# Calibration and Evidence-Locking Policy

This document defines when a numerical setting may move from development to a
locked experiment. Calibration output is engineering evidence, not a paper
result.

## Evidence states

Every setting or implementation contract receives one of four states:

1. **Verified contract**: a deterministic identity or accounting invariant has
   passed an independent reconstruction from stored arrays.
2. **Provisional numerical setting**: calibration supports using the setting in
   another calibration or pilot, but not in a locked experiment.
3. **Frozen setting**: the value, selection rule, analysis configuration, source
   commit, and admissible operating envelope are fixed before locked data are
   inspected.
4. **Not freeze-ready**: the calibration design is confounded, lacks the
   required comparison, or has an unacceptable safety/transparency trade-off.

## Freeze gate

A setting can be frozen only if all of the following are true:

- trials are generated from a clean, immutable Git commit;
- paired methods receive identical trajectory, model, sensor, and network
  inputs where the hypothesis requires pairing;
- calibration instances are genuinely distinct rather than timing-only
  repetitions;
- failure, invalidity, timeout, clipping, intervention, and exclusion reasons
  are machine-readable and retained;
- the primary endpoint is numerically well-defined for the selected stratum;
- the selected value is supported by a parameter scan or an external physical
  calibration, not by a single untested level;
- tail behavior and failed trials are reviewed before the value is selected;
- the locked configuration and independent metric configuration receive new
  hashes after the decision.

## H1--H4 decision boundaries

- **H1**: freeze only after reach clipping, joint-limit stress,
  low-manipulability stress, and valid branch-continuity trajectories are
  separately identifiable. The experimental unit is a complete trajectory.
- **H2**: numerical calibration may select a robust DLS region, but physical
  wrench-accuracy claims require an independent six-axis F/T reference,
  timestamp calibration, payload/friction calibration, and a causal
  acceleration estimate.
- **H3**: the fixed-branch virtual-work identity is a deterministic contract.
  Actual closed-loop power mismatch is a different performance endpoint and
  must not be replaced by the identity check. Near-zero-power trials require a
  preregistered normalizer gate or an absolute mismatch outcome.
- **H4**: passing the energy-accounting audit verifies implementation
  correctness only. Energy capacity and feedback gain remain not freeze-ready
  if the projection distortion is excessive or the tested network/contact
  envelope is incomplete.

## Data handling

Raw batches remain under `output/experiments/` and are intentionally ignored by
Git because they can be regenerated from the plan, source commit, and recorded
seeds. The source-controlled audit records plan hashes, source-data hashes,
anomalies, and freeze decisions. No calibration value may be copied into the
manuscript Results section.

Locked experiments must use a new batch directory and must never overwrite a
calibration batch. A locked run is invalid if the worktree is dirty or if its
recorded source and model hashes do not match the approved lock record.