@oimlsmart/primmel-packages 0.1.0

package/oiml-twin-cert/documents/tw-1/document.yaml

@@ -0,0 +1,454 @@
+# GENERATED package payload (TODO.v2/01 TCD-6) — the program's governing-document
+# module. The authoring draft is data/oiml-twin-cert/documents/tw-1/document.yaml (document prose has no
+# PRL construct); migrated by build-prl-package. Do not edit by hand.
+# OIML SMART TWIN-CERT DOCUMENT MODULE TW-1 — THE PROGRAM'S GOVERNING
+# DOCUMENT (urn:oiml:pub:cs:twin-1:2027)
+# -----------------------------------------------------------------------------
+# TW-1 "Digital-Twin Fidelity Certification Program — Governing Document",
+# edition 2027 — the normative text every /req/twin-fidelity/* requirement,
+# /conf/twin-fidelity/* conformance test, model register, symbol, behavior,
+# characteristic, term and D2 form of the oiml-twin-cert package cites by
+# clause anchor (TODO.v2/01 TCD-6 work item 1 — the TCD-1 review's backfill
+# contract).
+#
+# ANCHOR CONTRACT (cite-integrity — browser/src/__tests__/
+# twin-1-cite-integrity.test.ts pins it): the cited anchors are EXACTLY
+#   3.1        — the VIML naming record (twin-fidelity evaluation)
+#   4.1–4.4    — the twin-fidelity model (the two-channel relation, the
+#                served registers, the probe channel, the declared tolerance)
+#   5.1–5.6    — the normative requirements
+#   6.1–6.5    — the twin-fidelity evaluation (admission + the probe schedule)
+# Every citation in primmel-packages/oiml-twin-cert/ (source { doc … clause },
+# source "urn, clause", <urn>#clause-<c>, and the forms' section "TW-1, <c>"
+# facets) resolves to a section declared here, and every leaf section
+# numbered 3–6 declared here is cited. The clause-6 lead-in carries the
+# certification decision + certificate + surveillance semantics (the
+# subsections are the determination procedures).
+#
+# STATUS: a DECLARED governing document of the platform's own program — the
+# scheme operator's publication, styled on the OIML-CS document pattern
+# (data/oiml-cs/documents/<doc>/), not an OIML publication. The OIML-CS is
+# the program's recorded long-term home (controller decision 4: a new
+# category scheme inside the B 18 framework model when the OIML-CS adopts
+# it — modelled as nothing yet). Pilot values (the LC-500-class register,
+# δ = 0.1 kg, the mtl_f_001 / p_weber register citations) are the scheme's
+# DECLARED pilot parameters — declared examples of the fictional pilot
+# (primmel-packages/acme-lc500), never measured fact.
+#
+# Provenance: analysis/twin-certification-design.md (Q1–Q5 + the five
+# controller decisions, 2026-07-28); the normative content mirrors the
+# landed package — specification/requirements/twin-fidelity.prl,
+# specification/conformance/twin-fidelity.prl, model/*.prl,
+# terminology.prl, execution/forms/*.prl.
+#
+# Data conventions: hand-authored app configuration (no PRL construct for
+# document prose — the oiml-cs documents/<doc>/ module pattern); migrated
+# into the package by the authoring aid (browser/scripts/build-prl-package.ts
+# ships documents/** for certification_program layers verbatim).
+# ---
+document:
+  id: tw-1
+  urn: urn:oiml:pub:cs:twin-1:2027
+  doc: TW-1
+  title: "Digital-Twin Fidelity Certification Program — Governing Document"
+  edition: 2027
+  year: 2027
+  status: current
+  validity:
+    from: '2027-01-01'
+  foreword: >
+    This document is the governing document of the Digital-Twin Fidelity
+    Certification Program operated by the scheme operator (the twin
+    certification body). The Program confirms that a digital twin provided
+    by a measuring instrument faithfully reflects the physical instrument's
+    status — the served value equivalent to the physical state, within
+    declared bounds and freshness, continuously. The Program is a per-unit
+    certification scheme with surveillance, self-classified as scheme
+    type 5 against the ISO/IEC 17067 register; the twin certificate stands
+    alone from type evaluation but prerequisites a valid type certificate
+    of the underlying instrument. The Program is related to the OIML
+    Recommendations by mapping only (maps_to oiml-r60 for the pilot
+    register set), composes no Recommendation content, and is recorded as
+    a candidate category scheme of the OIML Certification System (OIML-CS)
+    — its long-term home.
