Land wave-B: belief-matching fix, v2 licence tokens, E/S/C wave work

Built on top of origin/main rather than force-pushed. The local snapshot repo
shares NO merge base with this history (156 commits, `git diff` reports "no
merge base"), so a force-push would have destroyed all of it. These changes are
applied as an ordinary commit on top instead.

fix(belief-matching): decode returned an empty array for EVERY syndrome.
`from_numpy_h` built `hyper_obs = zeros((0, nH))` and `decode` returns
`hyper_obs @ hard`, so a decoder constructed from a raw parity-check matrix was
silently useless and reported no error. `edge_obs` had the same defect, breaking
the matching fallback for exactly the syndromes BP found hardest. Both now carry
qubit incidence, so decode returns a length-n_qubits correction. Verified
faithful on all 16 repetition-code d=5 syndromes.

fix(license): malformed tokens raised instead of returning False. The
`except RuntimeError` clauses caught neither binascii.Error nor
UnicodeDecodeError (both ValueError subclasses), so garbage input crashed the
caller. Now catches (InvalidSignature, ValueError, TypeError).

feat(license): v2 tokens carrying tier + expiry inside the signature. Legacy
tokens sign only `receipt_id:email`, so a 60-day evaluation was
cryptographically identical to a perpetual licence. Signature is verified BEFORE
claims are parsed. Legacy 2- and 3-part tokens still verify; v2 fails closed on
older installs.

fix(stripe): stop pinning payment_method_types=["card"], which disabled Link,
wallets and local payment methods.

Lands the E1-E6 / S1 / S5 / C1-C6 work that K3dev.md recorded as complete but
which had never been committed (ler.py, bench.py, codes.py CSS logicals, the DEM
path, and their test modules).

Licensing notice now reaches non-interactive runs -- scripts and services, where
commercial users actually are; previously only a REPL saw it. One stderr message
at import, never repeats, never gates functionality, suppressed by
QECTOR_SILENT=1 and silent when licensed.

Docs: five tuning environment variables documented with which ones change
RESULTS rather than only throughput; docs/RELEASING.md records why an sdist must
never be published (.gitignore excludes src/, maturin sdist honours git, so the
tarball ships Cargo.toml with no .rs sources and cannot build).

Gates: ruff check clean; ruff format clean (172 files); 107 passed across the
licence/stripe/comprehensive suites on this tree; full local suite 1237 passed,
1 skipped, 0 failed; cargo test 203 passed; clippy 0 warnings.

Author: qectorlab

.gitignore

@@ -37,6 +37,12 @@ pip-wheel-metadata/
 share/python-wheels/
 MANIFEST
 
+# --- Secrets (never commit live keys) ---
+.env
+.env.local
+.env.*.local
+licenses_issued.json
+
 # --- Virtual environments ---
 .venv/
 venv/
@@ -68,8 +74,8 @@ artifacts/
 Thumbs.db
 desktop.ini
 
-# --- Benchmark outputs (tracked selectively) ---
-# benchmark_results/ is tracked intentionally for reproducibility evidence
+# --- Benchmark outputs (canonical archive on Zenodo: doi.org/10.5281/zenodo.21339300) ---
+benchmark_results/
 
 # --- Testing ---
 .pytest_cache/
@@ -95,6 +101,8 @@ _pytest_*.log
 _pytest_v*.log
 test_full_v*.py
 test_v0*.py
+_smoke_test.py
+_scratch*.py
 
 # kimi probe/fix helpers
 _kimi_fix_probe.py
@@ -147,6 +155,11 @@ gem.md
 todo2.md
 topplan.md
 QECTOR_v0.6.3_Development_Plan.md
+dev.md
+finaltodo.md
+Kimi.md
+todo_claude*.md
+test_market_leadership_suite.py
 *.tex
 *.pdf
 perf_chart_*.png
@@ -157,6 +170,13 @@ make_*.py
 generate_pdf_report.py
 cpu_benchmark_report.py
 
+# --- Local-only archives / scratch artifacts ---
+*.zip
+node_modules/
+package*.json
+proto.zip
+qector-build-rc-0.6.2.zip
+
 # --- IDE / editor config (never push) ---
 cspell.json
 pyrightconfig.json
@@ -174,3 +194,9 @@ PYPI_README.md
 # --- Local-only docs (contain secret names / infra details, never push) ---
 RELEASE_PROCEDURE.md
 
+
+# --- Internal implementation tracker (infra IDs, never publish) ---
+K3dev.md
+
+# Test result logs are captured deliberately; the global *.txt rule would hide them
+!test-results/*.txt

CHANGELOG.md

@@ -7,9 +7,53 @@ environment so report figures trace back to a specific build.
 
