sharky-0.5B-v3 — archived phase9 candidate (REJECTED per pre-registered gate)

Mixed-corpus retrain (UNSW-NB15 + DAPT-2020 + CIC-IDS2017 60.5k + CTU-13 10k states, from base, 18,208 steps / 291,308 records, lr 5e-5). Not promoted — the production model remains luispoveda93/sharky-0.5B.

Results (phase9 5-gate battery — 3/5)

Suite	v2 production	v3 (this)
CTU-13 Botnet-42 (real malware) recall	7.4%	99.0% ✓
Unseen 2018 benign recall (false-flag)	58% (34% FF)	97.2% (2.8%) ✓
Locked (in-distribution)	0.9865	0.9808 ✓
CIC-IDS2017 macro-F1	0.173	0.706 (target 0.85) ✗
OOD ECE	0.33–0.51	S1 0.19 ✗, S2b/S4 ≤0.015 ✓

Why rejected: benign recall on CIC-IDS2017 is 0.36 — diagnosed as a benign-web shortcut (phase9/diag_s1_benign.json): web-destination benign flows are false-flagged 85%.

Full record: phase9/REJECTED.md · gate_v3.json · CONTRIBUTING.md

Serve exactly like the production model (POST /v1/systemone via the same shim); the same prefill-only battery applies. Useful as a real-malware detector today; not production-safe on benign web traffic.