Safety invariants

These rules are system boundaries, not preferences.

1. Never weaken a gate or test to make a desired result pass.
2. Discovery cannot read confirmation data.
3. Confirmation uses a frozen distinct claim and burns its reserve once.
4. Randomness is seeded and evaluation ordering is stable.
5. Search denominators are preregistered, never reconstructed from winners.
6. Missing data produces an honest routing state, never a fabricated value.
7. Model-written (generated) code runs only in the Docker sandbox; signed-bundle reproduction runs the frozen strategy in-process with P7/P8, so self-signed bundles are integrity-only, not independently trusted.
8. For any frozen claim, executable spec, data snapshot, and engine version, learned state cannot alter execution, gates, thresholds, search denominators, confirmation access, or the verdict. Learning may change the proposal distribution, but may not rank candidates by predicted survival, suppress otherwise-testable families, or optimize survivor rate.
9. The advisory inform, never gate rule is scoped to the verdict plane. In the generation plane, inspired_by grounding is legitimately a hard candidate-admission gate; gating admission is not gating a verdict.
10. Imported public records cannot create local verdicts.
11. P9 promotion is human-only.
12. Verdict language never claims profitability or tradeability.
13. Scientific history is append-only; corrections are versioned and superseded.
14. Public projection is allowlisted and cannot expose private engine state.

When an invariant conflicts with convenience or yield, the invariant wins.