docs(calibration): T0 Amendment 2 for OwnIR v2

OwnIR moved to v2 in the previous commit (the must-understand `proven_call`
of H1). The instrument's `facts` calibration generator stamps `ownir_version`
on every document it writes, so one literal moves: "ownir_version": 1 -> 2.
Nothing else in the harness source set changes. That literal is the only
cause of the identity move:

    1a26aa63fd5fbbe06e7ae72dd5e1c8f2d611bff8856af4a5b93ae36d2d23a9b1   before
    b92f08c990fcf6d74df29aad333b330b6c3c4f9e1c1bad55efe8164c39dea57c   after

Re-bound, in the order the chain runs, exactly as Amendment 1 did: the digest
in the policy freeze (step 4), in the ratified design constants (step 5), and
in the training preregistration's bindings (step 6) — and with it
design_constants_blob_sha1 (0ff316d -> 1059a69), which moved because
the design-constants artifact itself was re-bound. The pyproject comment that
names the identity follows.

The frozen T0 records this as Amendment 2, a new state of the contract under
the owner's ruling (OwnIR v2 and this amendment approved for H1, on the
Amendment 1 principle, for nothing else): T0-1 names the new identity, the
status block points at the amendment, and the amendment says what moved and
what did not. FROZEN and collection_authorized are unchanged. No rule,
budget, population, statistic, roll-up, host predicate or retry budget
changes; the measurement methodology is untouched — this is a schema-transport
change carried by the generated calibration documents, not a change to the
experiment. Committed evidence of past runs is not rewritten.

Merge gate, observed: with the literal moved and nothing re-bound it REFUSED
(instrument_matches_t0: b92f08c990fc vs T0's 1a26aa63fd5f); after the
re-binding it allows. perf-calibration-facts-current was red between the
core's version move and this literal, and holds after it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011ZFvhLx1fM9Gerg4dKsZcL

Author: claude

docs/evidence/calibration/p022-263a-design-constants.json

@@ -1,6 +1,6 @@
 {
   "artifact": "p022-263a-calibration-design-constants",
-  "bound_measurement_harness_digest": "1a26aa63fd5fbbe06e7ae72dd5e1c8f2d611bff8856af4a5b93ae36d2d23a9b1",
+  "bound_measurement_harness_digest": "b92f08c990fcf6d74df29aad333b330b6c3c4f9e1c1bad55efe8164c39dea57c",
   "bound_policy_implementation_digest": "c3068ed7fa880a7083866ead25fe8bf65c87889d242d8af1f7eee01582cd5cbf",
   "constants": {
     "G": [

docs/evidence/calibration/p022-263a-policy-freeze.json

@@ -1,6 +1,6 @@
 {
   "artifact": "p022-263a-calibration-policy-freeze",
-  "measurement_harness_digest": "1a26aa63fd5fbbe06e7ae72dd5e1c8f2d611bff8856af4a5b93ae36d2d23a9b1",
+  "measurement_harness_digest": "b92f08c990fcf6d74df29aad333b330b6c3c4f9e1c1bad55efe8164c39dea57c",
   "policy_implementation_digest": "c3068ed7fa880a7083866ead25fe8bf65c87889d242d8af1f7eee01582cd5cbf",
   "policy_implementation_digest_framing": "sha256 over the source set ordered by the UTF-8 bytes of each repo-relative POSIX path. Each file contributes, with no header and no separator: its path byte length as an 8-byte big-endian unsigned integer, its path's exact UTF-8 bytes, its blob byte length as an 8-byte big-endian unsigned integer, and its exact git blob bytes.",
   "policy_source_commit": "b4f657a0abdfdfaae199cbc7eee0c47acd8b0057",

docs/evidence/calibration/p022-263a-training-preregistration.json

@@ -30,8 +30,8 @@
   "anchor_commit": "eedf6d3ed44ecf7bda69fa509dcd23b45960cf76",
   "artifact": "p022-263a-calibration-training-preregistration",
   "bindings": {
-    "design_constants_blob_sha1": "0ff316d5aea6af92c01679babaf0f0251191dcee",
-    "measurement_harness_digest": "1a26aa63fd5fbbe06e7ae72dd5e1c8f2d611bff8856af4a5b93ae36d2d23a9b1",
+    "design_constants_blob_sha1": "1059a69fe53ff3c2286414731e6104f848596ca7",
+    "measurement_harness_digest": "b92f08c990fcf6d74df29aad333b330b6c3c4f9e1c1bad55efe8164c39dea57c",
     "policy_implementation_digest": "c3068ed7fa880a7083866ead25fe8bf65c87889d242d8af1f7eee01582cd5cbf",
     "training_scope_implementation_digest": "614bf9efe6ba2bb10e26a251c10d6c4a8fdaa99985d43ea03d76c6774447d25b",
     "training_scope_root": "scripts/training/"