+  sections:
+    - clause: "1"
+      title: Scope
+      prose: >
+        This document specifies the Digital-Twin Fidelity Certification
+        Program: the twin-fidelity model (clause 4), the program
+        requirements a certified twin shall meet (clause 5), and the
+        twin-fidelity evaluation — the determination activities, the
+        certification decision, the certificate and the surveillance
+        regime (clause 6). The object of certification is the serving
+        layer of a digital twin of an individual measuring instrument
+        (the certified unit): the governed projection of the instrument's
+        status the twin serves — declared registers with declared
+        freshness and provenance. The Program certifies the fidelity of
+        that projection, never the completeness of any larger
+        representation the provider operates. Certification of the
+        underlying instrument type is outside the scope of this document;
+        a valid type certificate is an admission prerequisite (6.1).
+    - clause: "2"
+      title: Normative references
+      prose: >
+        The following documents are indispensable for the application of
+        this document: ISO/IEC 17000:2020 (conformity assessment —
+        vocabulary and general principles, in particular determination
+        A.3.2 and attestation A.4.3); ISO/IEC 17065 (requirements for
+        bodies certifying products, processes and services); ISO/IEC 17025
+        (requirements for the competence of testing and calibration
+        laboratories, in particular the personnel-authorization records of
+        6.2.6); ISO/IEC 17067 (product certification schemes — the scheme
+        type register against which this Program classifies itself as
+        type 5); the OIML Recommendation the Program maps to for the
+        certified register set (OIML R 60 for the pilot registers — the
+        metrological definitions of the served aspects live there, never
+        restated here); OIML B 18 (the OIML-CS framework — the Program's
+        recorded long-term home).
+    - clause: "3"
+      title: Terms and definitions
+      prose: >
+        For the purposes of this document, the terms and definitions of
+        ISO/IEC 17000, the International Vocabulary of Metrology (VIM)
+        and the International Vocabulary of Terms in Legal Metrology
+        (VIML) apply, together with the following. VIML names no
+        twin-verification kind: VIML 2.09 and 2.12–2.14 are verifications
+        of the instrument itself (initial, subsequent, in-service), so the
+        twin-fidelity discipline is defined by this Program. The naming
+        decision and its record are 3.1.
+    - clause: "3.1"
+      title: twin-fidelity evaluation
+      prose: >
+        determination activity, and its attestation, confirming that a
+        digital twin provided by a measuring instrument faithfully
+        reflects the physical instrument's status — the served value
+        equivalent to the physical state, within declared bounds and
+        freshness, continuously. NOTE — The term is this Program's naming
+        decision (accepted 2026-07-28): VIML 2.09 and 2.12–2.14 name
+        instrument verifications and no twin-verification kind, so the
+        new verification kind is named here — a determination activity
+        per ISO/IEC 17000:2020, A.3.2 with attestation per A.4.3, a new
+        kind alongside initial, subsequent and in-service verification.
+        This entry is the naming decision record.
+    - clause: "4"
+      title: The twin-fidelity model
+      prose: >
+        Clause 4 declares the model the requirements of clause 5 and the
+        evaluation of clause 6 operate on: the two-channel fidelity
+        relation (4.1), the served registers the Program reads (4.2), the
+        physical-side probe channel with its sources, timestamps and
+        pairing window (4.3), and the declared twin tolerance (4.4). The
+        metrological definitions of the served aspects live in the
+        Recommendation the Program maps to; this clause declares only the
+        binding slots and the evidence registers the Program reads.
+    - clause: "4.1"
+      title: The two-channel fidelity relation
+      prose: >
+        Twin fidelity is a TWO-channel relation between the twin's served
+        channel and a physical-side reference channel. The serving
+        behavior under evaluation is the twin's served indication in
+        response to the physical instrument's applied load; the deviation
+        the relation judges is the characteristic Δ_ind = |served −
+        reference|, quantity-typed over the served register (4.2) and the
+        reference register (4.3) paired at a probe point. The deviation
+        is derived once, as the declared characteristic
+        twin_deviation_indication; requirements and tests consume that
+        single derivation, never a restated copy. The relation is closed
+        only by the probe channel of 4.3 — a served value alone, however
+        fresh, is one channel of a two-channel claim.
