docs(fr-041): rebuild the benchmark design around a two-reviewer review

The 2026-09-11 draft went to two independent reviewers on one neutral brief,
blind to each other. Both rejected executing it as written and both rejected
deferring the study for another friction round — the earlier friction programme
did not stall, it self-terminated with a prescription, and this FR is that
prescription. So the study stays; the phasing and the pre-registration change.

The defect most likely to have sunk the published result came from one reviewer
alone: §9 tuned Arm B against the SCORED task sequence until three clean runs,
while Arm A got no equivalent loop. That is train-on-test with an asymmetric
tuning budget. §3a now splits a held-out scored set from a disjoint pilot set,
and both arms get the same published improvement budget on the pilot — the same
shape the fit-assessment design already uses for tuning vs held-out targets.

Arm A is now DERIVED from Arm B's generated output with the model and generators
removed, so the two seeds differ in the model and the gate rather than in
craftsmanship — and a fluent reviewer is asked to review code, which is
recruitable, instead of to build an app, which is not.

n is calibrated from pilot variance instead of asserted. The analysis unit is
the run, not the task execution: tasks in a cumulative sequence are correlated,
so 15x10 is ~10 data points, not 150. The old "at least 10" is plausibly
under-powered two- to three-fold. The variance is not hypothetical — one
identical configuration measured 25/51/28 agent turns at temperature 0 (41% CV)
while authored lines held to 2%, so the choice of measure decides whether you
are measuring the treatment or the trajectory.

H2 becomes time-to-CORRECT, not time-to-done, and drops to secondary. It stays
in despite its likely failure: dropping a hypothesis because its result would be
an unflattering headline is what pre-registration exists to stop. The primary is
analysed intention-to-treat (§5a), because an escaped defect requires a green
build, so an arm that abandons tasks scored better — and with a 3-4x measured
cost differential and a shared budget cap, Arm B abandons first.

Added in review, raised by neither reviewer: `meta verify` already covers four
of the five §4 invariant classes and §2 wires it into Arm B's build, so Arm B's
escaped-defect count for those is structurally zero rather than empirically low.
That is the mechanism, but read naively it is circular. §4a requires the split
report, and makes model coverage a measured quantity — code the model does not
cover cannot drift against the model, which is exactly the escape hatch the
earlier rounds observed.

§1 now states the earlier benchmark in full, including that MetaObjects was a
NET NEGATIVE on one-shot greenfield builds at 3-4x the cost. The draft called it
"one earlier internal comparison ... too small to mean anything", which
understated 14 runs over four rounds and read as burying the result.

§2 also settles a contradiction that hid real cost: it said "the public
reference app" and "TypeScript + Postgres", and the only public reference app
runs on Cloudflare D1. Ruled: a purpose-built Postgres app, both arms new.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011cQxyVuTkdPmAduLiedNEg

Author: dmealing