scientific: enforce Rubin design-envelope conformance at activation #514

Finding

Draft #506 binds an opaque design_envelope_id into RubinProjectionActivationReceiptV1 and owner-controlled approved pairings, but decide_rubin_projection_activation does not compare the actual runtime design dimensions against the Validation Evidence envelope. The current pure decision receives snapshot identity/digest, knowledge cutoff, and indicator kind only.

That means a future approved pairing could authorize a run with unsupported observation/draw counts merely because the receipt names the approved envelope. This would overgeneralize #504's candidate repeated-sampling evidence, which is explicitly scoped to discrete observation-count and draw-count design points, into unvalidated runtime regimes.

Required contract

• Keep Rubin arithmetic in psychometric_core; do not change Qbar/Ubar/B/T.
• Keep design_envelope_id as immutable identity, but make owner authority encode the exact supported runtime design points needed for activation.
• At minimum, bind runtime observation_count and draw_count into the activation decision and require membership in the owner-approved design point sets. Do not infer a continuous range from discrete Monte Carlo scenarios.
• Production approved pairings remain empty until independent Validation Evidence promotion.
• Add RED/GREEN tests proving an exact supported design point can be eligible under a private test registry while unsupported observation or draw counts are rejected even when every ID/digest/snapshot/cutoff/indicator field matches.
• Preserve all validation: bind authoritative Validation Evidence availability in Rubin activation registry #507–validation: bind Rubin projection authority to source snapshot digest #512 authority, cutoff, snapshot, digest, mutable-locator, and canonical-analysis safeguards.
• Currentize ADR 0034 and the Rubin projection activation research contract; shared TRACEABILITY/product-gap/CHANGELOG remain in the designated docs lane.

Scientific rationale

A design-envelope label is not executable evidence that the current run lies inside the validated design. #504's recovery/coverage evidence is scenario-scoped. Activation must therefore prove conformance to the exact promoted evidence envelope rather than treating the envelope ID as a bearer capability.

Do not close solely because a branch-local repair exists. Close only after exact-head verification and verified inheritance by the surviving Analysis Run vehicle.