scientific(time): bind admitted document event times to cutoff-qualified source evidence

[seonghobae]

Finding

Fresh temporal-owner review of Draft #639 found a leakage/estimand binding gap underneath #658/#665.

ReferenceTopicInput::new(...) receives caller-authored event_times: &[EventTime]. Those values drive standardized temporal prevalence and time-varying Membership lookup, so the same admitted document UUIDs can be rebound to different event-valid coordinates after source admission. ReferenceTopicFit then faithfully retains whichever detached event-time vector was admitted; it does not authenticate those times against Evidence/source truth.

A second, lower-level defect was separated to #672: CorpusSnapshot previously accepted a knowledge cutoff on every insertion without retaining one snapshot horizon, so documents admitted under T1 and T2 could coexist in one snapshot. #672 owns that corpus-split invariant.

This issue remains distinct from #672 and from #665/#670 fit-local integrity. It is an Evidence/Temporal Semantics admission problem and should converge with #658/#527 rather than be patched with another caller digest.

Clock-semantics correction

KnowledgeCutoff constrains evidence availability, not EventTime. TEPP's temporal contract intentionally keeps event-valid time and availability time nominally distinct. An EventTime later than the knowledge cutoff is therefore not automatically leakage: evidence available by the cutoff may legitimately describe a future scheduled or expected event. The earlier requirement to reject every EventTime > KnowledgeCutoff was scientifically over-broad and is withdrawn.

The fail-closed condition is instead that the event time used by modeling must be the event-valid coordinate authenticated by the owner-issued source/observation receipt for that admitted evidence. Availability still must satisfy AvailableTime <= KnowledgeCutoff under the run's one bound snapshot horizon.

Required RED

Once the Evidence owner exposes a consumer-appropriate source/event-time receipt:

• build two owner receipts with the same analytical document UUID but materially different authenticated event-time coordinates;
• require estimator admission to accept only the event time bound to the receipt used for that run;
• reject A-document/B-event-time rebinding before design construction, Membership lookup, fitting, or release serialization;
• cover an owner-authenticated future EventTime whose evidence AvailableTime is cutoff-eligible and require it to remain admissible, proving that event-valid time is not substituted for availability;
• preserve per-document time-varying Membership semantics rather than collapsing to one cohort timestamp.

Owner direction

Do not copy Evidence records into topic_measurement and do not add a free snapshot_id/event-time digest string. Evidence/Temporal Semantics should issue a versioned typed admitted-source coordinate/receipt that binds at least document identity, source observation/event time, availability/cutoff evidence, and vocabulary/source coordinates needed by #658/#663. topic_measurement should consume that owner-issued projection through an ACL when it becomes immutable/released.

Until that contract exists, ReferenceTopicInput event times are fit-local caller input, not leakage-safe source provenance.

Acceptance

• realistic A/B event-time mismatch RED at the owner ACL;
• cutoff eligibility remains defined by availability, with a positive future-event/eligible-availability fixture preventing clock conflation;
• scientific(cutoff): bind corpus snapshots to one knowledge horizon #672 single-horizon snapshot contract is preserved rather than duplicated here;
• no cross-service SQL/source copy or mutable dependency;
• fix(release): bind fail-closed reconstructable topic-lineage results (#638) #639/release(provenance): bind topic-lineage input to owner-issued source snapshot evidence #658/scientific(topic): bind reference fit results to the admitted estimator input #665/docs(ddd): restore queue authority and bounded-context ownership #435 TRACEABILITY and release claim boundary updated;
• rolling-origin scientific recovery uses the same bound source/event-time evidence.

Refs #527 #638 #639 #658 #663 #665 #670 #672.

[seonghobae]

Owner-boundary handoff from #674: canonical #639 now has a narrower local temporal-integrity repair. Observed transition edges are numerically admitted only when their validated source/target TemporalInterval<EventTime> contains the modeled EventTime for the corresponding endpoint (fa3af4a... RED → 85ce83e... repair → 562d679... ADR currentization).

This does not satisfy #671. Containment only proves consistency between two already-present temporal coordinates; it does not prove that the modeled event time was issued by Evidence/Temporal Semantics for the admitted source observation. Keep the A-document/B-event-time owner-receipt mismatch RED and the positive cutoff-eligible future-event fixture in #671.