 ## [Unreleased]
 
+### Fixed
+- **`verify_license_token` raised instead of rejecting malformed input.** The
+  `except RuntimeError` clauses caught neither `binascii.Error` nor
+  `UnicodeDecodeError` (both `ValueError` subclasses), so a garbage token
+  propagated an exception to the caller rather than returning `False`. Any
+  caller passing attacker-influenced input crashed. Now catches
+  `(InvalidSignature, ValueError, TypeError)`; nine adversarial inputs are
+  locked by tests.
+- **Checkout no longer pins `payment_method_types=["card"]`.** Pinning it
+  disables Stripe dynamic payment methods, so Link, Apple/Google Pay and local
+  methods never render and every buyer must type a card number. Omitting the
+  parameter lets Stripe show the highest-converting eligible methods per
+  customer, configured from the Dashboard.
+
+### Added
+- **v2 licence tokens carrying `tier` and `exp`.** Legacy tokens sign only
+  `receipt_id:email`, so a 60-day evaluation was cryptographically identical to
+  a perpetual licence. Format `v2.{claims_b64}.{sig}` over
+  `{rid, email, tier, exp}`; the signature covers the encoded claims segment
+  verbatim and is verified *before* the claims are parsed. `license_claims()`
+  returns verified, unexpired claims so callers can gate on tier.
+  Legacy 2- and 3-part tokens continue to verify unchanged, and a v2 token fails
+  **closed** on installs predating v2 support.
+- **Tuning environment variables documented** in the README: `QECTOR_BLOSSOM_K_MULT`,
+  `QECTOR_BLOSSOM_INTRA_PAR`, `QECTOR_BLOSSOM_INTRA_THREADS`,
+  `QECTOR_CUDA_DEVICE_ID`, `QECTOR_OPENCL_DEVICE_ALLOW` — with which of them can
+  change results rather than only throughput.
+
 ### Notes
 - v0.6.8 hotfix published to PyPI, superseding the broken v0.6.7.
 
+## [0.6.9] - 2026-07-24
+
+### Added
+- **Task A — Exact log-domain BP**: `BpMethod{MinSum,Exact}` enum in `bp_osd.rs`, default `Exact`. `phi(x) = -ln(tanh(x/2))` via hybrid exact (<0.25) + 65536-entry interpolated LUT ([0.25, 20]) + 0.0 (≥20). Deterministic reliability ranking (`rel_key` 1e-6 quantization + index tie-break) fixes float-noise OSD-0 basis flipping. PyO3 `bp_method` kwarg (`"exact"`/`"min_sum"`).
+- **Task B — Higher-order OSD**: true combination-sweep OSD-1/2 in `bp_osd.rs` — flip subsets of W≤12 least-reliable selected columns, residual GF(2) re-solve with syndrome pre-subtraction, min-weight faithful candidate wins. PyO3 `osd_order` kwarg (0 default preserved, non-breaking).
+- **Task C — GNN-enhanced belief matching**: `GNNBeliefMatcher` class in `belief_matching.py` — end-to-end GNN-guided MWPM pipeline (`DetectorGraph` → `GNNPredecoder.predict_with_node_probs` → per-edge weights → max-per-qubit fan-in → `SparseBlossomDecoder.decode_with_weights` → faithfulness fallback). Optional synthetic training (`train_samples`/`error_rate`/`train_epochs`/`seed`). `decode_with_gnn` one-shot helper. Both re-exported at package top level.
+- **`BPOSDDecoder` Python wrapper** now forwards `bp_method`/`osd_order` kwargs (additive, default-preserving).
+- **`backend.py`**: batch-decode 1D-output reshape fix (handles decoders returning flat arrays for 2D input).
+- **`stripe_integration.py`**: `create_license_token` import fallback when `generate_license_keys` is absent.
+
+### Fixed
+- **blossom.rs boundary bug**: boundary node matched without `boundary_spt`, panicking on odd-defect boundary-less codes.
+
+### Performance / internals (dev.md items, this cycle)
+- f32 GNN stack (Task 2.1); seeded GNN init (6.5); hybrid hot-path allocations (6.7); word-packed GF(2) solver `src/gf2.rs` shared by BP-OSD and Blossom (1.1); hyperedge `BestEffortVerified` policy (7.2); mwpm dense fallback threshold (4.1); RadixHeap SmallVec buckets (4.4); sliding-window bit-packed history (5.2); latency quantiles (5.4); NoHashHasher lookup table (2.3); safetensors strict shape guard (2.4).
+
 ## [0.6.8] - 2026-07-22
 
 ### Fixed