Motivated by a real defect a from-genesis import proof found the same day: the
public patch set's loader bound key index 0 while its seal rule called it
unbound, rejecting a valid first anchor certificate that production accepts.
The model proves with z3 that under one shared index->address mapping,
'unbound never validates' is a theorem, and exhibits both divergence
directions: valid-rejected (liveness loss, the defect measured today) and
unvouched-accepted (safety loss, the silent one). Both proven impossible under
agreement. Six checks, each with the solver required to SAT the planted bad
world before the UNSAT proof counts. Engineering consequence stated: one
function, not two implementations of the same idea.