+    - clause: "4.2"
+      title: The served channel — served registers
+      prose: >
+        The served channel is the set of registers the twin serves and
+        the Program reads, each bound at deployment through the Program's
+        gateway: the served indication I (the live output reading in
+        units of mass, quantity-kind mass, unit kg — the served channel
+        of the two-channel fidelity relation) and the served operational
+        state (the instrument's off/warming/ready/measuring/fault state
+        as served by the twin's state channel). The metrological
+        definition of each served aspect lives in the Recommendation the
+        Program maps to; this section declares only the binding slots.
+        Every served register carries a declared freshness window on its
+        serve binding (fresh_within) — the window the requirements of 5.3
+        inherit and never re-declare.
+    - clause: "4.3"
+      title: The reference channel — probe sources, timestamps and the pairing window
+      prose: >
+        The reference channel is the physical-side evidence register
+        family paired with the served registers at a probe point. A
+        reference reading arrives by exactly one of three declared probe
+        sources, recorded on the evidence with its register citation:
+        reference_instrument — a traceable reference instrument, cited by
+        equipment-register id with its calibration trace (PREFERRED);
+        observer_attestation — a verification officer reads the physical
+        instrument's display and records the reading with its observation
+        timestamp, attestation per ISO/IEC 17000:2020, A.4.3, admitted
+        with the DECLARED traceability limitation: attestation-only
+        evidence proves the twin serves what the instrument's own display
+        annunciates — twin ≡ display, not twin ≡ mass (the reference IS
+        the EUT's own indication, never an independent physical
+        standard); sim_ground_truth — ground truth of the declared
+        acceptance environment, never a production channel. Each paired
+        reading is timestamped on both sides: the twin's OWN served
+        timestamp t_srv (the served-timestamp source declared per
+        operation — freshness is judged against the twin's own timestamp,
+        never the platform's receipt clock) and the reference observation
+        timestamp t_obs captured at evidence-capture time; the pairing
+        skew Δt_pair = |t_srv − t_obs| is derived once at evidence
+        capture and recorded as evidence. A pair whose skew exceeds the
+        declared pairing window — at most the probed register's
+        fresh_within, declared per register with fresh_within as the
+        ceiling, never a fixed platform constant — is INVALID: the
+        probe's setup was wrong, never a fail of the twin.
+    - clause: "4.4"
+      title: The declared twin tolerance
+      prose: >
+        The twin tolerance δ is the maximum permitted absolute deviation
+        between the served and the reference reading at any probe point,
+        declared per register by the scheme as a declared fraction of the
+        underlying instrument's maximum permissible error — declared by
+        the scheme, never a platform constant. For the pilot indication
+        register (the LC-500-class load-cell register) the scheme declares
+        δ_indication = 0.1 kg (the declared pilot parameter: 25 times the
+        good cell's noise σ, so the faithful twin passes cleanly and a
+        0.25 kg lie is unmistakable).
+    - clause: "4.5"
+      title: The behavioral register family (the creep dwell)
+      prose: >
+        The behavioral registers close the behavioral fidelity relation
+        (5.6) over the creep dwell (6.5): the dwell parameters — the
+        declared dwell duration T_dw (the scheme's declaration per
+        register, the pilot's 900 s), the dwell load L_dw (≈90 % of
+        E_max, the lookupMPE load input), the certified type's accuracy
+        class (the lookupMPE class input) and the apportionment factor
+        p_lc (0.7 by default for load cells per R 60); the dwell
+        readings — the served indication at dwell start I_t0 (the drift
+        baseline) and at dwell end I_end, and the constant-reference
+        anchors I_ref,t0 and I_ref,end from the declared probe channel
+        (4.3); the derived maximum drift Δ_max — the maximum
+        |served sample − I_t0| over the recorded dwell series, derived
+        once at evidence capture from the recorded series (facts only,
+        auditable against it — the same derived-once discipline as the
+        pairing skew of 4.3); and the class creep allowance δ_cr =
+        lookupMPE(L_dw, accuracy_class, p_lc), the mapped Recommendation's
+        own apportioned maximum permissible error at the dwell load,
+        computed from the class tables, never a platform constant. The
+        behavioral judgment (5.6) is the canonical verdict
+        twin_creep_drift_indication read off the Δ_max register, judged
+        against δ_cr.
