@@ -28,6 +28,14 @@ at commit `52200a5` (Phases 0–2 merged, plus the README and this register). **
 at each phase gate**: confirm the evidence still reproduces, close what the phase closed, and add
 what it introduced. A register without a snapshot goes stale invisibly.
 
+**Phase 3 Gate 2 artefacts landed on 2026-08-18** (branch `phase-3-gate2-artefacts`): `data/real/`
+now holds the frozen pre-registration, 19 crops, 13 of 21 source figures, and the provenance and
+manifest tables. **No entry below has been re-checked against them, and no real blot has been
+measured**, so S1 — the generator has never been validated against a real blot — is unchanged: the
+data to close it now exists in the tree, and the measurement that would close it does not. S6, S15
+and E6 likewise still stand. The one thing that did change mechanically: `tools/check_claims.py`
+verifies every crop and committed parent against its recorded digest on each CI run.
+
 **Phase 4a is in progress** on branch `phase-4a-api`, under the human ruling of 2026-08-17 that
 runs Phase 4 before the remainder of Phase 3 (P2 entry 7). **Four entries have been updated for it,
 and only four:** P2 gains entries (7) and (8); **P1 is widened from numeric claims to claims
 
@@ -2911,6 +2911,76 @@ property carefully: it is *no item requiring a code change*, not *nothing behavi
 saw something behavioural and reported it as a claim defect, which is the hedge the paragraph above
 sets out.
 
+## Phase 3 — Gate 2 artefacts
+
+Gate 2 approved the real-image list on 2026-08-18. This section records where the artefacts
+landed and what was decided about them; **no real blot has been measured yet**, so nothing here
+changes a figure.
+
+### The pre-registration is imported byte-identical, not restated
+
+`data/real/DECISION_unit_of_analysis.md` — 11 sections plus one amendment — was written outside
+this repository and frozen before any measurement, and its digest is cited:
+
+```
+sha256 = 994acc30daf82011acfe957adff2866f824b05aa3b39bade118e539f4cfd88d0
+```
+
+**So it is committed unchanged rather than folded into this file.** NOTES.md records decisions in
+its own voice; rewriting a pre-registration into that voice would destroy the single property
+that makes it one, and any edit — including tidying — invalidates a hash that is quoted in three
+places. This file points at it and deliberately does not paraphrase it. `tools/check_claims.py`
+pins the digest, so an edit fails CI rather than being noticed later.
+
+One consequence worth surfacing here, because a reader of §11 alone would get it wrong: §11a
+re-cropped `PMC13135388_Figure4__E-Vinculin` after §11 was written, so §11's stated
+colour-fraction maximum of 0.0158 describes a **superseded** crop. The current set maximum is
+0.0068, and `crop_log.csv` holds the current crop's digest.
+
+### A source figure is committed if and only if a measured artefact derives from it
+
+19 crops are committed without argument: they are the measured artefacts, and §9 requires ImageJ
+to run on the same crop file byte-identical, so a comparison whose crops are not fixed in the
+tree is not reproducible at all.
+
+Of the 21 source figures, **13 are committed and 8 are not** — the 13 being exactly those a crop
+derives from. The rule is a column (`committed`) in `data/real/sources.csv` rather than a
+convention someone has to remember.
+
+**The brief's premise was that sources are "recoverable from the recorded URLs and sha256s", and
+as recorded they were not.** Checking it before relying on it: `provenance.md` carries
+**truncated** 16-hex digests and **no URL at all**, and the shortlist's `graphic_href` is a bare
+filename, not a link. PMC serves figures from a CDN path containing an opaque per-blob hash that
+cannot be derived from anything recorded, so a URL has to be re-read from the live article page
+every time. Recovery therefore depended on data that existed nowhere in the tree.
+
+That is now fixed in the direction that makes the premise true: `sources.csv` carries the **full**
+64-hex digest, the DOI, the licence, the article URL and the CDN graphic name for all 21, and
+`tools/gate2/refetch_sources.py` performs the recovery — it re-resolves each figure's CDN URL
+from its article page, downloads it, and verifies against the recorded digest, failing loudly if
+upstream has been re-rendered. Runnable, not described.
+
+**Committing the 13 anyway is the deliberate belt-and-braces**, on the same argument that commits
+`data/images/`: recovery depends on someone else's website continuing to serve byte-identical
+bytes, and a measured claim has to stay auditable when it does not. 2.5 MB against that is cheap.
+
+**Recovery was subsequently verified live: 21 of 21** — see the closed open item below. The first
+run failed on all 8 for a TLS-interception reason unrelated to PMC, which is why
+`refetch_sources.py` now builds its TLS context from `certifi`.
+
+### The digest chain is now checked mechanically, because it already caught two real failures
+
+Cropping was done by hand in Preview, whose Cmd+S writes back to the *open* file rather than
+exporting, silently re-encoding the JPEG. **Twice during Gate 2 a parent figure's digest stopped
+matching what `fetch_v2.py` recorded at download**, which is the only reason either overwrite was
+noticed: the pixels look identical and nothing else would have flagged it.
+
+`tools/check_claims.py` now re-verifies both halves of that chain on every CI run — every crop
+against `crop_sha256`, and every committed parent against `parent_sha256` — so a re-saved
+artefact fails the build rather than being measured. Each failure mode was falsified before being
+trusted: a re-saved crop, a missing crop, a re-encoded parent and an edited pre-registration all
+produce the expected failure.
+
 ## Open items
 
