[Sad Catapella B8][Scientific identity] Changing notebook output directory retains and can overwrite the wrong confirmed experiment design #98

Audit basis and classification

Batch 8 at d7a538e56d41ac1093ba79adcad397c21b3dfd32. Confirmed UI state/flow bug by source tracing; runtime integration test not executed.

Evidence

• _open_design() lines 770–802 loads experiment_design.csv for the current output folder and keeps the confirmed ExperimentDesign in self.design.
• _output_edited() lines 1078–1082 changes only the hint and run plan, not self.design, _design_saved, or confirmation state. _design_folder() lines 762–768 immediately switches to the new output target.
• run() lines 2223–2242 passes the old self.design while writing to the new output_folder. run_experiment() contract reconciles that supplied design and publishes it as experiment_design.csv. An existing design in the new output is not loaded.
• Existing output-change test checks only the text of the plan, not design reload/protection; design tests cover same-output reload.

Deterministic regression scenario

Create experiment with confirmed, independently saved output-A design control=ctrl and output-B design control=drug, both with valid matching folders. Load notebook pointing at A, confirm labels and roles, then change only output widget to B and click run. The UI retains A's confirmed design and can publish it to B, overriding B's user-approved controls/repeat grouping. A change to a completely new output also shows misleading saved state from A.

Impact

Loss of confirmed experimental pairing/control provenance and potential overwriting of an existing valid design in another workspace. The current run revalidates axis and source data, but it cannot detect that the wrong design object was provided.

Fix/acceptance

Bind design state to canonical output folder identity. On output change, invalidate confirmed design state, inspect/load destination design with existing refusal-on-unreadable semantics, and require explicit confirmation before run. Do not silently copy the previous output's design to a new destination. If user explicitly chooses Copy my design to new output, make that an explicit audited action. Add A→B→A, missing destination, unreadable design, changed controls/groups and save-failure integration tests. No Numba opportunity.