docs: name the training-set round-trip invariant as the standing gate

fit + transform on the training set == the original query with __THIS__
pointing at the training set. Free (the training set is the oracle
input), and it survives every loop: today DuckDB plays transform via
serving_sql; when infer lands, the same assertion gates the real
serving path end-to-end.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: ahrzb

docs/superpowers/specs/2026-07-29-sql-projection-marginalization-design.md

@@ -197,10 +197,21 @@ module *interprets* is read through a pydantic view that validates shape at
 the read site — a DuckDB format change fails as one named "AST shape drift"
 error, not a `KeyError` mid-walk.
 
-## The bulletproof gate
+## The bulletproof gate: the training-set round-trip invariant
 
-DuckDB-vs-DuckDB differential — no inference code anywhere, both sides at
-`threads = 1` (the only setting where the oracle's own float window
+The standing invariant, for this loop and every one after it:
+
+> **fit + transform, applied to the training set, must be bit-equal to
+> running the original query with `__THIS__` pointing at the training set.**
+
+It is free — the training set itself is the oracle input, so no expected
+values are ever written by hand — and it survives every future widening:
+today "transform" is played by DuckDB executing `serving_sql` against the
+fitted params; when `infer`/`infer_batch` land, the same assertion runs
+through the real serving path (Confit) and gates the wiring end-to-end.
+
+Concretely, DuckDB-vs-DuckDB differential — no inference code anywhere, both
+sides at `threads = 1` (the only setting where the oracle's own float window
 aggregation is bit-deterministic):
 
 ```python

packages/sql-transform/sql_transform/_projection_test.py

@@ -1,9 +1,12 @@
-"""SQLProjection tests: the DuckDB-vs-DuckDB differential gate.
-
-The bulletproof property: for any accepted projection, running the original
-SQL over the training table must be bit-exact with running the rewritten
-``serving_sql`` joined against the fitted params — both executed by DuckDB,
-the oracle. No inference code is involved anywhere.
+"""SQLProjection tests: the training-set round-trip invariant.
+
+The standing invariant for this loop and every one after it: fit + transform,
+applied to the training set, must be bit-equal to running the original SQL
+with ``__THIS__`` pointing at the training set. It is free — the training set
+is the oracle input, so no expected values are written by hand. Today
+"transform" is played by DuckDB executing ``serving_sql`` against the fitted
+params; when ``infer``/``infer_batch`` land, the same assertion runs through
+the real serving path and gates the wiring end-to-end.
 """
 
 import inspect