Split the confidence floor warning into two named findings

[astrogilda]

Follows the question left open at the end of #214: whether check_confidence_signal.py should read verification_basis where present, or whether there is a real reason to keep the two independent.

This pull request answers neither. They are not one question at two levels of rigor. is_floor_basis tests cardinality, len(set(engines)) <= 1; engine_vantage tests capability, whether any member reaches substrate. Neither predicate contains the other, and all four combinations on origin/main show where they part:

#	engines	confidence check	derived basis
1	two, both short of substrate	silent	artifact_intercepted
2	one, substrate-capable	fires	substrate_intercepted
3	one, without substrate reach	fires	artifact_intercepted
4	two, one substrate-capable	silent	substrate_intercepted

Row 1 is a miss and row 2 fires on a record whose vantage is genuinely strong. The miss is live: of the 80 published records, 8 sit in the high band and every one derives artifact_reconstructed, because none declares evidence_vantage or evidence_method. None of the 8 is single-engine, so cardinality stays silent and the check currently reports that all 80 are consistent with their basis.

Reading verification_basis in place of cardinality would close the miss. It would also lose the corroboration signal, because a single substrate-capable engine has a strong vantage and one source. So this splits the check into two named findings with different remedies. A vantage floor is remedied by observing from somewhere closer. An independence floor is remedied by adding a second source. A record can carry either, both or neither, and the output says which.

What changed

is_floor_basis is gone. vantage_floor_signal and independence_floor_signal replace it, assembled by confidence_signals with the high-band gate stated once. The return shape changes with them: confidence_signal returning a string or None becomes confidence_signals returning a list, because a single string cannot carry two faults a consumer routes on differently. There is no alias and no shim, and every caller is updated. The JSON output gains a records key, and count keeps meaning findings.

derived_vantage is extracted in write_verification_basis.py so the check imports a name for the value it needs. The obvious move is to read a stamped verification_basis. The vantage arm derives instead: where a stamp exists validate_records.py already hard-fails a declaration the derivation refutes, so in a valid corpus the two agree, and where they could differ the stamp is what the author typed, which is issue #98 wearing a better field name.

semantic_inference folds into the vantage arm where a third finding would have split it, because the arms divide by remedy and an inference over meaning is a reading of artifact-produced content. The authority-probe note gained a second form, and says nothing about cardinality, since 00074 adopted external_authority in #218 and its ceiling now reaches substrate, so only the missing declaration holds it down. The old wording would have told that author to add a member the record already carries.

Consequences worth stating

The CI log for this check goes from one quiet line to nine. That is the fix working rather than a regression, and the exit code is unchanged; the check stays a soft warning.

Since silence derives the floor, the vantage arm fires on records that have not declared. That is correct for a consumer, because no substrate binding exists either way, and it does not penalise stating the floor: the high band is still required, so an honest artifact record with a mid baseline stays silent.

No record was edited to add evidence_vantage. The 8 findings are real, and each one is a producer-side judgement for that record's author to make.

Checks

CI's steps in order: validate_records 80 valid, validate_crosswalks 9 of 9, check_fixtures 80, check_confidence_signal 8 findings across 8 of 80, check_vulnerability_taxonomy clean, write_verification_basis all 80 agree with their derivation, pytest 450 passed. Tests went 435 to 450. Each of the three commits was tested independently from a clean snapshot.

Fourteen mutations were run against the new behaviour, one per claim the tests make, and all fourteen were killed.

If you would rather keep one signal and take the OR, say so and I will cut it back to that.

[chaksaray]

The derived_vantage choice is the part I'd have gotten wrong, I'd have read the stamped verification_basis, and your reasoning against it is right: validate_records already hard-fails a refuted declaration, so in a valid corpus they agree, and in the case where they could differ the stamp is what an author typed. Reading it would put a self-report back inside the check built to catch self-reports.

Clean break on the return shape is correct. A string can't carry two faults a consumer routes on differently, and a shim would have preserved an API that no longer describes the check.

The semantic_inference fold is the right call for the reason you give, the arms divide by remedy, and an inference over meaning is still a reading of artifact-produced content. Consistent with the split's own principle rather than an exception to it.

Split, not the OR. No cutting back.

One thing worth deciding, not blocking: nine lines where there was one is the fix working, but the vantage arm fires on all 8 until each author makes a judgment with no deadline attached. Worth knowing whether that count is expected to come down as records get stamped or sit at 8 and become background noise, soft warnings at volume stop being read. Not a reason to change this PR, just worth answering before it settles into whatever it settles into.

Merging.