record(perf): step 5 — the owner's ratified design constants

Records the five design constants the owner chose, bound to the step 4
identity, and records nothing else.

  q         19/20     committed as [19, 20]
  M         2         committed as [2, 1]
  R_runs    5
  N_ladder  [5, 15, 45], the last rung being the mandatory stop
  G         1/10      committed as [1, 10]

  bound policy digest   c3068ed7fa880a7083866ead25fe8bf65c87889d242d8af1f7eee01582cd5cbf
  bound harness digest  562a7f7232dad2f4c79c6adfe0e1e7e25680b4b6f3444d54824bf0405e3c14b3

Rationals are reduced integer pairs and counts are plain integers, so no
reader has to decide whether 15 means the integer or the pair. There is
no N_max: a second field holding 45 would be a duplicate free to drift.

Deliberately absent: A_abs, R_rel, a selected N, any measurement output.
Those are fitted rather than chosen, no admissible fitting corpus exists,
and no measurement is authorised. The schema is enumerated by a control,
so there is no key for one to arrive under.

Four controls, both platforms:

  constants-artifact-shape      the permitted schema and nothing else;
                                bool excluded explicitly, since in Python
                                a bool is an int
  constants-accepted-by-policy  the frozen DesignConstants.from_committed()
                                accepts them and as_committed() round-trips
                                exactly. The ranges are NOT re-stated here:
                                a second copy of them would only prove the
                                two copies agree, so the implementation
                                under freeze is the judge of its own
                                constants
  constants-bound-to-freeze     both digests equal what step 4 froze, and
                                the harness digest equals the live one
  constants-no-empirical        a second net whose forbidden names are
                                derived from what Envelope serialises. No
                                mutation isolates it, because the schema
                                refuses every route one check earlier, and
                                that is recorded rather than counted as
                                coverage

Fifteen mutations, each declaring in advance which control must catch it,
scored only on a FAIL line from that control. The count is not the claim.

ratified_by records "owner" and the repository cannot check that. It is an
attribution, not a proof, in the same sense the Round 7 reading's withdrawn
"checkable" claim was not. What is established is the binding: these
constants are recorded against an implementation whose bytes are frozen and
independently recomputable.

No policy code change, no harness change, no measurement. The step 4 freeze
artifact is untouched and the harness digest is unmoved.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CYLNQy6tLXqsV1CbuNqsSb

Author: claude

.github/workflows/ci.yml

@@ -2954,6 +2954,11 @@ jobs:
       # artifact outright if it ever grows a field that is not identity.
       - name: Calibration policy freeze controls (step 4 digest identity)
         run: python tests/test_calibration_freeze.py
+      # Step 5 records the five constants the owner chose, bound to the step 4
+      # identity. The frozen implementation is the judge of its own ranges, so
+      # these controls hand it the committed pairs rather than re-stating them.
+      - name: Calibration design constants controls (step 5 ratified values)
+        run: python tests/test_calibration_constants.py
       # Plan mode builds the arms, preflights THOSE bytes, freezes their
       # identities and fixes the execution order — then returns before the
       # timing function is reachable. Linux only: the arms are ELF binaries.

docs/evidence/calibration/p022-263a-design-constants.json

@@ -0,0 +1,26 @@
+{
+  "artifact": "p022-263a-calibration-design-constants",
+  "bound_measurement_harness_digest": "562a7f7232dad2f4c79c6adfe0e1e7e25680b4b6f3444d54824bf0405e3c14b3",
+  "bound_policy_implementation_digest": "c3068ed7fa880a7083866ead25fe8bf65c87889d242d8af1f7eee01582cd5cbf",
+  "constants": {
+    "G": [
+      1,
+      10
+    ],
+    "M": [
+      2,
+      1
+    ],
+    "N_ladder": [
+      5,
+      15,
+      45
+    ],
+    "R_runs": 5,
+    "q": [
+      19,
+      20
+    ]
+  },
+  "ratified_by": "owner"
+}

