Item 17: Simulator substitution: the divergence witness

Construct the smallest model in which A's model of the principal agrees with the actual principal everywhere except one critical event, and in which the simulator comparator preempts the actual principal exactly there. Then determine which candidate distinctions — extensional agreement, causal responsiveness, designated-channel dependence, counterfactual behaviour, private information, perfect simulability — separate delegation from substitution, and which collapse the two.

Unpredictability is not available as a separator. The thesis must survive a perfectly predictable principal, so a criterion that works only because A cannot model H⁺ has not answered the question.

Deliverable shape: a witness plus a report, not a theorem of record — the exact divergence instance, witness-checked if it fits the house checker, and a comparison of candidate criteria with their implications and counterexamples. Acceptance check: the witness checker accepts the divergence instance; the report states, for each candidate criterion, what it admits and what it excludes.

Context: projects/deference/notes/FINITE_MODEL_SKELETON.md §3, §4. A solution ships: the witness, the candidate criteria, which collapse, the weakest one excluding the witness, and whether private information is necessary, sufficient, or neither. Not permitted: canonizing a final definition. That is a maintainer act.