feat(cal): Tier-1 validator ports from SubmodelTarget

[jeliason]

Six validators the submodel schema has enforced for a while, brought over to CalibrationTarget. Each was measured against the 52 live pdac calibration targets before it was written, so the migration cost is known rather than assumed — and that measurement changed the design of two of them.

Validator	Live hits	Severity
source relevance walks secondary sources too	1	warn
context mismatch must be justified	0	raise
centre channel must not be the population range	26	raise
no hardcoded non-integer floats in distribution_code	5	raise
snippet must appear in the source PDF	0 (context-gated)	raise
assumed_* / uncertainty inputs (earlier commit)	1	raise

The centre-channel check found a real defect

An across_patient target uses two channels: samples carries the population spread that hierarchical inference reads as omega, while median + ci95 pin the centre and must shrink with n. 26 of the 49 population targets return the population's own 2.5/97.5 percentiles as ci95. The check does not infer this — it compares the two and finds them identical:

tam_density  n=113   ci95     [18.64, 698.9]
                     samples  [18.64, 698.9]   <- 2.5/97.5 percentiles

The same width then goes into omega and into the flat likelihood as measurement noise, so the target is weighted as though one simulated patient could land anywhere in the cohort.

The trap is population.summarize(), whose ci95 is np.percentile(samples, 2.5/97.5) by construction. It is the obvious helper to call and it silently produces a population-scale centre channel. Fixed at the source: summarize() gains n= / rng= / n_boot=, and with n it subsample-bootstraps the median (shape-agnostic, which matters for the skewed lognormal marginals the density targets use). Verified on tam_density — the centre narrows 8.7x while samples and median_obs do not move at all. 8.7x rather than sqrt(113)=10.6x is correct: the SE of a median is ~1.25 sd/sqrt(n).

Without the helper change the error message had no actionable fix for 24 of the 26 (bootstrap_median needs per-patient values they do not have), and the only other escape — population_spread: center_only — would have deleted the omega channel. The message now leads with summarize(n=...) and flags what the center_only route destroys.

Why the hardcoded-value ban is scoped

The submodel allowlist ({0,1,2,1.96,1.645}) fails 50 of 50 live targets, because distribution_code is Monte-Carlo statistics: seeds (42 x49), draw counts (10000 x22), percentile arguments, IQR->SD factors (1.349). A ban that flags every target gets switched off. Scoped to non-integer floats it flags 5, all real — a paper's 2–21% range read straight into np.log(), and a detection floor plus tolerance band belonging in assumptions. Integer-valued measurements are a known gap, documented on the validator.

Downstream

31 of the 52 live pdac targets will not load until they are migrated (26 need n= threaded through plus a recomputed ci95; 5 need their literals declared). Mechanical, but it moves x_obs for half the corpus, so it wants one batch plus a fresh flat run. The pdac-side maple pin should not move until then.

Two existing fixtures were themselves examples of what is now rejected — the population-sample fixture returned population percentiles as ci95, and the clipping fixture wrote its floor inline. Both updated.

408 passed, 6 skipped.