Add leakage-safe spatial replay revision contract

[FlorianPfaff]

Scope

Adds the Bayesian-ACh consumer, strict sidecar-validated artifact contract, and frozen Pfeiffer/Foster raw-emission runner:

• signed pre-replay filtering-to-smoothing revision fields in compact destination-well state;
• shared-base marginal raw-log-emission scoring versus surprise, content, current-location, recency, prospective, finite TD-error, and null fields;
• LO-rat temperature selection, fixed smoothing-versus-every-alternative contrasts, simultaneous bootstrap bounds, and exact animal sign-flip gates;
• executable LOAO/LOSO pure/mixture/null recovery on the exact complete-case cohort;
• full-tree, route-provenance, event-audit, cohort, predictor, and clean-code hash checks;
• technical-abstention artifacts, including when the complete-case cohort is empty.

Exact claim boundary

The revision field aggregates, over routes completed before the ripple,

KL(q_smooth || q_filter) * exp(-age/300 s) * (q_smooth - q_filter),

mapped from destination wells to the event grid and normalized by absolute mass. Filtering is fixed at 50% of a 21-point historical route; smoothing may use the rest of that already-completed route plus its terminal destination, never observations after the target ripple. The documentation freezes and tabulates every pseudocount, width, error rate, decay, normalization, and temperature.

The replay prior is constant across event bins and the score averages per-bin spatial marginal likelihood. A positive result could therefore identify only time-marginal spatial alignment with this specified signed revision field. It cannot identify replay sequence order/direction, ordered reinstatement, a smoothing generator, the animal's algorithm, causality, or acetylcholine coding.

Matched-field Gaussian injection recovery is post-decoder score recovery at empirical point-spread resolution. It is not end-to-end spike/place-field decoder recovery and is not robustness to smoothing-field misspecification.

Decoder-calibration amendment

The claim-bearing contract now requires a fixed 120-second strictly pre-replay
point-spread holdout (100-ms bins, moving RUN outside ripples, at least 20 valid
bins, q68 error). The initial 60-second rule left two of the fixed 160
LFP-selected events with only 17 and 10 bins. Before any replay scoring, an
outcome- and score-blind counts preflight over 60/120/180 seconds found 120
seconds was the shortest tested global window supporting all events (minimum
42); no event was dropped or backfilled. This is a transparent design amendment,
not a preregistered choice. The loader binds exact decoder configuration digest
a79fa8a1f55a964c4367853cc120efc9b742ec4e327c277ede78cfd6a277f20b.
The producer evaluates only eligible calibration bins in deterministic
32-time-bin chunks, with a dense-versus-bounded equality regression; chunking
changes memory use, not the likelihood definition.

Mandatory abstention

Pfeiffer/Foster has four rats. At 95% confidence, the smallest possible one-sided animal sign-flip p value is 1/16, so the real runner cannot return identified; it must freeze abstain while retaining descriptive scores. No real-data smoothing claim is made by this draft.

The raw predictor must be produced by the paired HippoReplayDynamics causal-prefix producer and pass actual verifier-report, clean route-manifest, event-audit, and cohort checks before this runner will load it.