Reproducibility package for the paper "A Locked Decoder for BeineckeMS 408: Statistical Evidence for Hebrew Encoding Under a Domain-Transparent Substitution Cipher" (Hearl 2026). Contains the locked Python decoder (~180 lines, no external dependencies),the locked substitution table of 19 rules, the working dictionary of 212entries, the control-corpus specifications, the self-test suite, and theSHA-256 manifest required for bit-identity verification. The decoder isdeterministic and reproducible from the publicly available Takahashi EVAtranscription of MS 408. The package implements a falsifiable hypothesis with a pre-registeredheld-out test on the balneological folios (f75-f84). Independentinvestigators are invited to run the held-out test and report resultsagainst four pre-committed pass/fail thresholds. Full depositdocumentation, methodology rationale, and reviewer guide are included. Released under CC BY 4.0 as a Global Public Good. The author retains noproprietary interest in the methods or results. Verification: sha256sum -c MANIFEST.txt should report OK on all 16 files.Self-test: python3 src/voynich_decoder.py --selftest should report"11 passed, 0 failed".