Expert investigation track

Keep the three VaultBot challenges. For each: state a hypothesis, run a benign control, change one input property, inspect the observed outcome, then propose a defence and a counterexample. Missions 2 and 3 include a session notebook and JSON evidence export; use the worksheet for Mission 1.

All outcomes come from deterministic rules, not model inference. Treat them as observations about this simulator. A proposed defence has not been validated until tested separately.