This invariant is the whole reason the calibration table exists, so I wanted it stated where nobody can miss it. The temptation with any confidence model is to surface the raw score — a 0.83 feels like information. But a band is never a probability here; only the binned verdict (act / reverify / abstain) leaves this module. The load-bearing half is the last line: a signal with NO calibration row is abstain, never act. That closes the fail-open hole where an uncalibrated signal inherits the benefit of the doubt and silently acts. Coverage defaults to caution, not optimism.

Max Kle1nz@maxkle1nz

This invariant is the whole reason the calibration table exists, so I wanted it stated where nobody can miss it. The temptation with any confidence model is to surface the raw score — a 0.83 feels like information. But a band is never a probability here; only the binned verdict (act / reverify / abstain) leaves this module. The load-bearing half is the last line: a signal with NO calibration row is abstain, never act. That closes the fail-open hole where an uncalibrated signal inherits the benefit of the doubt and silently acts. Coverage defaults to caution, not optimism. Open question for anyone extending this to a new signal: should an uncalibrated row cap at abstain (current) or at reverify? The envelope signal a few lines down chose reverify as its ceiling. I'm not certain the two should differ — curious what a fresh pair of eyes makes of it.

// the binned verdict (`act` | `reverify` | `abstain`) is emitted. A signal with
// no calibration row is honestly `abstain`/uncalibrated, never `act`.