docs/notes/p022-263a-calibration-policy-proposal.md

@@ -4,8 +4,9 @@
 Status:
   MECHANISM RATIFIED.
   STEPS 1-3 COMPLETE.
-  STEP 4 DIGEST FREEZE TAKEN, PENDING OWNER ACCEPTANCE.
-  NO DESIGN CONSTANT VALUES RATIFIED.
+  STEP 4 DIGEST FREEZE ACCEPTED.
+  STEP 5 DESIGN CONSTANTS RATIFIED BY THE OWNER AND RECORDED.
+  NO EMPIRICAL CONSTANT IS FITTED.
   NO NUMERIC FITTING CORPUS EXISTS.
   NO TRAINING OR VALIDATION MEASUREMENT AUTHORISED.
 ```
@@ -26,7 +27,7 @@ where the value was chosen by whoever was holding the pen.
 
 No clock authority is claimed or implied. No measurement is proposed here.
 
-## Step 4 — the digest freeze, taken
+## Step 4 — the digest freeze, accepted
 
 `docs/evidence/calibration/p022-263a-policy-freeze.json` records **which bytes the
 policy is**, and nothing else. It carries no design constant, no fitted constant
@@ -102,6 +103,71 @@ now reads the objects themselves, and the one claim shallowness genuinely blocks
 ancestry — says so in its own message instead of reading as a provenance break.
 The CI job that runs these controls therefore checks out with full history.
 
+## Step 5 — the design constants, chosen by the owner
+
+`docs/evidence/calibration/p022-263a-design-constants.json` records the five
+constants and nothing else. They were **chosen by the owner**, which is the whole
+point of the step: a constant this repository picked for itself would be a knob
+wearing a ratification.
+
+| constant | committed form | value |
+|---|---|---|
+| `q` | `[19, 20]` | 19/20 |
+| `M` | `[2, 1]` | 2 |
+| `R_runs` | `5` | 5 |
+| `N_ladder` | `[5, 15, 45]` | rungs 5, 15, 45, stopping at 45 |
+| `G` | `[1, 10]` | 1/10 |
+
+Rationals are committed as reduced integer pairs and counts as plain integers,
+which is the separation revision 4 introduced so that no reader has to decide
+whether `15` means the integer or the pair. There is no `N_max`: the ladder's last
+rung **is** the mandatory stop, and a second field holding 45 would be a duplicate
+free to drift.
+
+The artifact binds both identities: `policy_implementation_digest c3068ed7fa88…`
+and `measurement_harness_digest 562a7f7232da…`. Constants bound to an
+implementation other than the frozen one are constants for a policy nobody
+reviewed.
+
+**What is deliberately absent.** No `A_abs`, no `R_rel`, no selected `N`, no
+measurement output. Those are fitted rather than chosen, no admissible fitting
+corpus exists, and no measurement is authorised. The artifact's schema is
+enumerated by a control, so there is no key for one to arrive under.
+
+**A provenance limit, stated rather than implied.** `ratified_by` records `owner`,
+and the repository **cannot check that**. It is an attribution, not a proof, in
+exactly the sense the Round 7 reading's withdrawn "checkable" claim was not. What
+the repository does establish is the binding: these constants are recorded against
+a policy implementation whose bytes are frozen and independently recomputable, so
+whatever is later fitted is fitted under constants that were fixed first.
+
+### The controls
+
+`tests/test_calibration_constants.py` runs four on every CI run, both platforms:
+
+- **`constants-artifact-shape`** enumerates the permitted schema, requires rationals
+  as reduced integer pairs and counts as exact integers, and excludes `bool`
+  explicitly, since in Python a `bool` is an `int`.
+- **`constants-accepted-by-policy`** hands the committed pairs to the frozen
+  `DesignConstants.from_committed()` and requires an exact round trip through
+  `as_committed()`. It deliberately does **not** re-state the ranges — `0 < q < 1`,
+  `M > 1`, `G >= 0`, `R_runs >= 2`, a strictly increasing ladder — because a second
+  copy of those rules would only prove the two copies agree. The implementation
+  under freeze is the judge of its own constants.
+- **`constants-bound-to-freeze`** requires both recorded digests to equal what step
+  4 froze, and the harness digest to equal the live one.
+- **`constants-no-empirical`** is a second net whose forbidden names are *derived*
+  from what `Envelope` serialises, so it grows if the policy grows another