 Unresolved questions carried out of a phase. Not decisions — each one names the phase
@@ -2922,6 +2992,47 @@ meaning of the numbers, the usability of the tool, or the trustworthiness of the
 carries the evidence for each. This section stays the per-phase narrative; DEBT.md is the
 index.
 
+### ~~Recovery of the 8 uncommitted Gate 2 sources is untested end to end~~ — CLOSED, 21 of 21 verified live
+
+**Closed 2026-08-18. The recovery works, and the first run found a defect in the tool rather than
+in the record.**
+
+The first networked run failed on all 8 with `CERTIFICATE_VERIFY_FAILED: self signed certificate
+in certificate chain` on every article URL. That is **TLS interception on the operator's network**
+— a middlebox re-signing traffic with a CA the Python default store does not carry — and not a PMC
+failure: the same URLs return 200 when the context is built from certifi's bundle. The tool now
+builds its `SSLContext` from certifi when importable and falls back to the system store with a
+logged note. **Verification is not disabled and will not be**: every fetched byte is checked
+against a recorded sha256, and hashing bytes from a connection nobody authenticated would prove
+only that they match what *someone* served, which is the question the digest exists to answer.
+
+With that fixed, the live result:
+
+- **8 of 8 uncommitted sources recovered**, each matching its recorded sha256.
+- **13 of 13 committed sources re-verified against upstream**, and each byte-identical to the
+  copy in this tree.
+
+So all 21 are recoverable today, and the 13 committed parents are confirmed to be what PMC still
+serves. **This does not retire the argument for committing them** — it confirms the premise held
+on one day, against one set of publishers, and the reason for committing was always that the
+premise can stop holding without notice.
+
+**The run also exposed a defect in the tool, which mattered more than the failure.** It reported
+`0 of 8 verified` and the exit status was read as 0. The status was in fact 1 — the 0 came from
+`$?` after a shell pipe, which reports the last command in the pipeline, not the tool. But the
+episode is why the exit contract is now pinned by `tests/test_refetch_sources.py` rather than
+assumed: the count printed and the status returned are derived from one counter, so they cannot
+disagree, and four tests fail if that is reverted. One genuine defect of the same family was found
+and fixed while looking: a source whose upstream matched the record but whose *committed copy*
+differed was printed as `ok <name>: … COMMITTED COPY DIFFERS` and counted toward the total. A line
+beginning `ok` is what a reader skims past — the same defect as a success exit code, in smaller
+type. It is now a `FAIL` line and excluded from the count.
+
+**Two archived scripts have the same shape and were deliberately not fixed**, since editing them
+would make them differ from what produced `data/real/`: `fetch_v2.py` exits 0 after reporting
+failed downloads, and `log_crops.py` exits 0 after skipping a crop whose parent it could not
+match. Both are recorded in `tools/gate2/README.md` with the controls that now cover them.
+
 ### Whether band ROIs become caller-supplyable — Phase 4b to settle
 
 Phase 4a made **lane** rectangles supplyable and left band ROIs detector-only, so the band object
 