+    - clause: "5"
+      title: Program requirements
+      prose: >
+        Clause 5 states the normative requirements a certified twin shall
+        meet. A twin-fidelity requirement is, per served register, the
+        conjunction of value fidelity (5.2), freshness (5.3) and
+        provenance (5.4), plus state fidelity (5.5) and behavioral fidelity (5.6), gated by the
+        static-conformance admission (5.1). The requirements are cited by
+        the determination activities of clause 6 and judged through the
+        verdict chain of the Program's evaluation machinery.
+    - clause: "5.1"
+      title: Static conformance of the served twin interface (admission)
+      prose: >
+        A certified twin shall serve exactly the interface its certified
+        product package declares: the endpoint identifier, the served
+        operations with their payload schemas and quantity kinds, and the
+        access scopes shall equal the package's endpoint declaration. A
+        twin that mis-serves its declared contract shall not enter
+        value-fidelity probing. Verification: inspection — the
+        admission-time contract check against the pinned product
+        package's endpoint declaration, re-verified at every surveillance
+        cycle start.
+    - clause: "5.2"
+      title: Served indication within the declared twin tolerance
+      prose: >
+        The twin's served indication shall match the physical
+        instrument's indication within the declared tolerance
+        δ_indication at every probe point: |served − reference| ≤
+        δ_indication, the reference reading taken from a declared probe
+        channel (4.3) and paired with the served reading within the
+        pairing window. Verification: testing — the probe schedule's
+        range and envelope tests (6.2, 6.3): paired reference-vs-served
+        readings at the declared load points and envelope corners, each
+        pair timestamped within the pairing window.
+    - clause: "5.3"
+      title: Declared freshness on every fidelity register
+      prose: >
+        Every fidelity register shall be served under a declared
+        freshness window: the serve binding carries fresh_within, and a
+        served value older than its window degrades the fidelity verdict
+        to indeterminate — never a fail, never a silent pass. The Program
+        inherits the window from the serve declaration and never
+        re-declares it on the binding. Verification: definitional —
+        satisfied by the serve declaration the Program reuses and
+        enforced continuously by the verdict machinery's freshness gate.
+    - clause: "5.4"
+      title: Served-timestamp provenance on every fidelity register
+      prose: >
+        A certified twin shall serve a parseable timestamp on every
+        fidelity register, and the deployment shall declare the
+        served-timestamp field per operation (the timestamp_fields
+        declaration) so freshness is judged against the twin's own served
+        timestamp — a declared-but-absent timestamp is unavailable, never
+        invented. Every fidelity fact shall carry provenance: the
+        endpoint identifier bound to the certified unit's serial, the
+        serving operation, and the definition version pin. Verification:
+        definitional — a declaration requirement gated at admission and
+        enforced continuously by the freshness gate.
+    - clause: "5.5"
+      title: Served operational state equals the physical state
+      prose: >
+        The twin's served operational state shall equal the physical
+        instrument's state at every state transition, including fault
+        annunciation: a served fault state faithfully reporting the
+        instrument's fault is not infidelity — it passes fidelity and
+        triggers service. A twin that serves a healthy state over a
+        faulted instrument, or a fault state over a healthy one, fails
+        state fidelity. Verification: testing — the probe schedule's
+        transition test (6.4): the served operational state is compared
+        with the reference state at each declared transition.
+    - clause: "5.6"
+      title: Behavioral fidelity — the creep envelope (class-parameterized)
+      prose: >
+        Under a CONSTANT reference load held for the declared dwell, the
+        twin's served indication shall drift no more than the instrument's
+        accuracy-class creep allowance — the behavioral fidelity
+        requirement: the twin's dynamics track the physical instrument's,
+        not merely its single points. The allowance is parameterized per
+        accuracy class through the mapped Recommendation's own apportioned
+        maximum permissible error — creep_allowance = lookupMPE(dwell_load,
+        accuracy_class, p_lc), the same computation the Recommendation's
+        creep test uses (for R 60 the apportionment factor p_lc = 0.7 by
+        default). A twin whose creep response exceeds the class envelope
+        is unfaithful however cleanly its point probes pass; a reference
+        that itself drifts beyond one third of the allowance (the U:MPE
+        ≤ 1:3 discipline) voids the setup — INVALID, never a fail.