+  empirical field. **No mutation isolates it**, because the exact schema refuses
+  every smuggling route one check earlier, and that is recorded rather than
+  counted as coverage.
+
+Fifteen mutations, each declaring in advance which control must catch it and
+scored only on a `FAIL` line from that control. The count is not the claim: the
+claim is that every mutation has a named expected catcher and is scored by output
+rather than by a non-zero exit code, so the campaign can grow without the
+guarantee changing shape.
+
 ## Revision 5 — what the owner's fourth review changed
 
 Revision 4 was ruled **CHANGES REQUIRED before the step 4 freeze**, on one P0 in

tests/test_calibration_constants.py

@@ -0,0 +1,253 @@
+#!/usr/bin/env python3
+"""#263-A calibration policy — step 5, the ratified design constants.
+
+Step 5 records the five constants the owner chose, bound to the step 4 identity.
+It records nothing else. No `A_abs`, no `R_rel`, no selected `N`, no measurement
+output: those are empirical, they do not exist yet, and an artifact that made
+room for them would be step 7 arriving with step 5's paperwork.
+
+    constants-artifact-shape    the artifact is five design constants and two bindings
+    constants-accepted-by-policy the frozen implementation accepts them and round-trips
+    constants-bound-to-freeze   the bindings are the step 4 digests, not lookalikes
+    constants-no-empirical      no name the policy uses for a fitted quantity appears
+
+`constants-accepted-by-policy` is the one that matters. It does not re-implement
+the ranges — `0 < q < 1`, `M > 1`, `G >= 0`, `R_runs >= 2`, a strictly increasing
+ladder — because a second copy of those rules would only ever prove the two copies
+agree. It hands the committed pairs to the frozen `DesignConstants.from_committed()`
+and lets the implementation under freeze be the judge.
+
+Failures print `FAIL[<check>]: <detail>`; nothing stops at the first one.
+
+Run:  python tests/test_calibration_constants.py
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from fractions import Fraction
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT / "scripts"))
+sys.path.insert(0, str(ROOT / "scripts" / "calibration"))
+
+import perf_baseline as pb  # noqa: E402
+import policy as pol  # noqa: E402
+
+CONSTANTS_ARTIFACT = ROOT / "docs" / "evidence" / "calibration" / "p022-263a-design-constants.json"
+FREEZE_ARTIFACT = ROOT / "docs" / "evidence" / "calibration" / "p022-263a-policy-freeze.json"
+
+ARTIFACT_NAME = "p022-263a-calibration-design-constants"
+RATIONALS = ("q", "M", "G")
+COUNTS = ("R_runs",)
+LADDERS = ("N_ladder",)
+
+_FAILURES: list[tuple[str, str]] = []
+_PASSES: list[str] = []
+
+
+def fail(check: str, detail: str) -> None:
+    _FAILURES.append((check, detail))
+    print(f"FAIL[{check}]: {detail}")
+
+
+def ok(check: str, detail: str = "") -> None:
+    _PASSES.append(check)
+    print(f"ok[{check}]: {detail}" if detail else f"ok[{check}]")
+
+
+def _exact_int(value: object) -> bool:
+    """`bool` is excluded: in Python a bool IS an int, and round 9 was lost to that."""
+    return isinstance(value, int) and not isinstance(value, bool)
+
+
+def _load(path: Path, check: str) -> dict[str, object] | None:
+    if not path.exists():
+        fail(check, f"{path.relative_to(ROOT).as_posix()} does not exist")
+        return None
+    try:
+        loaded = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, ValueError) as exc:
+        fail(check, f"{path.name} could not be read as JSON: {exc}")
+        return None
+    if not isinstance(loaded, dict):
+        fail(check, f"{path.name} is a {type(loaded).__name__}, not an object")
+        return None
+    return loaded
+
+
+def control_artifact_shape(art: dict[str, object]) -> None:
+    permitted = {"artifact", "bound_measurement_harness_digest",
+                 "bound_policy_implementation_digest", "constants", "ratified_by"}
+    problems: list[str] = []
+
+    unexpected = sorted(set(art) - permitted)
+    missing = sorted(permitted - set(art))
+    if unexpected:
+        problems.append(f"keys step 5 does not permit: {unexpected}; the empirical "
