Function apply_provenance_ceiling 

pub fn apply_provenance_ceiling(input_c: f64, ceiling: f64) -> f64

v2.5.0 — tainted-overriding (founder refinement A). A PROVENANCE member’s declared default_confidence — an extension member’s ceiling (v2.5.0), or the built-in epistemic:<level> axis — is a CEILING on the announced certainty, never a floor. When a value with certainty input_c is annotated with such a member, the announced certainty degrades to min(ceiling, input_c).

This is the SAME Theorem 5.1 (Epistemic Degradation) rule compose applies — c_out = min(c₁, c₂) — with the declared ceiling as one operand. A doubtful input (input_c < ceiling) is therefore NEVER laundered UP to the declared ceiling; certainty cannot increase.

Pure + total. Both operands are clamped to [0,1] defensively so a malformed declared ceiling cannot push the result out of range.

Scope (honest): this is the mathematical rule, ready to wire. Driving it from live step execution needs a path from a step’s effect-row provenance annotation to the runtime ψ-envelope of the value it produces — today effect rows are static contract metadata, not runtime certainty carriers, so that plumbing is a separate feature. The rule here is the contract that plumbing will call.