A statistical office with a synthetic version of a protected file must decide whether it may be released for a stated purpose. We study the locked audit, a pre-specified and simultaneous form of the verification servers used in official statistics. Before a protected audit sample is opened, the custodian fixes the use, the candidates, the analyses, a tolerance for each and the schedule. The audit then reports simultaneous finite-sample bounds on paired loss gaps, and a declared negative control must fail. We correct an anytime-valid sequence that an earlier release had implemented with a variance penalty four times too small. Two confirmatory rounds were pre-specified in a hash-locked local ledger and publicly timestamped only after the audits. The control and ideal-generator outcomes were near-certain by design. A Gaussian copula certified in every cell, but only inside the rounding step of the tolerance rule. A second transparent candidate certified once, against a written prediction. Learned models, at library defaults and 4,000 training rows, certified in one of 18 fits in round 1 and in none of 12 tables in round 2. The paper is a protocol and an evidence record, not a claim that any generator is private or deployable.

翻译：暂无翻译