+        Verification: testing — the behavioral probe program (6.5): a
+        constant-load dwell with served samples over the dwell and
+        constant-reference anchors at both ends.
+    - clause: "6"
+      title: Twin-fidelity evaluation and certification
+      prose: >
+        Clause 6 specifies the twin-fidelity evaluation — the Program's
+        determination activities — and the certification decision,
+        certificate and surveillance regime. The determination set is the
+        static-conformance admission (6.1) and the probe schedule (6.2
+        the measuring range, 6.3 the operational envelope, 6.4 the
+        operational transitions, 6.5 the behavioral creep dwell); every probe test is gated on the
+        admission and carries the pairing-window INVALID precondition of
+        4.3, and each probe execution is recorded in the Program's probe
+        record — served value and timestamp, reference value and
+        observation timestamp, the channel and its register citation, the
+        carried traceability limitation when the channel is observer
+        attestation, and the pairing skew. The certification decision
+        certifies when every fidelity register passes and the admission,
+        the timestamp-provenance declaration and the type-certificate
+        prerequisite hold; any register fail refuses; anything unprovable
+        is inconclusive — silence is not evidence and never a silent
+        certify. The twin certificate claims a scoped, conditional
+        relation: for the certified unit, the twin served at the
+        certified endpoint via the certified operations reflects the
+        physical state of the certified registers within the declared
+        tolerance and freshness per register, verified by the probe
+        schedule on the verification date with served-timestamp
+        provenance declared — validity conditional on continuous
+        surveillance; a sustained fail suspends; an unresolved fail
+        withdraws. Surveillance is the Program's continuous half (scheme
+        type 5 — non-dischargeable): the same fidelity requirements are
+        re-judged continuously by the Program's monitor over the
+        certified-twin fleet, and post-certification infidelity walks the
+        certificate machine — a monitor fail flags the certificate and
+        opens a service case (investigate), a case unresolved past the
+        declared cure window or the declared count of consecutive failed
+        cycles suspends, rectification (a re-probe pass, or a re-judged
+        surveillance window under the same tolerance returning pass on
+        stored snapshots — the twin never re-queried) reinstates, and an
+        unresolved fail withdraws. A served fault state faithfully
+        reporting the instrument's fault is not infidelity: the
+        state-triggered rule opens a service case without flagging the
+        certificate — a twin lying about a healthy instrument fails
+        fidelity; a twin truthfully serving a fault state passes fidelity
+        and triggers service.
+    - clause: "6.1"
+      title: Static conformance admission
+      prose: >
+        The admission determination verifies that the twin serves exactly
+        the interface its certified product package declares — endpoint
+        identifier, operations, payload schemas and quantity kinds,
+        access scopes — before any value-fidelity probing: read the
+        twin's served schema, operations, access scopes and payload
+        semantics and compare them against the pinned product package's
+        endpoint declaration; any mismatch is an admission failure and a
+        twin that mis-serves its contract never reaches value probes. The
+        admission is an inspection determination and is re-verified at
+        every surveillance cycle start; its evidence record is the
+        Program's static-conformance admission record.
+    - clause: "6.2"
+      title: Twin-fidelity probe — the measuring range
+      prose: >
+        The range probe closes the two-channel fidelity relation across
+        the measuring range: minimum load, then approximately 25 %, 50 %,
+        75 % and 100 % of E_max, increasing and, where the physics
+        demands, decreasing — the load-point discipline of the mapped
+        Recommendation's maximum-permissible-error test. At each load
+        point, record the reference reading from the declared probe
+        channel (4.3) and the served reading fetched through the gateway
+        at probe time, each timestamped, and pair the readings within the
+        pairing window — a pair whose skew exceeds it is INVALID, never a
+        fail. Value fidelity at each point is judged per 5.2 through the
+        declared deviation characteristic, and each execution is recorded
+        in the Program's probe record (the report format of this
+        determination).
