# Codebook v4.4

The unit is a frozen, falsifiable guarantee rather than a mechanism family. Each guarantee row records protected state, security goal, adversary, trusted components, deciding event, lifecycle endpoint, component granularity, evidence locator, alternative reading, and F1-F3. Claim-level locators and alternatives remain authoritative in the claim register.

F1, F2, and F3 permit only `yes`, `no`, `unknown`, or `not applicable`; `conditional` is not a result. `local` has precedence when one documented point decides the named event without cross-boundary coordination, even if data cross a component boundary. `distributed` requires F1=F2=F3=yes; `distributed_in_proposed_model` is the same classification with an explicit evidence-scope qualifier. A multi-decision path with a false predicate is `composed_but_not_distributed`. Missing path evidence or unresolved granularity yields `not_classifiable`. A demonstrably absent named goal is `guarantee_not_established`. Changing exactly one guarantee element or component boundary creates a sensitivity case, not a replacement result.

The five operations - name, mediate, measure, remember, and erase - are provisional comparison bins, not a validated scale. Multi-AI recoding is correlated non-human evidence and cannot establish inter-coder reliability. C29 was retired because the cited book was not checked at the required locator depth.