+                        "constants are fitted, not chosen, and have no home here")
+    if missing:
+        problems.append(f"keys step 5 requires: {missing}")
+    if art.get("artifact") != ARTIFACT_NAME:
+        problems.append("artifact is not the frozen literal")
+    if art.get("ratified_by") != "owner":
+        problems.append("ratified_by is not 'owner'; a constant this repository chose "
+                        "for itself is the one thing step 5 must never record")
+    for key in ("bound_policy_implementation_digest", "bound_measurement_harness_digest"):
+        value = art.get(key)
+        if not (isinstance(value, str) and len(value) == 64
+                and all(ch in "0123456789abcdef" for ch in value)):
+            problems.append(f"{key} is not 64 lowercase hex characters")
+
+    constants = art.get("constants")
+    if not isinstance(constants, dict):
+        problems.append("constants is not an object")
+    else:
+        expected = set(RATIONALS) | set(COUNTS) | set(LADDERS)
+        if set(constants) != expected:
+            problems.append(f"constants names {sorted(constants)}, not {sorted(expected)}")
+        for name in RATIONALS:
+            pair = constants.get(name)
+            if not (isinstance(pair, list) and len(pair) == 2 and all(_exact_int(v) for v in pair)):
+                problems.append(f"{name} is not a pair of exact integers; a rational is "
+                                "committed as a reduced pair, never as a float or a "
+                                "decimal string")
+        for name in COUNTS:
+            if not _exact_int(constants.get(name)):
+                problems.append(f"{name} is not an exact integer count")
+        for name in LADDERS:
+            ladder = constants.get(name)
+            if not (isinstance(ladder, list) and ladder and all(_exact_int(v) for v in ladder)):
+                problems.append(f"{name} is not a non-empty list of exact integers")
+
+    if problems:
+        fail("constants-artifact-shape", "; ".join(problems))
+    else:
+        ok("constants-artifact-shape",
+           f"{len(permitted)} permitted keys and no others; {len(RATIONALS)} rationals as "
+           f"reduced pairs, {len(COUNTS)} count and {len(LADDERS)} ladder as exact integers")
+
+
+def control_accepted_by_policy(art: dict[str, object]) -> None:
+    """The frozen implementation is the judge of its own constants."""
+    constants = art.get("constants")
+    if not isinstance(constants, dict):
+        fail("constants-accepted-by-policy", "there are no constants to hand to the policy")
+        return
+    try:
+        built = pol.DesignConstants.from_committed(
+            q=tuple(constants["q"]), m=tuple(constants["M"]),      # type: ignore[arg-type]
+            r_runs=constants["R_runs"], n_ladder=constants["N_ladder"],  # type: ignore[arg-type]
+            g=tuple(constants["G"]))                                # type: ignore[arg-type]
+    except (pol.PolicyRefused, KeyError, TypeError, ValueError) as exc:
+        fail("constants-accepted-by-policy",
+             f"the frozen policy refuses the committed constants: {exc}")
+        return
+
+    round_trip = json.loads(json.dumps(built.as_committed()))
+    committed = json.loads(json.dumps(constants))
+    if round_trip != committed:
+        fail("constants-accepted-by-policy",
+             f"the policy reads the constants back as {round_trip}, not as the committed "
+             f"{committed}; a form that does not survive the round trip is not canonical")
+        return
+    if not all(isinstance(v, Fraction) for v in (built.q, built.m, built.g)):
+        fail("constants-accepted-by-policy", "a rational came back as something other "
+                                             "than Fraction")
+        return
+    ok("constants-accepted-by-policy",
+       f"q={built.q}, M={built.m}, R_runs={built.r_runs}, ladder={list(built.n_ladder)} "
+       f"stopping at {built.n_ladder[-1]}, G={built.g}; accepted by the frozen "
+       "implementation and byte-identical on the round trip")
+
+
