validation: replace bias-SE sample-count staircase with measured exact-proof budget

[seonghobae]

Problem

Production validation_core::bias_standard_error remains deliberately bounded to n=4..=16. GAP-111 through GAP-125 show translated floating moments / sqrt can differ by one ULP from the correctly rounded represented-input result. The cutoff is an implementation/resource boundary, not a scientific boundary, and must not be widened by sample-count staircase alone.

Canonical arithmetic and exact rounding

For exact integer coordinates c_i on a common dyadic unit,

P = Σ(i<j)(c_i-c_j)² = nΣc_i²-(Σc_i)².

The branch retains dependency-free Wide256, signed-dyadic-exponent comparison, exact candidate/adjacent-midpoint ordering, and tie-to-even. Existing characterization shows narrow u128 O(n) can refuse on cancellation-product width while exact P still fits; Wide256 recovers that case. Pairwise-f64 exactness is also stricter than represented-input admission: [0,1,2^-54,2], [0,1,2,-2^53], and [1,2^-54,2,3] establish exact neutral/anchor admissions that pairwise represented subtraction can reject.

Production resource repair on #488

Predecessor #488 head 103768fc3f2fa2f05e8c6e7314b325ceeaf804d4 paid O(n²) before any linear proof. Source-level RED e0b324864e48a503e2aba0d2a487a0b95f5276ed added a production-order contract requiring:

neutral_zero_linear -> conditioned_observed_anchor -> pairwise_reference.

Repair 2b62bd46eb0c391327d2285c2244a76f5a1e0449 implements that route in crates/validation_core/src/bias_se.rs.

exact_neutral_zero_linear_pair_square_sum uses two residual scans: determine the common dyadic exponent, then accumulate signed coefficient sums and Σc_i²; n*Σc_i²-(Σc_i)² uses exact Wide256 products/subtraction. The kernel is O(n) time with O(1) proof storage after the residual vector and allocates no pair records. If its bounded integer coordinate representation refuses, exact_anchor_linear_pair_square_sum searches exact observed anchors as a conditioned O(n²) dynamic-range fallback. exact_pairwise_pair_square_sum runs last as O(n²) comparison/fail-closed reference.

The repair adds a common-domain neutral-zero/pairwise equality unit and preserves the three anchor-only fixtures above. Production admission remains n=4..=16.

The RED commit was superseded before hosted failure evidence completed: non-Rust runs were cancelled and its Rust run had not produced a failing result. Treat it as source-level TDD evidence only.

Remaining scientific/resource evidence

The current equality unit is necessary but insufficient for promotion. Before budget changes, broaden deterministic represented-input neutral-zero/pairwise equality wherever both admit, preserve forward/reversed/permuted bit identity, and either demonstrate a conditioned observed-anchor recovery where the zero-origin bounded representation refuses or remove that O(n²) fallback as unjustified complexity. Preserve exact denominator reduction, candidate stepping, adjacent-midpoint comparison, tie-to-even, overflow refusal, and generic fail-closed behavior.

The checked-in bias_se_exact_proof_budget example is characterization tooling. It records narrow/wide/pair behavior but does not prove which production route executed. Route evidence must distinguish neutral_zero_linear, conditioned_observed_anchor, pairwise_reference, and generic_fallback; identical numeric output is not route evidence.

Code-current doctoring

Current #488 lineage now includes research d57bf6cecc43ac2309dad0dde9a486d30fb9b68b, CHANGELOG 763eba8ff72c5469ef77511c993f9fdd8724e922, TEST_STRATEGY 6ec2d31c963d3494380ab10ae8cf56950cc39a18, and OPERABILITY/current head 5a27c64dcac6d37bb1e576351c52144922bc1f4d.

Canonical docs/TRACEABILITY.md is still the 2026-08-24 cross-cutting matrix without a direct #491 neutral-zero/Wide256 route row. docs/product-technical-gap-baseline.md is also stale on #435. These two are not complete and PR/issue prose is not a substitute.

Foundation prerequisite

#492 remains at 794ba9e6dda9f043aa499920fdf609b81b075d7e, Ready for Review and mergeable. Rust Foundation, Documentation Quality, Security Scan, and Semgrep are exact-head GREEN. CodeQL fails before scan execution at canonical .github machine-principal authorization: live actor/sender opencode-agent[bot], owner allowlist github-actions[bot]. Fresh reviews are COMMENTED only; no qualifying APPROVED exists. TEPP must not alter the owner allowlist, impersonate an allowed actor, self-approve, restore repository-local scheduling, or bypass that gate.

