scientific(topic): bind reference fit results to the admitted estimator input #665

Finding

Reviewing #664 exposed a broader owner-level mismatch boundary. fit_reference_topic_model(&ReferenceTopicInput, ...) returns a ReferenceTopicModel that retains numerical fit quantities but no admitted-input identity or document-row binding. Later APIs, including #662 projection and the new #664 FittedDocumentCoordinateSummary::from_fit(input, model), can therefore receive a dimension-compatible ReferenceTopicInput from run A beside a ReferenceTopicModel from run B and silently zip A's document identities with B's document proportions/variances.

This is not Evidence/source provenance (#658). Even before a source snapshot is authenticated, the numerical owner must prove that the model quantities being projected came from the same admitted estimator input whose row coordinates are being attached. It is also distinct from #663 fitted topic-basis identity: topic basis content can be valid while the model is detached from the document/design/transition input that produced it.

Required RED

Use two actual admitted reference inputs A and B with the same dimensions and topic count but materially different document order and/or counts/design/transition state. Fit each through the CPU f64 reference estimator. Prove that every owner API which binds model quantities to input coordinates fails closed for (input A, model B) and (input B, model A) while the matched A/A and B/B pairs remain valid.

At minimum cover the coordinate/uncertainty path used by #662/#664. The eventual binding must also be reusable by release execution so Analysis cannot recreate the check with a detached caller string/digest.

Owner direction

Prefer an owner-issued fitted-result aggregate or nominal binding minted inside topic_measurement at successful fit time. It should carry enough immutable fit-local identity to prove the exact admitted estimator population/order and model belong together without pretending to be Evidence authentication. Do not let callers manufacture the binding from a free snapshot_id, document UUID list, or post-hoc digest.

The binding must cover every fit-relevant coordinate whose substitution can change the estimand/result: admitted document row order, term-count input, event-time/design state, transition structure, and numerical configuration/basis as appropriate. Avoid a digest that omits private fit inputs merely because they are inconvenient to serialize.

Boundary

• Evidence release(provenance): bind topic-lineage input to owner-issued source snapshot evidence #658/feat(evidence): own immutable source snapshot receipts #527 still owns source/vocabulary provenance and availability/cutoff authority.
• release(topic): bind topic-index coordinates to the fitted topic basis #663 owns fitted topic-basis coordinate identity.
• release(uncertainty): bind diagonal-Laplace variance to its fitted ALR location #664 owns fitted ALR location + diagonal variance pairing.
• This issue owns fit-result ↔ admitted-estimator-input integrity inside topic_measurement.

Until this binding exists, FittedDocumentCoordinateSummary is a numerical convenience over a caller-supplied matched pair, not release authority. Keep #639 Draft and do not project #664 into tepp.trsl_topic_lineage.v2 as authoritative evidence.

Refs #638 #639 #658 #662 #663 #664 ADR 0012.