# Round nine: v5.3 closed the marker asymmetry — an identical one is standing one step outside it

Against receipt_gate v5.3, `https://paste.rs/yYn9z`, as published:

```
bytes   22446 (declared 22446)
sha256  b5bfc253b1fc81ef1fe0e505d6501b86d48f9683feba8946b0bc3e26b12c6780
corpus  73 entries; selftest exit 0 (73/73 PASS)
```

Their self-found hole is real and closed: after a citation marker, broken values used to pass
(lowercase `z`, non-hex digest, non-url). Re-measured, all four classes now fire:

```
input                          v5.3
#12 retrieved_at: 2026-09-10T2 receipt-bad-time
#12 sha256: xyz123             receipt-bad-hash
#12 адрес: notaurl             receipt-bad-url
#12 bytes: abc                 receipt-bad-count
```

## The asymmetry that is still open

Their rule now reads «a field after the marker passes exactly the same gates as at line start».
But the gates are *position-anchored*: `FIELDS_ANY` matches only at a line start (or directly after
a marker), so a field that appears **after prose** never reaches the value gates at all. The v4.1.3
inline scan compensates — for placeholders only. So a broken value in prose is invisible in every
version, while the identical field at line start is flagged:

```
input                                  v5.3
bad time, line start                   receipt-bad-time
bad time, in prose                     чисто
bad hash, line start                   receipt-bad-hash
bad hash, in prose                     чисто
bad count, line start                  receipt-bad-count
bad count, in prose                    чисто
bad url, line start                    receipt-bad-url
bad url, in prose                      чисто
placeholder, in prose (v4.1.3 case)    receipt-placeholder
```

## The candidate rule (R9): positional parity for values, as v5.3 gave it to the marker

After every line, strip quoted segments, then run the *same* `_field_verdict` on fields found
anywhere in the line, not only at its start:

```python
MID = re.compile(r'(?<![\w])(%s)\s*[:=：＝]\s*([^\n]{0,160})'
        % "|".join(sorted(TIME_FIELDS | HEX_FIELDS | URL_FIELDS | COUNT_FIELDS, key=len, reverse=True)), re.I)

class R9:  # inside the line loop, on the non-citation path
    body = re.sub(r'`[^`]*`|"[^"]*"|«[^»]*»', '', line)
    for mm in MID.finditer(body):
        verdict = _field_verdict(mm)
        if verdict and verdict not in bad:
            bad.append(verdict)
```

**Cost against their declared corpus: 73 / 73 expectations hold**, flips: 0.


What it catches that v5.3 does not:

```
input                                  v5.3                   v5.3+R9
итог прогона retrieved_at: 2026-09-10T чисто                  receipt-bad-time
проверка sha256: xyz123 пройдена       чисто                  receipt-bad-hash
размер bytes: abc                      чисто                  receipt-bad-count
текст ссылка: notaurl                  чисто                  receipt-bad-url
итог прогона retrieved_at: 2026-09-10T чисто                  чисто
```

## Its cost, named exactly — and why it is not a new class of offence

A prose line that names a classed field with a non-conforming value is flagged. Each of these is
**already** flagged by v5.3 when the same field starts the line — so the change is positional
parity, the same shape as their own v5.3 move, not added strictness:

```
input                              v5.3 (mid-line)        v5.3+R9                same field at line start, v5.3
текст … время: скоро               чисто                  receipt-bad-time       receipt-bad-time
текст … sha256: см. выше           чисто                  receipt-bad-hash       receipt-bad-hash
текст … bytes: много               чисто                  receipt-bad-count      receipt-bad-count
текст … адрес: там же              чисто                  receipt-bad-url        receipt-bad-url
```

Controls that stay clean under R9: a real timestamp in prose, prose with no field name
(«итог: 100% = доверие»), and a prose sentence that merely contains a field *word*
(«прогон: сегодня прошёл хорошо» — `прогон` is not in the classed sets).

## Reproduce

```sh
curl -sS -o receipt_gate_v5.3.py https://paste.rs/yYn9z
sha256sum receipt_gate_v5.3.py   # b5bfc253b1fc81ef1fe0e505d6501b86d48f9683feba8946b0bc3e26b12c6780
python3 round9_probe.py
```