@@ -0,0 +1,179 @@
+# Phase 3 — unit of analysis, minimum N, QC-excluded ratios
+
+Decided: 2026-08-18, before any real image was measured.
+Decided by: Sofia. Status: pre-registered; frozen once the first image is
+downloaded. Amendments after that point require a dated entry below stating
+what changed and why, and are themselves part of the record.
+
+## 1. Unit of analysis
+
+DECISION: ratio (one normalized ratio = one point in the ImageJ comparison).
+
+Rationale: blot-level N (8–10 reachable blots) is below Spearman's
+discriminating power — the Gate 1 deferred question "can Spearman discriminate
+at expected N" answers itself as "no" at that N. Ratio-level N≈30 is reachable
+within the time budget and is testable against the pre-registered thresholds
+(>=0.9 / 0.7–0.9 / <0.7).
+
+## 2. Target N, source, and ratio definition
+
+DECISION: 30 ratios from 8–10 blots with >=3 usable lanes each.
+
+Ratio definition (fixed now, before any measurement):
+- Per blot, the reference lane/band is designated at image-selection time,
+  from the figure caption alone, before any measurement is run.
+- Each remaining usable lane contributes exactly one ratio to that reference:
+  a blot with L usable lanes yields L−1 ratios. No other pairings enter N.
+- Normalization mode per blot is likewise fixed at selection time from the
+  caption: a stated loading-control band -> housekeeping; stated stain-based
+  loading (Ponceau, total protein stain) -> total_protein.
+- A blot whose caption states neither is REJECTED at selection, not decided
+  at measurement time. Guessing the loading control from the data is
+  forbidden (consistent with Phase 2 Ruling 2).
+
+Arithmetic check: 8–10 blots × (L−1) >= 2 ratios each gives 16–30+; the
+stopping rule below caps collection, not the definition.
+
+## 3. Non-independence of ratios within a blot
+
+DECISION: disclosed, not corrected. Ratios within one blot share a background
+estimate and an exposure; effective N is below nominal N; any reported
+confidence interval is optimistic. This becomes a DEBT entry when merged into
+the repo. The reported r itself is unaffected; only its uncertainty is
+understated, and that is stated wherever r is stated.
+
+Agreed: Sofia, 2026-08-18.
+
+## 4. QC-excluded ratios in the ImageJ comparison
+
+DECISION: excluded from the correlation; reported as a separate count
+("n excluded by QC", with the flags that excluded them).
+
+Rationale: the correlation measures agreement on numbers the tool certifies.
+Including numbers the tool itself refuses to certify would mix two populations
+and answer neither question. A secondary correlation on flagged ratios was
+considered and rejected: at the expected flagged n (likely <10) it would be
+uninterpretable noise, and reporting an uninterpretable number invites
+misreading it.
+
+Failure mode I accept: QC may leave fewer than 15 surviving ratios. I will
+report that count as a finding in its own right ("QC excluded X of Y ratios
+from N real blots") and will not relax any QC threshold to save N. QC
+thresholds are frozen as shipped (Phase 3 Gate 1); nothing here reopens them.
+
+## 5. Stopping rule
+
+DECISION: collection stops at 30 ratios or 10 blots, whichever comes first.
+
+If fewer than 15 ratios survive QC, the ImageJ correlation is reported with
+the explicit caveat that N is below the pre-registered minimum and the
+agreement claim is downgraded to descriptive (no threshold verdict). The
+survival count itself is reported as a primary finding. Criteria are not
+relaxed to reach 15.
+
+Agreed: Sofia, 2026-08-18.
+## 6. Source image format (recorded before download, 2026-08-18)
+
+Every candidate figure in the Gate 2 shortlist is distributed as JPEG. The
+`lossy_format` QC flag is therefore expected to fire on the entire real-blot
+set. This is reported as a finding about the OA literature — published figures
+do not preserve the acquisition format the measurement should be made on — and
+not treated as grounds to suppress or exempt the flag.
+
+## 7. Pseudocoloured blots (recorded before download, 2026-08-18)
+
+DECISION: a blot panel whose pixels are not single-channel is REJECTED at
+selection; it is not converted to greyscale.
+
+Scope: the rule applies to the CROPPED blot panel, not to the source figure.
+Published figures are montages — coloured bar charts and MW ladders share a
+file with greyscale blot panels — so a whole-figure colour test would reject
+nearly every candidate while saying nothing about the measured region. The
+download step records a whole-figure colour fraction as a screening aid only.
+
+Rationale: choosing an RGB→grey conversion would introduce a measurement
+parameter selected without data to select it. Phase 3's only reference is the
+ImageJ comparison, and ImageJ applies its own conversion; part of any observed