+def control_bound_to_freeze(art: dict[str, object]) -> None:
+    freeze = _load(FREEZE_ARTIFACT, "constants-bound-to-freeze")
+    if freeze is None:
+        return
+    problems: list[str] = []
+    pairs = (("bound_policy_implementation_digest", "policy_implementation_digest"),
+             ("bound_measurement_harness_digest", "measurement_harness_digest"))
+    for here, there in pairs:
+        if art.get(here) != freeze.get(there):
+            problems.append(f"{here} is {str(art.get(here))[:12]} but step 4 froze "
+                            f"{str(freeze.get(there))[:12]}")
+    live = pb.harness_digest()
+    if art.get("bound_measurement_harness_digest") != live:
+        problems.append(f"the bound harness digest is not the live one, {live[:12]}")
+    if problems:
+        fail("constants-bound-to-freeze", "; ".join(problems)
+             + "; constants bound to an implementation other than the frozen one are "
+               "constants for a policy nobody reviewed")
+    else:
+        ok("constants-bound-to-freeze",
+           f"bound to policy {str(art.get('bound_policy_implementation_digest'))[:12]}… and "
+           f"harness {live[:12]}…, both equal to what step 4 froze")
+
+
+def control_no_empirical(art: dict[str, object]) -> None:
+    """No name the policy itself uses for a fitted quantity may appear here.
+
+    The exact schema above is the primary guarantee. This is a second net, and it
+    is DERIVED from the module rather than hand-listed: the forbidden names are
+    whatever `Envelope` serialises as, so if the policy ever grows another
+    empirical field the net grows with it instead of going quietly out of date.
+
+    NO MUTATION ISOLATES THIS CONTROL, and that is recorded rather than papered
+    over. Every way of smuggling an empirical name in today is refused one check
+    earlier by the exact schema, so the mutation campaign scores those against
+    `constants-artifact-shape`. This is defence in depth, which is worth having and
+    is not the same thing as tested coverage. Counting it as covered would be the
+    defect this PR exists to remove, one level up.
+    """
+    sample = pol.Envelope(n=1, a_abs=Fraction(0), r_rel=Fraction(0))
+    empirical = set(sample.as_committed()) - {"n"}
+    empirical |= {"selected_N", "measurements", "elapsed_ns"}
+
+    def names(node: object) -> list[str]:
+        if isinstance(node, dict):
+            return list(node) + [n for v in node.values() for n in names(v)]
+        if isinstance(node, list):
+            return [n for item in node for n in names(item)]
+        return []
+
+    def floats(node: object) -> list[object]:
+        if isinstance(node, dict):
+            return [f for v in node.values() for f in floats(v)]
+        if isinstance(node, list):
+            return [f for item in node for f in floats(item)]
+        return [node] if isinstance(node, float) else []
+
+    problems: list[str] = []
+    present = sorted(set(names(art)) & empirical)
+    if present:
+        problems.append(f"names the policy uses for fitted quantities: {present}; those "
+                        "are measured, not chosen, and no measurement is authorised")
+    stray = floats(art)
+    if stray:
+        problems.append(f"floating-point values: {stray}; the policy computes in exact "
+                        "rationals and a committed decimal is a float to one reader and "
+                        "a rational to another")
+    if problems:
+        fail("constants-no-empirical", "; ".join(problems))
+    else:
+        ok("constants-no-empirical",
+           f"none of {sorted(empirical)} appears, and no value is a float")
+
+
+def run() -> int:
+    art = _load(CONSTANTS_ARTIFACT, "constants-artifact-shape")
+    if art is not None:
+        control_artifact_shape(art)
+        control_accepted_by_policy(art)
+        control_bound_to_freeze(art)
+        control_no_empirical(art)
+    print()
+    print(f"calibration constants controls: {len(_PASSES)} passed, {len(_FAILURES)} failed")
+    return 1 if _FAILURES else 0
+
+
+if __name__ == "__main__":
+    sys.exit(run())