docs/notes/p022-263-t0-protocol-freeze.md

@@ -34,6 +34,13 @@ Status:
     instrument's generated facts moved to OwnIR v1, and steps 4, 5 and 6 were
     re-bound to it. The freeze and the authorisation above are unchanged, and so
     is every rule, budget, population and predicate below.
+
+  AMENDMENT 2 (2026-10-03) is the next such state, on the same principle:
+    the accepted harness identity moved 1a26aa63fd5f -> b92f08c990fc when the
+    instrument's generated facts moved to OwnIR v2 (the `proven_call` transport
+    of H1), and steps 4, 5 and 6 were re-bound to it. The freeze and the
+    authorisation above are unchanged, and so is every rule, budget, population
+    and predicate below.
 ```
 
 **What this is.** The contract that fixes *how numbers will be judged*, before any
@@ -170,13 +177,14 @@ Doing so edits `scripts/perf_baseline.py`, which is one of the two files in the
 harness source set, so it moves the harness identity
 
     measurement_harness_digest
-    1a26aa63fd5fbbe06e7ae72dd5e1c8f2d611bff8856af4a5b93ae36d2d23a9b1
-
-to which steps 4, 5 and 6 are bound. The identity has moved twice, each time by
-a recorded act and never as a side effect: steps 4, 5 and 6 were **re-bound**
-after the S8 memory-semantics repair (`562a7f7232da` → `104c384d01bf`), and
-re-bound again by Amendment 1, when the instrument's generated facts moved to
-OwnIR v1 (`104c384d01bf` → `1a26aa63fd5f`).
+    b92f08c990fcf6d74df29aad333b330b6c3c4f9e1c1bad55efe8164c39dea57c
+
+to which steps 4, 5 and 6 are bound. The identity has moved three times, each
+time by a recorded act and never as a side effect: steps 4, 5 and 6 were
+**re-bound** after the S8 memory-semantics repair (`562a7f7232da` →
+`104c384d01bf`), re-bound again by Amendment 1, when the instrument's generated
+facts moved to OwnIR v1 (`104c384d01bf` → `1a26aa63fd5f`), and re-bound a third
+time by Amendment 2, when they moved to OwnIR v2 (`1a26aa63fd5f` → `b92f08c990fc`).
 Moving it again is a new instrument and a re-evaluation of accepted
 instrumentation evidence, not a T0 detail.
 
@@ -1326,3 +1334,64 @@ qualification, an exact execution binding, the campaign link and the session
 preflight are still required, and each may still refuse. It changes no number a
 verdict is computed from. And it is not a precedent for moving the identity as a
 side effect: the next move is a new amendment or it is a defect.
+
+### Amendment 2 — the harness identity follows OwnIR v2 (2026-10-03)
+
+```text
+Status after this amendment:
+  FROZEN, collection_authorized: true        unchanged
+  accepted harness identity                  1a26aa63fd5f -> b92f08c990fc
+  rules, budgets, populations, statistic,
+  roll-ups, host predicate, retry budget     unchanged, every one of them
+```
+
+**The owner's ruling.** H1 connects state protocols to the interprocedural
+heap-effect summaries through a must-understand flow op, `proven_call`, so that
+an older core cannot read an unproven call as clean. A new flow op is a
+vocabulary change, so `OWNIR_VERSION` moved 1 → 2
+([OwnIR.md §2, §5.4](../../spec/OwnIR.md), [H1](h1-proven-call.md)). The owner
+approved the version move and this amendment for exactly that reason, on the
+Amendment 1 principle — a minimal re-binding forced by the version literal — and
+for nothing else: no other change to T0, its budgets, populations, predicates or
+measurement semantics is authorised by it. As in Amendment 1, a compatibility
+shim on either side (a v2 core that also accepts v1) is ruled out.
+
+**What changed in the instrument.** One literal in the `facts` generator of
+`scripts/perf_baseline.py`: `"ownir_version": 1` became `"ownir_version": 2`.
+Nothing else in the harness source set moved: the workload manifest, the rung
+ladder, the clock, the memory accounting, the identity gate and
+`HARNESS_VERSION` are byte-for-byte what they were. This is a schema-transport
+change carried by the generated calibration documents, not a change to the
