feat(represent): what a search observes, stated apart from what a contract admits (BS2-F1)

[chrishayuk]

BS2-F1. Stacked on #376 — merge that first.

balanced-v1 is untouched, and that is the point.

The coupling, severed

before   diagnostic dimensions := statistics the CONTRACT bounds
         ⇒ anything the contract does not judge is invisible

after    diagnostic dimensions := an explicit DiagnosticPolicy

The obvious repair — give balanced-v1 a route-flip limit so the search can see it — is the one that had to be refused. It would turn an instrumentation requirement into behavioural policy, and freeze into a contract a number earned only as an ordering proxy.

The two invariants

A diagnostic statistic does not become an authority criterion merely by being observed or predictive. DiagnosticReading has no limit, no utilisation, no headroom — there is no bound to divide by, so a price cannot be computed there even by mistake. A type boundary, not a discipline.

An authority criterion need not be usable at diagnostic scale. routed mixture moved at p99 rests on 46 events at 256 positions and stays Unusable; the contract judges it unchanged at 8,192.

The relation is many-to-many, and which authority behaviour a proxy informs is recorded where it is used (ProxyObservation::for_criterion), not in the policy — a policy says what to look at, never what to conclude.

Two things the tests forced

These are worth more than the plumbing.

The diagnostic fall-through was wrong. evidence_for returned Direct for any well-measured unregistered statistic — and a count is always Measured, since counts have no tail to be thin. So a bounded count came back directly priceable, to be spent against a budget written for a different sample size. 46 flips over 256 positions is not 72 % of a bound set for 8,192. At diagnostic scale the fall-through now never reaches Direct; magnitude transfer must be earned by a calibration.

MeasurementStatus had two derivations, and writing the second reproduced BS2-F2's mistake within the hour. TailSupportPolicy::status reads None as "no percentile recorded", while an observed non-percentile means "no tail to be thin" — reading one as the other turned a well-measured count into NotObserved. There is now one shared status_of, used by both Margin and DiagnosticReading.

RouteFlipRate is its own statistic

Flips-per-position is what ROUTE-CAL-1 measured transferring (0.89–1.02 for any map with ≥ 40 events), and it is a different quantity from the raw RouteFlips count a contract might one day bound. The calibration now keys the rate.

The five properties, as tests

1. route_flip_rate is observed although no gate bounds it.
2. Adding or removing an observation cannot change balanced-v1 admission.
3. A gate growing a bound grows no observation — declaration, never inference.
4. route_flip_rate orders and is never priced; and its converse, a contract criterion may be Unusable here.
5. The proxy classifies a candidate (ProxySupported) while no route-flip cost exists anywhere to spend.

Plus a conformance test that both schemas read the same bank identically, and:

The payoff — at 256 positions the search can now order on kl p99 and route flip rate. Before this it was kl alone, which is the single-proxy dependence the ladder exists to prevent.

Verification

fmt, clippy -D warnings, E0 (10 passed), full suite (3626 passed, 0 failed), cargo check --workspace --all-targets. Coverage policy passed — diagnostic.rs 100.00%, constraint.rs 100.00%, search_evidence.rs 98.95%, measurement.rs 97.50%; crate 93.45%.