No efficient-decoder claim beyond the declared controls

The decoder is explicit and executable in the printed finite control set. Its validity-controlled swap is a named bounded matrix. Translating that primitive into a restricted laboratory architecture needs a separate compilation and leakage proof.

The model requires access to both key and ciphertext payloads. Restricting access to either whole cell gives a replacement channel and optimal error $3/4$, regardless of an observer's classical computational power.