per-edition feeds, exports, partner reports). At publication time each total is marked with a keyed residue embedded by magnitude (units digit always; tens and hundreds digits on larger tiers; distortion on the shipped marker measured at median 0.260%, p99 2.34% of the total - lab: median 0.229%, p99 2.18%); verification decodes the residue from (quantity, unit price, published total) triples and confirms a scale when its matches clear the adaptive R-ADAPT bar, the edition verdict being the OR across scales - so the mark survives #1 noise (the hundreds scale confirms) and rounding to the nearest hundred (the tens/unit scales confirm) without either transformation being anticipated. SDK re-measurement on fresh seeds: false confirmations 0/200 exact, 0/200 rounded, 0/200 cross-key; marked editions confirmed 200/200 under ±1 noise, 200/200 under rounding, 200/200 through a two-step transformation chain; group totals are covered by the module's unit tests (50/50 marked groups confirm, honest groups do not) rather than by a recheck cell; small marked editions that cannot confirm alone confirm pooled across 80 editions at 90.0% (180/200; lab 94.0%) - exactly at the pre-registered >= 90% bar, a thin pass recorded as such. Structural properties, stated up front: totals recomputed from their components carry no mark (0/200, pinned by test), and a fully informed adversary who knows the key and placement can forge or strip marks, so the claim is provenance of the publication path, not resistance to an insider.
• Excluded at the SDK stage — lineage watch (R14): the lab candidate for grouping synthetic account lineages holds a PASS-lab record (the v2b law, stability-verified over 5 fresh seed blocks: pooled family recovery ARI 0.782, flat false-merge <= 0.614% per block), and its SDK port's clustering is bit-faithful - at any fixed threshold its partition is identical to the lab's. The port nevertheless failed the locked SDK recheck: its self-calibration draws nulls by permuting coordinates of the OBSERVED population, and on a population that HAS lineage structure those marginals are lumpy with founder mass, so the calibration false-merge rate at a given threshold runs higher than under the lab's generator-drawn flat nulls, the <= 1% selection rule picks a lower cut (h_b 0.24-0.28 on the structured cells, against the lab's 0.32), and recovery pays for it - pooled CLEAN ARI 0.622 against the locked 0.75 bar and EV-SWITCH 0.439 against 0.50 (EV-MERGE 0.527 and flat false-merge 0.645% passed). On flat populations the two nulls nearly coincide and the deviation vanishes, which is the evidence the defect sits in the calibration step, not the clustering. Under the release rule - no gate loosened after the numbers, no candidate forced in - it does not ship in 2.7.2. The full record is in the deep dive (Part 7); any fix is a change to the calibration mechanism and requires its own registration, not a patch in this release.