+    - clause: "6.3"
+      title: Twin-fidelity probe — the operational envelope
+      prose: >
+        The envelope probe closes the two-channel fidelity relation
+        across the operational envelope: condition the instrument at each
+        declared envelope corner — the rated temperature corners of the
+        certified product's declared envelope, and the declared humidity
+        corner where the certified product declares a humidity class (the
+        corner is the scheme's declaration, never an assumption) — probe
+        the paired reading per the range probe's channel discipline (6.2)
+        at each corner, each pair timestamped within the pairing window,
+        and return to reference conditions for the closing pair. Value
+        fidelity at each corner is judged per 5.2 — fidelity holds at
+        the envelope extremes, not only at reference conditions.
+    - clause: "6.4"
+      title: Twin-fidelity probe — the operational transitions
+      prose: >
+        The transition probe closes the two-channel fidelity relation
+        across the operational transitions: the warm-up leg
+        (off→warming→ready), the measurement leg (ready→measuring), and
+        the fault-annunciation leg and clear. At each declared
+        transition, record the physical state from the declared probe
+        channel (4.3 — observer attestation: the verification officer
+        reads the instrument's own state annunciation, admitted with the
+        declared traceability limitation) and the served operational
+        state delivered on the twin's state channel, each timestamped,
+        and pair within the pairing window of the state register — a
+        violating pair is INVALID, never a fail. State fidelity at each
+        transition is judged per 5.5: a served fault faithfully reporting
+        the instrument's fault passes fidelity and triggers service,
+        never a fidelity fail.
+    - clause: "6.5"
+      title: Twin-fidelity behavioral probe — the creep dwell
+      prose: >
+        The behavioral probe closes the behavioral fidelity relation
+        (5.6): apply the declared dwell load (≈90 % of E_max) and hold it
+        CONSTANT for the declared dwell. Record the reference reading at
+        dwell start and dwell end from the declared probe channel (4.3) —
+        each anchor a timestamped reference-vs-served pair within the
+        pairing window (a violating anchor pair is INVALID, never a fail)
+        — and sample the served indication through the gateway at the
+        declared instants over the dwell. The served drift is derived once
+        at evidence capture as the maximum |sample − served at dwell
+        start| over the recorded series (facts only — auditable against
+        the recorded series), and the creep allowance is computed from the
+        class tables as lookupMPE(dwell_load, accuracy_class, p_lc) — the
+        mapped Recommendation's own apportioned MPE at the dwell load,
+        never a platform constant. A reference that itself drifts beyond
+        one third of the allowance (the U:MPE ≤ 1:3 discipline) INVALIDATES
+        the setup — never a fail. Behavioral fidelity is judged per 5.6:
+        the maximum drift against the class allowance. Each execution is
+        recorded in the Program's behavioral probe record (the report
+        format of this determination).

package/oiml-twin-cert/evaluation/roles.prl

@@ -0,0 +1,15 @@
+role scheme_operator {
+  label "Scheme Operator"
+  description "The twin certification body operating the program (the ISO/IEC 17067 scheme owner): admits twins to certification, issues the twin certificate, and runs surveillance — including the suspension, reinstatement and withdrawal of certificates."
+}
+
+role twin_provider {
+  label "Twin Provider"
+  description "The instrument owner (or manufacturer) providing the digital twin and applying for its certification — the certified unit's serving layer is the object of certification; a valid type certificate of the underlying instrument is a hard admission prerequisite."
+}
+
+role verification_officer {
+  label "Verification Officer"
+  description "The probe agent of the observer-attestation channel: reads the physical instrument's display at a probe point and records the reference reading (with its observation timestamp) into the probe form — attestation per ISO/IEC 17000 A.4.3, admitted with recorded traceability limits. ROLE-LINK DECISION (TCD-3, the R45 review minor — decided and pinned): the linker's R45 leg resolves the attestation citation to a lab personnel register entry — IDENTITY only. The person⇄verification_officer role link is a JUDGMENT the certification decision weighs (D3), declared as data: the citing lab's ISO/IEC 17025 6.2.6 authorization activity verification_attestation on the officer's personnel entry. Attestation-channel probe evidence from an officer WITHOUT the declared authorization is INADMISSIBLE at decision time (the admissibility doctrine — it grounds no certification decision, never a fidelity fail of the twin); the program's own roles register declares the role kind, never the person."