+disagreement would then be attributable to the conversion rather than to the
+method, with no third reference available to separate the two contributions.
+
+Failure mode I accept: fluorescence-detection blots are common, so this may
+remove a substantial share of candidates and push N down. That count is
+reported ("X of Y candidate panels rejected as pseudocoloured") rather than
+recovered by converting.
+
+Carried to backlog, not Phase 3: blotquant should detect non-single-channel
+input and BLOCK with an explanatory message directing the user to the
+scanner's single-channel export, consistent with the three-state QC model
+(pass | flagged | blocked). Silently converting and returning a number is the
+failure mode this project exists to refuse. -> DEBT entry.
+
+## 8. Gate 2 image review — ratified 2026-08-18, after download, before any crop
+
+(a) FINDING: every total-protein stain panel in the downloaded set (Ponceau,
+2 blots) is reproduced in colour. Under §7 these reference panels are not
+single-channel and are excluded; no per-channel extraction is applied. The
+real-blot set is therefore HOUSEKEEPING-ONLY, and the README will state that
+total_protein agreement was not measurable on published figures for this
+reason. Feeds the non_grayscale_source blocking-flag DEBT entry.
+
+(b) Removed at image review: PMC13135388 Figure 1 (reference panel
+pseudocoloured), PMC13019689 Figures 1 and 3 (Ponceau reference in colour),
+PMC13138064 Figure 4 (2 lanes, below the >=3 minimum — visible only in the
+image, not the caption). Retained with restriction: PMC13135388 Figure 4,
+panels TIGAR + vinculin only (adjacent Parkin panel is pseudocoloured; §7
+applies to the cropped panel). Retained: PMC12956003 Figure 2 (Pon S panel is
+coloured but is not the designated reference; α-tubulin is, and is greyscale).
+
+(c) Borderline-resolution rule: no figure is excluded by eye for band size.
+All remaining figures are cropped; the crop's measured pixel height decides
+against the pre-registered >=15 px band-height minimum. Selection by
+measurement, not by impression.
+
+## 9. Crop rule — fixed before the first crop, 2026-08-18
+
+- One crop = one blot panel: the rectangle bounds the panel's lanes, full lane
+  height, plus >=10 px background margin on every side where the montage
+  allows it.
+- The crop must include the panel's designated reference band row if the
+  reference shares the panel; if the reference is a separate strip (e.g.
+  loading-control row below), it is cropped as part of the same rectangle
+  whenever they are vertically contiguous in the figure, else as a second
+  rectangle recorded against the same blot_id.
+- Annotation overlays (arrows, kDa markers, labels) may remain if they sit
+  outside lane boundaries; a crop where annotation touches a measured lane is
+  rejected.
+- No rotation, no rescaling, no level/contrast adjustment, no resampling.
+  Export as PNG (lossless container; the source pixels are already JPEG and
+  are not re-encoded into further loss).
+- Every crop records: parent file, parent sha256, crop rectangle is NOT
+  recorded manually — the crop file's own sha256 and pixel size are recorded
+  at creation by the logging step, and the parent linkage makes the crop
+  auditable against its source.
+- ImageJ runs on the SAME crop file, byte-identical, never on its own crop.
+
+## 10. Gate 2 CLOSED — 2026-08-18
+
+Real-image list approved by Sofia. The approved set is exactly the rows of
+crops/crop_log.csv at this timestamp; provenance (DOI, licence, sha256 of crop
+and parent) recorded per image in images/provenance.md and crops/crop_log.csv.
+Housekeeping-only per §8(a). Borderline crops enter measurement; the >=15 px
+band-height minimum and lane-width reality decide there, per §8(c).
+
+## 11. §7 verified mechanically on crops — 2026-08-18
+
+Colour fraction measured on all 19 crops after Gate 2 closure: 13 crops at
+0.0000, 5 between 0.0034 and 0.0068 (labels and kDa markers, not bands),
+maximum 0.0158 (PMC13135388_Figure4__E-Vinculin, adjacent to the
+pseudocoloured Parkin panel). All below the 0.02 screening threshold. The §7
+single-channel rule is therefore confirmed by measurement, not by eye.
+
+### 11a. Amendment — 2026-08-18, after §11
+
+PMC13135388_Figure4__E-Vinculin was re-cropped: the original rectangle
+included the lower edge of the adjacent pseudocoloured Parkin panel
+(colour fraction 0.0158). The band region was unaffected, but that edge sits
+in the background region the pipeline uses for background estimation. The
+re-crop excludes it; measured colour fraction is now 0.0000 and the crop
+sha256 in crop_log.csv is updated accordingly. §11's stated maximum of 0.0158
+refers to the superseded crop; the current set maximum is 0.0068.