[cailmdaley]

Closes #419.

This hardens the non-tomographic blinding from #253 before a catalogue is declared blind: <name>. The design is unchanged, and on blind: none catalogues, which is all of them today, every product is identical.

What changes

• Tomographic refusal at the producers. calculate_pseudo_cl_map and calculate_pseudo_cl_catalog refuse a named blind for integer bin pairs before reading the catalogue. Previously only their orchestrator did. Tomographic sealing waits on Feature/305 adapt tomographic 2pcf script to sacc io format #306 / Tomographic SACC writers: one tracer and n(z) per bin #376.
• Stamp checked where a part is consumed. sacc_io.load(path, blind=...) raises if the part's stamp differs from the declared blind, and sacc_io.expect does the same for a part held in memory. It is used in the ξ± part reuse, the reporting-part loader, COSEBIs, pure-E/B, the pseudo-Cℓ plots, the B-mode summary and assembly, so a stale blind: none part can't feed figures or NPZ under a named blind. The consuming rules pass blind=blind_of(version).
• Same-file check on physical paths. blind_of compares realpath, so symlinks and /automnt/n17data vs /n17data can't put one catalogue under two blinds.
• Tests in test_blinding.py:
  • distinct blinds give distinct shifts, and the same blind gives identical ones;
  • Smokescreen's actual draw stays inside the envelope, over 1000 seeds;
  • in a 2-bin SACC, every pair, cross-pair included, gets its shift from both bins' own n(z), checked against the n(z) arrays CCL actually receives. A cross-pair using the auto n(z) now fails;
  • the seed and the hidden S8/Ωm appear nowhere in the saved bytes or in stdout/stderr. A theory callback that prints its params now fails.

papers/bmodes readers are left alone: Paper II runs only on public catalogues.

Checks.

• Touched suites: 125 + 15 passed. Workflow tests: 15 passed, 3 skipped.
• Full non-slow suite: 4 failures, and the same 4 fail on develop (test_config_paths_exist ×2, HDF5 star-loader tmp cleanup ×2).
• A Sol (high) review found two vacuous tests and the gaps above; each fix was verified by mutating the code until the test failed.
• An Opus review of the statistical design found the shift sound for tomographic shear: nuisance pulls ≤ 0.07σ in Δz and m, and Δχ² ≤ 0.2 for the ΔS8 = −0.06 blind.

— Claude (Opus 5.5) on behalf of Cail

🤖 Generated with Claude Code

[github-actions]

🤖 autofix pushed 4fbfa8d, ruff is clean — formatting and safe lint fixes were applied for you; nothing else to do.