+}
+

package/oiml-twin-cert/execution/forms/probe-creep.prl

@@ -0,0 +1,179 @@
+form twin-1/probe-creep {
+  name "Twin-Fidelity Behavioral Probe Record (Creep Dwell)"
+  description "The D2 evidence record of one behavioral probe execution (TODO.v3/02): the constant-load creep dwell — the declared program parameters (dwell duration, dwell load, accuracy class, apportionment factor), the constant-reference anchors at dwell start and end, the served readings at both ends, the RECORDED served series over the dwell, the derived maximum drift (derived ONCE at evidence capture from that series — auditable against it) and the computed class creep allowance (lookupMPE from the Recommendation's class tables, never a platform constant). Facts only — the behavioral fidelity judgment is the verdict chain's (the canonical creep-drift verdict), never the form's."
+  data_class FormInstance#data
+  conformance_process /conf/twin-fidelity/probe-creep
+  section "TW-1, 6.5"
+  requirements { /req/twin-fidelity/creep-envelope }
+  ref requirement "urn:oiml:pub:cs:twin-1:2027#clause-5.6"
+  ref test-procedure "urn:oiml:pub:cs:twin-1:2027#clause-6.5"
+  ref report-format "urn:oiml:pub:cs:twin-1:2027#clause-6.5"
+  field probe_point : string {
+    label "Probe point"
+    description "The behavioral schedule point (e.g. 'creep dwell 90% E_max')."
+    required true
+    targets { /req/twin-fidelity/creep-envelope }
+  }
+  field channel : enum {
+    label "Probe channel"
+    description "The physical-side channel the reference anchors arrived by — the three-source vocabulary (reference_instrument PREFERRED; observer_attestation admitted with the declared traceability limitation; sim_ground_truth in the acceptance environment only, never a production channel)."
+    required true
+    targets { /req/twin-fidelity/creep-envelope }
+    values { reference_instrument { label "Reference instrument" } observer_attestation { label "Observer attestation" } sim_ground_truth { label "Sim ground truth (acceptance only)" } }
+  }
+  field channel_ref : string {
+    label "Channel register citation"
+    description "The citation of the channel actually used: the equipment-register id with its calibration trace (reference_instrument), the personnel/participant id of the verification officer (observer_attestation), or the sim deployment id (sim_ground_truth)."
+    required true
+    targets { /req/twin-fidelity/creep-envelope }
+  }
+  field traceability_limitation : text {
+    label "Declared traceability limitation"
+    description "The DECLARED limitation the evidence carries when the channel is observer_attestation (twin ≡ display, not twin ≡ mass). Declared data, never a comment; empty only on the instrument and sim channels."
+    measurement_method declared
+    targets { /req/twin-fidelity/creep-envelope }
+  }
+  field dwell_s : number {
+    label "Dwell duration"
+    description "The declared dwell duration (the scheme's declaration per register — the pilot's 900 s)."
+    unit "s"
+    required true
+    measurement_method declared
+    bind model.parameters.dwell_s
+    targets { /req/twin-fidelity/creep-envelope }
+  }
+  field dwell_load : number {
+    label "Dwell load"
+    description "The applied dwell load (≈90 % E_max — 450 kg for the LC-500-class pilot), held constant over the dwell."
+    unit "kg"
+    required true
+    measurement_method declared
+    bind model.parameters.dwell_load
+    targets { /req/twin-fidelity/creep-envelope }
+  }
+  field accuracy_class : string {
+    label "Accuracy class"
+    description "The certified type's accuracy class (C for the LC-500-class pilot) — the lookupMPE class input."
+    required true
+    measurement_method declared
+    bind model.parameters.accuracy_class
+    targets { /req/twin-fidelity/creep-envelope }
+  }
+  field p_lc : number {
+    label "Apportionment factor"
+    description "The apportionment factor (0.7 by default for load cells per R 60) — the lookupMPE apportionment input."
+    required true
+    measurement_method declared
+    bind model.parameters.p_lc
+    targets { /req/twin-fidelity/creep-envelope }
+  }
+  field reference_indication_t0 : number {
+    label "Reference indication at dwell start"
+    description "The reference reading at dwell start (the constant-load anchor)."
+    unit "kg"
+    required true
+    bind sample.test_context.reference_indication_t0
+    targets { /req/twin-fidelity/creep-envelope }
+  }
+  field reference_indication_end : number {
+    label "Reference indication at dwell end"
+    description "The reference reading at dwell end (the constant-load confirmation — |end − start| ≤ allowance/3 or the setup is INVALID)."
