// GENERATED by `ggen sync` from ontology/bcinr.ttl + imports -- DO NOT EDIT.
//
// Numeric profile and policy constants. Each carries its provenance: either a
// derivation from a stated rule, or an explicit POLICY marker with an owner.
// No constant here is presented as following from the mathematics unless it
// does.
/// POLICY (owner: bcinr-cmca::allocator). UNDERIVED. Ceiling allocate_in clamps the learning-rate zeta into (beta = min(zeta, beta_max)) before the MWU weight update. A clamp target, not a refusal gate -- no input value for this bound produces an error, only a reshaped beta.
pub const ALLOCATOR_BETA_MAX_BITS: u32 = 6553;
/// POLICY (owner: bcinr-cmca::allocator). UNDERIVED. Ceiling paired with ALLOCATOR_MASS_MIN_BITS for the same per-measure node-mass clamp -- a clamp target, not a refusal gate.
pub const ALLOCATOR_MASS_MAX_BITS: u32 = 65536000;
/// POLICY (owner: bcinr-cmca::allocator). UNDERIVED. Floor allocate_in clips every per-measure node mass into before the cascade weight computation -- a clamp target, not a refusal gate.
pub const ALLOCATOR_MASS_MIN_BITS: u32 = 6;
/// POLICY (owner: bcinr-cmca::allocator). UNDERIVED. Unlike the three bounds above, this one gates rather than clamps: any `mu[i]` exceeding it sets price_err, which (Checkpoint A traced this precisely through allocate_in's err_val selection chain) produces StabilityRefusal::PriceGainUnsafe. The one bound among the allocator's four whose violation refuses instead of silently reshaping.
pub const ALLOCATOR_PRICE_GAIN_MAX_BITS: u32 = 6553600;
/// MEASURED (owner: bcinr-cmca). `tests/differential.rs` classifies each generated
/// leaf comparison as inside or outside the escort executable envelope (the sibling
/// spread `max_j(q*log2(m_j)) - min_j(q*log2(m_j))` described on
/// `ESCORT_DYNAMIC_RANGE_LIMIT`, maximized over every sibling group -- roots,
/// per-node children, per-node subtree leaves -- and every `(k, q)` pair the
/// allocator actually escorts over). That classification was measured against the
/// fixed-vs-f64 leaf diff over ~6800 generated leaf comparisons
/// (`PROPTEST_CASES=1500`): the two populations turned out statistically
/// indistinguishable (inside-envelope max diff 0.3309, outside-envelope max diff
/// 0.3211) -- the escort dynamic-range spread does not predict the size of
/// fixed-vs-f64 disagreement for this generator's inputs, so it does not carry the
/// tight-vs-loose split the constant's previous doc comment proposed. The
/// disagreement instead tracks discrete decision points elsewhere in `allocate_in`
/// (the MWU gradient-descent admission threshold `kappa > epsilon_kappa`; the
/// dwell-time mode-switch gate `can_switch` is NOT an independent source -- it
/// consumes identical `u32` inputs on both paths and can only amplify a divergence
/// that originated in the kappa gate, confirmed by direct inspection of
/// `allocator/mod.rs`'s `allocate_in` and `tests/reference.rs`'s f64 oracle) that
/// can flip between the fixed-point and f64 paths on inputs a hair apart, producing
/// an O(0.1)-scale output difference that is not a precision defect in the escort
/// kernel.
///
/// CMCA-117: the 0.40 value this replaces was measured (`PROPTEST_CASES=1500`) in
/// the same squashed commit (`835c7945`) as the CMCA-107 kappa-guard fix, with no
/// git evidence the measurement was re-run *after* that fix landed -- i.e. it may
/// have been calibrated against the pre-fix, unguarded-update population. Re-run
/// post-fix, at real scale (`PROPTEST_CASES=8000`, two independent runs, ~63,500
/// total leaf comparisons, run via `env PROPTEST_CASES=8000 cargo test -p bcinr-cmca
/// --test differential --features std`), the true post-fix maximum is higher, not
/// lower, than the pre-fix figure this constant was based on: 0.5638
/// (`differential.proptest-regressions`' `f1d66...` seed, deterministically
/// reproduced across both runs -- not a one-off outlier). So 0.40 was not merely
/// stale, it was actively too tight for the real post-fix population and would have
/// been silently unable to catch a further-widening regression once the true
/// maximum crossed it (both runs *did* fail against 0.40 once real proptest
/// coverage -- rather than the CI-default 1 case -- was applied, which is this
/// ticket's Detection-8 finding made concrete). New value: the larger of the
/// measured maxima (0.5638) with ~24% headroom, matching this crate's
/// measure-then-headroom convention (`escort.rs`'s
/// `power_disagrees_with_the_exact_path_at_a_measured_bound`: 704 -> 900, ~28%).
/// Unlike the constant it replaces, this bound is enforced by a hard assert, not a
/// `println!` diagnostic -- it no longer passes vacuously, it catches a genuine
/// blow-up (NaN, a multi-unit divergence, an unexpected non-`NumericRangeExceeded`
/// refusal) while tolerating the measured, root-caused (kappa-boundary) but not
/// numerically bounded decision noise. Re-measure and re-derive if
/// `tests/differential.rs`'s classification or generator strategy changes.
pub const DIFFERENTIAL_TOLERANCE: f64 = 0.70;
/// DERIVED. Derived from the fractional width. The escort kernel is max-shift stabilised -- exp2(q*log2(m_i) - max_j(q*log2(m_j))) -- so the largest weight is exactly 1.0 and overflow is structurally impossible. The binding constraint is the SPREAD: a sibling more than 2^-16 below the maximum underflows to zero. So the representable region is defined by max_j(q*log2(m_j)) - min_j(q*log2(m_j)) < 16, a property of the sibling SET, not of an individual (q, m) pair.
pub const ESCORT_DYNAMIC_RANGE_LIMIT: i32 = 16;
/// POLICY (owner: bcinr-powl::language). UNDERIVED, and load-bearing. The termination argument holds for any finite value, so 2 is a free choice -- but powl2_language IS the bounded-agreement oracle, so this constant silently sets how strong that check is. A larger value enumerates strictly more traces and therefore checks strictly more.
pub const MAX_CYCLE_UNROLL: usize = 2;
/// POLICY (owner: bcinr-cmca::cascade). UNDERIVED. Any value >= 2 satisfies the stated rationale of bounding the repeated-multiplication loop. This bound is shared, unconditionally enforced, and correctly unified between cascade.rs and escort.rs (escort.rs:178 checks against this same constant). It is NOT the same domain as allocator.rs:1452's separate q in [-2, 2] admission gate: that gate is an independent, ontology-declared *policy* bound on which lenses the allocator's MWU/mode-switching layer will admit, not a numeric-representability bound like this one -- and (a distinct, separately-tracked defect) it is only enforced when `proof.is_some()`, so it is silently skippable on the common `proof: None` call path. Do not conflate the two: any new code computing `m^q` directly (escort/cascade math) is bounded by this constant; allocator.rs's admission policy is a separate, still-partially-enforced concern that needs its own fix.
pub const MAX_LENS_MAGNITUDE: u32 = 16;
/// DERIVED. Definitional: the representation is Q16.16.
pub const Q16_16_FRACTIONAL_BITS: u32 = 16;