Current delivery evidence

Exact #488 head is 5a27c64dcac6d37bb1e576351c52144922bc1f4d, Draft and mergeable on protected main@a243f18da4a4ca8a8d068c39922537f1f8ed6ad0. At the latest sweep, Security Scan 34023672009, Documentation Quality 34023671960, Semgrep 34023672086, CodeQL 34023671932, and Rust Foundation 34023671881 were queued. No exact-head GREEN or qualifying independent approval is claimed.

Acceptance before any production budget change

• Same-head Rust 1.98.0 fmt/clippy/nextest/rustdoc and owned-production 100% line/branch/security/documentation GREEN.
• Broad pairwise-vs-neutral-zero represented-input equality plus explicit anchor-only admissions and permutation/reversal identity.
• Evidence that justifies the conditioned-anchor fallback, or removal/consolidation if it provides no admission value.
• Truthful production route observability for neutral-zero, conditioned anchor, pairwise reference, and generic fallback.
• Rust 1.98.0 --release raw timing, allocator/RSS and applicable buyer-path evidence on recorded hardware/build flags, without shrinking samples or omitting proof work.
• Normal protected-main landing of fix(actions): align central hourly admission contracts #492 and qualifying independent review; no self-approval or bypass.
• Code-current canonical TRACEABILITY and docs/product-technical-gap-baseline.md in addition to the already-current research/CHANGELOG/TEST_STRATEGY/OPERABILITY.
• No force push, destructive rebase, required-gate weakening, mutable sibling dependency, or fabricated benchmark/CI evidence.

[seonghobae]

#491 characterization은 #488 exact head cd0f9a7b7710fc7965588017a71286bd6cdc96a5까지 전진했습니다. Production bias_standard_error admission은 n=4..=16 그대로입니다.

기존 c70210e331ec096c90a42bec9de7d619bd51fe26가 checked O(n) u128 path를 pair reference의 strict sufficient subset으로 고정한 뒤, 이번 slice에서는 남아 있던 실제 hybrid measurement shape을 구현했습니다.

• c6b237e0bb1388cccd7bcb71a0df5cbf837a07c5: crates/validation_core/examples/bias_se_exact_proof_budget.rs에 O(n) sufficient fast path -> buffered O(n²) pair fallback을 추가했습니다. Compact fixtures는 linear path를 사용해야 하고, D=2^58 boundary에서 n=64는 linear admit, n=65는 checked-intermediate refusal 후 pair fallback을 사용해야 합니다. 모든 경우 timing 전에 restored exact pair numerator equality를 검사합니다.
• CSV는 이제 geometry와 used_pairwise_fallback을 기록합니다. 따라서 n=65라는 sample count만 보고 fallback을 추정하지 않고 실제 expensive path 실행 여부를 evidence로 남깁니다. Buffered fallback의 Vec<Option<(u128,i32)>> capacity/scratch payload도 같은 row에서 관측됩니다.
• 457654593391d09f4e3dc551ce75dc856ad1964f → c077b30a37900dd40ea994d1c3bba2195bbfea83 → df8f46b8e39142f2d7218e2ce4ad515aa0c67072 → cd0f9a7b7710fc7965588017a71286bd6cdc96a5: CHANGELOG, research/TRACEABILITY, TEST_STRATEGY, OPERABILITY를 hybrid measurement contract에 맞췄습니다.
• docs(ddd): restore queue authority and bounded-context ownership #435 docs/product-technical-gap-baseline.md도 d8d63aec5654ca810d19267d0e9ee514c6bae83f까지 갱신해 fix(validation): preserve representable recovery metrics #488 current head와 hybrid observability를 승계했습니다.

현재 실행 환경에는 Rust toolchain이 없어 release-mode raw CSV를 만들지 않았습니다. #488 exact-head Rust Foundation/Documentation/Security/SAST/CodeQL도 아직 queued/pending이고 Rust jobs는 runner 미배정입니다. 따라서 CPU p95, allocator/RSS, buyer-path p95 <= 20 ms, wider-integer reference 비교, exact-head GREEN을 주장하지 않습니다.

다음 production decision은 현 harness를 실제 recorded CPU/OS/Rust toolchain에서 release mode로 실행해 admitting/refusing geometry 양쪽의 raw CSV와 RSS를 확보하고 wider-reference를 비교한 뒤 내려야 합니다. 2,047, 4,095, 208,064, 또는 n=17 자체는 production budget이 아닙니다.