+    unit "kg"
+    required true
+    bind sample.test_context.reference_indication_end
+    targets { /req/twin-fidelity/creep-envelope }
+  }
+  field served_t0 : number {
+    label "Served indication at dwell start"
+    description "The served indication at dwell start (the drift baseline)."
+    unit "kg"
+    required true
+    bind sample.test_context.served_t0
+    targets { /req/twin-fidelity/creep-envelope }
+  }
+  field served_end : number {
+    label "Served indication at dwell end"
+    description "The served indication at dwell end."
+    unit "kg"
+    required true
+    bind sample.test_context.served_end
+    targets { /req/twin-fidelity/creep-envelope }
+  }
+  field served_at_t0 : number {
+    label "Served timestamp at dwell start"
+    description "The twin's OWN served timestamp at dwell start (timestamp_fields), epoch seconds — the series' first served_at."
+    unit "s"
+    required true
+    targets { /req/twin-fidelity/creep-envelope }
+  }
+  field observed_at_t0 : number {
+    label "Observation timestamp at dwell start"
+    description "The t0 anchor's reference observation timestamp, epoch seconds."
+    unit "s"
+    required true
+    targets { /req/twin-fidelity/creep-envelope }
+  }
+  field served_at_end : number {
+    label "Served timestamp at dwell end"
+    description "The twin's OWN served timestamp at dwell end (timestamp_fields), epoch seconds — the series' last served_at."
+    unit "s"
+    required true
+    targets { /req/twin-fidelity/creep-envelope }
+  }
+  field observed_at_end : number {
+    label "Observation timestamp at dwell end"
+    description "The end anchor's reference observation timestamp, epoch seconds."
+    unit "s"
+    required true
+    targets { /req/twin-fidelity/creep-envelope }
+  }
+  field pair_skew_t0 : number {
+    label "Pairing skew at dwell start"
+    description "The t0 anchor's pairing skew |served_at_t0 − observed_at_t0| — a skew beyond the pairing window INVALIDATES the execution, never a fail."
+    unit "s"
+    targets { /req/twin-fidelity/creep-envelope }
+    calculation "ocl{abs(served_at_t0 - observed_at_t0)}"
+  }
+  field pair_skew_end : number {
+    label "Pairing skew at dwell end"
+    description "The end anchor's pairing skew |served_at_end − observed_at_end| — a skew beyond the pairing window INVALIDATES the execution, never a fail."
+    unit "s"
+    targets { /req/twin-fidelity/creep-envelope }
+    calculation "ocl{abs(served_at_end - observed_at_end)}"
+  }
+  field served_series : array {
+    label "Served dwell series"
+    description "The RECORDED served samples over the dwell — one row per declared instant: the served value and its own served timestamp. The raw behavioral evidence; the maximum drift derives from this series, auditable against it."
+    required true
+    targets { /req/twin-fidelity/creep-envelope }
+    items { object fields {
+      field served_at : number {
+        label "Served timestamp"
+        unit "s"
+        required true
+      }
+      field value : number {
+        label "Served indication"
+        unit "kg"
+        required true
+      }
+      } }
+    min_items 2
+  }
+  field max_drift : number {
+    label "Maximum drift"
+    description "The maximum |served sample − served_t0| over the recorded series — derived ONCE at evidence capture (auditable against served_series)."
+    unit "kg"
+    bind sample.test_context.max_drift
+    targets { /req/twin-fidelity/creep-envelope }
+  }
+  field creep_allowance : number {
+    label "Creep allowance"
+    description "The accuracy-class creep allowance — lookupMPE(dwell_load, accuracy_class, p_lc) from the Recommendation's class tables (never a platform constant)."
+    unit "kg"
+    bind sample.test_context.creep_allowance
+    targets { /req/twin-fidelity/creep-envelope }
+  }
+  pass_fail { criteria "The execution is admissible: BOTH anchors paired within the pairing window (5 s — a violating pair is INVALID, never a fail) AND the reference constant within one third of the allowance (|reference_end − reference_t0| ≤ creep_allowance / 3 — a drifting reference INVALIDATES the setup, never a fail) — the behavioral judgment itself is the verdict chain's." pass_if "ocl{pair_skew_t0 <= 5 and pair_skew_end <= 5 and abs(reference_indication_end - reference_indication_t0) <= creep_allowance / 3}" }
+}
+