State-recovery experiment (model of Eqs. 1-16, not bit-exact with RTL)
Python 3.13.2
======================================================================
[1] xoshiro128** self-check, state [1,2,3,4]: [11520, 0, 5927040] -> OK

[2] Attack A: plain xoshiro128**, recover 128-bit state from K outputs
    (20 random seeds per K; success = recovered state equals true state and next 1000 outputs predicted)
    K=4 outputs: 20/20 recovered   {'solved': 20}
    K=5 outputs: 20/20 recovered   {'solved': 20}
    K=6 outputs: 20/20 recovered   {'solved': 20}
    K=8 outputs: 20/20 recovered   {'solved': 20}

[3] Attack B: the same attack applied blindly to the hybrid output (K=8)
    0/20 recovered   {'inconsistent': 20}

[4] Attack C: hybrid output when the attacker already knows w0 and x0 (K=8)
    20/20 recovered

[5] Integer Tent map x -> snext(x) (Eqs. 13-14): cycle structure of random starts
    starts sampled: 72, exceeded 4000000 steps without closing: 72

======================================================================
Notes
- Experiment 2 shows plain xoshiro128** is linear-recoverable from a handful
  of outputs because each output is a bijective function of s1.
- Experiment 3 only shows that the *trivial* attack does not apply to the
  hybrid. It does not show the hybrid is secure.
- Experiment 4 shows that once w0 and x0 (64 bits) are known, the hybrid
  reduces to plain xoshiro128**; its strength then rests on those 64 bits,
  and on how many distinct Tent states are really reachable (experiment 5).
Elapsed: 120.4 s