+measurement experiment: the generated `facts` workloads have the same shape and
+scale and do the same work, and the `refused` workload is refused at the same
+door.
+
+    harness identity before   1a26aa63fd5fbbe06e7ae72dd5e1c8f2d611bff8856af4a5b93ae36d2d23a9b1
+    harness identity after    b92f08c990fcf6d74df29aad333b330b6c3c4f9e1c1bad55efe8164c39dea57c
+
+**What was re-bound**, in the order the chain runs: the policy freeze (step 4),
+the ratified design constants (step 5), and the training preregistration's
+bindings (step 6) — and with the last, `design_constants_blob_sha1`
+(`0ff316d5aea6` → `1059a69fe53f`), which moved because the design-constants
+artifact itself was re-bound. T0-1 above names the new identity; the merge gate
+reads it there and recomputes it from the instrument sources of the tree being
+merged. With the literal moved and nothing re-bound, the gate refused
+(`instrument_matches_t0`: the instrument hashed to `b92f08c990fc`, T0 named
+`1a26aa63fd5f`); after the re-binding it allows.
+
+**What was not touched.** The committed evidence of runs that actually
+happened, for the same reason as in Amendment 1. No T0-governed clock has run
+under any identity, so there is no training or decisive observation for this
+amendment to re-evaluate, keep or discard.
+
+**The re-evaluation T0-1 says a moved identity owes.** The instrumentation
+controls were re-run on the amended tree, all of them as part of
+`tests/run_tests.py`, and all hold; `perf-calibration-facts-current` — the
+control Amendment 1 added for exactly this defect — was red between the version
+move and the instrument literal (the reference refused the generator's v1
+documents at the door) and holds after it.
+
+**What this amendment does not do.** It authorises nothing new and changes no
+number a verdict is computed from. FROZEN and `collection_authorized` stay as
+they were. It is not a precedent for moving the identity as a side effect: the
+next move is a new amendment or it is a defect.

docs/notes/p022-263a-instrument.md

@@ -276,6 +276,12 @@ caught it is `perf-calibration-facts-current`: it runs the reference on the
 generator's output and requires the `facts` workloads to be analysed and the
 `refused` one to be refused.
 
+It moved a third time, from `1a26aa63fd5f` to `b92f08c990fc`, when OwnIR's
+vocabulary moved to v2 for H1's must-understand `proven_call`: the same literal,
+`1` → `2`, the same re-binding of steps 4, 5 and 6, recorded as the frozen T0's
+Amendment 2. `perf-calibration-facts-current` named the defect between the core's
+version move and the instrument's, exactly as it was added to.
+
 On POSIX the same `wait4` call also carries the child's CPU split, fault counts
 and context-switch counts. Those are now kept rather than discarded — see *The
 interval kept its meaning and gave up its secrets* — under the same rule: off

pyproject.toml

@@ -18,7 +18,7 @@ select = ["E", "W", "F", "I", "B", "UP", "C4", "RUF"]
 [tool.ruff.lint.per-file-ignores]
 # scripts/perf_baseline.py is an INSTRUMENT SOURCE: its bytes are hashed into
 # the measurement harness digest that the frozen #263 preregistration names
-# (1a26aa63fd5f), and steps 4, 5 and 6 are bound to that same value. Rewrapping
+# (b92f08c990fc), and steps 4, 5 and 6 are bound to that same value. Rewrapping
 # a line there is not a cosmetic edit — it moves the digest and makes the frozen
 # contract point at an identity the tree no longer contains, which is exactly
 # what scripts/step7/mergegate.py exists to refuse. So the one over-long line

scripts/perf_baseline.py

@@ -1272,7 +1272,7 @@ def materialize_calibration(w: Workload, tmp: Path) -> Path:
     if gen == "facts":
         scale = _as_int(w.spec.get("scale", 1), 1)
         doc = {
-            "ownir_version": 1,
+            "ownir_version": 2,
             "module": w.id,
             "components": [{"name": f"C{i}", "kind": "class", "file": f"gen/{i}.cs", "line": i + 1}
                            for i in range(scale)],