risk formulas: replace language tiers with a measured fidelity table + a language-strictness table (child of #2560)

[squid-protocol]

Design pass for #2653, approved 2026-09-04. Full write-up (measurements, retractions, the three-input model): the "Language Confidence Tiers" memo, reproduced in summary here so the issue stands alone.

Where we are

keyword-rosetta shows identical §2 raw signals producing different §3 risk scores by language. Most of that is signal_processor._get_tier: two inline hand lists pick fc / irc / ot per language, and 45 of 59 defined languages fall through to the harshest setting (fc 0.60 / irc 5 / ot 1.40).

Measured on language-crucible (2,649 scored files) by scanning once as committed and once with TIER_VARS flattened — baseline reproduces golden_master_zero_dep_audit.json with zero diffs:

• 78.3% of files change; 18.2% by ≥ 25 points; 11.0% by ≥ 50. Tech Debt +19.5 mean on the 31.7% it moves (max 54.9); Documentation +14.7 on 21.2% (max 81.5); Testing max +77.6.
• On rosetta with content held identical: risk_documentation +87% and risk_tech_debt +56% tier 1 → tier 3.
• embedded_python is tier 3 (not the literal "python"): boot.py +77.5 Testing, bldc_driver.py +55.4 Documentation. Mean doc movement +26.6 vs python's +1.0.
• The heaviest-corrected languages are declarative: makefile +29.3 debt, jcl +29.1, m4 +14.9, html +9.7 doc. They have no runtime.

Why one dial can't be made right

fc / irc / ot is one three-valued lookup doing three separable jobs:

job	truth lives in	today
our rules catch less in some languages (fidelity)	rosetta measures it per language × signal	guessed by bucket; 21 of 45 tier-3 languages have full defence-rule coverage and rosetta catches their plants, yet lose 40% of credit
this file does runtime-dynamic things a regex can't follow	the file — high_risk_execution, reflection_metaprogramming, eval are already signals	flat irc by language; 80% of python files and 84% of groovy files contain zero dynamic execution and pay it anyway
this language lets you leave things unsaid (types, errors, memory, globals)	the language spec	two undocumented inline sets + a dead FIDELITY_TIERS that disagrees with them for ~20 languages

Rosetta cannot validate any §3 correction — its null hypothesis is "no correction" — so it corrects the measurement layer only. That is the reason this drifted unnoticed.

The plan

Same equations. The constants they read come from different places.

1. fc becomes a measured, per-signal fidelity coefficient generated from rosetta: fc(lang, signal) = min(1, planted / measured). Over-firing rules get their credit scaled to the planted truth; under-firing is a to-fix list, not a coefficient (a coefficient that compensates for a fixable gap stops the fixing). Ledgered n/a → 1.0. Retires systems_buffer_ratio, whose fc < 1.0 gate is the cause of the safety sign inversion.
2. irc / ot become a documented language-strictness table in analysis_lens: objective yes/no columns (static types · enforced errors · memory safe · no implicit globals), one row per language, family map so embedded_python → python. No-runtime languages get None → no language-level term. Weight small and bounded (UEF small-file normalization isn't achieving its intent — redesign scoring so identical intent scores identically regardless of file size (design pass for Fable) #2655's invariant stays: corrects measured risk, never creates it) until the outcome pilot says otherwise. Deletes FIDELITY_TIERS.
3. Per-file dynamism replaces the flat irc in the six formulas that read it, one formula at a time, each with its own crucible before/after.
4. Outcome pilot: the crucible is snapshot copies (PROVENANCE.json, 218 repos pinned by SHA, no .git), so clone ~10 upstream at their pins with history, classify fix commits, and ask whether strictness / dynamism predict later fixes at equal evidence. Decides how much weight (2) may ever carry.
5. Docs: 08-03 rewritten as a chain — what a regex can't see → the three inputs and their sources → the fixture that scores it → the UEF small-file normalization isn't achieving its intent — redesign scoring so identical intent scores identically regardless of file size (design pass for Fable) #2655 invariant — with per-language tables generated, never typed.

What "done" looks like: identical §2 gives near-identical §3 across languages; the only language-level offset left is the small documented strictness term, which rosetta prints rather than subtracts out with the F.3 within-tier band.

Children

• bug: safety systems_buffer_ratio sign inversion — _calc_safety: systems_buffer_ratio keyed on fc<1.0 makes tier-2/3 files score SAFER than tier 1 above 6/15 attack hits #2717
• engine PR 1: strictness table + fidelity coefficient replace _get_tier — engine PR 1: language-strictness table + measured fidelity coefficient replace _get_tier (child of #2716) #2718
• engine PR 2: per-file dynamism replaces flat irc — engine PR 2: per-file dynamism count replaces the flat irc term (child of #2716) #2719
• tooling: outcome-label pilot — tooling: outcome-label pilot — do strictness / dynamism predict later fix commits? (child of #2716) #2720
• docs: 08-03 chain rewrite (rides with PR 1)
• keyword-rosetta: retire the F.3 within-tier band once PR 1 lands; print the strictness offset instead

Related: #2653 (narrowed to the membership audit; closed by PR 1), #2669 (rosetta epic), #2655 (evidence-mass floor and the invariant), #2705.

[squid-protocol]

PR 1 is up: #2721 (closes #2718, #2717, #2653). Two things worth noting from the gauntlet: (1) rosetta_audit passes 46/46 with 0 regressions — the corpus gates §2 raw signals, which PR 1 does not touch, so no corpus re-bless is owed; the risk_* rows of the bias report will move on the next bias-history regen and keyword-rosetta#50's within-tier banding can then be retired (checklist item). (2) The golden-master attribution came out exactly as the design predicted: 0 topological diffs, zero movement for rust/java/yaml/json, ex-tier-3 languages down, ts/js/python/c/cpp slightly up from the #2717 buffer removal. Fidelity cells the engine actually reads below 1.0: c test 0.67, embedded_python safety 0.50 / test 0.67, haskell safety 0.67, perl test 0.67, solidity ownership 0.25, typescript safety 0.67 — each is a rule that over-fires on plant and is now a to-fix list as well as a coefficient.

[squid-protocol]

PR 2 is up: #2723 (closes #2719). Dynamism = the file's reflection_metaprogramming count — the first cut also summed high_risk_execution, and attribution showed that signal is the safety attack vocabulary across the registry (panic!, System.exit, STOP RUN, rm -rf), so it stays in safety at ×4. After this PR the language-level irc is read by exactly two formulas (safety, tech debt), each with a written reason. The per-file term also surfaced a rule over-match the flat constant had hidden: shell's reflection rule counts every $(...) and plain ${var} — #2722, 15 of 46 crucible shell files jump ≥ 25 on Documentation until it is fixed. Suite, audit_check, tree-sitter 30/30, tri 3/3, rosetta 46/46 clean; no corpus re-bless owed.